net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018-2019 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_ie_attr(const struct nlattr *attr,
 204                             struct netlink_ext_ack *extack)
 205 {
 206         const u8 *data = nla_data(attr);
 207         unsigned int len = nla_len(attr);
 208         const struct element *elem;
 209
 210         for_each_element(elem, data, len) {
 211                 /* nothing */
 212         }
 213
 214         if (for_each_element_completed(elem, data, len))
 215                 return 0;
 216
 217         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 218         return -EINVAL;
 219 }
 220
 221 /* policy for the attributes */
 222 static const struct nla_policy
 223 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 224         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 225         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 226                                         .len = U8_MAX },
 227         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 228                                              .len = U8_MAX },
 229 };
 230
 231 static const struct nla_policy
 232 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 233         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 234         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 235         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 236                 NLA_POLICY_MAX(NLA_U8, 15),
 237         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 238         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 239                 NLA_POLICY_MAX(NLA_U8, 15),
 240         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 241                 NLA_POLICY_MAX(NLA_U8, 31),
 242         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 243         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 244         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 245 };
 246
 247 static const struct nla_policy
 248 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 249         [NL80211_PMSR_TYPE_FTM] =
 250                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 251 };
 252
 253 static const struct nla_policy
 254 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 255         [NL80211_PMSR_REQ_ATTR_DATA] =
 256                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 257         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 258 };
 259
 260 static const struct nla_policy
 261 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 262         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 263         /*
 264          * we could specify this again to be the top-level policy,
 265          * but that would open us up to recursion problems ...
 266          */
 267         [NL80211_PMSR_PEER_ATTR_CHAN] = { .type = NLA_NESTED },
 268         [NL80211_PMSR_PEER_ATTR_REQ] =
 269                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 270         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 271 };
 272
 273 static const struct nla_policy
 274 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 275         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 276         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 277         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 278         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 279         [NL80211_PMSR_ATTR_PEERS] =
 280                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 281 };
 282
 283 const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 284         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 285         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 286                                       .len = 20-1 },
 287         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 288
 289         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 290         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 291         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 292         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 293         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 294
 295         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 296         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 297         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 298         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 299         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 300         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 301
 302         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 303         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 304         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 305
 306         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 307         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 308
 309         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 310         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 311                                     .len = WLAN_MAX_KEY_LEN },
 312         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 313         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 314         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 316         [NL80211_ATTR_KEY_TYPE] =
 317                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 318
 319         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 320         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 321         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 322                                        .len = IEEE80211_MAX_DATA_LEN },
 323         [NL80211_ATTR_BEACON_TAIL] =
 324                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 325                                        IEEE80211_MAX_DATA_LEN),
 326         [NL80211_ATTR_STA_AID] =
 327                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 328         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 329         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 330         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 331                                                .len = NL80211_MAX_SUPP_RATES },
 332         [NL80211_ATTR_STA_PLINK_ACTION] =
 333                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 334         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 335                 NLA_POLICY_RANGE(NLA_U8,
 336                                  NL80211_TX_POWER_AUTOMATIC,
 337                                  NL80211_TX_POWER_FIXED),
 338         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 339         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 340         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 341         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 342                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 343         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 344
 345         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 346         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 347
 348         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 349         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 350         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 351         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 352                                            .len = NL80211_MAX_SUPP_RATES },
 353         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 354
 355         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 356         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 357
 358         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 359
 360         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 361         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 362                                                    validate_ie_attr,
 363                                                    IEEE80211_MAX_DATA_LEN),
 364         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 365         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 366
 367         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 368                                 .len = IEEE80211_MAX_SSID_LEN },
 369         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 370         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 371         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 372         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 374                                                   NL80211_MFP_NO,
 375                                                   NL80211_MFP_OPTIONAL),
 376         [NL80211_ATTR_STA_FLAGS2] = {
 377                 .len = sizeof(struct nl80211_sta_flag_update),
 378         },
 379         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 380         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 381         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 384         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 385         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 386         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 387         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 388         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 389         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 390         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 391         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 392         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 393                                  .len = IEEE80211_MAX_DATA_LEN },
 394         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 395         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 396                                                    NL80211_PS_DISABLED,
 397                                                    NL80211_PS_ENABLED),
 398         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 399         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 400         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 401         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 402         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 403         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 404         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 405         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 406         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 407         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 408         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 409         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 410         [NL80211_ATTR_STA_PLINK_STATE] =
 411                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 412         [NL80211_ATTR_MESH_PEER_AID] =
 413                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 414         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 415         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 416         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 417         [NL80211_ATTR_HIDDEN_SSID] =
 418                 NLA_POLICY_RANGE(NLA_U32,
 419                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 420                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 421         [NL80211_ATTR_IE_PROBE_RESP] =
 422                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 423                                        IEEE80211_MAX_DATA_LEN),
 424         [NL80211_ATTR_IE_ASSOC_RESP] =
 425                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 426                                        IEEE80211_MAX_DATA_LEN),
 427         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 428         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 429         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 430         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 431         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 432         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 433         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 434         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 435         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 436         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 437         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 438                                       .len = IEEE80211_MAX_DATA_LEN },
 439         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 440         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 441         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 442                 .len = NL80211_HT_CAPABILITY_LEN
 443         },
 444         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 445         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 446         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 447         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 448         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 449         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 450         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 451         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 452         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 453         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 454         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 455                 NLA_POLICY_RANGE(NLA_U32,
 456                                  NL80211_MESH_POWER_UNKNOWN + 1,
 457                                  NL80211_MESH_POWER_MAX),
 458         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 459         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 460         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 461         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 462         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 463         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 464         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 465                 .len = NL80211_VHT_CAPABILITY_LEN,
 466         },
 467         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 468         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 469                                   .len = IEEE80211_MAX_DATA_LEN },
 470         [NL80211_ATTR_PEER_AID] =
 471                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 472         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 473         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 474         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 475         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 476         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 477         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 478         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 479         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 480         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 481         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 482         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 483         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 484         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 485                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 486         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 487         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 488         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 489         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 490         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 491         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 492         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 493         [NL80211_ATTR_USER_PRIO] =
 494                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 495         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 496         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 497         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 498         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 499         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 500         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 501         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 502         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 503         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 504         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 505                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 506         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 507                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 508         },
 509         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 510         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 511         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 512         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 513         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 514                                     .len = FILS_MAX_KEK_LEN },
 515         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 516         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 517         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 518         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 519         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 520                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 521         },
 522         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 523         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 524                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 525         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 526                                           .len = FILS_ERP_MAX_REALM_LEN },
 527         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 528         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 529                                         .len = FILS_ERP_MAX_RRK_LEN },
 530         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 531         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 532         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 533         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 534
 535         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 536         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 537         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 538         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 539                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 540
 541         [NL80211_ATTR_FTM_RESPONDER] = {
 542                 .type = NLA_NESTED,
 543                 .validation_data = nl80211_ftm_responder_policy,
 544         },
 545         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 546         [NL80211_ATTR_PEER_MEASUREMENTS] =
 547                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 548         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 549 };
 550
 551 /* policy for the key attributes */
 552 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 553         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 554         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 555         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 556         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 557         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 558         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 559         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 560         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 561         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 562 };
 563
 564 /* policy for the key default flags */
 565 static const struct nla_policy
 566 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 567         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 568         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 569 };
 570
 571 #ifdef CONFIG_PM
 572 /* policy for WoWLAN attributes */
 573 static const struct nla_policy
 574 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 575         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 576         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 577         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 578         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 579         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 580         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 581         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 582         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 583         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 584         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 585 };
 586
 587 static const struct nla_policy
 588 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 589         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 590         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 591         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 592         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 593         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 594         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 595         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 596                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 597         },
 598         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 599                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 600         },
 601         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 602         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 603         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 604 };
 605 #endif /* CONFIG_PM */
 606
 607 /* policy for coalesce rule attributes */
 608 static const struct nla_policy
 609 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 610         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 611         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 612                 NLA_POLICY_RANGE(NLA_U32,
 613                                  NL80211_COALESCE_CONDITION_MATCH,
 614                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 615         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 616 };
 617
 618 /* policy for GTK rekey offload attributes */
 619 static const struct nla_policy
 620 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 621         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 622         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 623         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 624 };
 625
 626 static const struct nla_policy
 627 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 628         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 629         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 630         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 631 };
 632
 633 static const struct nla_policy
 634 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 635         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 636                                                  .len = IEEE80211_MAX_SSID_LEN },
 637         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 638         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 639         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 640                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 641 };
 642
 643 static const struct nla_policy
 644 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 645         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 646         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 647 };
 648
 649 static const struct nla_policy
 650 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 651         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 652         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 653         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 654                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 655         },
 656 };
 657
 658 /* policy for NAN function attributes */
 659 static const struct nla_policy
 660 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 661         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 662         [NL80211_NAN_FUNC_SERVICE_ID] = {
 663                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 664         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 665         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 666         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 667         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 668         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 669         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 670         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 671         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 672         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 673                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 674         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 675         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 676         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 677         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 678         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 679 };
 680
 681 /* policy for Service Response Filter attributes */
 682 static const struct nla_policy
 683 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 684         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 685         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 686                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 687         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 688         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 689 };
 690
 691 /* policy for packet pattern attributes */
 692 static const struct nla_policy
 693 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 694         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 695         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 696         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 697 };
 698
 699 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 700                               struct cfg80211_registered_device **rdev,
 701                               struct wireless_dev **wdev)
 702 {
 703         int err;
 704
 705         if (!cb->args[0]) {
 706                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 707                                   genl_family_attrbuf(&nl80211_fam),
 708                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 709                 if (err)
 710                         return err;
 711
 712                 *wdev = __cfg80211_wdev_from_attrs(
 713                                         sock_net(cb->skb->sk),
 714                                         genl_family_attrbuf(&nl80211_fam));
 715                 if (IS_ERR(*wdev))
 716                         return PTR_ERR(*wdev);
 717                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 718                 /* 0 is the first index - add 1 to parse only once */
 719                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 720                 cb->args[1] = (*wdev)->identifier;
 721         } else {
 722                 /* subtract the 1 again here */
 723                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 724                 struct wireless_dev *tmp;
 725
 726                 if (!wiphy)
 727                         return -ENODEV;
 728                 *rdev = wiphy_to_rdev(wiphy);
 729                 *wdev = NULL;
 730
 731                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 732                         if (tmp->identifier == cb->args[1]) {
 733                                 *wdev = tmp;
 734                                 break;
 735                         }
 736                 }
 737
 738                 if (!*wdev)
 739                         return -ENODEV;
 740         }
 741
 742         return 0;
 743 }
 744
 745 /* message building helper */
 746 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 747                      int flags, u8 cmd)
 748 {
 749         /* since there is no private header just add the generic one */
 750         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 751 }
 752
 753 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 754                                      const struct ieee80211_reg_rule *rule)
 755 {
 756         int j;
 757         struct nlattr *nl_wmm_rules =
 758                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 759
 760         if (!nl_wmm_rules)
 761                 goto nla_put_failure;
 762
 763         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 764                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 765
 766                 if (!nl_wmm_rule)
 767                         goto nla_put_failure;
 768
 769                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 770                                 rule->wmm_rule.client[j].cw_min) ||
 771                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 772                                 rule->wmm_rule.client[j].cw_max) ||
 773                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 774                                rule->wmm_rule.client[j].aifsn) ||
 775                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 776                                 rule->wmm_rule.client[j].cot))
 777                         goto nla_put_failure;
 778
 779                 nla_nest_end(msg, nl_wmm_rule);
 780         }
 781         nla_nest_end(msg, nl_wmm_rules);
 782
 783         return 0;
 784
 785 nla_put_failure:
 786         return -ENOBUFS;
 787 }
 788
 789 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 790                                    struct ieee80211_channel *chan,
 791                                    bool large)
 792 {
 793         /* Some channels must be completely excluded from the
 794          * list to protect old user-space tools from breaking
 795          */
 796         if (!large && chan->flags &
 797             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 798                 return 0;
 799
 800         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 801                         chan->center_freq))
 802                 goto nla_put_failure;
 803
 804         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 805             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 806                 goto nla_put_failure;
 807         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 808                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 809                         goto nla_put_failure;
 810                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 811                         goto nla_put_failure;
 812         }
 813         if (chan->flags & IEEE80211_CHAN_RADAR) {
 814                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 815                         goto nla_put_failure;
 816                 if (large) {
 817                         u32 time;
 818
 819                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 820
 821                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 822                                         chan->dfs_state))
 823                                 goto nla_put_failure;
 824                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 825                                         time))
 826                                 goto nla_put_failure;
 827                         if (nla_put_u32(msg,
 828                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 829                                         chan->dfs_cac_ms))
 830                                 goto nla_put_failure;
 831                 }
 832         }
 833
 834         if (large) {
 835                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 836                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 837                         goto nla_put_failure;
 838                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 839                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 840                         goto nla_put_failure;
 841                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 842                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 843                         goto nla_put_failure;
 844                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 845                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 846                         goto nla_put_failure;
 847                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 848                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 849                         goto nla_put_failure;
 850                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 851                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 852                         goto nla_put_failure;
 853                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 854                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 855                         goto nla_put_failure;
 856                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 857                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 858                         goto nla_put_failure;
 859         }
 860
 861         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 862                         DBM_TO_MBM(chan->max_power)))
 863                 goto nla_put_failure;
 864
 865         if (large) {
 866                 const struct ieee80211_reg_rule *rule =
 867                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 868
 869                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 870                         if (nl80211_msg_put_wmm_rules(msg, rule))
 871                                 goto nla_put_failure;
 872                 }
 873         }
 874
 875         return 0;
 876
 877  nla_put_failure:
 878         return -ENOBUFS;
 879 }
 880
 881 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 882                                   struct cfg80211_txq_stats *txqstats,
 883                                   int attrtype)
 884 {
 885         struct nlattr *txqattr;
 886
 887 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 888         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 889             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 890                 return false;                                             \
 891         } while (0)
 892
 893         txqattr = nla_nest_start(msg, attrtype);
 894         if (!txqattr)
 895                 return false;
 896
 897         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 898         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 899         PUT_TXQVAL_U32(FLOWS, flows);
 900         PUT_TXQVAL_U32(DROPS, drops);
 901         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 902         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 903         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 904         PUT_TXQVAL_U32(COLLISIONS, collisions);
 905         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 906         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 907         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 908         nla_nest_end(msg, txqattr);
 909
 910 #undef PUT_TXQVAL_U32
 911         return true;
 912 }
 913
 914 /* netlink command implementations */
 915
 916 struct key_parse {
 917         struct key_params p;
 918         int idx;
 919         int type;
 920         bool def, defmgmt;
 921         bool def_uni, def_multi;
 922 };
 923
 924 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 925                                  struct key_parse *k)
 926 {
 927         struct nlattr *tb[NL80211_KEY_MAX + 1];
 928         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 929                                    nl80211_key_policy, info->extack);
 930         if (err)
 931                 return err;
 932
 933         k->def = !!tb[NL80211_KEY_DEFAULT];
 934         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 935
 936         if (k->def) {
 937                 k->def_uni = true;
 938                 k->def_multi = true;
 939         }
 940         if (k->defmgmt)
 941                 k->def_multi = true;
 942
 943         if (tb[NL80211_KEY_IDX])
 944                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 945
 946         if (tb[NL80211_KEY_DATA]) {
 947                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 948                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 949         }
 950
 951         if (tb[NL80211_KEY_SEQ]) {
 952                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 953                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 954         }
 955
 956         if (tb[NL80211_KEY_CIPHER])
 957                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 958
 959         if (tb[NL80211_KEY_TYPE])
 960                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 961
 962         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 963                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 964
 965                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 966                                        tb[NL80211_KEY_DEFAULT_TYPES],
 967                                        nl80211_key_default_policy,
 968                                        info->extack);
 969                 if (err)
 970                         return err;
 971
 972                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 973                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 974         }
 975
 976         if (tb[NL80211_KEY_MODE])
 977                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
 978
 979         return 0;
 980 }
 981
 982 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 983 {
 984         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 985                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 986                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 987         }
 988
 989         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 990                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 991                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 992         }
 993
 994         if (info->attrs[NL80211_ATTR_KEY_IDX])
 995                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 996
 997         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 998                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 999
1000         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1001         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1002
1003         if (k->def) {
1004                 k->def_uni = true;
1005                 k->def_multi = true;
1006         }
1007         if (k->defmgmt)
1008                 k->def_multi = true;
1009
1010         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1011                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1012
1013         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1014                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1015                 int err = nla_parse_nested(kdt,
1016                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1017                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1018                                            nl80211_key_default_policy,
1019                                            info->extack);
1020                 if (err)
1021                         return err;
1022
1023                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1024                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1025         }
1026
1027         return 0;
1028 }
1029
1030 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1031 {
1032         int err;
1033
1034         memset(k, 0, sizeof(*k));
1035         k->idx = -1;
1036         k->type = -1;
1037
1038         if (info->attrs[NL80211_ATTR_KEY])
1039                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1040         else
1041                 err = nl80211_parse_key_old(info, k);
1042
1043         if (err)
1044                 return err;
1045
1046         if (k->def && k->defmgmt) {
1047                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
1048                 return -EINVAL;
1049         }
1050
1051         if (k->defmgmt) {
1052                 if (k->def_uni || !k->def_multi) {
1053                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
1054                         return -EINVAL;
1055                 }
1056         }
1057
1058         if (k->idx != -1) {
1059                 if (k->defmgmt) {
1060                         if (k->idx < 4 || k->idx > 5) {
1061                                 GENL_SET_ERR_MSG(info,
1062                                                  "defmgmt key idx not 4 or 5");
1063                                 return -EINVAL;
1064                         }
1065                 } else if (k->def) {
1066                         if (k->idx < 0 || k->idx > 3) {
1067                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1068                                 return -EINVAL;
1069                         }
1070                 } else {
1071                         if (k->idx < 0 || k->idx > 5) {
1072                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1073                                 return -EINVAL;
1074                         }
1075                 }
1076         }
1077
1078         return 0;
1079 }
1080
1081 static struct cfg80211_cached_keys *
1082 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1083                        struct genl_info *info, bool *no_ht)
1084 {
1085         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1086         struct key_parse parse;
1087         struct nlattr *key;
1088         struct cfg80211_cached_keys *result;
1089         int rem, err, def = 0;
1090         bool have_key = false;
1091
1092         nla_for_each_nested(key, keys, rem) {
1093                 have_key = true;
1094                 break;
1095         }
1096
1097         if (!have_key)
1098                 return NULL;
1099
1100         result = kzalloc(sizeof(*result), GFP_KERNEL);
1101         if (!result)
1102                 return ERR_PTR(-ENOMEM);
1103
1104         result->def = -1;
1105
1106         nla_for_each_nested(key, keys, rem) {
1107                 memset(&parse, 0, sizeof(parse));
1108                 parse.idx = -1;
1109
1110                 err = nl80211_parse_key_new(info, key, &parse);
1111                 if (err)
1112                         goto error;
1113                 err = -EINVAL;
1114                 if (!parse.p.key)
1115                         goto error;
1116                 if (parse.idx < 0 || parse.idx > 3) {
1117                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1118                         goto error;
1119                 }
1120                 if (parse.def) {
1121                         if (def) {
1122                                 GENL_SET_ERR_MSG(info,
1123                                                  "only one key can be default");
1124                                 goto error;
1125                         }
1126                         def = 1;
1127                         result->def = parse.idx;
1128                         if (!parse.def_uni || !parse.def_multi)
1129                                 goto error;
1130                 } else if (parse.defmgmt)
1131                         goto error;
1132                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1133                                                      parse.idx, false, NULL);
1134                 if (err)
1135                         goto error;
1136                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1137                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1138                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1139                         err = -EINVAL;
1140                         goto error;
1141                 }
1142                 result->params[parse.idx].cipher = parse.p.cipher;
1143                 result->params[parse.idx].key_len = parse.p.key_len;
1144                 result->params[parse.idx].key = result->data[parse.idx];
1145                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1146
1147                 /* must be WEP key if we got here */
1148                 if (no_ht)
1149                         *no_ht = true;
1150         }
1151
1152         if (result->def < 0) {
1153                 err = -EINVAL;
1154                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1155                 goto error;
1156         }
1157
1158         return result;
1159  error:
1160         kfree(result);
1161         return ERR_PTR(err);
1162 }
1163
1164 static int nl80211_key_allowed(struct wireless_dev *wdev)
1165 {
1166         ASSERT_WDEV_LOCK(wdev);
1167
1168         switch (wdev->iftype) {
1169         case NL80211_IFTYPE_AP:
1170         case NL80211_IFTYPE_AP_VLAN:
1171         case NL80211_IFTYPE_P2P_GO:
1172         case NL80211_IFTYPE_MESH_POINT:
1173                 break;
1174         case NL80211_IFTYPE_ADHOC:
1175         case NL80211_IFTYPE_STATION:
1176         case NL80211_IFTYPE_P2P_CLIENT:
1177                 if (!wdev->current_bss)
1178                         return -ENOLINK;
1179                 break;
1180         case NL80211_IFTYPE_UNSPECIFIED:
1181         case NL80211_IFTYPE_OCB:
1182         case NL80211_IFTYPE_MONITOR:
1183         case NL80211_IFTYPE_NAN:
1184         case NL80211_IFTYPE_P2P_DEVICE:
1185         case NL80211_IFTYPE_WDS:
1186         case NUM_NL80211_IFTYPES:
1187                 return -EINVAL;
1188         }
1189
1190         return 0;
1191 }
1192
1193 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1194                                                         struct nlattr *tb)
1195 {
1196         struct ieee80211_channel *chan;
1197
1198         if (tb == NULL)
1199                 return NULL;
1200         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1201         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1202                 return NULL;
1203         return chan;
1204 }
1205
1206 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1207 {
1208         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1209         int i;
1210
1211         if (!nl_modes)
1212                 goto nla_put_failure;
1213
1214         i = 0;
1215         while (ifmodes) {
1216                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1217                         goto nla_put_failure;
1218                 ifmodes >>= 1;
1219                 i++;
1220         }
1221
1222         nla_nest_end(msg, nl_modes);
1223         return 0;
1224
1225 nla_put_failure:
1226         return -ENOBUFS;
1227 }
1228
1229 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1230                                           struct sk_buff *msg,
1231                                           bool large)
1232 {
1233         struct nlattr *nl_combis;
1234         int i, j;
1235
1236         nl_combis = nla_nest_start(msg,
1237                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1238         if (!nl_combis)
1239                 goto nla_put_failure;
1240
1241         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1242                 const struct ieee80211_iface_combination *c;
1243                 struct nlattr *nl_combi, *nl_limits;
1244
1245                 c = &wiphy->iface_combinations[i];
1246
1247                 nl_combi = nla_nest_start(msg, i + 1);
1248                 if (!nl_combi)
1249                         goto nla_put_failure;
1250
1251                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1252                 if (!nl_limits)
1253                         goto nla_put_failure;
1254
1255                 for (j = 0; j < c->n_limits; j++) {
1256                         struct nlattr *nl_limit;
1257
1258                         nl_limit = nla_nest_start(msg, j + 1);
1259                         if (!nl_limit)
1260                                 goto nla_put_failure;
1261                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1262                                         c->limits[j].max))
1263                                 goto nla_put_failure;
1264                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1265                                                 c->limits[j].types))
1266                                 goto nla_put_failure;
1267                         nla_nest_end(msg, nl_limit);
1268                 }
1269
1270                 nla_nest_end(msg, nl_limits);
1271
1272                 if (c->beacon_int_infra_match &&
1273                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1274                         goto nla_put_failure;
1275                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1276                                 c->num_different_channels) ||
1277                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1278                                 c->max_interfaces))
1279                         goto nla_put_failure;
1280                 if (large &&
1281                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1282                                 c->radar_detect_widths) ||
1283                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1284                                 c->radar_detect_regions)))
1285                         goto nla_put_failure;
1286                 if (c->beacon_int_min_gcd &&
1287                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1288                                 c->beacon_int_min_gcd))
1289                         goto nla_put_failure;
1290
1291                 nla_nest_end(msg, nl_combi);
1292         }
1293
1294         nla_nest_end(msg, nl_combis);
1295
1296         return 0;
1297 nla_put_failure:
1298         return -ENOBUFS;
1299 }
1300
1301 #ifdef CONFIG_PM
1302 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1303                                         struct sk_buff *msg)
1304 {
1305         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1306         struct nlattr *nl_tcp;
1307
1308         if (!tcp)
1309                 return 0;
1310
1311         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1312         if (!nl_tcp)
1313                 return -ENOBUFS;
1314
1315         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1316                         tcp->data_payload_max))
1317                 return -ENOBUFS;
1318
1319         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1320                         tcp->data_payload_max))
1321                 return -ENOBUFS;
1322
1323         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1324                 return -ENOBUFS;
1325
1326         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1327                                 sizeof(*tcp->tok), tcp->tok))
1328                 return -ENOBUFS;
1329
1330         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1331                         tcp->data_interval_max))
1332                 return -ENOBUFS;
1333
1334         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1335                         tcp->wake_payload_max))
1336                 return -ENOBUFS;
1337
1338         nla_nest_end(msg, nl_tcp);
1339         return 0;
1340 }
1341
1342 static int nl80211_send_wowlan(struct sk_buff *msg,
1343                                struct cfg80211_registered_device *rdev,
1344                                bool large)
1345 {
1346         struct nlattr *nl_wowlan;
1347
1348         if (!rdev->wiphy.wowlan)
1349                 return 0;
1350
1351         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1352         if (!nl_wowlan)
1353                 return -ENOBUFS;
1354
1355         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1356              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1357             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1358              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1359             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1360              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1361             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1362              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1363             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1364              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1365             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1366              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1367             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1368              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1369             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1370              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1371                 return -ENOBUFS;
1372
1373         if (rdev->wiphy.wowlan->n_patterns) {
1374                 struct nl80211_pattern_support pat = {
1375                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1376                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1377                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1378                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1379                 };
1380
1381                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1382                             sizeof(pat), &pat))
1383                         return -ENOBUFS;
1384         }
1385
1386         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1387             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1388                         rdev->wiphy.wowlan->max_nd_match_sets))
1389                 return -ENOBUFS;
1390
1391         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1392                 return -ENOBUFS;
1393
1394         nla_nest_end(msg, nl_wowlan);
1395
1396         return 0;
1397 }
1398 #endif
1399
1400 static int nl80211_send_coalesce(struct sk_buff *msg,
1401                                  struct cfg80211_registered_device *rdev)
1402 {
1403         struct nl80211_coalesce_rule_support rule;
1404
1405         if (!rdev->wiphy.coalesce)
1406                 return 0;
1407
1408         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1409         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1410         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1411         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1412         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1413         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1414
1415         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1416                 return -ENOBUFS;
1417
1418         return 0;
1419 }
1420
1421 static int
1422 nl80211_send_iftype_data(struct sk_buff *msg,
1423                          const struct ieee80211_sband_iftype_data *iftdata)
1424 {
1425         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1426
1427         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1428                                 iftdata->types_mask))
1429                 return -ENOBUFS;
1430
1431         if (he_cap->has_he) {
1432                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1433                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1434                             he_cap->he_cap_elem.mac_cap_info) ||
1435                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1436                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1437                             he_cap->he_cap_elem.phy_cap_info) ||
1438                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1439                             sizeof(he_cap->he_mcs_nss_supp),
1440                             &he_cap->he_mcs_nss_supp) ||
1441                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1442                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1443                         return -ENOBUFS;
1444         }
1445
1446         return 0;
1447 }
1448
1449 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1450                                       struct ieee80211_supported_band *sband)
1451 {
1452         struct nlattr *nl_rates, *nl_rate;
1453         struct ieee80211_rate *rate;
1454         int i;
1455
1456         /* add HT info */
1457         if (sband->ht_cap.ht_supported &&
1458             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1459                      sizeof(sband->ht_cap.mcs),
1460                      &sband->ht_cap.mcs) ||
1461              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1462                          sband->ht_cap.cap) ||
1463              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1464                         sband->ht_cap.ampdu_factor) ||
1465              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1466                         sband->ht_cap.ampdu_density)))
1467                 return -ENOBUFS;
1468
1469         /* add VHT info */
1470         if (sband->vht_cap.vht_supported &&
1471             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1472                      sizeof(sband->vht_cap.vht_mcs),
1473                      &sband->vht_cap.vht_mcs) ||
1474              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1475                          sband->vht_cap.cap)))
1476                 return -ENOBUFS;
1477
1478         if (sband->n_iftype_data) {
1479                 struct nlattr *nl_iftype_data =
1480                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1481                 int err;
1482
1483                 if (!nl_iftype_data)
1484                         return -ENOBUFS;
1485
1486                 for (i = 0; i < sband->n_iftype_data; i++) {
1487                         struct nlattr *iftdata;
1488
1489                         iftdata = nla_nest_start(msg, i + 1);
1490                         if (!iftdata)
1491                                 return -ENOBUFS;
1492
1493                         err = nl80211_send_iftype_data(msg,
1494                                                        &sband->iftype_data[i]);
1495                         if (err)
1496                                 return err;
1497
1498                         nla_nest_end(msg, iftdata);
1499                 }
1500
1501                 nla_nest_end(msg, nl_iftype_data);
1502         }
1503
1504         /* add bitrates */
1505         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1506         if (!nl_rates)
1507                 return -ENOBUFS;
1508
1509         for (i = 0; i < sband->n_bitrates; i++) {
1510                 nl_rate = nla_nest_start(msg, i);
1511                 if (!nl_rate)
1512                         return -ENOBUFS;
1513
1514                 rate = &sband->bitrates[i];
1515                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1516                                 rate->bitrate))
1517                         return -ENOBUFS;
1518                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1519                     nla_put_flag(msg,
1520                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1521                         return -ENOBUFS;
1522
1523                 nla_nest_end(msg, nl_rate);
1524         }
1525
1526         nla_nest_end(msg, nl_rates);
1527
1528         return 0;
1529 }
1530
1531 static int
1532 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1533                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1534 {
1535         u16 stypes;
1536         struct nlattr *nl_ftypes, *nl_ifs;
1537         enum nl80211_iftype ift;
1538         int i;
1539
1540         if (!mgmt_stypes)
1541                 return 0;
1542
1543         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1544         if (!nl_ifs)
1545                 return -ENOBUFS;
1546
1547         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1548                 nl_ftypes = nla_nest_start(msg, ift);
1549                 if (!nl_ftypes)
1550                         return -ENOBUFS;
1551                 i = 0;
1552                 stypes = mgmt_stypes[ift].tx;
1553                 while (stypes) {
1554                         if ((stypes & 1) &&
1555                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1556                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1557                                 return -ENOBUFS;
1558                         stypes >>= 1;
1559                         i++;
1560                 }
1561                 nla_nest_end(msg, nl_ftypes);
1562         }
1563
1564         nla_nest_end(msg, nl_ifs);
1565
1566         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1567         if (!nl_ifs)
1568                 return -ENOBUFS;
1569
1570         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1571                 nl_ftypes = nla_nest_start(msg, ift);
1572                 if (!nl_ftypes)
1573                         return -ENOBUFS;
1574                 i = 0;
1575                 stypes = mgmt_stypes[ift].rx;
1576                 while (stypes) {
1577                         if ((stypes & 1) &&
1578                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1579                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1580                                 return -ENOBUFS;
1581                         stypes >>= 1;
1582                         i++;
1583                 }
1584                 nla_nest_end(msg, nl_ftypes);
1585         }
1586         nla_nest_end(msg, nl_ifs);
1587
1588         return 0;
1589 }
1590
1591 #define CMD(op, n)                                                      \
1592          do {                                                           \
1593                 if (rdev->ops->op) {                                    \
1594                         i++;                                            \
1595                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1596                                 goto nla_put_failure;                   \
1597                 }                                                       \
1598         } while (0)
1599
1600 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1601                                         struct sk_buff *msg)
1602 {
1603         int i = 0;
1604
1605         /*
1606          * do *NOT* add anything into this function, new things need to be
1607          * advertised only to new versions of userspace that can deal with
1608          * the split (and they can't possibly care about new features...
1609          */
1610         CMD(add_virtual_intf, NEW_INTERFACE);
1611         CMD(change_virtual_intf, SET_INTERFACE);
1612         CMD(add_key, NEW_KEY);
1613         CMD(start_ap, START_AP);
1614         CMD(add_station, NEW_STATION);
1615         CMD(add_mpath, NEW_MPATH);
1616         CMD(update_mesh_config, SET_MESH_CONFIG);
1617         CMD(change_bss, SET_BSS);
1618         CMD(auth, AUTHENTICATE);
1619         CMD(assoc, ASSOCIATE);
1620         CMD(deauth, DEAUTHENTICATE);
1621         CMD(disassoc, DISASSOCIATE);
1622         CMD(join_ibss, JOIN_IBSS);
1623         CMD(join_mesh, JOIN_MESH);
1624         CMD(set_pmksa, SET_PMKSA);
1625         CMD(del_pmksa, DEL_PMKSA);
1626         CMD(flush_pmksa, FLUSH_PMKSA);
1627         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1628                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1629         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1630         CMD(mgmt_tx, FRAME);
1631         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1632         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1633                 i++;
1634                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1635                         goto nla_put_failure;
1636         }
1637         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1638             rdev->ops->join_mesh) {
1639                 i++;
1640                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1641                         goto nla_put_failure;
1642         }
1643         CMD(set_wds_peer, SET_WDS_PEER);
1644         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1645                 CMD(tdls_mgmt, TDLS_MGMT);
1646                 CMD(tdls_oper, TDLS_OPER);
1647         }
1648         if (rdev->wiphy.max_sched_scan_reqs)
1649                 CMD(sched_scan_start, START_SCHED_SCAN);
1650         CMD(probe_client, PROBE_CLIENT);
1651         CMD(set_noack_map, SET_NOACK_MAP);
1652         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1653                 i++;
1654                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1655                         goto nla_put_failure;
1656         }
1657         CMD(start_p2p_device, START_P2P_DEVICE);
1658         CMD(set_mcast_rate, SET_MCAST_RATE);
1659 #ifdef CONFIG_NL80211_TESTMODE
1660         CMD(testmode_cmd, TESTMODE);
1661 #endif
1662
1663         if (rdev->ops->connect || rdev->ops->auth) {
1664                 i++;
1665                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1666                         goto nla_put_failure;
1667         }
1668
1669         if (rdev->ops->disconnect || rdev->ops->deauth) {
1670                 i++;
1671                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1672                         goto nla_put_failure;
1673         }
1674
1675         return i;
1676  nla_put_failure:
1677         return -ENOBUFS;
1678 }
1679
1680 static int
1681 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1682                            struct sk_buff *msg)
1683 {
1684         struct nlattr *ftm;
1685
1686         if (!cap->ftm.supported)
1687                 return 0;
1688
1689         ftm = nla_nest_start(msg, NL80211_PMSR_TYPE_FTM);
1690         if (!ftm)
1691                 return -ENOBUFS;
1692
1693         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1694                 return -ENOBUFS;
1695         if (cap->ftm.non_asap &&
1696             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1697                 return -ENOBUFS;
1698         if (cap->ftm.request_lci &&
1699             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1700                 return -ENOBUFS;
1701         if (cap->ftm.request_civicloc &&
1702             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
1703                 return -ENOBUFS;
1704         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
1705                         cap->ftm.preambles))
1706                 return -ENOBUFS;
1707         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
1708                         cap->ftm.bandwidths))
1709                 return -ENOBUFS;
1710         if (cap->ftm.max_bursts_exponent >= 0 &&
1711             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
1712                         cap->ftm.max_bursts_exponent))
1713                 return -ENOBUFS;
1714         if (cap->ftm.max_ftms_per_burst &&
1715             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
1716                         cap->ftm.max_ftms_per_burst))
1717                 return -ENOBUFS;
1718
1719         nla_nest_end(msg, ftm);
1720         return 0;
1721 }
1722
1723 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
1724                                   struct sk_buff *msg)
1725 {
1726         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
1727         struct nlattr *pmsr, *caps;
1728
1729         if (!cap)
1730                 return 0;
1731
1732         /*
1733          * we don't need to clean up anything here since the caller
1734          * will genlmsg_cancel() if we fail
1735          */
1736
1737         pmsr = nla_nest_start(msg, NL80211_ATTR_PEER_MEASUREMENTS);
1738         if (!pmsr)
1739                 return -ENOBUFS;
1740
1741         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
1742                 return -ENOBUFS;
1743
1744         if (cap->report_ap_tsf &&
1745             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
1746                 return -ENOBUFS;
1747
1748         if (cap->randomize_mac_addr &&
1749             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
1750                 return -ENOBUFS;
1751
1752         caps = nla_nest_start(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
1753         if (!caps)
1754                 return -ENOBUFS;
1755
1756         if (nl80211_send_pmsr_ftm_capa(cap, msg))
1757                 return -ENOBUFS;
1758
1759         nla_nest_end(msg, caps);
1760         nla_nest_end(msg, pmsr);
1761
1762         return 0;
1763 }
1764
1765 struct nl80211_dump_wiphy_state {
1766         s64 filter_wiphy;
1767         long start;
1768         long split_start, band_start, chan_start, capa_start;
1769         bool split;
1770 };
1771
1772 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1773                               enum nl80211_commands cmd,
1774                               struct sk_buff *msg, u32 portid, u32 seq,
1775                               int flags, struct nl80211_dump_wiphy_state *state)
1776 {
1777         void *hdr;
1778         struct nlattr *nl_bands, *nl_band;
1779         struct nlattr *nl_freqs, *nl_freq;
1780         struct nlattr *nl_cmds;
1781         enum nl80211_band band;
1782         struct ieee80211_channel *chan;
1783         int i;
1784         const struct ieee80211_txrx_stypes *mgmt_stypes =
1785                                 rdev->wiphy.mgmt_stypes;
1786         u32 features;
1787
1788         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1789         if (!hdr)
1790                 return -ENOBUFS;
1791
1792         if (WARN_ON(!state))
1793                 return -EINVAL;
1794
1795         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1796             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1797                            wiphy_name(&rdev->wiphy)) ||
1798             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1799                         cfg80211_rdev_list_generation))
1800                 goto nla_put_failure;
1801
1802         if (cmd != NL80211_CMD_NEW_WIPHY)
1803                 goto finish;
1804
1805         switch (state->split_start) {
1806         case 0:
1807                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1808                                rdev->wiphy.retry_short) ||
1809                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1810                                rdev->wiphy.retry_long) ||
1811                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1812                                 rdev->wiphy.frag_threshold) ||
1813                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1814                                 rdev->wiphy.rts_threshold) ||
1815                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1816                                rdev->wiphy.coverage_class) ||
1817                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1818                                rdev->wiphy.max_scan_ssids) ||
1819                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1820                                rdev->wiphy.max_sched_scan_ssids) ||
1821                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1822                                 rdev->wiphy.max_scan_ie_len) ||
1823                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1824                                 rdev->wiphy.max_sched_scan_ie_len) ||
1825                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1826                                rdev->wiphy.max_match_sets) ||
1827                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1828                                 rdev->wiphy.max_sched_scan_plans) ||
1829                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1830                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1831                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1832                                 rdev->wiphy.max_sched_scan_plan_iterations))
1833                         goto nla_put_failure;
1834
1835                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1836                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1837                         goto nla_put_failure;
1838                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1839                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1840                         goto nla_put_failure;
1841                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1842                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1843                         goto nla_put_failure;
1844                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1845                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1846                         goto nla_put_failure;
1847                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1848                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1849                         goto nla_put_failure;
1850                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1851                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1852                         goto nla_put_failure;
1853                 state->split_start++;
1854                 if (state->split)
1855                         break;
1856                 /* fall through */
1857         case 1:
1858                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1859                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1860                             rdev->wiphy.cipher_suites))
1861                         goto nla_put_failure;
1862
1863                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1864                                rdev->wiphy.max_num_pmkids))
1865                         goto nla_put_failure;
1866
1867                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1868                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1869                         goto nla_put_failure;
1870
1871                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1872                                 rdev->wiphy.available_antennas_tx) ||
1873                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1874                                 rdev->wiphy.available_antennas_rx))
1875                         goto nla_put_failure;
1876
1877                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1878                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1879                                 rdev->wiphy.probe_resp_offload))
1880                         goto nla_put_failure;
1881
1882                 if ((rdev->wiphy.available_antennas_tx ||
1883                      rdev->wiphy.available_antennas_rx) &&
1884                     rdev->ops->get_antenna) {
1885                         u32 tx_ant = 0, rx_ant = 0;
1886                         int res;
1887
1888                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1889                         if (!res) {
1890                                 if (nla_put_u32(msg,
1891                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1892                                                 tx_ant) ||
1893                                     nla_put_u32(msg,
1894                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1895                                                 rx_ant))
1896                                         goto nla_put_failure;
1897                         }
1898                 }
1899
1900                 state->split_start++;
1901                 if (state->split)
1902                         break;
1903                 /* fall through */
1904         case 2:
1905                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1906                                         rdev->wiphy.interface_modes))
1907                                 goto nla_put_failure;
1908                 state->split_start++;
1909                 if (state->split)
1910                         break;
1911                 /* fall through */
1912         case 3:
1913                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1914                 if (!nl_bands)
1915                         goto nla_put_failure;
1916
1917                 for (band = state->band_start;
1918                      band < NUM_NL80211_BANDS; band++) {
1919                         struct ieee80211_supported_band *sband;
1920
1921                         sband = rdev->wiphy.bands[band];
1922
1923                         if (!sband)
1924                                 continue;
1925
1926                         nl_band = nla_nest_start(msg, band);
1927                         if (!nl_band)
1928                                 goto nla_put_failure;
1929
1930                         switch (state->chan_start) {
1931                         case 0:
1932                                 if (nl80211_send_band_rateinfo(msg, sband))
1933                                         goto nla_put_failure;
1934                                 state->chan_start++;
1935                                 if (state->split)
1936                                         break;
1937                                 /* fall through */
1938                         default:
1939                                 /* add frequencies */
1940                                 nl_freqs = nla_nest_start(
1941                                         msg, NL80211_BAND_ATTR_FREQS);
1942                                 if (!nl_freqs)
1943                                         goto nla_put_failure;
1944
1945                                 for (i = state->chan_start - 1;
1946                                      i < sband->n_channels;
1947                                      i++) {
1948                                         nl_freq = nla_nest_start(msg, i);
1949                                         if (!nl_freq)
1950                                                 goto nla_put_failure;
1951
1952                                         chan = &sband->channels[i];
1953
1954                                         if (nl80211_msg_put_channel(
1955                                                         msg, &rdev->wiphy, chan,
1956                                                         state->split))
1957                                                 goto nla_put_failure;
1958
1959                                         nla_nest_end(msg, nl_freq);
1960                                         if (state->split)
1961                                                 break;
1962                                 }
1963                                 if (i < sband->n_channels)
1964                                         state->chan_start = i + 2;
1965                                 else
1966                                         state->chan_start = 0;
1967                                 nla_nest_end(msg, nl_freqs);
1968                         }
1969
1970                         nla_nest_end(msg, nl_band);
1971
1972                         if (state->split) {
1973                                 /* start again here */
1974                                 if (state->chan_start)
1975                                         band--;
1976                                 break;
1977                         }
1978                 }
1979                 nla_nest_end(msg, nl_bands);
1980
1981                 if (band < NUM_NL80211_BANDS)
1982                         state->band_start = band + 1;
1983                 else
1984                         state->band_start = 0;
1985
1986                 /* if bands & channels are done, continue outside */
1987                 if (state->band_start == 0 && state->chan_start == 0)
1988                         state->split_start++;
1989                 if (state->split)
1990                         break;
1991                 /* fall through */
1992         case 4:
1993                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1994                 if (!nl_cmds)
1995                         goto nla_put_failure;
1996
1997                 i = nl80211_add_commands_unsplit(rdev, msg);
1998                 if (i < 0)
1999                         goto nla_put_failure;
2000                 if (state->split) {
2001                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2002                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2003                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2004                                 CMD(channel_switch, CHANNEL_SWITCH);
2005                         CMD(set_qos_map, SET_QOS_MAP);
2006                         if (rdev->wiphy.features &
2007                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2008                                 CMD(add_tx_ts, ADD_TX_TS);
2009                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2010                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2011                 }
2012 #undef CMD
2013
2014                 nla_nest_end(msg, nl_cmds);
2015                 state->split_start++;
2016                 if (state->split)
2017                         break;
2018                 /* fall through */
2019         case 5:
2020                 if (rdev->ops->remain_on_channel &&
2021                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2022                     nla_put_u32(msg,
2023                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2024                                 rdev->wiphy.max_remain_on_channel_duration))
2025                         goto nla_put_failure;
2026
2027                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2028                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2029                         goto nla_put_failure;
2030
2031                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2032                         goto nla_put_failure;
2033                 state->split_start++;
2034                 if (state->split)
2035                         break;
2036                 /* fall through */
2037         case 6:
2038 #ifdef CONFIG_PM
2039                 if (nl80211_send_wowlan(msg, rdev, state->split))
2040                         goto nla_put_failure;
2041                 state->split_start++;
2042                 if (state->split)
2043                         break;
2044 #else
2045                 state->split_start++;
2046 #endif
2047                 /* fall through */
2048         case 7:
2049                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2050                                         rdev->wiphy.software_iftypes))
2051                         goto nla_put_failure;
2052
2053                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2054                                                    state->split))
2055                         goto nla_put_failure;
2056
2057                 state->split_start++;
2058                 if (state->split)
2059                         break;
2060                 /* fall through */
2061         case 8:
2062                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2063                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2064                                 rdev->wiphy.ap_sme_capa))
2065                         goto nla_put_failure;
2066
2067                 features = rdev->wiphy.features;
2068                 /*
2069                  * We can only add the per-channel limit information if the
2070                  * dump is split, otherwise it makes it too big. Therefore
2071                  * only advertise it in that case.
2072                  */
2073                 if (state->split)
2074                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2075                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2076                         goto nla_put_failure;
2077
2078                 if (rdev->wiphy.ht_capa_mod_mask &&
2079                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2080                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2081                             rdev->wiphy.ht_capa_mod_mask))
2082                         goto nla_put_failure;
2083
2084                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2085                     rdev->wiphy.max_acl_mac_addrs &&
2086                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2087                                 rdev->wiphy.max_acl_mac_addrs))
2088                         goto nla_put_failure;
2089
2090                 /*
2091                  * Any information below this point is only available to
2092                  * applications that can deal with it being split. This
2093                  * helps ensure that newly added capabilities don't break
2094                  * older tools by overrunning their buffers.
2095                  *
2096                  * We still increment split_start so that in the split
2097                  * case we'll continue with more data in the next round,
2098                  * but break unconditionally so unsplit data stops here.
2099                  */
2100                 state->split_start++;
2101                 break;
2102         case 9:
2103                 if (rdev->wiphy.extended_capabilities &&
2104                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2105                              rdev->wiphy.extended_capabilities_len,
2106                              rdev->wiphy.extended_capabilities) ||
2107                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2108                              rdev->wiphy.extended_capabilities_len,
2109                              rdev->wiphy.extended_capabilities_mask)))
2110                         goto nla_put_failure;
2111
2112                 if (rdev->wiphy.vht_capa_mod_mask &&
2113                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2114                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2115                             rdev->wiphy.vht_capa_mod_mask))
2116                         goto nla_put_failure;
2117
2118                 state->split_start++;
2119                 break;
2120         case 10:
2121                 if (nl80211_send_coalesce(msg, rdev))
2122                         goto nla_put_failure;
2123
2124                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2125                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2126                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2127                         goto nla_put_failure;
2128
2129                 if (rdev->wiphy.max_ap_assoc_sta &&
2130                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2131                                 rdev->wiphy.max_ap_assoc_sta))
2132                         goto nla_put_failure;
2133
2134                 state->split_start++;
2135                 break;
2136         case 11:
2137                 if (rdev->wiphy.n_vendor_commands) {
2138                         const struct nl80211_vendor_cmd_info *info;
2139                         struct nlattr *nested;
2140
2141                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
2142                         if (!nested)
2143                                 goto nla_put_failure;
2144
2145                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2146                                 info = &rdev->wiphy.vendor_commands[i].info;
2147                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2148                                         goto nla_put_failure;
2149                         }
2150                         nla_nest_end(msg, nested);
2151                 }
2152
2153                 if (rdev->wiphy.n_vendor_events) {
2154                         const struct nl80211_vendor_cmd_info *info;
2155                         struct nlattr *nested;
2156
2157                         nested = nla_nest_start(msg,
2158                                                 NL80211_ATTR_VENDOR_EVENTS);
2159                         if (!nested)
2160                                 goto nla_put_failure;
2161
2162                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2163                                 info = &rdev->wiphy.vendor_events[i];
2164                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2165                                         goto nla_put_failure;
2166                         }
2167                         nla_nest_end(msg, nested);
2168                 }
2169                 state->split_start++;
2170                 break;
2171         case 12:
2172                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2173                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2174                                rdev->wiphy.max_num_csa_counters))
2175                         goto nla_put_failure;
2176
2177                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2178                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2179                         goto nla_put_failure;
2180
2181                 if (rdev->wiphy.max_sched_scan_reqs &&
2182                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2183                                 rdev->wiphy.max_sched_scan_reqs))
2184                         goto nla_put_failure;
2185
2186                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2187                             sizeof(rdev->wiphy.ext_features),
2188                             rdev->wiphy.ext_features))
2189                         goto nla_put_failure;
2190
2191                 if (rdev->wiphy.bss_select_support) {
2192                         struct nlattr *nested;
2193                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2194
2195                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2196                         if (!nested)
2197                                 goto nla_put_failure;
2198
2199                         i = 0;
2200                         while (bss_select_support) {
2201                                 if ((bss_select_support & 1) &&
2202                                     nla_put_flag(msg, i))
2203                                         goto nla_put_failure;
2204                                 i++;
2205                                 bss_select_support >>= 1;
2206                         }
2207                         nla_nest_end(msg, nested);
2208                 }
2209
2210                 state->split_start++;
2211                 break;
2212         case 13:
2213                 if (rdev->wiphy.num_iftype_ext_capab &&
2214                     rdev->wiphy.iftype_ext_capab) {
2215                         struct nlattr *nested_ext_capab, *nested;
2216
2217                         nested = nla_nest_start(msg,
2218                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2219                         if (!nested)
2220                                 goto nla_put_failure;
2221
2222                         for (i = state->capa_start;
2223                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2224                                 const struct wiphy_iftype_ext_capab *capab;
2225
2226                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2227
2228                                 nested_ext_capab = nla_nest_start(msg, i);
2229                                 if (!nested_ext_capab ||
2230                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2231                                                 capab->iftype) ||
2232                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2233                                             capab->extended_capabilities_len,
2234                                             capab->extended_capabilities) ||
2235                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2236                                             capab->extended_capabilities_len,
2237                                             capab->extended_capabilities_mask))
2238                                         goto nla_put_failure;
2239
2240                                 nla_nest_end(msg, nested_ext_capab);
2241                                 if (state->split)
2242                                         break;
2243                         }
2244                         nla_nest_end(msg, nested);
2245                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2246                                 state->capa_start = i + 1;
2247                                 break;
2248                         }
2249                 }
2250
2251                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2252                                 rdev->wiphy.nan_supported_bands))
2253                         goto nla_put_failure;
2254
2255                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2256                                             NL80211_EXT_FEATURE_TXQS)) {
2257                         struct cfg80211_txq_stats txqstats = {};
2258                         int res;
2259
2260                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2261                         if (!res &&
2262                             !nl80211_put_txq_stats(msg, &txqstats,
2263                                                    NL80211_ATTR_TXQ_STATS))
2264                                 goto nla_put_failure;
2265
2266                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2267                                         rdev->wiphy.txq_limit))
2268                                 goto nla_put_failure;
2269                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2270                                         rdev->wiphy.txq_memory_limit))
2271                                 goto nla_put_failure;
2272                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2273                                         rdev->wiphy.txq_quantum))
2274                                 goto nla_put_failure;
2275                 }
2276
2277                 state->split_start++;
2278                 break;
2279         case 14:
2280                 if (nl80211_send_pmsr_capa(rdev, msg))
2281                         goto nla_put_failure;
2282
2283                 state->split_start++;
2284                 break;
2285         case 15:
2286                 if (rdev->wiphy.akm_suites &&
2287                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2288                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2289                             rdev->wiphy.akm_suites))
2290                         goto nla_put_failure;
2291
2292                 /* done */
2293                 state->split_start = 0;
2294                 break;
2295         }
2296  finish:
2297         genlmsg_end(msg, hdr);
2298         return 0;
2299
2300  nla_put_failure:
2301         genlmsg_cancel(msg, hdr);
2302         return -EMSGSIZE;
2303 }
2304
2305 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2306                                     struct netlink_callback *cb,
2307                                     struct nl80211_dump_wiphy_state *state)
2308 {
2309         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2310         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2311                               nl80211_fam.maxattr, nl80211_policy, NULL);
2312         /* ignore parse errors for backward compatibility */
2313         if (ret)
2314                 return 0;
2315
2316         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2317         if (tb[NL80211_ATTR_WIPHY])
2318                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2319         if (tb[NL80211_ATTR_WDEV])
2320                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2321         if (tb[NL80211_ATTR_IFINDEX]) {
2322                 struct net_device *netdev;
2323                 struct cfg80211_registered_device *rdev;
2324                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2325
2326                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2327                 if (!netdev)
2328                         return -ENODEV;
2329                 if (netdev->ieee80211_ptr) {
2330                         rdev = wiphy_to_rdev(
2331                                 netdev->ieee80211_ptr->wiphy);
2332                         state->filter_wiphy = rdev->wiphy_idx;
2333                 }
2334         }
2335
2336         return 0;
2337 }
2338
2339 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2340 {
2341         int idx = 0, ret;
2342         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2343         struct cfg80211_registered_device *rdev;
2344
2345         rtnl_lock();
2346         if (!state) {
2347                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2348                 if (!state) {
2349                         rtnl_unlock();
2350                         return -ENOMEM;
2351                 }
2352                 state->filter_wiphy = -1;
2353                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2354                 if (ret) {
2355                         kfree(state);
2356                         rtnl_unlock();
2357                         return ret;
2358                 }
2359                 cb->args[0] = (long)state;
2360         }
2361
2362         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2363                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2364                         continue;
2365                 if (++idx <= state->start)
2366                         continue;
2367                 if (state->filter_wiphy != -1 &&
2368                     state->filter_wiphy != rdev->wiphy_idx)
2369                         continue;
2370                 /* attempt to fit multiple wiphy data chunks into the skb */
2371                 do {
2372                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2373                                                  skb,
2374                                                  NETLINK_CB(cb->skb).portid,
2375                                                  cb->nlh->nlmsg_seq,
2376                                                  NLM_F_MULTI, state);
2377                         if (ret < 0) {
2378                                 /*
2379                                  * If sending the wiphy data didn't fit (ENOBUFS
2380                                  * or EMSGSIZE returned), this SKB is still
2381                                  * empty (so it's not too big because another
2382                                  * wiphy dataset is already in the skb) and
2383                                  * we've not tried to adjust the dump allocation
2384                                  * yet ... then adjust the alloc size to be
2385                                  * bigger, and return 1 but with the empty skb.
2386                                  * This results in an empty message being RX'ed
2387                                  * in userspace, but that is ignored.
2388                                  *
2389                                  * We can then retry with the larger buffer.
2390                                  */
2391                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2392                                     !skb->len && !state->split &&
2393                                     cb->min_dump_alloc < 4096) {
2394                                         cb->min_dump_alloc = 4096;
2395                                         state->split_start = 0;
2396                                         rtnl_unlock();
2397                                         return 1;
2398                                 }
2399                                 idx--;
2400                                 break;
2401                         }
2402                 } while (state->split_start > 0);
2403                 break;
2404         }
2405         rtnl_unlock();
2406
2407         state->start = idx;
2408
2409         return skb->len;
2410 }
2411
2412 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2413 {
2414         kfree((void *)cb->args[0]);
2415         return 0;
2416 }
2417
2418 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2419 {
2420         struct sk_buff *msg;
2421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2422         struct nl80211_dump_wiphy_state state = {};
2423
2424         msg = nlmsg_new(4096, GFP_KERNEL);
2425         if (!msg)
2426                 return -ENOMEM;
2427
2428         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2429                                info->snd_portid, info->snd_seq, 0,
2430                                &state) < 0) {
2431                 nlmsg_free(msg);
2432                 return -ENOBUFS;
2433         }
2434
2435         return genlmsg_reply(msg, info);
2436 }
2437
2438 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2439         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2440         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2441         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2442         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2443         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2444 };
2445
2446 static int parse_txq_params(struct nlattr *tb[],
2447                             struct ieee80211_txq_params *txq_params)
2448 {
2449         u8 ac;
2450
2451         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2452             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2453             !tb[NL80211_TXQ_ATTR_AIFS])
2454                 return -EINVAL;
2455
2456         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2457         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2458         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2459         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2460         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2461
2462         if (ac >= NL80211_NUM_ACS)
2463                 return -EINVAL;
2464         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2465         return 0;
2466 }
2467
2468 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2469 {
2470         /*
2471          * You can only set the channel explicitly for WDS interfaces,
2472          * all others have their channel managed via their respective
2473          * "establish a connection" command (connect, join, ...)
2474          *
2475          * For AP/GO and mesh mode, the channel can be set with the
2476          * channel userspace API, but is only stored and passed to the
2477          * low-level driver when the AP starts or the mesh is joined.
2478          * This is for backward compatibility, userspace can also give
2479          * the channel in the start-ap or join-mesh commands instead.
2480          *
2481          * Monitors are special as they are normally slaved to
2482          * whatever else is going on, so they have their own special
2483          * operation to set the monitor channel if possible.
2484          */
2485         return !wdev ||
2486                 wdev->iftype == NL80211_IFTYPE_AP ||
2487                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2488                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2489                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2490 }
2491
2492 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2493                           struct genl_info *info,
2494                           struct cfg80211_chan_def *chandef)
2495 {
2496         struct netlink_ext_ack *extack = info->extack;
2497         struct nlattr **attrs = info->attrs;
2498         u32 control_freq;
2499
2500         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2501                 return -EINVAL;
2502
2503         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2504
2505         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2506         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2507         chandef->center_freq1 = control_freq;
2508         chandef->center_freq2 = 0;
2509
2510         /* Primary channel not allowed */
2511         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2512                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2513                                     "Channel is disabled");
2514                 return -EINVAL;
2515         }
2516
2517         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2518                 enum nl80211_channel_type chantype;
2519
2520                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2521
2522                 switch (chantype) {
2523                 case NL80211_CHAN_NO_HT:
2524                 case NL80211_CHAN_HT20:
2525                 case NL80211_CHAN_HT40PLUS:
2526                 case NL80211_CHAN_HT40MINUS:
2527                         cfg80211_chandef_create(chandef, chandef->chan,
2528                                                 chantype);
2529                         /* user input for center_freq is incorrect */
2530                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2531                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2532                                 NL_SET_ERR_MSG_ATTR(extack,
2533                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2534                                                     "bad center frequency 1");
2535                                 return -EINVAL;
2536                         }
2537                         /* center_freq2 must be zero */
2538                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2539                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2540                                 NL_SET_ERR_MSG_ATTR(extack,
2541                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2542                                                     "center frequency 2 can't be used");
2543                                 return -EINVAL;
2544                         }
2545                         break;
2546                 default:
2547                         NL_SET_ERR_MSG_ATTR(extack,
2548                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2549                                             "invalid channel type");
2550                         return -EINVAL;
2551                 }
2552         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2553                 chandef->width =
2554                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2555                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2556                         chandef->center_freq1 =
2557                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2558                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2559                         chandef->center_freq2 =
2560                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2561         }
2562
2563         if (!cfg80211_chandef_valid(chandef)) {
2564                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2565                 return -EINVAL;
2566         }
2567
2568         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2569                                      IEEE80211_CHAN_DISABLED)) {
2570                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2571                 return -EINVAL;
2572         }
2573
2574         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2575              chandef->width == NL80211_CHAN_WIDTH_10) &&
2576             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2577                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2578                 return -EINVAL;
2579         }
2580
2581         return 0;
2582 }
2583
2584 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2585                                  struct net_device *dev,
2586                                  struct genl_info *info)
2587 {
2588         struct cfg80211_chan_def chandef;
2589         int result;
2590         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2591         struct wireless_dev *wdev = NULL;
2592
2593         if (dev)
2594                 wdev = dev->ieee80211_ptr;
2595         if (!nl80211_can_set_dev_channel(wdev))
2596                 return -EOPNOTSUPP;
2597         if (wdev)
2598                 iftype = wdev->iftype;
2599
2600         result = nl80211_parse_chandef(rdev, info, &chandef);
2601         if (result)
2602                 return result;
2603
2604         switch (iftype) {
2605         case NL80211_IFTYPE_AP:
2606         case NL80211_IFTYPE_P2P_GO:
2607                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2608                                                    iftype)) {
2609                         result = -EINVAL;
2610                         break;
2611                 }
2612                 if (wdev->beacon_interval) {
2613                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2614                             !(rdev->wiphy.features &
2615                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2616                                 result = -EBUSY;
2617                                 break;
2618                         }
2619
2620                         /* Only allow dynamic channel width changes */
2621                         if (chandef.chan != wdev->preset_chandef.chan) {
2622                                 result = -EBUSY;
2623                                 break;
2624                         }
2625                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2626                         if (result)
2627                                 break;
2628                 }
2629                 wdev->preset_chandef = chandef;
2630                 result = 0;
2631                 break;
2632         case NL80211_IFTYPE_MESH_POINT:
2633                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2634                 break;
2635         case NL80211_IFTYPE_MONITOR:
2636                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2637                 break;
2638         default:
2639                 result = -EINVAL;
2640         }
2641
2642         return result;
2643 }
2644
2645 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2646 {
2647         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2648         struct net_device *netdev = info->user_ptr[1];
2649
2650         return __nl80211_set_channel(rdev, netdev, info);
2651 }
2652
2653 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2654 {
2655         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2656         struct net_device *dev = info->user_ptr[1];
2657         struct wireless_dev *wdev = dev->ieee80211_ptr;
2658         const u8 *bssid;
2659
2660         if (!info->attrs[NL80211_ATTR_MAC])
2661                 return -EINVAL;
2662
2663         if (netif_running(dev))
2664                 return -EBUSY;
2665
2666         if (!rdev->ops->set_wds_peer)
2667                 return -EOPNOTSUPP;
2668
2669         if (wdev->iftype != NL80211_IFTYPE_WDS)
2670                 return -EOPNOTSUPP;
2671
2672         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2673         return rdev_set_wds_peer(rdev, dev, bssid);
2674 }
2675
2676 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2677 {
2678         struct cfg80211_registered_device *rdev;
2679         struct net_device *netdev = NULL;
2680         struct wireless_dev *wdev;
2681         int result = 0, rem_txq_params = 0;
2682         struct nlattr *nl_txq_params;
2683         u32 changed;
2684         u8 retry_short = 0, retry_long = 0;
2685         u32 frag_threshold = 0, rts_threshold = 0;
2686         u8 coverage_class = 0;
2687         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2688
2689         ASSERT_RTNL();
2690
2691         /*
2692          * Try to find the wiphy and netdev. Normally this
2693          * function shouldn't need the netdev, but this is
2694          * done for backward compatibility -- previously
2695          * setting the channel was done per wiphy, but now
2696          * it is per netdev. Previous userland like hostapd
2697          * also passed a netdev to set_wiphy, so that it is
2698          * possible to let that go to the right netdev!
2699          */
2700
2701         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2702                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2703
2704                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2705                 if (netdev && netdev->ieee80211_ptr)
2706                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2707                 else
2708                         netdev = NULL;
2709         }
2710
2711         if (!netdev) {
2712                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2713                                                   info->attrs);
2714                 if (IS_ERR(rdev))
2715                         return PTR_ERR(rdev);
2716                 wdev = NULL;
2717                 netdev = NULL;
2718                 result = 0;
2719         } else
2720                 wdev = netdev->ieee80211_ptr;
2721
2722         /*
2723          * end workaround code, by now the rdev is available
2724          * and locked, and wdev may or may not be NULL.
2725          */
2726
2727         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2728                 result = cfg80211_dev_rename(
2729                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2730
2731         if (result)
2732                 return result;
2733
2734         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2735                 struct ieee80211_txq_params txq_params;
2736                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2737
2738                 if (!rdev->ops->set_txq_params)
2739                         return -EOPNOTSUPP;
2740
2741                 if (!netdev)
2742                         return -EINVAL;
2743
2744                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2745                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2746                         return -EINVAL;
2747
2748                 if (!netif_running(netdev))
2749                         return -ENETDOWN;
2750
2751                 nla_for_each_nested(nl_txq_params,
2752                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2753                                     rem_txq_params) {
2754                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2755                                                   nl_txq_params,
2756                                                   txq_params_policy,
2757                                                   info->extack);
2758                         if (result)
2759                                 return result;
2760                         result = parse_txq_params(tb, &txq_params);
2761                         if (result)
2762                                 return result;
2763
2764                         result = rdev_set_txq_params(rdev, netdev,
2765                                                      &txq_params);
2766                         if (result)
2767                                 return result;
2768                 }
2769         }
2770
2771         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2772                 result = __nl80211_set_channel(
2773                         rdev,
2774                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2775                         info);
2776                 if (result)
2777                         return result;
2778         }
2779
2780         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2781                 struct wireless_dev *txp_wdev = wdev;
2782                 enum nl80211_tx_power_setting type;
2783                 int idx, mbm = 0;
2784
2785                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2786                         txp_wdev = NULL;
2787
2788                 if (!rdev->ops->set_tx_power)
2789                         return -EOPNOTSUPP;
2790
2791                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2792                 type = nla_get_u32(info->attrs[idx]);
2793
2794                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2795                     (type != NL80211_TX_POWER_AUTOMATIC))
2796                         return -EINVAL;
2797
2798                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2799                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2800                         mbm = nla_get_u32(info->attrs[idx]);
2801                 }
2802
2803                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2804                 if (result)
2805                         return result;
2806         }
2807
2808         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2809             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2810                 u32 tx_ant, rx_ant;
2811
2812                 if ((!rdev->wiphy.available_antennas_tx &&
2813                      !rdev->wiphy.available_antennas_rx) ||
2814                     !rdev->ops->set_antenna)
2815                         return -EOPNOTSUPP;
2816
2817                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2818                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2819
2820                 /* reject antenna configurations which don't match the
2821                  * available antenna masks, except for the "all" mask */
2822                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2823                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2824                         return -EINVAL;
2825
2826                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2827                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2828
2829                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2830                 if (result)
2831                         return result;
2832         }
2833
2834         changed = 0;
2835
2836         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2837                 retry_short = nla_get_u8(
2838                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2839
2840                 changed |= WIPHY_PARAM_RETRY_SHORT;
2841         }
2842
2843         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2844                 retry_long = nla_get_u8(
2845                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2846
2847                 changed |= WIPHY_PARAM_RETRY_LONG;
2848         }
2849
2850         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2851                 frag_threshold = nla_get_u32(
2852                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2853                 if (frag_threshold < 256)
2854                         return -EINVAL;
2855
2856                 if (frag_threshold != (u32) -1) {
2857                         /*
2858                          * Fragments (apart from the last one) are required to
2859                          * have even length. Make the fragmentation code
2860                          * simpler by stripping LSB should someone try to use
2861                          * odd threshold value.
2862                          */
2863                         frag_threshold &= ~0x1;
2864                 }
2865                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2866         }
2867
2868         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2869                 rts_threshold = nla_get_u32(
2870                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2871                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2872         }
2873
2874         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2875                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2876                         return -EINVAL;
2877
2878                 coverage_class = nla_get_u8(
2879                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2880                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2881         }
2882
2883         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2884                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2885                         return -EOPNOTSUPP;
2886
2887                 changed |= WIPHY_PARAM_DYN_ACK;
2888         }
2889
2890         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2891                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2892                                              NL80211_EXT_FEATURE_TXQS))
2893                         return -EOPNOTSUPP;
2894                 txq_limit = nla_get_u32(
2895                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2896                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2897         }
2898
2899         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2900                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2901                                              NL80211_EXT_FEATURE_TXQS))
2902                         return -EOPNOTSUPP;
2903                 txq_memory_limit = nla_get_u32(
2904                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2905                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2906         }
2907
2908         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2909                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2910                                              NL80211_EXT_FEATURE_TXQS))
2911                         return -EOPNOTSUPP;
2912                 txq_quantum = nla_get_u32(
2913                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2914                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2915         }
2916
2917         if (changed) {
2918                 u8 old_retry_short, old_retry_long;
2919                 u32 old_frag_threshold, old_rts_threshold;
2920                 u8 old_coverage_class;
2921                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2922
2923                 if (!rdev->ops->set_wiphy_params)
2924                         return -EOPNOTSUPP;
2925
2926                 old_retry_short = rdev->wiphy.retry_short;
2927                 old_retry_long = rdev->wiphy.retry_long;
2928                 old_frag_threshold = rdev->wiphy.frag_threshold;
2929                 old_rts_threshold = rdev->wiphy.rts_threshold;
2930                 old_coverage_class = rdev->wiphy.coverage_class;
2931                 old_txq_limit = rdev->wiphy.txq_limit;
2932                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2933                 old_txq_quantum = rdev->wiphy.txq_quantum;
2934
2935                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2936                         rdev->wiphy.retry_short = retry_short;
2937                 if (changed & WIPHY_PARAM_RETRY_LONG)
2938                         rdev->wiphy.retry_long = retry_long;
2939                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2940                         rdev->wiphy.frag_threshold = frag_threshold;
2941                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2942                         rdev->wiphy.rts_threshold = rts_threshold;
2943                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2944                         rdev->wiphy.coverage_class = coverage_class;
2945                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2946                         rdev->wiphy.txq_limit = txq_limit;
2947                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2948                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2949                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2950                         rdev->wiphy.txq_quantum = txq_quantum;
2951
2952                 result = rdev_set_wiphy_params(rdev, changed);
2953                 if (result) {
2954                         rdev->wiphy.retry_short = old_retry_short;
2955                         rdev->wiphy.retry_long = old_retry_long;
2956                         rdev->wiphy.frag_threshold = old_frag_threshold;
2957                         rdev->wiphy.rts_threshold = old_rts_threshold;
2958                         rdev->wiphy.coverage_class = old_coverage_class;
2959                         rdev->wiphy.txq_limit = old_txq_limit;
2960                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2961                         rdev->wiphy.txq_quantum = old_txq_quantum;
2962                         return result;
2963                 }
2964         }
2965         return 0;
2966 }
2967
2968 static int nl80211_send_chandef(struct sk_buff *msg,
2969                                 const struct cfg80211_chan_def *chandef)
2970 {
2971         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2972                 return -EINVAL;
2973
2974         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2975                         chandef->chan->center_freq))
2976                 return -ENOBUFS;
2977         switch (chandef->width) {
2978         case NL80211_CHAN_WIDTH_20_NOHT:
2979         case NL80211_CHAN_WIDTH_20:
2980         case NL80211_CHAN_WIDTH_40:
2981                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2982                                 cfg80211_get_chandef_type(chandef)))
2983                         return -ENOBUFS;
2984                 break;
2985         default:
2986                 break;
2987         }
2988         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2989                 return -ENOBUFS;
2990         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2991                 return -ENOBUFS;
2992         if (chandef->center_freq2 &&
2993             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2994                 return -ENOBUFS;
2995         return 0;
2996 }
2997
2998 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2999                               struct cfg80211_registered_device *rdev,
3000                               struct wireless_dev *wdev,
3001                               enum nl80211_commands cmd)
3002 {
3003         struct net_device *dev = wdev->netdev;
3004         void *hdr;
3005
3006         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3007                 cmd != NL80211_CMD_DEL_INTERFACE &&
3008                 cmd != NL80211_CMD_SET_INTERFACE);
3009
3010         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3011         if (!hdr)
3012                 return -1;
3013
3014         if (dev &&
3015             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3016              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3017                 goto nla_put_failure;
3018
3019         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3020             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3021             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3022                               NL80211_ATTR_PAD) ||
3023             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3024             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3025                         rdev->devlist_generation ^
3026                         (cfg80211_rdev_list_generation << 2)) ||
3027             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3028                 goto nla_put_failure;
3029
3030         if (rdev->ops->get_channel) {
3031                 int ret;
3032                 struct cfg80211_chan_def chandef;
3033
3034                 ret = rdev_get_channel(rdev, wdev, &chandef);
3035                 if (ret == 0) {
3036                         if (nl80211_send_chandef(msg, &chandef))
3037                                 goto nla_put_failure;
3038                 }
3039         }
3040
3041         if (rdev->ops->get_tx_power) {
3042                 int dbm, ret;
3043
3044                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3045                 if (ret == 0 &&
3046                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3047                                 DBM_TO_MBM(dbm)))
3048                         goto nla_put_failure;
3049         }
3050
3051         wdev_lock(wdev);
3052         switch (wdev->iftype) {
3053         case NL80211_IFTYPE_AP:
3054                 if (wdev->ssid_len &&
3055                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3056                         goto nla_put_failure_locked;
3057                 break;
3058         case NL80211_IFTYPE_STATION:
3059         case NL80211_IFTYPE_P2P_CLIENT:
3060         case NL80211_IFTYPE_ADHOC: {
3061                 const u8 *ssid_ie;
3062                 if (!wdev->current_bss)
3063                         break;
3064                 rcu_read_lock();
3065                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3066                                                WLAN_EID_SSID);
3067                 if (ssid_ie &&
3068                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3069                         goto nla_put_failure_rcu_locked;
3070                 rcu_read_unlock();
3071                 break;
3072                 }
3073         default:
3074                 /* nothing */
3075                 break;
3076         }
3077         wdev_unlock(wdev);
3078
3079         if (rdev->ops->get_txq_stats) {
3080                 struct cfg80211_txq_stats txqstats = {};
3081                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3082
3083                 if (ret == 0 &&
3084                     !nl80211_put_txq_stats(msg, &txqstats,
3085                                            NL80211_ATTR_TXQ_STATS))
3086                         goto nla_put_failure;
3087         }
3088
3089         genlmsg_end(msg, hdr);
3090         return 0;
3091
3092  nla_put_failure_rcu_locked:
3093         rcu_read_unlock();
3094  nla_put_failure_locked:
3095         wdev_unlock(wdev);
3096  nla_put_failure:
3097         genlmsg_cancel(msg, hdr);
3098         return -EMSGSIZE;
3099 }
3100
3101 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3102 {
3103         int wp_idx = 0;
3104         int if_idx = 0;
3105         int wp_start = cb->args[0];
3106         int if_start = cb->args[1];
3107         int filter_wiphy = -1;
3108         struct cfg80211_registered_device *rdev;
3109         struct wireless_dev *wdev;
3110         int ret;
3111
3112         rtnl_lock();
3113         if (!cb->args[2]) {
3114                 struct nl80211_dump_wiphy_state state = {
3115                         .filter_wiphy = -1,
3116                 };
3117
3118                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3119                 if (ret)
3120                         goto out_unlock;
3121
3122                 filter_wiphy = state.filter_wiphy;
3123
3124                 /*
3125                  * if filtering, set cb->args[2] to +1 since 0 is the default
3126                  * value needed to determine that parsing is necessary.
3127                  */
3128                 if (filter_wiphy >= 0)
3129                         cb->args[2] = filter_wiphy + 1;
3130                 else
3131                         cb->args[2] = -1;
3132         } else if (cb->args[2] > 0) {
3133                 filter_wiphy = cb->args[2] - 1;
3134         }
3135
3136         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3137                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3138                         continue;
3139                 if (wp_idx < wp_start) {
3140                         wp_idx++;
3141                         continue;
3142                 }
3143
3144                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3145                         continue;
3146
3147                 if_idx = 0;
3148
3149                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3150                         if (if_idx < if_start) {
3151                                 if_idx++;
3152                                 continue;
3153                         }
3154                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3155                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3156                                                rdev, wdev,
3157                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3158                                 goto out;
3159                         }
3160                         if_idx++;
3161                 }
3162
3163                 wp_idx++;
3164         }
3165  out:
3166         cb->args[0] = wp_idx;
3167         cb->args[1] = if_idx;
3168
3169         ret = skb->len;
3170  out_unlock:
3171         rtnl_unlock();
3172
3173         return ret;
3174 }
3175
3176 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3177 {
3178         struct sk_buff *msg;
3179         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3180         struct wireless_dev *wdev = info->user_ptr[1];
3181
3182         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3183         if (!msg)
3184                 return -ENOMEM;
3185
3186         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3187                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3188                 nlmsg_free(msg);
3189                 return -ENOBUFS;
3190         }
3191
3192         return genlmsg_reply(msg, info);
3193 }
3194
3195 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3196         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3197         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3198         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3199         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3200         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3201         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3202 };
3203
3204 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3205 {
3206         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3207         int flag;
3208
3209         *mntrflags = 0;
3210
3211         if (!nla)
3212                 return -EINVAL;
3213
3214         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3215                              mntr_flags_policy, NULL))
3216                 return -EINVAL;
3217
3218         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3219                 if (flags[flag])
3220                         *mntrflags |= (1<<flag);
3221
3222         *mntrflags |= MONITOR_FLAG_CHANGED;
3223
3224         return 0;
3225 }
3226
3227 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3228                                      enum nl80211_iftype type,
3229                                      struct genl_info *info,
3230                                      struct vif_params *params)
3231 {
3232         bool change = false;
3233         int err;
3234
3235         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3236                 if (type != NL80211_IFTYPE_MONITOR)
3237                         return -EINVAL;
3238
3239                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3240                                           &params->flags);
3241                 if (err)
3242                         return err;
3243
3244                 change = true;
3245         }
3246
3247         if (params->flags & MONITOR_FLAG_ACTIVE &&
3248             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3249                 return -EOPNOTSUPP;
3250
3251         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3252                 const u8 *mumimo_groups;
3253                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3254
3255                 if (type != NL80211_IFTYPE_MONITOR)
3256                         return -EINVAL;
3257
3258                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3259                         return -EOPNOTSUPP;
3260
3261                 mumimo_groups =
3262                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3263
3264                 /* bits 0 and 63 are reserved and must be zero */
3265                 if ((mumimo_groups[0] & BIT(0)) ||
3266                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3267                         return -EINVAL;
3268
3269                 params->vht_mumimo_groups = mumimo_groups;
3270                 change = true;
3271         }
3272
3273         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3274                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3275
3276                 if (type != NL80211_IFTYPE_MONITOR)
3277                         return -EINVAL;
3278
3279                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3280                         return -EOPNOTSUPP;
3281
3282                 params->vht_mumimo_follow_addr =
3283                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3284                 change = true;
3285         }
3286
3287         return change ? 1 : 0;
3288 }
3289
3290 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3291                                struct net_device *netdev, u8 use_4addr,
3292                                enum nl80211_iftype iftype)
3293 {
3294         if (!use_4addr) {
3295                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3296                         return -EBUSY;
3297                 return 0;
3298         }
3299
3300         switch (iftype) {
3301         case NL80211_IFTYPE_AP_VLAN:
3302                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3303                         return 0;
3304                 break;
3305         case NL80211_IFTYPE_STATION:
3306                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3307                         return 0;
3308                 break;
3309         default:
3310                 break;
3311         }
3312
3313         return -EOPNOTSUPP;
3314 }
3315
3316 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3317 {
3318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3319         struct vif_params params;
3320         int err;
3321         enum nl80211_iftype otype, ntype;
3322         struct net_device *dev = info->user_ptr[1];
3323         bool change = false;
3324
3325         memset(&params, 0, sizeof(params));
3326
3327         otype = ntype = dev->ieee80211_ptr->iftype;
3328
3329         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3330                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3331                 if (otype != ntype)
3332                         change = true;
3333         }
3334
3335         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3336                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3337
3338                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3339                         return -EINVAL;
3340                 if (netif_running(dev))
3341                         return -EBUSY;
3342
3343                 wdev_lock(wdev);
3344                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3345                              IEEE80211_MAX_MESH_ID_LEN);
3346                 wdev->mesh_id_up_len =
3347                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3348                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3349                        wdev->mesh_id_up_len);
3350                 wdev_unlock(wdev);
3351         }
3352
3353         if (info->attrs[NL80211_ATTR_4ADDR]) {
3354                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3355                 change = true;
3356                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3357                 if (err)
3358                         return err;
3359         } else {
3360                 params.use_4addr = -1;
3361         }
3362
3363         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3364         if (err < 0)
3365                 return err;
3366         if (err > 0)
3367                 change = true;
3368
3369         if (change)
3370                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3371         else
3372                 err = 0;
3373
3374         if (!err && params.use_4addr != -1)
3375                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3376
3377         if (change && !err) {
3378                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3379
3380                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3381         }
3382
3383         return err;
3384 }
3385
3386 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3387 {
3388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3389         struct vif_params params;
3390         struct wireless_dev *wdev;
3391         struct sk_buff *msg;
3392         int err;
3393         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3394
3395         /* to avoid failing a new interface creation due to pending removal */
3396         cfg80211_destroy_ifaces(rdev);
3397
3398         memset(&params, 0, sizeof(params));
3399
3400         if (!info->attrs[NL80211_ATTR_IFNAME])
3401                 return -EINVAL;
3402
3403         if (info->attrs[NL80211_ATTR_IFTYPE])
3404                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3405
3406         if (!rdev->ops->add_virtual_intf ||
3407             !(rdev->wiphy.interface_modes & (1 << type)))
3408                 return -EOPNOTSUPP;
3409
3410         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3411              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3412             info->attrs[NL80211_ATTR_MAC]) {
3413                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3414                            ETH_ALEN);
3415                 if (!is_valid_ether_addr(params.macaddr))
3416                         return -EADDRNOTAVAIL;
3417         }
3418
3419         if (info->attrs[NL80211_ATTR_4ADDR]) {
3420                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3421                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3422                 if (err)
3423                         return err;
3424         }
3425
3426         err = nl80211_parse_mon_options(rdev, type, info, &params);
3427         if (err < 0)
3428                 return err;
3429
3430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3431         if (!msg)
3432                 return -ENOMEM;
3433
3434         wdev = rdev_add_virtual_intf(rdev,
3435                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3436                                 NET_NAME_USER, type, &params);
3437         if (WARN_ON(!wdev)) {
3438                 nlmsg_free(msg);
3439                 return -EPROTO;
3440         } else if (IS_ERR(wdev)) {
3441                 nlmsg_free(msg);
3442                 return PTR_ERR(wdev);
3443         }
3444
3445         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3446                 wdev->owner_nlportid = info->snd_portid;
3447
3448         switch (type) {
3449         case NL80211_IFTYPE_MESH_POINT:
3450                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3451                         break;
3452                 wdev_lock(wdev);
3453                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3454                              IEEE80211_MAX_MESH_ID_LEN);
3455                 wdev->mesh_id_up_len =
3456                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3457                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3458                        wdev->mesh_id_up_len);
3459                 wdev_unlock(wdev);
3460                 break;
3461         case NL80211_IFTYPE_NAN:
3462         case NL80211_IFTYPE_P2P_DEVICE:
3463                 /*
3464                  * P2P Device and NAN do not have a netdev, so don't go
3465                  * through the netdev notifier and must be added here
3466                  */
3467                 cfg80211_init_wdev(rdev, wdev);
3468                 break;
3469         default:
3470                 break;
3471         }
3472
3473         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3474                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3475                 nlmsg_free(msg);
3476                 return -ENOBUFS;
3477         }
3478
3479         return genlmsg_reply(msg, info);
3480 }
3481
3482 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3483 {
3484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3485         struct wireless_dev *wdev = info->user_ptr[1];
3486
3487         if (!rdev->ops->del_virtual_intf)
3488                 return -EOPNOTSUPP;
3489
3490         /*
3491          * If we remove a wireless device without a netdev then clear
3492          * user_ptr[1] so that nl80211_post_doit won't dereference it
3493          * to check if it needs to do dev_put(). Otherwise it crashes
3494          * since the wdev has been freed, unlike with a netdev where
3495          * we need the dev_put() for the netdev to really be freed.
3496          */
3497         if (!wdev->netdev)
3498                 info->user_ptr[1] = NULL;
3499
3500         return rdev_del_virtual_intf(rdev, wdev);
3501 }
3502
3503 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3504 {
3505         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3506         struct net_device *dev = info->user_ptr[1];
3507         u16 noack_map;
3508
3509         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3510                 return -EINVAL;
3511
3512         if (!rdev->ops->set_noack_map)
3513                 return -EOPNOTSUPP;
3514
3515         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3516
3517         return rdev_set_noack_map(rdev, dev, noack_map);
3518 }
3519
3520 struct get_key_cookie {
3521         struct sk_buff *msg;
3522         int error;
3523         int idx;
3524 };
3525
3526 static void get_key_callback(void *c, struct key_params *params)
3527 {
3528         struct nlattr *key;
3529         struct get_key_cookie *cookie = c;
3530
3531         if ((params->key &&
3532              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3533                      params->key_len, params->key)) ||
3534             (params->seq &&
3535              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3536                      params->seq_len, params->seq)) ||
3537             (params->cipher &&
3538              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3539                          params->cipher)))
3540                 goto nla_put_failure;
3541
3542         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3543         if (!key)
3544                 goto nla_put_failure;
3545
3546         if ((params->key &&
3547              nla_put(cookie->msg, NL80211_KEY_DATA,
3548                      params->key_len, params->key)) ||
3549             (params->seq &&
3550              nla_put(cookie->msg, NL80211_KEY_SEQ,
3551                      params->seq_len, params->seq)) ||
3552             (params->cipher &&
3553              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3554                          params->cipher)))
3555                 goto nla_put_failure;
3556
3557         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3558                 goto nla_put_failure;
3559
3560         nla_nest_end(cookie->msg, key);
3561
3562         return;
3563  nla_put_failure:
3564         cookie->error = 1;
3565 }
3566
3567 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3568 {
3569         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3570         int err;
3571         struct net_device *dev = info->user_ptr[1];
3572         u8 key_idx = 0;
3573         const u8 *mac_addr = NULL;
3574         bool pairwise;
3575         struct get_key_cookie cookie = {
3576                 .error = 0,
3577         };
3578         void *hdr;
3579         struct sk_buff *msg;
3580
3581         if (info->attrs[NL80211_ATTR_KEY_IDX])
3582                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3583
3584         if (info->attrs[NL80211_ATTR_MAC])
3585                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3586
3587         pairwise = !!mac_addr;
3588         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3589                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3590
3591                 if (kt != NL80211_KEYTYPE_GROUP &&
3592                     kt != NL80211_KEYTYPE_PAIRWISE)
3593                         return -EINVAL;
3594                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3595         }
3596
3597         if (!rdev->ops->get_key)
3598                 return -EOPNOTSUPP;
3599
3600         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3601                 return -ENOENT;
3602
3603         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3604         if (!msg)
3605                 return -ENOMEM;
3606
3607         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3608                              NL80211_CMD_NEW_KEY);
3609         if (!hdr)
3610                 goto nla_put_failure;
3611
3612         cookie.msg = msg;
3613         cookie.idx = key_idx;
3614
3615         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3616             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3617                 goto nla_put_failure;
3618         if (mac_addr &&
3619             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3620                 goto nla_put_failure;
3621
3622         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3623                            get_key_callback);
3624
3625         if (err)
3626                 goto free_msg;
3627
3628         if (cookie.error)
3629                 goto nla_put_failure;
3630
3631         genlmsg_end(msg, hdr);
3632         return genlmsg_reply(msg, info);
3633
3634  nla_put_failure:
3635         err = -ENOBUFS;
3636  free_msg:
3637         nlmsg_free(msg);
3638         return err;
3639 }
3640
3641 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3642 {
3643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3644         struct key_parse key;
3645         int err;
3646         struct net_device *dev = info->user_ptr[1];
3647
3648         err = nl80211_parse_key(info, &key);
3649         if (err)
3650                 return err;
3651
3652         if (key.idx < 0)
3653                 return -EINVAL;
3654
3655         /* Only support setting default key and
3656          * Extended Key ID action NL80211_KEY_SET_TX.
3657          */
3658         if (!key.def && !key.defmgmt &&
3659             !(key.p.mode == NL80211_KEY_SET_TX))
3660                 return -EINVAL;
3661
3662         wdev_lock(dev->ieee80211_ptr);
3663
3664         if (key.def) {
3665                 if (!rdev->ops->set_default_key) {
3666                         err = -EOPNOTSUPP;
3667                         goto out;
3668                 }
3669
3670                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3671                 if (err)
3672                         goto out;
3673
3674                 err = rdev_set_default_key(rdev, dev, key.idx,
3675                                                  key.def_uni, key.def_multi);
3676
3677                 if (err)
3678                         goto out;
3679
3680 #ifdef CONFIG_CFG80211_WEXT
3681                 dev->ieee80211_ptr->wext.default_key = key.idx;
3682 #endif
3683         } else if (key.defmgmt) {
3684                 if (key.def_uni || !key.def_multi) {
3685                         err = -EINVAL;
3686                         goto out;
3687                 }
3688
3689                 if (!rdev->ops->set_default_mgmt_key) {
3690                         err = -EOPNOTSUPP;
3691                         goto out;
3692                 }
3693
3694                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3695                 if (err)
3696                         goto out;
3697
3698                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3699                 if (err)
3700                         goto out;
3701
3702 #ifdef CONFIG_CFG80211_WEXT
3703                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3704 #endif
3705         } else if (key.p.mode == NL80211_KEY_SET_TX &&
3706                    wiphy_ext_feature_isset(&rdev->wiphy,
3707                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
3708                 u8 *mac_addr = NULL;
3709
3710                 if (info->attrs[NL80211_ATTR_MAC])
3711                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3712
3713                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
3714                         err = -EINVAL;
3715                         goto out;
3716                 }
3717
3718                 err = rdev_add_key(rdev, dev, key.idx,
3719                                    NL80211_KEYTYPE_PAIRWISE,
3720                                    mac_addr, &key.p);
3721         } else {
3722                 err = -EINVAL;
3723         }
3724  out:
3725         wdev_unlock(dev->ieee80211_ptr);
3726
3727         return err;
3728 }
3729
3730 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3731 {
3732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3733         int err;
3734         struct net_device *dev = info->user_ptr[1];
3735         struct key_parse key;
3736         const u8 *mac_addr = NULL;
3737
3738         err = nl80211_parse_key(info, &key);
3739         if (err)
3740                 return err;
3741
3742         if (!key.p.key)
3743                 return -EINVAL;
3744
3745         if (info->attrs[NL80211_ATTR_MAC])
3746                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3747
3748         if (key.type == -1) {
3749                 if (mac_addr)
3750                         key.type = NL80211_KEYTYPE_PAIRWISE;
3751                 else
3752                         key.type = NL80211_KEYTYPE_GROUP;
3753         }
3754
3755         /* for now */
3756         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3757             key.type != NL80211_KEYTYPE_GROUP)
3758                 return -EINVAL;
3759
3760         if (!rdev->ops->add_key)
3761                 return -EOPNOTSUPP;
3762
3763         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3764                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3765                                            mac_addr))
3766                 return -EINVAL;
3767
3768         wdev_lock(dev->ieee80211_ptr);
3769         err = nl80211_key_allowed(dev->ieee80211_ptr);
3770         if (!err)
3771                 err = rdev_add_key(rdev, dev, key.idx,
3772                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3773                                     mac_addr, &key.p);
3774         wdev_unlock(dev->ieee80211_ptr);
3775
3776         return err;
3777 }
3778
3779 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3780 {
3781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3782         int err;
3783         struct net_device *dev = info->user_ptr[1];
3784         u8 *mac_addr = NULL;
3785         struct key_parse key;
3786
3787         err = nl80211_parse_key(info, &key);
3788         if (err)
3789                 return err;
3790
3791         if (info->attrs[NL80211_ATTR_MAC])
3792                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3793
3794         if (key.type == -1) {
3795                 if (mac_addr)
3796                         key.type = NL80211_KEYTYPE_PAIRWISE;
3797                 else
3798                         key.type = NL80211_KEYTYPE_GROUP;
3799         }
3800
3801         /* for now */
3802         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3803             key.type != NL80211_KEYTYPE_GROUP)
3804                 return -EINVAL;
3805
3806         if (!rdev->ops->del_key)
3807                 return -EOPNOTSUPP;
3808
3809         wdev_lock(dev->ieee80211_ptr);
3810         err = nl80211_key_allowed(dev->ieee80211_ptr);
3811
3812         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3813             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3814                 err = -ENOENT;
3815
3816         if (!err)
3817                 err = rdev_del_key(rdev, dev, key.idx,
3818                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3819                                    mac_addr);
3820
3821 #ifdef CONFIG_CFG80211_WEXT
3822         if (!err) {
3823                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3824                         dev->ieee80211_ptr->wext.default_key = -1;
3825                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3826                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3827         }
3828 #endif
3829         wdev_unlock(dev->ieee80211_ptr);
3830
3831         return err;
3832 }
3833
3834 /* This function returns an error or the number of nested attributes */
3835 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3836 {
3837         struct nlattr *attr;
3838         int n_entries = 0, tmp;
3839
3840         nla_for_each_nested(attr, nl_attr, tmp) {
3841                 if (nla_len(attr) != ETH_ALEN)
3842                         return -EINVAL;
3843
3844                 n_entries++;
3845         }
3846
3847         return n_entries;
3848 }
3849
3850 /*
3851  * This function parses ACL information and allocates memory for ACL data.
3852  * On successful return, the calling function is responsible to free the
3853  * ACL buffer returned by this function.
3854  */
3855 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3856                                                 struct genl_info *info)
3857 {
3858         enum nl80211_acl_policy acl_policy;
3859         struct nlattr *attr;
3860         struct cfg80211_acl_data *acl;
3861         int i = 0, n_entries, tmp;
3862
3863         if (!wiphy->max_acl_mac_addrs)
3864                 return ERR_PTR(-EOPNOTSUPP);
3865
3866         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3867                 return ERR_PTR(-EINVAL);
3868
3869         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3870         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3871             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3872                 return ERR_PTR(-EINVAL);
3873
3874         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3875                 return ERR_PTR(-EINVAL);
3876
3877         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3878         if (n_entries < 0)
3879                 return ERR_PTR(n_entries);
3880
3881         if (n_entries > wiphy->max_acl_mac_addrs)
3882                 return ERR_PTR(-ENOTSUPP);
3883
3884         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
3885         if (!acl)
3886                 return ERR_PTR(-ENOMEM);
3887
3888         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3889                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3890                 i++;
3891         }
3892
3893         acl->n_acl_entries = n_entries;
3894         acl->acl_policy = acl_policy;
3895
3896         return acl;
3897 }
3898
3899 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3900 {
3901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3902         struct net_device *dev = info->user_ptr[1];
3903         struct cfg80211_acl_data *acl;
3904         int err;
3905
3906         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3907             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3908                 return -EOPNOTSUPP;
3909
3910         if (!dev->ieee80211_ptr->beacon_interval)
3911                 return -EINVAL;
3912
3913         acl = parse_acl_data(&rdev->wiphy, info);
3914         if (IS_ERR(acl))
3915                 return PTR_ERR(acl);
3916
3917         err = rdev_set_mac_acl(rdev, dev, acl);
3918
3919         kfree(acl);
3920
3921         return err;
3922 }
3923
3924 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3925                            u8 *rates, u8 rates_len)
3926 {
3927         u8 i;
3928         u32 mask = 0;
3929
3930         for (i = 0; i < rates_len; i++) {
3931                 int rate = (rates[i] & 0x7f) * 5;
3932                 int ridx;
3933
3934                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3935                         struct ieee80211_rate *srate =
3936                                 &sband->bitrates[ridx];
3937                         if (rate == srate->bitrate) {
3938                                 mask |= 1 << ridx;
3939                                 break;
3940                         }
3941                 }
3942                 if (ridx == sband->n_bitrates)
3943                         return 0; /* rate not found */
3944         }
3945
3946         return mask;
3947 }
3948
3949 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3950                                u8 *rates, u8 rates_len,
3951                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3952 {
3953         u8 i;
3954
3955         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3956
3957         for (i = 0; i < rates_len; i++) {
3958                 int ridx, rbit;
3959
3960                 ridx = rates[i] / 8;
3961                 rbit = BIT(rates[i] % 8);
3962
3963                 /* check validity */
3964                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3965                         return false;
3966
3967                 /* check availability */
3968                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3969                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3970                         mcs[ridx] |= rbit;
3971                 else
3972                         return false;
3973         }
3974
3975         return true;
3976 }
3977
3978 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3979 {
3980         u16 mcs_mask = 0;
3981
3982         switch (vht_mcs_map) {
3983         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3984                 break;
3985         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3986                 mcs_mask = 0x00FF;
3987                 break;
3988         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3989                 mcs_mask = 0x01FF;
3990                 break;
3991         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3992                 mcs_mask = 0x03FF;
3993                 break;
3994         default:
3995                 break;
3996         }
3997
3998         return mcs_mask;
3999 }
4000
4001 static void vht_build_mcs_mask(u16 vht_mcs_map,
4002                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4003 {
4004         u8 nss;
4005
4006         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4007                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4008                 vht_mcs_map >>= 2;
4009         }
4010 }
4011
4012 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4013                              struct nl80211_txrate_vht *txrate,
4014                              u16 mcs[NL80211_VHT_NSS_MAX])
4015 {
4016         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4017         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4018         u8 i;
4019
4020         if (!sband->vht_cap.vht_supported)
4021                 return false;
4022
4023         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4024
4025         /* Build vht_mcs_mask from VHT capabilities */
4026         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4027
4028         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4029                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4030                         mcs[i] = txrate->mcs[i];
4031                 else
4032                         return false;
4033         }
4034
4035         return true;
4036 }
4037
4038 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
4039         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
4040                                     .len = NL80211_MAX_SUPP_RATES },
4041         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
4042                                 .len = NL80211_MAX_SUPP_HT_RATES },
4043         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
4044         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
4045 };
4046
4047 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4048                                          struct cfg80211_bitrate_mask *mask)
4049 {
4050         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4051         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4052         int rem, i;
4053         struct nlattr *tx_rates;
4054         struct ieee80211_supported_band *sband;
4055         u16 vht_tx_mcs_map;
4056
4057         memset(mask, 0, sizeof(*mask));
4058         /* Default to all rates enabled */
4059         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4060                 sband = rdev->wiphy.bands[i];
4061
4062                 if (!sband)
4063                         continue;
4064
4065                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4066                 memcpy(mask->control[i].ht_mcs,
4067                        sband->ht_cap.mcs.rx_mask,
4068                        sizeof(mask->control[i].ht_mcs));
4069
4070                 if (!sband->vht_cap.vht_supported)
4071                         continue;
4072
4073                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4074                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4075         }
4076
4077         /* if no rates are given set it back to the defaults */
4078         if (!info->attrs[NL80211_ATTR_TX_RATES])
4079                 goto out;
4080
4081         /* The nested attribute uses enum nl80211_band as the index. This maps
4082          * directly to the enum nl80211_band values used in cfg80211.
4083          */
4084         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4085         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
4086                 enum nl80211_band band = nla_type(tx_rates);
4087                 int err;
4088
4089                 if (band < 0 || band >= NUM_NL80211_BANDS)
4090                         return -EINVAL;
4091                 sband = rdev->wiphy.bands[band];
4092                 if (sband == NULL)
4093                         return -EINVAL;
4094                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
4095                                        nl80211_txattr_policy, info->extack);
4096                 if (err)
4097                         return err;
4098                 if (tb[NL80211_TXRATE_LEGACY]) {
4099                         mask->control[band].legacy = rateset_to_mask(
4100                                 sband,
4101                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4102                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4103                         if ((mask->control[band].legacy == 0) &&
4104                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4105                                 return -EINVAL;
4106                 }
4107                 if (tb[NL80211_TXRATE_HT]) {
4108                         if (!ht_rateset_to_mask(
4109                                         sband,
4110                                         nla_data(tb[NL80211_TXRATE_HT]),
4111                                         nla_len(tb[NL80211_TXRATE_HT]),
4112                                         mask->control[band].ht_mcs))
4113                                 return -EINVAL;
4114                 }
4115                 if (tb[NL80211_TXRATE_VHT]) {
4116                         if (!vht_set_mcs_mask(
4117                                         sband,
4118                                         nla_data(tb[NL80211_TXRATE_VHT]),
4119                                         mask->control[band].vht_mcs))
4120                                 return -EINVAL;
4121                 }
4122                 if (tb[NL80211_TXRATE_GI]) {
4123                         mask->control[band].gi =
4124                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4125                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4126                                 return -EINVAL;
4127                 }
4128
4129                 if (mask->control[band].legacy == 0) {
4130                         /* don't allow empty legacy rates if HT or VHT
4131                          * are not even supported.
4132                          */
4133                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4134                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
4135                                 return -EINVAL;
4136
4137                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4138                                 if (mask->control[band].ht_mcs[i])
4139                                         goto out;
4140
4141                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4142                                 if (mask->control[band].vht_mcs[i])
4143                                         goto out;
4144
4145                         /* legacy and mcs rates may not be both empty */
4146                         return -EINVAL;
4147                 }
4148         }
4149
4150 out:
4151         return 0;
4152 }
4153
4154 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4155                                    enum nl80211_band band,
4156                                    struct cfg80211_bitrate_mask *beacon_rate)
4157 {
4158         u32 count_ht, count_vht, i;
4159         u32 rate = beacon_rate->control[band].legacy;
4160
4161         /* Allow only one rate */
4162         if (hweight32(rate) > 1)
4163                 return -EINVAL;
4164
4165         count_ht = 0;
4166         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4167                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4168                         return -EINVAL;
4169                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4170                         count_ht++;
4171                         if (count_ht > 1)
4172                                 return -EINVAL;
4173                 }
4174                 if (count_ht && rate)
4175                         return -EINVAL;
4176         }
4177
4178         count_vht = 0;
4179         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4180                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4181                         return -EINVAL;
4182                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4183                         count_vht++;
4184                         if (count_vht > 1)
4185                                 return -EINVAL;
4186                 }
4187                 if (count_vht && rate)
4188                         return -EINVAL;
4189         }
4190
4191         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4192                 return -EINVAL;
4193
4194         if (rate &&
4195             !wiphy_ext_feature_isset(&rdev->wiphy,
4196                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4197                 return -EINVAL;
4198         if (count_ht &&
4199             !wiphy_ext_feature_isset(&rdev->wiphy,
4200                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4201                 return -EINVAL;
4202         if (count_vht &&
4203             !wiphy_ext_feature_isset(&rdev->wiphy,
4204                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4205                 return -EINVAL;
4206
4207         return 0;
4208 }
4209
4210 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4211                                 struct nlattr *attrs[],
4212                                 struct cfg80211_beacon_data *bcn)
4213 {
4214         bool haveinfo = false;
4215         int err;
4216
4217         memset(bcn, 0, sizeof(*bcn));
4218
4219         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4220                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4221                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4222                 if (!bcn->head_len)
4223                         return -EINVAL;
4224                 haveinfo = true;
4225         }
4226
4227         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4228                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4229                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4230                 haveinfo = true;
4231         }
4232
4233         if (!haveinfo)
4234                 return -EINVAL;
4235
4236         if (attrs[NL80211_ATTR_IE]) {
4237                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4238                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4239         }
4240
4241         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4242                 bcn->proberesp_ies =
4243                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4244                 bcn->proberesp_ies_len =
4245                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4246         }
4247
4248         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4249                 bcn->assocresp_ies =
4250                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4251                 bcn->assocresp_ies_len =
4252                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4253         }
4254
4255         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4256                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4257                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4258         }
4259
4260         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4261                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4262
4263                 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX,
4264                                        attrs[NL80211_ATTR_FTM_RESPONDER],
4265                                        NULL, NULL);
4266                 if (err)
4267                         return err;
4268
4269                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4270                     wiphy_ext_feature_isset(&rdev->wiphy,
4271                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4272                         bcn->ftm_responder = 1;
4273                 else
4274                         return -EOPNOTSUPP;
4275
4276                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4277                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4278                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4279                 }
4280
4281                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4282                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4283                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4284                 }
4285         } else {
4286                 bcn->ftm_responder = -1;
4287         }
4288
4289         return 0;
4290 }
4291
4292 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4293                                             const u8 *rates)
4294 {
4295         int i;
4296
4297         if (!rates)
4298                 return;
4299
4300         for (i = 0; i < rates[1]; i++) {
4301                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4302                         params->ht_required = true;
4303                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4304                         params->vht_required = true;
4305         }
4306 }
4307
4308 /*
4309  * Since the nl80211 API didn't include, from the beginning, attributes about
4310  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4311  * benefit of drivers that rebuild IEs in the firmware.
4312  */
4313 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4314 {
4315         const struct cfg80211_beacon_data *bcn = &params->beacon;
4316         size_t ies_len = bcn->tail_len;
4317         const u8 *ies = bcn->tail;
4318         const u8 *rates;
4319         const u8 *cap;
4320
4321         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4322         nl80211_check_ap_rate_selectors(params, rates);
4323
4324         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4325         nl80211_check_ap_rate_selectors(params, rates);
4326
4327         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4328         if (cap && cap[1] >= sizeof(*params->ht_cap))
4329                 params->ht_cap = (void *)(cap + 2);
4330         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4331         if (cap && cap[1] >= sizeof(*params->vht_cap))
4332                 params->vht_cap = (void *)(cap + 2);
4333         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4334         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4335                 params->he_cap = (void *)(cap + 3);
4336 }
4337
4338 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4339                                    struct cfg80211_ap_settings *params)
4340 {
4341         struct wireless_dev *wdev;
4342         bool ret = false;
4343
4344         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4345                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4346                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4347                         continue;
4348
4349                 if (!wdev->preset_chandef.chan)
4350                         continue;
4351
4352                 params->chandef = wdev->preset_chandef;
4353                 ret = true;
4354                 break;
4355         }
4356
4357         return ret;
4358 }
4359
4360 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4361                                     enum nl80211_auth_type auth_type,
4362                                     enum nl80211_commands cmd)
4363 {
4364         if (auth_type > NL80211_AUTHTYPE_MAX)
4365                 return false;
4366
4367         switch (cmd) {
4368         case NL80211_CMD_AUTHENTICATE:
4369                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4370                     auth_type == NL80211_AUTHTYPE_SAE)
4371                         return false;
4372                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4373                                              NL80211_EXT_FEATURE_FILS_STA) &&
4374                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4375                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4376                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4377                         return false;
4378                 return true;
4379         case NL80211_CMD_CONNECT:
4380                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4381                     auth_type == NL80211_AUTHTYPE_SAE)
4382                         return false;
4383
4384                 /* FILS with SK PFS or PK not supported yet */
4385                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4386                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4387                         return false;
4388                 if (!wiphy_ext_feature_isset(
4389                             &rdev->wiphy,
4390                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4391                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4392                         return false;
4393                 return true;
4394         case NL80211_CMD_START_AP:
4395                 /* SAE not supported yet */
4396                 if (auth_type == NL80211_AUTHTYPE_SAE)
4397                         return false;
4398                 /* FILS not supported yet */
4399                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4400                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4401                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4402                         return false;
4403                 return true;
4404         default:
4405                 return false;
4406         }
4407 }
4408
4409 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4410 {
4411         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4412         struct net_device *dev = info->user_ptr[1];
4413         struct wireless_dev *wdev = dev->ieee80211_ptr;
4414         struct cfg80211_ap_settings params;
4415         int err;
4416
4417         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4418             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4419                 return -EOPNOTSUPP;
4420
4421         if (!rdev->ops->start_ap)
4422                 return -EOPNOTSUPP;
4423
4424         if (wdev->beacon_interval)
4425                 return -EALREADY;
4426
4427         memset(&params, 0, sizeof(params));
4428
4429         /* these are required for START_AP */
4430         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4431             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4432             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4433                 return -EINVAL;
4434
4435         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4436         if (err)
4437                 return err;
4438
4439         params.beacon_interval =
4440                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4441         params.dtim_period =
4442                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4443
4444         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4445                                            params.beacon_interval);
4446         if (err)
4447                 return err;
4448
4449         /*
4450          * In theory, some of these attributes should be required here
4451          * but since they were not used when the command was originally
4452          * added, keep them optional for old user space programs to let
4453          * them continue to work with drivers that do not need the
4454          * additional information -- drivers must check!
4455          */
4456         if (info->attrs[NL80211_ATTR_SSID]) {
4457                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4458                 params.ssid_len =
4459                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4460                 if (params.ssid_len == 0 ||
4461                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4462                         return -EINVAL;
4463         }
4464
4465         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4466                 params.hidden_ssid = nla_get_u32(
4467                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4468
4469         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4470
4471         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4472                 params.auth_type = nla_get_u32(
4473                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4474                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4475                                              NL80211_CMD_START_AP))
4476                         return -EINVAL;
4477         } else
4478                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4479
4480         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4481                                       NL80211_MAX_NR_CIPHER_SUITES);
4482         if (err)
4483                 return err;
4484
4485         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4486                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4487                         return -EOPNOTSUPP;
4488                 params.inactivity_timeout = nla_get_u16(
4489                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4490         }
4491
4492         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4493                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4494                         return -EINVAL;
4495                 params.p2p_ctwindow =
4496                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4497                 if (params.p2p_ctwindow != 0 &&
4498                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4499                         return -EINVAL;
4500         }
4501
4502         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4503                 u8 tmp;
4504
4505                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4506                         return -EINVAL;
4507                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4508                 params.p2p_opp_ps = tmp;
4509                 if (params.p2p_opp_ps != 0 &&
4510                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4511                         return -EINVAL;
4512         }
4513
4514         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4515                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4516                 if (err)
4517                         return err;
4518         } else if (wdev->preset_chandef.chan) {
4519                 params.chandef = wdev->preset_chandef;
4520         } else if (!nl80211_get_ap_channel(rdev, &params))
4521                 return -EINVAL;
4522
4523         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4524                                            wdev->iftype))
4525                 return -EINVAL;
4526
4527         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4528                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4529                 if (err)
4530                         return err;
4531
4532                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4533                                               &params.beacon_rate);
4534                 if (err)
4535                         return err;
4536         }
4537
4538         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4539                 params.smps_mode =
4540                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4541                 switch (params.smps_mode) {
4542                 case NL80211_SMPS_OFF:
4543                         break;
4544                 case NL80211_SMPS_STATIC:
4545                         if (!(rdev->wiphy.features &
4546                               NL80211_FEATURE_STATIC_SMPS))
4547                                 return -EINVAL;
4548                         break;
4549                 case NL80211_SMPS_DYNAMIC:
4550                         if (!(rdev->wiphy.features &
4551                               NL80211_FEATURE_DYNAMIC_SMPS))
4552                                 return -EINVAL;
4553                         break;
4554                 default:
4555                         return -EINVAL;
4556                 }
4557         } else {
4558                 params.smps_mode = NL80211_SMPS_OFF;
4559         }
4560
4561         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4562         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4563                 return -EOPNOTSUPP;
4564
4565         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4566                 params.acl = parse_acl_data(&rdev->wiphy, info);
4567                 if (IS_ERR(params.acl))
4568                         return PTR_ERR(params.acl);
4569         }
4570
4571         nl80211_calculate_ap_params(&params);
4572
4573         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
4574                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
4575
4576         wdev_lock(wdev);
4577         err = rdev_start_ap(rdev, dev, &params);
4578         if (!err) {
4579                 wdev->preset_chandef = params.chandef;
4580                 wdev->beacon_interval = params.beacon_interval;
4581                 wdev->chandef = params.chandef;
4582                 wdev->ssid_len = params.ssid_len;
4583                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4584
4585                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4586                         wdev->conn_owner_nlportid = info->snd_portid;
4587         }
4588         wdev_unlock(wdev);
4589
4590         kfree(params.acl);
4591
4592         return err;
4593 }
4594
4595 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4596 {
4597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4598         struct net_device *dev = info->user_ptr[1];
4599         struct wireless_dev *wdev = dev->ieee80211_ptr;
4600         struct cfg80211_beacon_data params;
4601         int err;
4602
4603         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4604             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4605                 return -EOPNOTSUPP;
4606
4607         if (!rdev->ops->change_beacon)
4608                 return -EOPNOTSUPP;
4609
4610         if (!wdev->beacon_interval)
4611                 return -EINVAL;
4612
4613         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4614         if (err)
4615                 return err;
4616
4617         wdev_lock(wdev);
4618         err = rdev_change_beacon(rdev, dev, &params);
4619         wdev_unlock(wdev);
4620
4621         return err;
4622 }
4623
4624 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4625 {
4626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4627         struct net_device *dev = info->user_ptr[1];
4628
4629         return cfg80211_stop_ap(rdev, dev, false);
4630 }
4631
4632 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4633         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4634         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4635         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4636         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4637         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4638         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4639 };
4640
4641 static int parse_station_flags(struct genl_info *info,
4642                                enum nl80211_iftype iftype,
4643                                struct station_parameters *params)
4644 {
4645         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4646         struct nlattr *nla;
4647         int flag;
4648
4649         /*
4650          * Try parsing the new attribute first so userspace
4651          * can specify both for older kernels.
4652          */
4653         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4654         if (nla) {
4655                 struct nl80211_sta_flag_update *sta_flags;
4656
4657                 sta_flags = nla_data(nla);
4658                 params->sta_flags_mask = sta_flags->mask;
4659                 params->sta_flags_set = sta_flags->set;
4660                 params->sta_flags_set &= params->sta_flags_mask;
4661                 if ((params->sta_flags_mask |
4662                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4663                         return -EINVAL;
4664                 return 0;
4665         }
4666
4667         /* if present, parse the old attribute */
4668
4669         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4670         if (!nla)
4671                 return 0;
4672
4673         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4674                              sta_flags_policy, info->extack))
4675                 return -EINVAL;
4676
4677         /*
4678          * Only allow certain flags for interface types so that
4679          * other attributes are silently ignored. Remember that
4680          * this is backward compatibility code with old userspace
4681          * and shouldn't be hit in other cases anyway.
4682          */
4683         switch (iftype) {
4684         case NL80211_IFTYPE_AP:
4685         case NL80211_IFTYPE_AP_VLAN:
4686         case NL80211_IFTYPE_P2P_GO:
4687                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4688                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4689                                          BIT(NL80211_STA_FLAG_WME) |
4690                                          BIT(NL80211_STA_FLAG_MFP);
4691                 break;
4692         case NL80211_IFTYPE_P2P_CLIENT:
4693         case NL80211_IFTYPE_STATION:
4694                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4695                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4696                 break;
4697         case NL80211_IFTYPE_MESH_POINT:
4698                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4699                                          BIT(NL80211_STA_FLAG_MFP) |
4700                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4701                 break;
4702         default:
4703                 return -EINVAL;
4704         }
4705
4706         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4707                 if (flags[flag]) {
4708                         params->sta_flags_set |= (1<<flag);
4709
4710                         /* no longer support new API additions in old API */
4711                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4712                                 return -EINVAL;
4713                 }
4714         }
4715
4716         return 0;
4717 }
4718
4719 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
4720 {
4721         struct nlattr *rate;
4722         u32 bitrate;
4723         u16 bitrate_compat;
4724         enum nl80211_rate_info rate_flg;
4725
4726         rate = nla_nest_start(msg, attr);
4727         if (!rate)
4728                 return false;
4729
4730         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4731         bitrate = cfg80211_calculate_bitrate(info);
4732         /* report 16-bit bitrate only if we can */
4733         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4734         if (bitrate > 0 &&
4735             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4736                 return false;
4737         if (bitrate_compat > 0 &&
4738             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4739                 return false;
4740
4741         switch (info->bw) {
4742         case RATE_INFO_BW_5:
4743                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4744                 break;
4745         case RATE_INFO_BW_10:
4746                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4747                 break;
4748         default:
4749                 WARN_ON(1);
4750                 /* fall through */
4751         case RATE_INFO_BW_20:
4752                 rate_flg = 0;
4753                 break;
4754         case RATE_INFO_BW_40:
4755                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4756                 break;
4757         case RATE_INFO_BW_80:
4758                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4759                 break;
4760         case RATE_INFO_BW_160:
4761                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4762                 break;
4763         case RATE_INFO_BW_HE_RU:
4764                 rate_flg = 0;
4765                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4766         }
4767
4768         if (rate_flg && nla_put_flag(msg, rate_flg))
4769                 return false;
4770
4771         if (info->flags & RATE_INFO_FLAGS_MCS) {
4772                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4773                         return false;
4774                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4775                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4776                         return false;
4777         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4778                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4779                         return false;
4780                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4781                         return false;
4782                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4783                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4784                         return false;
4785         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4786                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4787                         return false;
4788                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4789                         return false;
4790                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4791                         return false;
4792                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4793                         return false;
4794                 if (info->bw == RATE_INFO_BW_HE_RU &&
4795                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4796                                info->he_ru_alloc))
4797                         return false;
4798         }
4799
4800         nla_nest_end(msg, rate);
4801         return true;
4802 }
4803
4804 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4805                                int id)
4806 {
4807         void *attr;
4808         int i = 0;
4809
4810         if (!mask)
4811                 return true;
4812
4813         attr = nla_nest_start(msg, id);
4814         if (!attr)
4815                 return false;
4816
4817         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4818                 if (!(mask & BIT(i)))
4819                         continue;
4820
4821                 if (nla_put_u8(msg, i, signal[i]))
4822                         return false;
4823         }
4824
4825         nla_nest_end(msg, attr);
4826
4827         return true;
4828 }
4829
4830 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4831                                 u32 seq, int flags,
4832                                 struct cfg80211_registered_device *rdev,
4833                                 struct net_device *dev,
4834                                 const u8 *mac_addr, struct station_info *sinfo)
4835 {
4836         void *hdr;
4837         struct nlattr *sinfoattr, *bss_param;
4838
4839         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4840         if (!hdr)
4841                 return -1;
4842
4843         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4844             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4845             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4846                 goto nla_put_failure;
4847
4848         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4849         if (!sinfoattr)
4850                 goto nla_put_failure;
4851
4852 #define PUT_SINFO(attr, memb, type) do {                                \
4853         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4854         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4855             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4856                              sinfo->memb))                              \
4857                 goto nla_put_failure;                                   \
4858         } while (0)
4859 #define PUT_SINFO_U64(attr, memb) do {                                  \
4860         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4861             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4862                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4863                 goto nla_put_failure;                                   \
4864         } while (0)
4865
4866         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4867         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4868
4869         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4870                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4871             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4872                         (u32)sinfo->rx_bytes))
4873                 goto nla_put_failure;
4874
4875         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4876                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4877             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4878                         (u32)sinfo->tx_bytes))
4879                 goto nla_put_failure;
4880
4881         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4882         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4883         PUT_SINFO(LLID, llid, u16);
4884         PUT_SINFO(PLID, plid, u16);
4885         PUT_SINFO(PLINK_STATE, plink_state, u8);
4886         PUT_SINFO_U64(RX_DURATION, rx_duration);
4887         PUT_SINFO_U64(TX_DURATION, tx_duration);
4888
4889         if (wiphy_ext_feature_isset(&rdev->wiphy,
4890                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
4891                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
4892
4893         switch (rdev->wiphy.signal_type) {
4894         case CFG80211_SIGNAL_TYPE_MBM:
4895                 PUT_SINFO(SIGNAL, signal, u8);
4896                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4897                 break;
4898         default:
4899                 break;
4900         }
4901         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4902                 if (!nl80211_put_signal(msg, sinfo->chains,
4903                                         sinfo->chain_signal,
4904                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4905                         goto nla_put_failure;
4906         }
4907         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4908                 if (!nl80211_put_signal(msg, sinfo->chains,
4909                                         sinfo->chain_signal_avg,
4910                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4911                         goto nla_put_failure;
4912         }
4913         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4914                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4915                                           NL80211_STA_INFO_TX_BITRATE))
4916                         goto nla_put_failure;
4917         }
4918         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4919                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4920                                           NL80211_STA_INFO_RX_BITRATE))
4921                         goto nla_put_failure;
4922         }
4923
4924         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4925         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4926         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4927         PUT_SINFO(TX_FAILED, tx_failed, u32);
4928         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4929         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
4930         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4931         PUT_SINFO(LOCAL_PM, local_pm, u32);
4932         PUT_SINFO(PEER_PM, peer_pm, u32);
4933         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4934         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
4935
4936         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4937                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4938                 if (!bss_param)
4939                         goto nla_put_failure;
4940
4941                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4942                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4943                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4944                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4945                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4946                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4947                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4948                                sinfo->bss_param.dtim_period) ||
4949                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4950                                 sinfo->bss_param.beacon_interval))
4951                         goto nla_put_failure;
4952
4953                 nla_nest_end(msg, bss_param);
4954         }
4955         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4956             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4957                     sizeof(struct nl80211_sta_flag_update),
4958                     &sinfo->sta_flags))
4959                 goto nla_put_failure;
4960
4961         PUT_SINFO_U64(T_OFFSET, t_offset);
4962         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4963         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4964         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4965         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
4966         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
4967         if (wiphy_ext_feature_isset(&rdev->wiphy,
4968                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
4969                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4970                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
4971         }
4972
4973 #undef PUT_SINFO
4974 #undef PUT_SINFO_U64
4975
4976         if (sinfo->pertid) {
4977                 struct nlattr *tidsattr;
4978                 int tid;
4979
4980                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4981                 if (!tidsattr)
4982                         goto nla_put_failure;
4983
4984                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4985                         struct cfg80211_tid_stats *tidstats;
4986                         struct nlattr *tidattr;
4987
4988                         tidstats = &sinfo->pertid[tid];
4989
4990                         if (!tidstats->filled)
4991                                 continue;
4992
4993                         tidattr = nla_nest_start(msg, tid + 1);
4994                         if (!tidattr)
4995                                 goto nla_put_failure;
4996
4997 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4998         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4999             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5000                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5001                 goto nla_put_failure;                                   \
5002         } while (0)
5003
5004                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5005                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5006                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5007                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5008
5009 #undef PUT_TIDVAL_U64
5010                         if ((tidstats->filled &
5011                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5012                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5013                                                    NL80211_TID_STATS_TXQ_STATS))
5014                                 goto nla_put_failure;
5015
5016                         nla_nest_end(msg, tidattr);
5017                 }
5018
5019                 nla_nest_end(msg, tidsattr);
5020         }
5021
5022         nla_nest_end(msg, sinfoattr);
5023
5024         if (sinfo->assoc_req_ies_len &&
5025             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5026                     sinfo->assoc_req_ies))
5027                 goto nla_put_failure;
5028
5029         cfg80211_sinfo_release_content(sinfo);
5030         genlmsg_end(msg, hdr);
5031         return 0;
5032
5033  nla_put_failure:
5034         cfg80211_sinfo_release_content(sinfo);
5035         genlmsg_cancel(msg, hdr);
5036         return -EMSGSIZE;
5037 }
5038
5039 static int nl80211_dump_station(struct sk_buff *skb,
5040                                 struct netlink_callback *cb)
5041 {
5042         struct station_info sinfo;
5043         struct cfg80211_registered_device *rdev;
5044         struct wireless_dev *wdev;
5045         u8 mac_addr[ETH_ALEN];
5046         int sta_idx = cb->args[2];
5047         int err;
5048
5049         rtnl_lock();
5050         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5051         if (err)
5052                 goto out_err;
5053
5054         if (!wdev->netdev) {
5055                 err = -EINVAL;
5056                 goto out_err;
5057         }
5058
5059         if (!rdev->ops->dump_station) {
5060                 err = -EOPNOTSUPP;
5061                 goto out_err;
5062         }
5063
5064         while (1) {
5065                 memset(&sinfo, 0, sizeof(sinfo));
5066                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
5067                                         mac_addr, &sinfo);
5068                 if (err == -ENOENT)
5069                         break;
5070                 if (err)
5071                         goto out_err;
5072
5073                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
5074                                 NETLINK_CB(cb->skb).portid,
5075                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
5076                                 rdev, wdev->netdev, mac_addr,
5077                                 &sinfo) < 0)
5078                         goto out;
5079
5080                 sta_idx++;
5081         }
5082
5083  out:
5084         cb->args[2] = sta_idx;
5085         err = skb->len;
5086  out_err:
5087         rtnl_unlock();
5088
5089         return err;
5090 }
5091
5092 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
5093 {
5094         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5095         struct net_device *dev = info->user_ptr[1];
5096         struct station_info sinfo;
5097         struct sk_buff *msg;
5098         u8 *mac_addr = NULL;
5099         int err;
5100
5101         memset(&sinfo, 0, sizeof(sinfo));
5102
5103         if (!info->attrs[NL80211_ATTR_MAC])
5104                 return -EINVAL;
5105
5106         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5107
5108         if (!rdev->ops->get_station)
5109                 return -EOPNOTSUPP;
5110
5111         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
5112         if (err)
5113                 return err;
5114
5115         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5116         if (!msg) {
5117                 cfg80211_sinfo_release_content(&sinfo);
5118                 return -ENOMEM;
5119         }
5120
5121         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
5122                                  info->snd_portid, info->snd_seq, 0,
5123                                  rdev, dev, mac_addr, &sinfo) < 0) {
5124                 nlmsg_free(msg);
5125                 return -ENOBUFS;
5126         }
5127
5128         return genlmsg_reply(msg, info);
5129 }
5130
5131 int cfg80211_check_station_change(struct wiphy *wiphy,
5132                                   struct station_parameters *params,
5133                                   enum cfg80211_station_type statype)
5134 {
5135         if (params->listen_interval != -1 &&
5136             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5137                 return -EINVAL;
5138
5139         if (params->support_p2p_ps != -1 &&
5140             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5141                 return -EINVAL;
5142
5143         if (params->aid &&
5144             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
5145             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
5146                 return -EINVAL;
5147
5148         /* When you run into this, adjust the code below for the new flag */
5149         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5150
5151         switch (statype) {
5152         case CFG80211_STA_MESH_PEER_KERNEL:
5153         case CFG80211_STA_MESH_PEER_USER:
5154                 /*
5155                  * No ignoring the TDLS flag here -- the userspace mesh
5156                  * code doesn't have the bug of including TDLS in the
5157                  * mask everywhere.
5158                  */
5159                 if (params->sta_flags_mask &
5160                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5161                                   BIT(NL80211_STA_FLAG_MFP) |
5162                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
5163                         return -EINVAL;
5164                 break;
5165         case CFG80211_STA_TDLS_PEER_SETUP:
5166         case CFG80211_STA_TDLS_PEER_ACTIVE:
5167                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5168                         return -EINVAL;
5169                 /* ignore since it can't change */
5170                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5171                 break;
5172         default:
5173                 /* disallow mesh-specific things */
5174                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
5175                         return -EINVAL;
5176                 if (params->local_pm)
5177                         return -EINVAL;
5178                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5179                         return -EINVAL;
5180         }
5181
5182         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5183             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
5184                 /* TDLS can't be set, ... */
5185                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
5186                         return -EINVAL;
5187                 /*
5188                  * ... but don't bother the driver with it. This works around
5189                  * a hostapd/wpa_supplicant issue -- it always includes the
5190                  * TLDS_PEER flag in the mask even for AP mode.
5191                  */
5192                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5193         }
5194
5195         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5196             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5197                 /* reject other things that can't change */
5198                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5199                         return -EINVAL;
5200                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5201                         return -EINVAL;
5202                 if (params->supported_rates)
5203                         return -EINVAL;
5204                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5205                     params->he_capa)
5206                         return -EINVAL;
5207         }
5208
5209         if (statype != CFG80211_STA_AP_CLIENT &&
5210             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5211                 if (params->vlan)
5212                         return -EINVAL;
5213         }
5214
5215         switch (statype) {
5216         case CFG80211_STA_AP_MLME_CLIENT:
5217                 /* Use this only for authorizing/unauthorizing a station */
5218                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5219                         return -EOPNOTSUPP;
5220                 break;
5221         case CFG80211_STA_AP_CLIENT:
5222         case CFG80211_STA_AP_CLIENT_UNASSOC:
5223                 /* accept only the listed bits */
5224                 if (params->sta_flags_mask &
5225                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5226                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5227                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5228                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5229                                   BIT(NL80211_STA_FLAG_WME) |
5230                                   BIT(NL80211_STA_FLAG_MFP)))
5231                         return -EINVAL;
5232
5233                 /* but authenticated/associated only if driver handles it */
5234                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5235                     params->sta_flags_mask &
5236                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5237                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5238                         return -EINVAL;
5239                 break;
5240         case CFG80211_STA_IBSS:
5241         case CFG80211_STA_AP_STA:
5242                 /* reject any changes other than AUTHORIZED */
5243                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5244                         return -EINVAL;
5245                 break;
5246         case CFG80211_STA_TDLS_PEER_SETUP:
5247                 /* reject any changes other than AUTHORIZED or WME */
5248                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5249                                                BIT(NL80211_STA_FLAG_WME)))
5250                         return -EINVAL;
5251                 /* force (at least) rates when authorizing */
5252                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5253                     !params->supported_rates)
5254                         return -EINVAL;
5255                 break;
5256         case CFG80211_STA_TDLS_PEER_ACTIVE:
5257                 /* reject any changes */
5258                 return -EINVAL;
5259         case CFG80211_STA_MESH_PEER_KERNEL:
5260                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5261                         return -EINVAL;
5262                 break;
5263         case CFG80211_STA_MESH_PEER_USER:
5264                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5265                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5266                         return -EINVAL;
5267                 break;
5268         }
5269
5270         /*
5271          * Older kernel versions ignored this attribute entirely, so don't
5272          * reject attempts to update it but mark it as unused instead so the
5273          * driver won't look at the data.
5274          */
5275         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5276             statype != CFG80211_STA_TDLS_PEER_SETUP)
5277                 params->opmode_notif_used = false;
5278
5279         return 0;
5280 }
5281 EXPORT_SYMBOL(cfg80211_check_station_change);
5282
5283 /*
5284  * Get vlan interface making sure it is running and on the right wiphy.
5285  */
5286 static struct net_device *get_vlan(struct genl_info *info,
5287                                    struct cfg80211_registered_device *rdev)
5288 {
5289         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5290         struct net_device *v;
5291         int ret;
5292
5293         if (!vlanattr)
5294                 return NULL;
5295
5296         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5297         if (!v)
5298                 return ERR_PTR(-ENODEV);
5299
5300         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5301                 ret = -EINVAL;
5302                 goto error;
5303         }
5304
5305         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5306             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5307             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5308                 ret = -EINVAL;
5309                 goto error;
5310         }
5311
5312         if (!netif_running(v)) {
5313                 ret = -ENETDOWN;
5314                 goto error;
5315         }
5316
5317         return v;
5318  error:
5319         dev_put(v);
5320         return ERR_PTR(ret);
5321 }
5322
5323 static const struct nla_policy
5324 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5325         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5326         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5327 };
5328
5329 static int nl80211_parse_sta_wme(struct genl_info *info,
5330                                  struct station_parameters *params)
5331 {
5332         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5333         struct nlattr *nla;
5334         int err;
5335
5336         /* parse WME attributes if present */
5337         if (!info->attrs[NL80211_ATTR_STA_WME])
5338                 return 0;
5339
5340         nla = info->attrs[NL80211_ATTR_STA_WME];
5341         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5342                                nl80211_sta_wme_policy, info->extack);
5343         if (err)
5344                 return err;
5345
5346         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5347                 params->uapsd_queues = nla_get_u8(
5348                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5349         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5350                 return -EINVAL;
5351
5352         if (tb[NL80211_STA_WME_MAX_SP])
5353                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5354
5355         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5356                 return -EINVAL;
5357
5358         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5359
5360         return 0;
5361 }
5362
5363 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5364                                       struct station_parameters *params)
5365 {
5366         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5367                 params->supported_channels =
5368                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5369                 params->supported_channels_len =
5370                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5371                 /*
5372                  * Need to include at least one (first channel, number of
5373                  * channels) tuple for each subband, and must have proper
5374                  * tuples for the rest of the data as well.
5375                  */
5376                 if (params->supported_channels_len < 2)
5377                         return -EINVAL;
5378                 if (params->supported_channels_len % 2)
5379                         return -EINVAL;
5380         }
5381
5382         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5383                 params->supported_oper_classes =
5384                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5385                 params->supported_oper_classes_len =
5386                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5387                 /*
5388                  * The value of the Length field of the Supported Operating
5389                  * Classes element is between 2 and 253.
5390                  */
5391                 if (params->supported_oper_classes_len < 2 ||
5392                     params->supported_oper_classes_len > 253)
5393                         return -EINVAL;
5394         }
5395         return 0;
5396 }
5397
5398 static int nl80211_set_station_tdls(struct genl_info *info,
5399                                     struct station_parameters *params)
5400 {
5401         int err;
5402         /* Dummy STA entry gets updated once the peer capabilities are known */
5403         if (info->attrs[NL80211_ATTR_PEER_AID])
5404                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5405         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5406                 params->ht_capa =
5407                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5408         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5409                 params->vht_capa =
5410                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5411         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5412                 params->he_capa =
5413                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5414                 params->he_capa_len =
5415                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5416
5417                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5418                         return -EINVAL;
5419         }
5420
5421         err = nl80211_parse_sta_channel_info(info, params);
5422         if (err)
5423                 return err;
5424
5425         return nl80211_parse_sta_wme(info, params);
5426 }
5427
5428 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
5429                                              struct station_parameters *params)
5430 {
5431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5432         int idx;
5433
5434         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
5435                 if (!rdev->ops->set_tx_power ||
5436                     !wiphy_ext_feature_isset(&rdev->wiphy,
5437                                          NL80211_EXT_FEATURE_STA_TX_PWR))
5438                         return -EOPNOTSUPP;
5439
5440                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
5441                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
5442
5443                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
5444                         idx = NL80211_ATTR_STA_TX_POWER;
5445
5446                         if (info->attrs[idx])
5447                                 params->txpwr.power =
5448                                         nla_get_s16(info->attrs[idx]);
5449                         else
5450                                 return -EINVAL;
5451                 }
5452                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
5453         }
5454
5455         return 0;
5456 }
5457
5458 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5459 {
5460         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5461         struct net_device *dev = info->user_ptr[1];
5462         struct station_parameters params;
5463         u8 *mac_addr;
5464         int err;
5465
5466         memset(&params, 0, sizeof(params));
5467
5468         if (!rdev->ops->change_station)
5469                 return -EOPNOTSUPP;
5470
5471         /*
5472          * AID and listen_interval properties can be set only for unassociated
5473          * station. Include these parameters here and will check them in
5474          * cfg80211_check_station_change().
5475          */
5476         if (info->attrs[NL80211_ATTR_STA_AID])
5477                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5478
5479         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5480                 params.listen_interval =
5481                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5482         else
5483                 params.listen_interval = -1;
5484
5485         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5486                 params.support_p2p_ps =
5487                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5488         else
5489                 params.support_p2p_ps = -1;
5490
5491         if (!info->attrs[NL80211_ATTR_MAC])
5492                 return -EINVAL;
5493
5494         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5495
5496         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5497                 params.supported_rates =
5498                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5499                 params.supported_rates_len =
5500                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5501         }
5502
5503         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5504                 params.capability =
5505                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5506                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5507         }
5508
5509         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5510                 params.ext_capab =
5511                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5512                 params.ext_capab_len =
5513                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5514         }
5515
5516         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5517                 return -EINVAL;
5518
5519         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5520                 params.plink_action =
5521                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5522
5523         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5524                 params.plink_state =
5525                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5526                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5527                         params.peer_aid = nla_get_u16(
5528                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5529                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5530         }
5531
5532         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5533                 params.local_pm = nla_get_u32(
5534                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5535
5536         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5537                 params.opmode_notif_used = true;
5538                 params.opmode_notif =
5539                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5540         }
5541
5542         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5543                 params.airtime_weight =
5544                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5545
5546         if (params.airtime_weight &&
5547             !wiphy_ext_feature_isset(&rdev->wiphy,
5548                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5549                 return -EOPNOTSUPP;
5550
5551         err = nl80211_parse_sta_txpower_setting(info, &params);
5552         if (err)
5553                 return err;
5554
5555         /* Include parameters for TDLS peer (will check later) */
5556         err = nl80211_set_station_tdls(info, &params);
5557         if (err)
5558                 return err;
5559
5560         params.vlan = get_vlan(info, rdev);
5561         if (IS_ERR(params.vlan))
5562                 return PTR_ERR(params.vlan);
5563
5564         switch (dev->ieee80211_ptr->iftype) {
5565         case NL80211_IFTYPE_AP:
5566         case NL80211_IFTYPE_AP_VLAN:
5567         case NL80211_IFTYPE_P2P_GO:
5568         case NL80211_IFTYPE_P2P_CLIENT:
5569         case NL80211_IFTYPE_STATION:
5570         case NL80211_IFTYPE_ADHOC:
5571         case NL80211_IFTYPE_MESH_POINT:
5572                 break;
5573         default:
5574                 err = -EOPNOTSUPP;
5575                 goto out_put_vlan;
5576         }
5577
5578         /* driver will call cfg80211_check_station_change() */
5579         err = rdev_change_station(rdev, dev, mac_addr, &params);
5580
5581  out_put_vlan:
5582         if (params.vlan)
5583                 dev_put(params.vlan);
5584
5585         return err;
5586 }
5587
5588 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5589 {
5590         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5591         int err;
5592         struct net_device *dev = info->user_ptr[1];
5593         struct station_parameters params;
5594         u8 *mac_addr = NULL;
5595         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5596                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5597
5598         memset(&params, 0, sizeof(params));
5599
5600         if (!rdev->ops->add_station)
5601                 return -EOPNOTSUPP;
5602
5603         if (!info->attrs[NL80211_ATTR_MAC])
5604                 return -EINVAL;
5605
5606         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5607                 return -EINVAL;
5608
5609         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5610                 return -EINVAL;
5611
5612         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5613             !info->attrs[NL80211_ATTR_PEER_AID])
5614                 return -EINVAL;
5615
5616         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5617         params.supported_rates =
5618                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5619         params.supported_rates_len =
5620                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5621         params.listen_interval =
5622                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5623
5624         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5625                 params.support_p2p_ps =
5626                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5627         } else {
5628                 /*
5629                  * if not specified, assume it's supported for P2P GO interface,
5630                  * and is NOT supported for AP interface
5631                  */
5632                 params.support_p2p_ps =
5633                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5634         }
5635
5636         if (info->attrs[NL80211_ATTR_PEER_AID])
5637                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5638         else
5639                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5640
5641         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5642                 params.capability =
5643                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5644                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5645         }
5646
5647         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5648                 params.ext_capab =
5649                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5650                 params.ext_capab_len =
5651                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5652         }
5653
5654         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5655                 params.ht_capa =
5656                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5657
5658         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5659                 params.vht_capa =
5660                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5661
5662         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5663                 params.he_capa =
5664                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5665                 params.he_capa_len =
5666                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5667
5668                 /* max len is validated in nla policy */
5669                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5670                         return -EINVAL;
5671         }
5672
5673         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5674                 params.opmode_notif_used = true;
5675                 params.opmode_notif =
5676                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5677         }
5678
5679         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5680                 params.plink_action =
5681                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5682
5683         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
5684                 params.airtime_weight =
5685                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
5686
5687         if (params.airtime_weight &&
5688             !wiphy_ext_feature_isset(&rdev->wiphy,
5689                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5690                 return -EOPNOTSUPP;
5691
5692         err = nl80211_parse_sta_txpower_setting(info, &params);
5693         if (err)
5694                 return err;
5695
5696         err = nl80211_parse_sta_channel_info(info, &params);
5697         if (err)
5698                 return err;
5699
5700         err = nl80211_parse_sta_wme(info, &params);
5701         if (err)
5702                 return err;
5703
5704         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5705                 return -EINVAL;
5706
5707         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5708          * as userspace might just pass through the capabilities from the IEs
5709          * directly, rather than enforcing this restriction and returning an
5710          * error in this case.
5711          */
5712         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5713                 params.ht_capa = NULL;
5714                 params.vht_capa = NULL;
5715
5716                 /* HE requires WME */
5717                 if (params.he_capa_len)
5718                         return -EINVAL;
5719         }
5720
5721         /* When you run into this, adjust the code below for the new flag */
5722         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5723
5724         switch (dev->ieee80211_ptr->iftype) {
5725         case NL80211_IFTYPE_AP:
5726         case NL80211_IFTYPE_AP_VLAN:
5727         case NL80211_IFTYPE_P2P_GO:
5728                 /* ignore WME attributes if iface/sta is not capable */
5729                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5730                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5731                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5732
5733                 /* TDLS peers cannot be added */
5734                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5735                     info->attrs[NL80211_ATTR_PEER_AID])
5736                         return -EINVAL;
5737                 /* but don't bother the driver with it */
5738                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5739
5740                 /* allow authenticated/associated only if driver handles it */
5741                 if (!(rdev->wiphy.features &
5742                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5743                     params.sta_flags_mask & auth_assoc)
5744                         return -EINVAL;
5745
5746                 /* Older userspace, or userspace wanting to be compatible with
5747                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5748                  * and assoc flags in the mask, but assumes the station will be
5749                  * added as associated anyway since this was the required driver
5750                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5751                  * introduced.
5752                  * In order to not bother drivers with this quirk in the API
5753                  * set the flags in both the mask and set for new stations in
5754                  * this case.
5755                  */
5756                 if (!(params.sta_flags_mask & auth_assoc)) {
5757                         params.sta_flags_mask |= auth_assoc;
5758                         params.sta_flags_set |= auth_assoc;
5759                 }
5760
5761                 /* must be last in here for error handling */
5762                 params.vlan = get_vlan(info, rdev);
5763                 if (IS_ERR(params.vlan))
5764                         return PTR_ERR(params.vlan);
5765                 break;
5766         case NL80211_IFTYPE_MESH_POINT:
5767                 /* ignore uAPSD data */
5768                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5769
5770                 /* associated is disallowed */
5771                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5772                         return -EINVAL;
5773                 /* TDLS peers cannot be added */
5774                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5775                     info->attrs[NL80211_ATTR_PEER_AID])
5776                         return -EINVAL;
5777                 break;
5778         case NL80211_IFTYPE_STATION:
5779         case NL80211_IFTYPE_P2P_CLIENT:
5780                 /* ignore uAPSD data */
5781                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5782
5783                 /* these are disallowed */
5784                 if (params.sta_flags_mask &
5785                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5786                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5787                         return -EINVAL;
5788                 /* Only TDLS peers can be added */
5789                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5790                         return -EINVAL;
5791                 /* Can only add if TDLS ... */
5792                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5793                         return -EOPNOTSUPP;
5794                 /* ... with external setup is supported */
5795                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5796                         return -EOPNOTSUPP;
5797                 /*
5798                  * Older wpa_supplicant versions always mark the TDLS peer
5799                  * as authorized, but it shouldn't yet be.
5800                  */
5801                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5802                 break;
5803         default:
5804                 return -EOPNOTSUPP;
5805         }
5806
5807         /* be aware of params.vlan when changing code here */
5808
5809         err = rdev_add_station(rdev, dev, mac_addr, &params);
5810
5811         if (params.vlan)
5812                 dev_put(params.vlan);
5813         return err;
5814 }
5815
5816 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5817 {
5818         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5819         struct net_device *dev = info->user_ptr[1];
5820         struct station_del_parameters params;
5821
5822         memset(&params, 0, sizeof(params));
5823
5824         if (info->attrs[NL80211_ATTR_MAC])
5825                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5826
5827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5828             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5829             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5830             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5831                 return -EINVAL;
5832
5833         if (!rdev->ops->del_station)
5834                 return -EOPNOTSUPP;
5835
5836         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5837                 params.subtype =
5838                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5839                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5840                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5841                         return -EINVAL;
5842         } else {
5843                 /* Default to Deauthentication frame */
5844                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5845         }
5846
5847         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5848                 params.reason_code =
5849                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5850                 if (params.reason_code == 0)
5851                         return -EINVAL; /* 0 is reserved */
5852         } else {
5853                 /* Default to reason code 2 */
5854                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5855         }
5856
5857         return rdev_del_station(rdev, dev, &params);
5858 }
5859
5860 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5861                                 int flags, struct net_device *dev,
5862                                 u8 *dst, u8 *next_hop,
5863                                 struct mpath_info *pinfo)
5864 {
5865         void *hdr;
5866         struct nlattr *pinfoattr;
5867
5868         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5869         if (!hdr)
5870                 return -1;
5871
5872         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5873             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5874             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5875             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5876                 goto nla_put_failure;
5877
5878         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5879         if (!pinfoattr)
5880                 goto nla_put_failure;
5881         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5882             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5883                         pinfo->frame_qlen))
5884                 goto nla_put_failure;
5885         if (((pinfo->filled & MPATH_INFO_SN) &&
5886              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5887             ((pinfo->filled & MPATH_INFO_METRIC) &&
5888              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5889                          pinfo->metric)) ||
5890             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5891              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5892                          pinfo->exptime)) ||
5893             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5894              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5895                         pinfo->flags)) ||
5896             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5897              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5898                          pinfo->discovery_timeout)) ||
5899             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5900              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5901                         pinfo->discovery_retries)) ||
5902             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
5903              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
5904                         pinfo->hop_count)) ||
5905             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
5906              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
5907                          pinfo->path_change_count)))
5908                 goto nla_put_failure;
5909
5910         nla_nest_end(msg, pinfoattr);
5911
5912         genlmsg_end(msg, hdr);
5913         return 0;
5914
5915  nla_put_failure:
5916         genlmsg_cancel(msg, hdr);
5917         return -EMSGSIZE;
5918 }
5919
5920 static int nl80211_dump_mpath(struct sk_buff *skb,
5921                               struct netlink_callback *cb)
5922 {
5923         struct mpath_info pinfo;
5924         struct cfg80211_registered_device *rdev;
5925         struct wireless_dev *wdev;
5926         u8 dst[ETH_ALEN];
5927         u8 next_hop[ETH_ALEN];
5928         int path_idx = cb->args[2];
5929         int err;
5930
5931         rtnl_lock();
5932         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5933         if (err)
5934                 goto out_err;
5935
5936         if (!rdev->ops->dump_mpath) {
5937                 err = -EOPNOTSUPP;
5938                 goto out_err;
5939         }
5940
5941         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5942                 err = -EOPNOTSUPP;
5943                 goto out_err;
5944         }
5945
5946         while (1) {
5947                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5948                                       next_hop, &pinfo);
5949                 if (err == -ENOENT)
5950                         break;
5951                 if (err)
5952                         goto out_err;
5953
5954                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5955                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5956                                        wdev->netdev, dst, next_hop,
5957                                        &pinfo) < 0)
5958                         goto out;
5959
5960                 path_idx++;
5961         }
5962
5963  out:
5964         cb->args[2] = path_idx;
5965         err = skb->len;
5966  out_err:
5967         rtnl_unlock();
5968         return err;
5969 }
5970
5971 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5972 {
5973         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5974         int err;
5975         struct net_device *dev = info->user_ptr[1];
5976         struct mpath_info pinfo;
5977         struct sk_buff *msg;
5978         u8 *dst = NULL;
5979         u8 next_hop[ETH_ALEN];
5980
5981         memset(&pinfo, 0, sizeof(pinfo));
5982
5983         if (!info->attrs[NL80211_ATTR_MAC])
5984                 return -EINVAL;
5985
5986         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5987
5988         if (!rdev->ops->get_mpath)
5989                 return -EOPNOTSUPP;
5990
5991         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5992                 return -EOPNOTSUPP;
5993
5994         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5995         if (err)
5996                 return err;
5997
5998         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5999         if (!msg)
6000                 return -ENOMEM;
6001
6002         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6003                                  dev, dst, next_hop, &pinfo) < 0) {
6004                 nlmsg_free(msg);
6005                 return -ENOBUFS;
6006         }
6007
6008         return genlmsg_reply(msg, info);
6009 }
6010
6011 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6012 {
6013         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6014         struct net_device *dev = info->user_ptr[1];
6015         u8 *dst = NULL;
6016         u8 *next_hop = NULL;
6017
6018         if (!info->attrs[NL80211_ATTR_MAC])
6019                 return -EINVAL;
6020
6021         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6022                 return -EINVAL;
6023
6024         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6025         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6026
6027         if (!rdev->ops->change_mpath)
6028                 return -EOPNOTSUPP;
6029
6030         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6031                 return -EOPNOTSUPP;
6032
6033         return rdev_change_mpath(rdev, dev, dst, next_hop);
6034 }
6035
6036 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6037 {
6038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6039         struct net_device *dev = info->user_ptr[1];
6040         u8 *dst = NULL;
6041         u8 *next_hop = NULL;
6042
6043         if (!info->attrs[NL80211_ATTR_MAC])
6044                 return -EINVAL;
6045
6046         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6047                 return -EINVAL;
6048
6049         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6050         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6051
6052         if (!rdev->ops->add_mpath)
6053                 return -EOPNOTSUPP;
6054
6055         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6056                 return -EOPNOTSUPP;
6057
6058         return rdev_add_mpath(rdev, dev, dst, next_hop);
6059 }
6060
6061 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
6062 {
6063         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6064         struct net_device *dev = info->user_ptr[1];
6065         u8 *dst = NULL;
6066
6067         if (info->attrs[NL80211_ATTR_MAC])
6068                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6069
6070         if (!rdev->ops->del_mpath)
6071                 return -EOPNOTSUPP;
6072
6073         return rdev_del_mpath(rdev, dev, dst);
6074 }
6075
6076 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
6077 {
6078         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6079         int err;
6080         struct net_device *dev = info->user_ptr[1];
6081         struct mpath_info pinfo;
6082         struct sk_buff *msg;
6083         u8 *dst = NULL;
6084         u8 mpp[ETH_ALEN];
6085
6086         memset(&pinfo, 0, sizeof(pinfo));
6087
6088         if (!info->attrs[NL80211_ATTR_MAC])
6089                 return -EINVAL;
6090
6091         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6092
6093         if (!rdev->ops->get_mpp)
6094                 return -EOPNOTSUPP;
6095
6096         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6097                 return -EOPNOTSUPP;
6098
6099         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
6100         if (err)
6101                 return err;
6102
6103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6104         if (!msg)
6105                 return -ENOMEM;
6106
6107         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6108                                dev, dst, mpp, &pinfo) < 0) {
6109                 nlmsg_free(msg);
6110                 return -ENOBUFS;
6111         }
6112
6113         return genlmsg_reply(msg, info);
6114 }
6115
6116 static int nl80211_dump_mpp(struct sk_buff *skb,
6117                             struct netlink_callback *cb)
6118 {
6119         struct mpath_info pinfo;
6120         struct cfg80211_registered_device *rdev;
6121         struct wireless_dev *wdev;
6122         u8 dst[ETH_ALEN];
6123         u8 mpp[ETH_ALEN];
6124         int path_idx = cb->args[2];
6125         int err;
6126
6127         rtnl_lock();
6128         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6129         if (err)
6130                 goto out_err;
6131
6132         if (!rdev->ops->dump_mpp) {
6133                 err = -EOPNOTSUPP;
6134                 goto out_err;
6135         }
6136
6137         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6138                 err = -EOPNOTSUPP;
6139                 goto out_err;
6140         }
6141
6142         while (1) {
6143                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
6144                                     mpp, &pinfo);
6145                 if (err == -ENOENT)
6146                         break;
6147                 if (err)
6148                         goto out_err;
6149
6150                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6151                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6152                                        wdev->netdev, dst, mpp,
6153                                        &pinfo) < 0)
6154                         goto out;
6155
6156                 path_idx++;
6157         }
6158
6159  out:
6160         cb->args[2] = path_idx;
6161         err = skb->len;
6162  out_err:
6163         rtnl_unlock();
6164         return err;
6165 }
6166
6167 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
6168 {
6169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6170         struct net_device *dev = info->user_ptr[1];
6171         struct wireless_dev *wdev = dev->ieee80211_ptr;
6172         struct bss_parameters params;
6173         int err;
6174
6175         memset(&params, 0, sizeof(params));
6176         /* default to not changing parameters */
6177         params.use_cts_prot = -1;
6178         params.use_short_preamble = -1;
6179         params.use_short_slot_time = -1;
6180         params.ap_isolate = -1;
6181         params.ht_opmode = -1;
6182         params.p2p_ctwindow = -1;
6183         params.p2p_opp_ps = -1;
6184
6185         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
6186                 params.use_cts_prot =
6187                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
6188         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
6189                 params.use_short_preamble =
6190                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
6191         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
6192                 params.use_short_slot_time =
6193                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
6194         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
6195                 params.basic_rates =
6196                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6197                 params.basic_rates_len =
6198                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
6199         }
6200         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
6201                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
6202         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
6203                 params.ht_opmode =
6204                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
6205
6206         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6207                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6208                         return -EINVAL;
6209                 params.p2p_ctwindow =
6210                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6211                 if (params.p2p_ctwindow != 0 &&
6212                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
6213                         return -EINVAL;
6214         }
6215
6216         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6217                 u8 tmp;
6218
6219                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6220                         return -EINVAL;
6221                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6222                 params.p2p_opp_ps = tmp;
6223                 if (params.p2p_opp_ps &&
6224                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6225                         return -EINVAL;
6226         }
6227
6228         if (!rdev->ops->change_bss)
6229                 return -EOPNOTSUPP;
6230
6231         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6233                 return -EOPNOTSUPP;
6234
6235         wdev_lock(wdev);
6236         err = rdev_change_bss(rdev, dev, &params);
6237         wdev_unlock(wdev);
6238
6239         return err;
6240 }
6241
6242 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6243 {
6244         char *data = NULL;
6245         bool is_indoor;
6246         enum nl80211_user_reg_hint_type user_reg_hint_type;
6247         u32 owner_nlportid;
6248
6249         /*
6250          * You should only get this when cfg80211 hasn't yet initialized
6251          * completely when built-in to the kernel right between the time
6252          * window between nl80211_init() and regulatory_init(), if that is
6253          * even possible.
6254          */
6255         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6256                 return -EINPROGRESS;
6257
6258         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6259                 user_reg_hint_type =
6260                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6261         else
6262                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6263
6264         switch (user_reg_hint_type) {
6265         case NL80211_USER_REG_HINT_USER:
6266         case NL80211_USER_REG_HINT_CELL_BASE:
6267                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6268                         return -EINVAL;
6269
6270                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6271                 return regulatory_hint_user(data, user_reg_hint_type);
6272         case NL80211_USER_REG_HINT_INDOOR:
6273                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6274                         owner_nlportid = info->snd_portid;
6275                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6276                 } else {
6277                         owner_nlportid = 0;
6278                         is_indoor = true;
6279                 }
6280
6281                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6282         default:
6283                 return -EINVAL;
6284         }
6285 }
6286
6287 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6288 {
6289         return reg_reload_regdb();
6290 }
6291
6292 static int nl80211_get_mesh_config(struct sk_buff *skb,
6293                                    struct genl_info *info)
6294 {
6295         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6296         struct net_device *dev = info->user_ptr[1];
6297         struct wireless_dev *wdev = dev->ieee80211_ptr;
6298         struct mesh_config cur_params;
6299         int err = 0;
6300         void *hdr;
6301         struct nlattr *pinfoattr;
6302         struct sk_buff *msg;
6303
6304         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6305                 return -EOPNOTSUPP;
6306
6307         if (!rdev->ops->get_mesh_config)
6308                 return -EOPNOTSUPP;
6309
6310         wdev_lock(wdev);
6311         /* If not connected, get default parameters */
6312         if (!wdev->mesh_id_len)
6313                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6314         else
6315                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6316         wdev_unlock(wdev);
6317
6318         if (err)
6319                 return err;
6320
6321         /* Draw up a netlink message to send back */
6322         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6323         if (!msg)
6324                 return -ENOMEM;
6325         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6326                              NL80211_CMD_GET_MESH_CONFIG);
6327         if (!hdr)
6328                 goto out;
6329         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6330         if (!pinfoattr)
6331                 goto nla_put_failure;
6332         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6333             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6334                         cur_params.dot11MeshRetryTimeout) ||
6335             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6336                         cur_params.dot11MeshConfirmTimeout) ||
6337             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6338                         cur_params.dot11MeshHoldingTimeout) ||
6339             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6340                         cur_params.dot11MeshMaxPeerLinks) ||
6341             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6342                        cur_params.dot11MeshMaxRetries) ||
6343             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6344                        cur_params.dot11MeshTTL) ||
6345             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6346                        cur_params.element_ttl) ||
6347             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6348                        cur_params.auto_open_plinks) ||
6349             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6350                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6351             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6352                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6353             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6354                         cur_params.path_refresh_time) ||
6355             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6356                         cur_params.min_discovery_timeout) ||
6357             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6358                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6359             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6360                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6361             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6362                         cur_params.dot11MeshHWMPperrMinInterval) ||
6363             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6364                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6365             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6366                        cur_params.dot11MeshHWMPRootMode) ||
6367             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6368                         cur_params.dot11MeshHWMPRannInterval) ||
6369             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6370                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6371             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6372                        cur_params.dot11MeshForwarding) ||
6373             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6374                         cur_params.rssi_threshold) ||
6375             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6376                         cur_params.ht_opmode) ||
6377             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6378                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6379             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6380                         cur_params.dot11MeshHWMProotInterval) ||
6381             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6382                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6383             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6384                         cur_params.power_mode) ||
6385             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6386                         cur_params.dot11MeshAwakeWindowDuration) ||
6387             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6388                         cur_params.plink_timeout) ||
6389             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
6390                        cur_params.dot11MeshConnectedToMeshGate))
6391                 goto nla_put_failure;
6392         nla_nest_end(msg, pinfoattr);
6393         genlmsg_end(msg, hdr);
6394         return genlmsg_reply(msg, info);
6395
6396  nla_put_failure:
6397  out:
6398         nlmsg_free(msg);
6399         return -ENOBUFS;
6400 }
6401
6402 static const struct nla_policy
6403 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6404         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6405                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6406         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6407                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6408         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6409                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6410         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6411                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6412         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6413         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6414         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6415         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6416         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6417                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6418         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6419         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6420         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6421         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6422         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6423                 NLA_POLICY_MIN(NLA_U16, 1),
6424         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6425                 NLA_POLICY_MIN(NLA_U16, 1),
6426         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6427                 NLA_POLICY_MIN(NLA_U16, 1),
6428         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6429         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6430                 NLA_POLICY_MIN(NLA_U16, 1),
6431         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6432         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6433         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6434                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6435         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6436         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6437         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6438                 NLA_POLICY_MIN(NLA_U16, 1),
6439         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6440                 NLA_POLICY_MIN(NLA_U16, 1),
6441         [NL80211_MESHCONF_POWER_MODE] =
6442                 NLA_POLICY_RANGE(NLA_U32,
6443                                  NL80211_MESH_POWER_ACTIVE,
6444                                  NL80211_MESH_POWER_MAX),
6445         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6446         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6447         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
6448 };
6449
6450 static const struct nla_policy
6451         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6452         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6453         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6454         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6455         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6456         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6457         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6458         [NL80211_MESH_SETUP_IE] =
6459                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6460                                        IEEE80211_MAX_DATA_LEN),
6461         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6462 };
6463
6464 static int nl80211_parse_mesh_config(struct genl_info *info,
6465                                      struct mesh_config *cfg,
6466                                      u32 *mask_out)
6467 {
6468         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6469         u32 mask = 0;
6470         u16 ht_opmode;
6471
6472 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6473 do {                                                                    \
6474         if (tb[attr]) {                                                 \
6475                 cfg->param = fn(tb[attr]);                              \
6476                 mask |= BIT((attr) - 1);                                \
6477         }                                                               \
6478 } while (0)
6479
6480         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6481                 return -EINVAL;
6482         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6483                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6484                              nl80211_meshconf_params_policy, info->extack))
6485                 return -EINVAL;
6486
6487         /* This makes sure that there aren't more than 32 mesh config
6488          * parameters (otherwise our bitfield scheme would not work.) */
6489         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6490
6491         /* Fill in the params struct */
6492         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6493                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6494         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6495                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6496                                   nla_get_u16);
6497         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6498                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6499                                   nla_get_u16);
6500         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6501                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6502                                   nla_get_u16);
6503         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6504                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6505         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6506                                   NL80211_MESHCONF_TTL, nla_get_u8);
6507         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6508                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6510                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6511                                   nla_get_u8);
6512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6513                                   mask,
6514                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6515                                   nla_get_u32);
6516         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6517                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6518                                   nla_get_u8);
6519         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6520                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6521                                   nla_get_u32);
6522         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6523             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6524                 return -EINVAL;
6525         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6526                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6527                                   nla_get_u16);
6528         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6529                                   mask,
6530                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6531                                   nla_get_u32);
6532         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6533             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6534              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6535                 return -EINVAL;
6536         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6537                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6538                                   nla_get_u16);
6539         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6540                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6541                                   nla_get_u16);
6542         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6543                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6544                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6545                                   nla_get_u16);
6546         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6547                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6548         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6549                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6550                                   nla_get_u16);
6551         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6552                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6553                                   nla_get_u8);
6554         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6555                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6556         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6557                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6558                                   nla_get_s32);
6559         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
6560                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
6561                                   nla_get_u8);
6562         /*
6563          * Check HT operation mode based on
6564          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6565          */
6566         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6567                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6568
6569                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6570                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6571                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6572                         return -EINVAL;
6573
6574                 /* NON_HT_STA bit is reserved, but some programs set it */
6575                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6576
6577                 cfg->ht_opmode = ht_opmode;
6578                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6579         }
6580         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6581                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6582                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6583                                   nla_get_u32);
6584         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6585             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6586              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6587                 return -EINVAL;
6588         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6589                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6590                                   nla_get_u16);
6591         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6592                                   mask,
6593                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6594                                   nla_get_u16);
6595         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6596                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6597         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6598                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6599         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6600                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6601         if (mask_out)
6602                 *mask_out = mask;
6603
6604         return 0;
6605
6606 #undef FILL_IN_MESH_PARAM_IF_SET
6607 }
6608
6609 static int nl80211_parse_mesh_setup(struct genl_info *info,
6610                                      struct mesh_setup *setup)
6611 {
6612         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6613         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6614
6615         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6616                 return -EINVAL;
6617         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6618                              info->attrs[NL80211_ATTR_MESH_SETUP],
6619                              nl80211_mesh_setup_params_policy, info->extack))
6620                 return -EINVAL;
6621
6622         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6623                 setup->sync_method =
6624                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6625                  IEEE80211_SYNC_METHOD_VENDOR :
6626                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6627
6628         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6629                 setup->path_sel_proto =
6630                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6631                  IEEE80211_PATH_PROTOCOL_VENDOR :
6632                  IEEE80211_PATH_PROTOCOL_HWMP;
6633
6634         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6635                 setup->path_metric =
6636                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6637                  IEEE80211_PATH_METRIC_VENDOR :
6638                  IEEE80211_PATH_METRIC_AIRTIME;
6639
6640         if (tb[NL80211_MESH_SETUP_IE]) {
6641                 struct nlattr *ieattr =
6642                         tb[NL80211_MESH_SETUP_IE];
6643                 setup->ie = nla_data(ieattr);
6644                 setup->ie_len = nla_len(ieattr);
6645         }
6646         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6647             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6648                 return -EINVAL;
6649         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6650         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6651         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6652         if (setup->is_secure)
6653                 setup->user_mpm = true;
6654
6655         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6656                 if (!setup->user_mpm)
6657                         return -EINVAL;
6658                 setup->auth_id =
6659                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6660         }
6661
6662         return 0;
6663 }
6664
6665 static int nl80211_update_mesh_config(struct sk_buff *skb,
6666                                       struct genl_info *info)
6667 {
6668         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6669         struct net_device *dev = info->user_ptr[1];
6670         struct wireless_dev *wdev = dev->ieee80211_ptr;
6671         struct mesh_config cfg;
6672         u32 mask;
6673         int err;
6674
6675         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6676                 return -EOPNOTSUPP;
6677
6678         if (!rdev->ops->update_mesh_config)
6679                 return -EOPNOTSUPP;
6680
6681         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6682         if (err)
6683                 return err;
6684
6685         wdev_lock(wdev);
6686         if (!wdev->mesh_id_len)
6687                 err = -ENOLINK;
6688
6689         if (!err)
6690                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6691
6692         wdev_unlock(wdev);
6693
6694         return err;
6695 }
6696
6697 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6698                               struct sk_buff *msg)
6699 {
6700         struct nlattr *nl_reg_rules;
6701         unsigned int i;
6702
6703         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6704             (regdom->dfs_region &&
6705              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6706                 goto nla_put_failure;
6707
6708         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6709         if (!nl_reg_rules)
6710                 goto nla_put_failure;
6711
6712         for (i = 0; i < regdom->n_reg_rules; i++) {
6713                 struct nlattr *nl_reg_rule;
6714                 const struct ieee80211_reg_rule *reg_rule;
6715                 const struct ieee80211_freq_range *freq_range;
6716                 const struct ieee80211_power_rule *power_rule;
6717                 unsigned int max_bandwidth_khz;
6718
6719                 reg_rule = &regdom->reg_rules[i];
6720                 freq_range = &reg_rule->freq_range;
6721                 power_rule = &reg_rule->power_rule;
6722
6723                 nl_reg_rule = nla_nest_start(msg, i);
6724                 if (!nl_reg_rule)
6725                         goto nla_put_failure;
6726
6727                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6728                 if (!max_bandwidth_khz)
6729                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6730                                                                   reg_rule);
6731
6732                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6733                                 reg_rule->flags) ||
6734                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6735                                 freq_range->start_freq_khz) ||
6736                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6737                                 freq_range->end_freq_khz) ||
6738                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6739                                 max_bandwidth_khz) ||
6740                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6741                                 power_rule->max_antenna_gain) ||
6742                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6743                                 power_rule->max_eirp) ||
6744                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6745                                 reg_rule->dfs_cac_ms))
6746                         goto nla_put_failure;
6747
6748                 nla_nest_end(msg, nl_reg_rule);
6749         }
6750
6751         nla_nest_end(msg, nl_reg_rules);
6752         return 0;
6753
6754 nla_put_failure:
6755         return -EMSGSIZE;
6756 }
6757
6758 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6759 {
6760         const struct ieee80211_regdomain *regdom = NULL;
6761         struct cfg80211_registered_device *rdev;
6762         struct wiphy *wiphy = NULL;
6763         struct sk_buff *msg;
6764         void *hdr;
6765
6766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6767         if (!msg)
6768                 return -ENOBUFS;
6769
6770         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6771                              NL80211_CMD_GET_REG);
6772         if (!hdr)
6773                 goto put_failure;
6774
6775         if (info->attrs[NL80211_ATTR_WIPHY]) {
6776                 bool self_managed;
6777
6778                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6779                 if (IS_ERR(rdev)) {
6780                         nlmsg_free(msg);
6781                         return PTR_ERR(rdev);
6782                 }
6783
6784                 wiphy = &rdev->wiphy;
6785                 self_managed = wiphy->regulatory_flags &
6786                                REGULATORY_WIPHY_SELF_MANAGED;
6787                 regdom = get_wiphy_regdom(wiphy);
6788
6789                 /* a self-managed-reg device must have a private regdom */
6790                 if (WARN_ON(!regdom && self_managed)) {
6791                         nlmsg_free(msg);
6792                         return -EINVAL;
6793                 }
6794
6795                 if (regdom &&
6796                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6797                         goto nla_put_failure;
6798         }
6799
6800         if (!wiphy && reg_last_request_cell_base() &&
6801             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6802                         NL80211_USER_REG_HINT_CELL_BASE))
6803                 goto nla_put_failure;
6804
6805         rcu_read_lock();
6806
6807         if (!regdom)
6808                 regdom = rcu_dereference(cfg80211_regdomain);
6809
6810         if (nl80211_put_regdom(regdom, msg))
6811                 goto nla_put_failure_rcu;
6812
6813         rcu_read_unlock();
6814
6815         genlmsg_end(msg, hdr);
6816         return genlmsg_reply(msg, info);
6817
6818 nla_put_failure_rcu:
6819         rcu_read_unlock();
6820 nla_put_failure:
6821 put_failure:
6822         nlmsg_free(msg);
6823         return -EMSGSIZE;
6824 }
6825
6826 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6827                                u32 seq, int flags, struct wiphy *wiphy,
6828                                const struct ieee80211_regdomain *regdom)
6829 {
6830         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6831                                    NL80211_CMD_GET_REG);
6832
6833         if (!hdr)
6834                 return -1;
6835
6836         genl_dump_check_consistent(cb, hdr);
6837
6838         if (nl80211_put_regdom(regdom, msg))
6839                 goto nla_put_failure;
6840
6841         if (!wiphy && reg_last_request_cell_base() &&
6842             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6843                         NL80211_USER_REG_HINT_CELL_BASE))
6844                 goto nla_put_failure;
6845
6846         if (wiphy &&
6847             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6848                 goto nla_put_failure;
6849
6850         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6851             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6852                 goto nla_put_failure;
6853
6854         genlmsg_end(msg, hdr);
6855         return 0;
6856
6857 nla_put_failure:
6858         genlmsg_cancel(msg, hdr);
6859         return -EMSGSIZE;
6860 }
6861
6862 static int nl80211_get_reg_dump(struct sk_buff *skb,
6863                                 struct netlink_callback *cb)
6864 {
6865         const struct ieee80211_regdomain *regdom = NULL;
6866         struct cfg80211_registered_device *rdev;
6867         int err, reg_idx, start = cb->args[2];
6868
6869         rtnl_lock();
6870
6871         if (cfg80211_regdomain && start == 0) {
6872                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6873                                           NLM_F_MULTI, NULL,
6874                                           rtnl_dereference(cfg80211_regdomain));
6875                 if (err < 0)
6876                         goto out_err;
6877         }
6878
6879         /* the global regdom is idx 0 */
6880         reg_idx = 1;
6881         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6882                 regdom = get_wiphy_regdom(&rdev->wiphy);
6883                 if (!regdom)
6884                         continue;
6885
6886                 if (++reg_idx <= start)
6887                         continue;
6888
6889                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6890                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6891                 if (err < 0) {
6892                         reg_idx--;
6893                         break;
6894                 }
6895         }
6896
6897         cb->args[2] = reg_idx;
6898         err = skb->len;
6899 out_err:
6900         rtnl_unlock();
6901         return err;
6902 }
6903
6904 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6905 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6906         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6907         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6908         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6909         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6910         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6911         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6912         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6913 };
6914
6915 static int parse_reg_rule(struct nlattr *tb[],
6916         struct ieee80211_reg_rule *reg_rule)
6917 {
6918         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6919         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6920
6921         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6922                 return -EINVAL;
6923         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6924                 return -EINVAL;
6925         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6926                 return -EINVAL;
6927         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6928                 return -EINVAL;
6929         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6930                 return -EINVAL;
6931
6932         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6933
6934         freq_range->start_freq_khz =
6935                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6936         freq_range->end_freq_khz =
6937                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6938         freq_range->max_bandwidth_khz =
6939                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6940
6941         power_rule->max_eirp =
6942                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6943
6944         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6945                 power_rule->max_antenna_gain =
6946                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6947
6948         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6949                 reg_rule->dfs_cac_ms =
6950                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6951
6952         return 0;
6953 }
6954
6955 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6956 {
6957         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6958         struct nlattr *nl_reg_rule;
6959         char *alpha2;
6960         int rem_reg_rules, r;
6961         u32 num_rules = 0, rule_idx = 0;
6962         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6963         struct ieee80211_regdomain *rd;
6964
6965         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6966                 return -EINVAL;
6967
6968         if (!info->attrs[NL80211_ATTR_REG_RULES])
6969                 return -EINVAL;
6970
6971         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6972
6973         if (info->attrs[NL80211_ATTR_DFS_REGION])
6974                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6975
6976         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6977                             rem_reg_rules) {
6978                 num_rules++;
6979                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6980                         return -EINVAL;
6981         }
6982
6983         if (!reg_is_valid_request(alpha2))
6984                 return -EINVAL;
6985
6986         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
6987         if (!rd)
6988                 return -ENOMEM;
6989
6990         rd->n_reg_rules = num_rules;
6991         rd->alpha2[0] = alpha2[0];
6992         rd->alpha2[1] = alpha2[1];
6993
6994         /*
6995          * Disable DFS master mode if the DFS region was
6996          * not supported or known on this kernel.
6997          */
6998         if (reg_supported_dfs_region(dfs_region))
6999                 rd->dfs_region = dfs_region;
7000
7001         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7002                             rem_reg_rules) {
7003                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
7004                                      nl_reg_rule, reg_rule_policy,
7005                                      info->extack);
7006                 if (r)
7007                         goto bad_reg;
7008                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7009                 if (r)
7010                         goto bad_reg;
7011
7012                 rule_idx++;
7013
7014                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7015                         r = -EINVAL;
7016                         goto bad_reg;
7017                 }
7018         }
7019
7020         /* set_regdom takes ownership of rd */
7021         return set_regdom(rd, REGD_SOURCE_CRDA);
7022  bad_reg:
7023         kfree(rd);
7024         return r;
7025 }
7026 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
7027
7028 static int validate_scan_freqs(struct nlattr *freqs)
7029 {
7030         struct nlattr *attr1, *attr2;
7031         int n_channels = 0, tmp1, tmp2;
7032
7033         nla_for_each_nested(attr1, freqs, tmp1)
7034                 if (nla_len(attr1) != sizeof(u32))
7035                         return 0;
7036
7037         nla_for_each_nested(attr1, freqs, tmp1) {
7038                 n_channels++;
7039                 /*
7040                  * Some hardware has a limited channel list for
7041                  * scanning, and it is pretty much nonsensical
7042                  * to scan for a channel twice, so disallow that
7043                  * and don't require drivers to check that the
7044                  * channel list they get isn't longer than what
7045                  * they can scan, as long as they can scan all
7046                  * the channels they registered at once.
7047                  */
7048                 nla_for_each_nested(attr2, freqs, tmp2)
7049                         if (attr1 != attr2 &&
7050                             nla_get_u32(attr1) == nla_get_u32(attr2))
7051                                 return 0;
7052         }
7053
7054         return n_channels;
7055 }
7056
7057 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
7058 {
7059         return b < NUM_NL80211_BANDS && wiphy->bands[b];
7060 }
7061
7062 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
7063                             struct cfg80211_bss_selection *bss_select)
7064 {
7065         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
7066         struct nlattr *nest;
7067         int err;
7068         bool found = false;
7069         int i;
7070
7071         /* only process one nested attribute */
7072         nest = nla_data(nla);
7073         if (!nla_ok(nest, nla_len(nest)))
7074                 return -EINVAL;
7075
7076         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
7077                                nl80211_bss_select_policy, NULL);
7078         if (err)
7079                 return err;
7080
7081         /* only one attribute may be given */
7082         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
7083                 if (attr[i]) {
7084                         if (found)
7085                                 return -EINVAL;
7086                         found = true;
7087                 }
7088         }
7089
7090         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
7091
7092         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
7093                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
7094
7095         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
7096                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
7097                 bss_select->param.band_pref =
7098                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
7099                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
7100                         return -EINVAL;
7101         }
7102
7103         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
7104                 struct nl80211_bss_select_rssi_adjust *adj_param;
7105
7106                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
7107                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
7108                 bss_select->param.adjust.band = adj_param->band;
7109                 bss_select->param.adjust.delta = adj_param->delta;
7110                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
7111                         return -EINVAL;
7112         }
7113
7114         /* user-space did not provide behaviour attribute */
7115         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
7116                 return -EINVAL;
7117
7118         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
7119                 return -EINVAL;
7120
7121         return 0;
7122 }
7123
7124 int nl80211_parse_random_mac(struct nlattr **attrs,
7125                              u8 *mac_addr, u8 *mac_addr_mask)
7126 {
7127         int i;
7128
7129         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
7130                 eth_zero_addr(mac_addr);
7131                 eth_zero_addr(mac_addr_mask);
7132                 mac_addr[0] = 0x2;
7133                 mac_addr_mask[0] = 0x3;
7134
7135                 return 0;
7136         }
7137
7138         /* need both or none */
7139         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
7140                 return -EINVAL;
7141
7142         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
7143         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
7144
7145         /* don't allow or configure an mcast address */
7146         if (!is_multicast_ether_addr(mac_addr_mask) ||
7147             is_multicast_ether_addr(mac_addr))
7148                 return -EINVAL;
7149
7150         /*
7151          * allow users to pass a MAC address that has bits set outside
7152          * of the mask, but don't bother drivers with having to deal
7153          * with such bits
7154          */
7155         for (i = 0; i < ETH_ALEN; i++)
7156                 mac_addr[i] &= mac_addr_mask[i];
7157
7158         return 0;
7159 }
7160
7161 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
7162 {
7163         ASSERT_WDEV_LOCK(wdev);
7164
7165         if (!cfg80211_beaconing_iface_active(wdev))
7166                 return true;
7167
7168         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
7169                 return true;
7170
7171         return regulatory_pre_cac_allowed(wdev->wiphy);
7172 }
7173
7174 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7175                                     enum nl80211_ext_feature_index feat)
7176 {
7177         if (!(flags & flag))
7178                 return true;
7179         if (wiphy_ext_feature_isset(wiphy, feat))
7180                 return true;
7181         return false;
7182 }
7183
7184 static int
7185 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7186                          void *request, struct nlattr **attrs,
7187                          bool is_sched_scan)
7188 {
7189         u8 *mac_addr, *mac_addr_mask;
7190         u32 *flags;
7191         enum nl80211_feature_flags randomness_flag;
7192
7193         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7194                 return 0;
7195
7196         if (is_sched_scan) {
7197                 struct cfg80211_sched_scan_request *req = request;
7198
7199                 randomness_flag = wdev ?
7200                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7201                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7202                 flags = &req->flags;
7203                 mac_addr = req->mac_addr;
7204                 mac_addr_mask = req->mac_addr_mask;
7205         } else {
7206                 struct cfg80211_scan_request *req = request;
7207
7208                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7209                 flags = &req->flags;
7210                 mac_addr = req->mac_addr;
7211                 mac_addr_mask = req->mac_addr_mask;
7212         }
7213
7214         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7215
7216         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7217              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7218             !nl80211_check_scan_feat(wiphy, *flags,
7219                                      NL80211_SCAN_FLAG_LOW_SPAN,
7220                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7221             !nl80211_check_scan_feat(wiphy, *flags,
7222                                      NL80211_SCAN_FLAG_LOW_POWER,
7223                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7224             !nl80211_check_scan_feat(wiphy, *flags,
7225                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7226                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7227             !nl80211_check_scan_feat(wiphy, *flags,
7228                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7229                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7230             !nl80211_check_scan_feat(wiphy, *flags,
7231                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7232                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7233             !nl80211_check_scan_feat(wiphy, *flags,
7234                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7235                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7236             !nl80211_check_scan_feat(wiphy, *flags,
7237                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7238                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7239             !nl80211_check_scan_feat(wiphy, *flags,
7240                                      NL80211_SCAN_FLAG_RANDOM_SN,
7241                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7242             !nl80211_check_scan_feat(wiphy, *flags,
7243                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7244                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7245                 return -EOPNOTSUPP;
7246
7247         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7248                 int err;
7249
7250                 if (!(wiphy->features & randomness_flag) ||
7251                     (wdev && wdev->current_bss))
7252                         return -EOPNOTSUPP;
7253
7254                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7255                 if (err)
7256                         return err;
7257         }
7258
7259         return 0;
7260 }
7261
7262 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7263 {
7264         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7265         struct wireless_dev *wdev = info->user_ptr[1];
7266         struct cfg80211_scan_request *request;
7267         struct nlattr *attr;
7268         struct wiphy *wiphy;
7269         int err, tmp, n_ssids = 0, n_channels, i;
7270         size_t ie_len;
7271
7272         wiphy = &rdev->wiphy;
7273
7274         if (wdev->iftype == NL80211_IFTYPE_NAN)
7275                 return -EOPNOTSUPP;
7276
7277         if (!rdev->ops->scan)
7278                 return -EOPNOTSUPP;
7279
7280         if (rdev->scan_req || rdev->scan_msg) {
7281                 err = -EBUSY;
7282                 goto unlock;
7283         }
7284
7285         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7286                 n_channels = validate_scan_freqs(
7287                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7288                 if (!n_channels) {
7289                         err = -EINVAL;
7290                         goto unlock;
7291                 }
7292         } else {
7293                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7294         }
7295
7296         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7297                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7298                         n_ssids++;
7299
7300         if (n_ssids > wiphy->max_scan_ssids) {
7301                 err = -EINVAL;
7302                 goto unlock;
7303         }
7304
7305         if (info->attrs[NL80211_ATTR_IE])
7306                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7307         else
7308                 ie_len = 0;
7309
7310         if (ie_len > wiphy->max_scan_ie_len) {
7311                 err = -EINVAL;
7312                 goto unlock;
7313         }
7314
7315         request = kzalloc(sizeof(*request)
7316                         + sizeof(*request->ssids) * n_ssids
7317                         + sizeof(*request->channels) * n_channels
7318                         + ie_len, GFP_KERNEL);
7319         if (!request) {
7320                 err = -ENOMEM;
7321                 goto unlock;
7322         }
7323
7324         if (n_ssids)
7325                 request->ssids = (void *)&request->channels[n_channels];
7326         request->n_ssids = n_ssids;
7327         if (ie_len) {
7328                 if (n_ssids)
7329                         request->ie = (void *)(request->ssids + n_ssids);
7330                 else
7331                         request->ie = (void *)(request->channels + n_channels);
7332         }
7333
7334         i = 0;
7335         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7336                 /* user specified, bail out if channel not found */
7337                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7338                         struct ieee80211_channel *chan;
7339
7340                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7341
7342                         if (!chan) {
7343                                 err = -EINVAL;
7344                                 goto out_free;
7345                         }
7346
7347                         /* ignore disabled channels */
7348                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7349                                 continue;
7350
7351                         request->channels[i] = chan;
7352                         i++;
7353                 }
7354         } else {
7355                 enum nl80211_band band;
7356
7357                 /* all channels */
7358                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7359                         int j;
7360
7361                         if (!wiphy->bands[band])
7362                                 continue;
7363                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7364                                 struct ieee80211_channel *chan;
7365
7366                                 chan = &wiphy->bands[band]->channels[j];
7367
7368                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7369                                         continue;
7370
7371                                 request->channels[i] = chan;
7372                                 i++;
7373                         }
7374                 }
7375         }
7376
7377         if (!i) {
7378                 err = -EINVAL;
7379                 goto out_free;
7380         }
7381
7382         request->n_channels = i;
7383
7384         wdev_lock(wdev);
7385         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7386                 struct ieee80211_channel *chan;
7387
7388                 if (request->n_channels != 1) {
7389                         wdev_unlock(wdev);
7390                         err = -EBUSY;
7391                         goto out_free;
7392                 }
7393
7394                 chan = request->channels[0];
7395                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7396                         wdev_unlock(wdev);
7397                         err = -EBUSY;
7398                         goto out_free;
7399                 }
7400         }
7401         wdev_unlock(wdev);
7402
7403         i = 0;
7404         if (n_ssids) {
7405                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7406                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7407                                 err = -EINVAL;
7408                                 goto out_free;
7409                         }
7410                         request->ssids[i].ssid_len = nla_len(attr);
7411                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7412                         i++;
7413                 }
7414         }
7415
7416         if (info->attrs[NL80211_ATTR_IE]) {
7417                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7418                 memcpy((void *)request->ie,
7419                        nla_data(info->attrs[NL80211_ATTR_IE]),
7420                        request->ie_len);
7421         }
7422
7423         for (i = 0; i < NUM_NL80211_BANDS; i++)
7424                 if (wiphy->bands[i])
7425                         request->rates[i] =
7426                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7427
7428         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7429                 nla_for_each_nested(attr,
7430                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7431                                     tmp) {
7432                         enum nl80211_band band = nla_type(attr);
7433
7434                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7435                                 err = -EINVAL;
7436                                 goto out_free;
7437                         }
7438
7439                         if (!wiphy->bands[band])
7440                                 continue;
7441
7442                         err = ieee80211_get_ratemask(wiphy->bands[band],
7443                                                      nla_data(attr),
7444                                                      nla_len(attr),
7445                                                      &request->rates[band]);
7446                         if (err)
7447                                 goto out_free;
7448                 }
7449         }
7450
7451         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7452                 if (!wiphy_ext_feature_isset(wiphy,
7453                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7454                         err = -EOPNOTSUPP;
7455                         goto out_free;
7456                 }
7457
7458                 request->duration =
7459                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7460                 request->duration_mandatory =
7461                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7462         }
7463
7464         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7465                                        false);
7466         if (err)
7467                 goto out_free;
7468
7469         request->no_cck =
7470                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7471
7472         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7473          * BSSID to scan for. This was problematic because that same attribute
7474          * was already used for another purpose (local random MAC address). The
7475          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7476          * compatibility with older userspace components, also use the
7477          * NL80211_ATTR_MAC value here if it can be determined to be used for
7478          * the specific BSSID use case instead of the random MAC address
7479          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7480          */
7481         if (info->attrs[NL80211_ATTR_BSSID])
7482                 memcpy(request->bssid,
7483                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7484         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7485                  info->attrs[NL80211_ATTR_MAC])
7486                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7487                        ETH_ALEN);
7488         else
7489                 eth_broadcast_addr(request->bssid);
7490
7491         request->wdev = wdev;
7492         request->wiphy = &rdev->wiphy;
7493         request->scan_start = jiffies;
7494
7495         rdev->scan_req = request;
7496         err = rdev_scan(rdev, request);
7497
7498         if (!err) {
7499                 nl80211_send_scan_start(rdev, wdev);
7500                 if (wdev->netdev)
7501                         dev_hold(wdev->netdev);
7502         } else {
7503  out_free:
7504                 rdev->scan_req = NULL;
7505                 kfree(request);
7506         }
7507
7508  unlock:
7509         return err;
7510 }
7511
7512 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7513 {
7514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7515         struct wireless_dev *wdev = info->user_ptr[1];
7516
7517         if (!rdev->ops->abort_scan)
7518                 return -EOPNOTSUPP;
7519
7520         if (rdev->scan_msg)
7521                 return 0;
7522
7523         if (!rdev->scan_req)
7524                 return -ENOENT;
7525
7526         rdev_abort_scan(rdev, wdev);
7527         return 0;
7528 }
7529
7530 static int
7531 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7532                                struct cfg80211_sched_scan_request *request,
7533                                struct nlattr **attrs)
7534 {
7535         int tmp, err, i = 0;
7536         struct nlattr *attr;
7537
7538         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7539                 u32 interval;
7540
7541                 /*
7542                  * If scan plans are not specified,
7543                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7544                  * case one scan plan will be set with the specified scan
7545                  * interval and infinite number of iterations.
7546                  */
7547                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7548                 if (!interval)
7549                         return -EINVAL;
7550
7551                 request->scan_plans[0].interval =
7552                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7553                 if (!request->scan_plans[0].interval)
7554                         return -EINVAL;
7555
7556                 if (request->scan_plans[0].interval >
7557                     wiphy->max_sched_scan_plan_interval)
7558                         request->scan_plans[0].interval =
7559                                 wiphy->max_sched_scan_plan_interval;
7560
7561                 return 0;
7562         }
7563
7564         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7565                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7566
7567                 if (WARN_ON(i >= n_plans))
7568                         return -EINVAL;
7569
7570                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7571                                        attr, nl80211_plan_policy, NULL);
7572                 if (err)
7573                         return err;
7574
7575                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7576                         return -EINVAL;
7577
7578                 request->scan_plans[i].interval =
7579                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7580                 if (!request->scan_plans[i].interval ||
7581                     request->scan_plans[i].interval >
7582                     wiphy->max_sched_scan_plan_interval)
7583                         return -EINVAL;
7584
7585                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7586                         request->scan_plans[i].iterations =
7587                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7588                         if (!request->scan_plans[i].iterations ||
7589                             (request->scan_plans[i].iterations >
7590                              wiphy->max_sched_scan_plan_iterations))
7591                                 return -EINVAL;
7592                 } else if (i < n_plans - 1) {
7593                         /*
7594                          * All scan plans but the last one must specify
7595                          * a finite number of iterations
7596                          */
7597                         return -EINVAL;
7598                 }
7599
7600                 i++;
7601         }
7602
7603         /*
7604          * The last scan plan must not specify the number of
7605          * iterations, it is supposed to run infinitely
7606          */
7607         if (request->scan_plans[n_plans - 1].iterations)
7608                 return  -EINVAL;
7609
7610         return 0;
7611 }
7612
7613 static int
7614 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
7615                                        struct cfg80211_match_set *match_sets,
7616                                        struct nlattr *tb_band_rssi,
7617                                        s32 rssi_thold)
7618 {
7619         struct nlattr *attr;
7620         int i, tmp, ret = 0;
7621
7622         if (!wiphy_ext_feature_isset(wiphy,
7623                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
7624                 if (tb_band_rssi)
7625                         ret = -EOPNOTSUPP;
7626                 else
7627                         for (i = 0; i < NUM_NL80211_BANDS; i++)
7628                                 match_sets->per_band_rssi_thold[i] =
7629                                         NL80211_SCAN_RSSI_THOLD_OFF;
7630                 return ret;
7631         }
7632
7633         for (i = 0; i < NUM_NL80211_BANDS; i++)
7634                 match_sets->per_band_rssi_thold[i] = rssi_thold;
7635
7636         nla_for_each_nested(attr, tb_band_rssi, tmp) {
7637                 enum nl80211_band band = nla_type(attr);
7638
7639                 if (band < 0 || band >= NUM_NL80211_BANDS)
7640                         return -EINVAL;
7641
7642                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
7643         }
7644
7645         return 0;
7646 }
7647
7648 static struct cfg80211_sched_scan_request *
7649 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7650                          struct nlattr **attrs, int max_match_sets)
7651 {
7652         struct cfg80211_sched_scan_request *request;
7653         struct nlattr *attr;
7654         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7655         enum nl80211_band band;
7656         size_t ie_len;
7657         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7658         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7659
7660         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7661                 n_channels = validate_scan_freqs(
7662                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7663                 if (!n_channels)
7664                         return ERR_PTR(-EINVAL);
7665         } else {
7666                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7667         }
7668
7669         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7670                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7671                                     tmp)
7672                         n_ssids++;
7673
7674         if (n_ssids > wiphy->max_sched_scan_ssids)
7675                 return ERR_PTR(-EINVAL);
7676
7677         /*
7678          * First, count the number of 'real' matchsets. Due to an issue with
7679          * the old implementation, matchsets containing only the RSSI attribute
7680          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7681          * RSSI for all matchsets, rather than their own matchset for reporting
7682          * all APs with a strong RSSI. This is needed to be compatible with
7683          * older userspace that treated a matchset with only the RSSI as the
7684          * global RSSI for all other matchsets - if there are other matchsets.
7685          */
7686         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7687                 nla_for_each_nested(attr,
7688                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7689                                     tmp) {
7690                         struct nlattr *rssi;
7691
7692                         err = nla_parse_nested(tb,
7693                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7694                                                attr, nl80211_match_policy,
7695                                                NULL);
7696                         if (err)
7697                                 return ERR_PTR(err);
7698
7699                         /* SSID and BSSID are mutually exclusive */
7700                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7701                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7702                                 return ERR_PTR(-EINVAL);
7703
7704                         /* add other standalone attributes here */
7705                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7706                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7707                                 n_match_sets++;
7708                                 continue;
7709                         }
7710                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7711                         if (rssi)
7712                                 default_match_rssi = nla_get_s32(rssi);
7713                 }
7714         }
7715
7716         /* However, if there's no other matchset, add the RSSI one */
7717         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7718                 n_match_sets = 1;
7719
7720         if (n_match_sets > max_match_sets)
7721                 return ERR_PTR(-EINVAL);
7722
7723         if (attrs[NL80211_ATTR_IE])
7724                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7725         else
7726                 ie_len = 0;
7727
7728         if (ie_len > wiphy->max_sched_scan_ie_len)
7729                 return ERR_PTR(-EINVAL);
7730
7731         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7732                 /*
7733                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7734                  * each scan plan already specifies its own interval
7735                  */
7736                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7737                         return ERR_PTR(-EINVAL);
7738
7739                 nla_for_each_nested(attr,
7740                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7741                         n_plans++;
7742         } else {
7743                 /*
7744                  * The scan interval attribute is kept for backward
7745                  * compatibility. If no scan plans are specified and sched scan
7746                  * interval is specified, one scan plan will be set with this
7747                  * scan interval and infinite number of iterations.
7748                  */
7749                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7750                         return ERR_PTR(-EINVAL);
7751
7752                 n_plans = 1;
7753         }
7754
7755         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7756                 return ERR_PTR(-EINVAL);
7757
7758         if (!wiphy_ext_feature_isset(
7759                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7760             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7761              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7762                 return ERR_PTR(-EINVAL);
7763
7764         request = kzalloc(sizeof(*request)
7765                         + sizeof(*request->ssids) * n_ssids
7766                         + sizeof(*request->match_sets) * n_match_sets
7767                         + sizeof(*request->scan_plans) * n_plans
7768                         + sizeof(*request->channels) * n_channels
7769                         + ie_len, GFP_KERNEL);
7770         if (!request)
7771                 return ERR_PTR(-ENOMEM);
7772
7773         if (n_ssids)
7774                 request->ssids = (void *)&request->channels[n_channels];
7775         request->n_ssids = n_ssids;
7776         if (ie_len) {
7777                 if (n_ssids)
7778                         request->ie = (void *)(request->ssids + n_ssids);
7779                 else
7780                         request->ie = (void *)(request->channels + n_channels);
7781         }
7782
7783         if (n_match_sets) {
7784                 if (request->ie)
7785                         request->match_sets = (void *)(request->ie + ie_len);
7786                 else if (n_ssids)
7787                         request->match_sets =
7788                                 (void *)(request->ssids + n_ssids);
7789                 else
7790                         request->match_sets =
7791                                 (void *)(request->channels + n_channels);
7792         }
7793         request->n_match_sets = n_match_sets;
7794
7795         if (n_match_sets)
7796                 request->scan_plans = (void *)(request->match_sets +
7797                                                n_match_sets);
7798         else if (request->ie)
7799                 request->scan_plans = (void *)(request->ie + ie_len);
7800         else if (n_ssids)
7801                 request->scan_plans = (void *)(request->ssids + n_ssids);
7802         else
7803                 request->scan_plans = (void *)(request->channels + n_channels);
7804
7805         request->n_scan_plans = n_plans;
7806
7807         i = 0;
7808         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7809                 /* user specified, bail out if channel not found */
7810                 nla_for_each_nested(attr,
7811                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7812                                     tmp) {
7813                         struct ieee80211_channel *chan;
7814
7815                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7816
7817                         if (!chan) {
7818                                 err = -EINVAL;
7819                                 goto out_free;
7820                         }
7821
7822                         /* ignore disabled channels */
7823                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7824                                 continue;
7825
7826                         request->channels[i] = chan;
7827                         i++;
7828                 }
7829         } else {
7830                 /* all channels */
7831                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7832                         int j;
7833
7834                         if (!wiphy->bands[band])
7835                                 continue;
7836                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7837                                 struct ieee80211_channel *chan;
7838
7839                                 chan = &wiphy->bands[band]->channels[j];
7840
7841                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7842                                         continue;
7843
7844                                 request->channels[i] = chan;
7845                                 i++;
7846                         }
7847                 }
7848         }
7849
7850         if (!i) {
7851                 err = -EINVAL;
7852                 goto out_free;
7853         }
7854
7855         request->n_channels = i;
7856
7857         i = 0;
7858         if (n_ssids) {
7859                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7860                                     tmp) {
7861                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7862                                 err = -EINVAL;
7863                                 goto out_free;
7864                         }
7865                         request->ssids[i].ssid_len = nla_len(attr);
7866                         memcpy(request->ssids[i].ssid, nla_data(attr),
7867                                nla_len(attr));
7868                         i++;
7869                 }
7870         }
7871
7872         i = 0;
7873         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7874                 nla_for_each_nested(attr,
7875                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7876                                     tmp) {
7877                         struct nlattr *ssid, *bssid, *rssi;
7878
7879                         err = nla_parse_nested(tb,
7880                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7881                                                attr, nl80211_match_policy,
7882                                                NULL);
7883                         if (err)
7884                                 goto out_free;
7885                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7886                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7887
7888                         if (!ssid && !bssid) {
7889                                 i++;
7890                                 continue;
7891                         }
7892
7893                         if (WARN_ON(i >= n_match_sets)) {
7894                                 /* this indicates a programming error,
7895                                  * the loop above should have verified
7896                                  * things properly
7897                                  */
7898                                 err = -EINVAL;
7899                                 goto out_free;
7900                         }
7901
7902                         if (ssid) {
7903                                 if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7904                                         err = -EINVAL;
7905                                         goto out_free;
7906                                 }
7907                                 memcpy(request->match_sets[i].ssid.ssid,
7908                                        nla_data(ssid), nla_len(ssid));
7909                                 request->match_sets[i].ssid.ssid_len =
7910                                         nla_len(ssid);
7911                         }
7912                         if (bssid) {
7913                                 if (nla_len(bssid) != ETH_ALEN) {
7914                                         err = -EINVAL;
7915                                         goto out_free;
7916                                 }
7917                                 memcpy(request->match_sets[i].bssid,
7918                                        nla_data(bssid), ETH_ALEN);
7919                         }
7920
7921                         /* special attribute - old implementation w/a */
7922                         request->match_sets[i].rssi_thold = default_match_rssi;
7923                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7924                         if (rssi)
7925                                 request->match_sets[i].rssi_thold =
7926                                         nla_get_s32(rssi);
7927
7928                         /* Parse per band RSSI attribute */
7929                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
7930                                 &request->match_sets[i],
7931                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
7932                                 request->match_sets[i].rssi_thold);
7933                         if (err)
7934                                 goto out_free;
7935
7936                         i++;
7937                 }
7938
7939                 /* there was no other matchset, so the RSSI one is alone */
7940                 if (i == 0 && n_match_sets)
7941                         request->match_sets[0].rssi_thold = default_match_rssi;
7942
7943                 request->min_rssi_thold = INT_MAX;
7944                 for (i = 0; i < n_match_sets; i++)
7945                         request->min_rssi_thold =
7946                                 min(request->match_sets[i].rssi_thold,
7947                                     request->min_rssi_thold);
7948         } else {
7949                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7950         }
7951
7952         if (ie_len) {
7953                 request->ie_len = ie_len;
7954                 memcpy((void *)request->ie,
7955                        nla_data(attrs[NL80211_ATTR_IE]),
7956                        request->ie_len);
7957         }
7958
7959         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7960         if (err)
7961                 goto out_free;
7962
7963         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7964                 request->delay =
7965                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7966
7967         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7968                 request->relative_rssi = nla_get_s8(
7969                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7970                 request->relative_rssi_set = true;
7971         }
7972
7973         if (request->relative_rssi_set &&
7974             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7975                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7976
7977                 rssi_adjust = nla_data(
7978                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7979                 request->rssi_adjust.band = rssi_adjust->band;
7980                 request->rssi_adjust.delta = rssi_adjust->delta;
7981                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7982                         err = -EINVAL;
7983                         goto out_free;
7984                 }
7985         }
7986
7987         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7988         if (err)
7989                 goto out_free;
7990
7991         request->scan_start = jiffies;
7992
7993         return request;
7994
7995 out_free:
7996         kfree(request);
7997         return ERR_PTR(err);
7998 }
7999
8000 static int nl80211_start_sched_scan(struct sk_buff *skb,
8001                                     struct genl_info *info)
8002 {
8003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8004         struct net_device *dev = info->user_ptr[1];
8005         struct wireless_dev *wdev = dev->ieee80211_ptr;
8006         struct cfg80211_sched_scan_request *sched_scan_req;
8007         bool want_multi;
8008         int err;
8009
8010         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8011                 return -EOPNOTSUPP;
8012
8013         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8014         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8015         if (err)
8016                 return err;
8017
8018         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8019                                                   info->attrs,
8020                                                   rdev->wiphy.max_match_sets);
8021
8022         err = PTR_ERR_OR_ZERO(sched_scan_req);
8023         if (err)
8024                 goto out_err;
8025
8026         /* leave request id zero for legacy request
8027          * or if driver does not support multi-scheduled scan
8028          */
8029         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
8030                 while (!sched_scan_req->reqid)
8031                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
8032         }
8033
8034         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
8035         if (err)
8036                 goto out_free;
8037
8038         sched_scan_req->dev = dev;
8039         sched_scan_req->wiphy = &rdev->wiphy;
8040
8041         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8042                 sched_scan_req->owner_nlportid = info->snd_portid;
8043
8044         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
8045
8046         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
8047         return 0;
8048
8049 out_free:
8050         kfree(sched_scan_req);
8051 out_err:
8052         return err;
8053 }
8054
8055 static int nl80211_stop_sched_scan(struct sk_buff *skb,
8056                                    struct genl_info *info)
8057 {
8058         struct cfg80211_sched_scan_request *req;
8059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8060         u64 cookie;
8061
8062         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
8063                 return -EOPNOTSUPP;
8064
8065         if (info->attrs[NL80211_ATTR_COOKIE]) {
8066                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
8067                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
8068         }
8069
8070         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
8071                                      struct cfg80211_sched_scan_request,
8072                                      list);
8073         if (!req || req->reqid ||
8074             (req->owner_nlportid &&
8075              req->owner_nlportid != info->snd_portid))
8076                 return -ENOENT;
8077
8078         return cfg80211_stop_sched_scan_req(rdev, req, false);
8079 }
8080
8081 static int nl80211_start_radar_detection(struct sk_buff *skb,
8082                                          struct genl_info *info)
8083 {
8084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8085         struct net_device *dev = info->user_ptr[1];
8086         struct wireless_dev *wdev = dev->ieee80211_ptr;
8087         struct wiphy *wiphy = wdev->wiphy;
8088         struct cfg80211_chan_def chandef;
8089         enum nl80211_dfs_regions dfs_region;
8090         unsigned int cac_time_ms;
8091         int err;
8092
8093         dfs_region = reg_get_dfs_region(wiphy);
8094         if (dfs_region == NL80211_DFS_UNSET)
8095                 return -EINVAL;
8096
8097         err = nl80211_parse_chandef(rdev, info, &chandef);
8098         if (err)
8099                 return err;
8100
8101         if (netif_carrier_ok(dev))
8102                 return -EBUSY;
8103
8104         if (wdev->cac_started)
8105                 return -EBUSY;
8106
8107         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8108         if (err < 0)
8109                 return err;
8110
8111         if (err == 0)
8112                 return -EINVAL;
8113
8114         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
8115                 return -EINVAL;
8116
8117         /* CAC start is offloaded to HW and can't be started manually */
8118         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
8119                 return -EOPNOTSUPP;
8120
8121         if (!rdev->ops->start_radar_detection)
8122                 return -EOPNOTSUPP;
8123
8124         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
8125         if (WARN_ON(!cac_time_ms))
8126                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
8127
8128         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
8129         if (!err) {
8130                 wdev->chandef = chandef;
8131                 wdev->cac_started = true;
8132                 wdev->cac_start_time = jiffies;
8133                 wdev->cac_time_ms = cac_time_ms;
8134         }
8135         return err;
8136 }
8137
8138 static int nl80211_notify_radar_detection(struct sk_buff *skb,
8139                                           struct genl_info *info)
8140 {
8141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8142         struct net_device *dev = info->user_ptr[1];
8143         struct wireless_dev *wdev = dev->ieee80211_ptr;
8144         struct wiphy *wiphy = wdev->wiphy;
8145         struct cfg80211_chan_def chandef;
8146         enum nl80211_dfs_regions dfs_region;
8147         int err;
8148
8149         dfs_region = reg_get_dfs_region(wiphy);
8150         if (dfs_region == NL80211_DFS_UNSET) {
8151                 GENL_SET_ERR_MSG(info,
8152                                  "DFS Region is not set. Unexpected Radar indication");
8153                 return -EINVAL;
8154         }
8155
8156         err = nl80211_parse_chandef(rdev, info, &chandef);
8157         if (err) {
8158                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
8159                 return err;
8160         }
8161
8162         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
8163         if (err < 0) {
8164                 GENL_SET_ERR_MSG(info, "chandef is invalid");
8165                 return err;
8166         }
8167
8168         if (err == 0) {
8169                 GENL_SET_ERR_MSG(info,
8170                                  "Unexpected Radar indication for chandef/iftype");
8171                 return -EINVAL;
8172         }
8173
8174         /* Do not process this notification if radar is already detected
8175          * by kernel on this channel, and return success.
8176          */
8177         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
8178                 return 0;
8179
8180         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
8181
8182         cfg80211_sched_dfs_chan_update(rdev);
8183
8184         memcpy(&rdev->radar_chandef, &chandef, sizeof(chandef));
8185
8186         /* Propagate this notification to other radios as well */
8187         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
8188
8189         return 0;
8190 }
8191
8192 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
8193 {
8194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8195         struct net_device *dev = info->user_ptr[1];
8196         struct wireless_dev *wdev = dev->ieee80211_ptr;
8197         struct cfg80211_csa_settings params;
8198         /* csa_attrs is defined static to avoid waste of stack size - this
8199          * function is called under RTNL lock, so this should not be a problem.
8200          */
8201         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
8202         int err;
8203         bool need_new_beacon = false;
8204         bool need_handle_dfs_flag = true;
8205         int len, i;
8206         u32 cs_count;
8207
8208         if (!rdev->ops->channel_switch ||
8209             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
8210                 return -EOPNOTSUPP;
8211
8212         switch (dev->ieee80211_ptr->iftype) {
8213         case NL80211_IFTYPE_AP:
8214         case NL80211_IFTYPE_P2P_GO:
8215                 need_new_beacon = true;
8216                 /* For all modes except AP the handle_dfs flag needs to be
8217                  * supplied to tell the kernel that userspace will handle radar
8218                  * events when they happen. Otherwise a switch to a channel
8219                  * requiring DFS will be rejected.
8220                  */
8221                 need_handle_dfs_flag = false;
8222
8223                 /* useless if AP is not running */
8224                 if (!wdev->beacon_interval)
8225                         return -ENOTCONN;
8226                 break;
8227         case NL80211_IFTYPE_ADHOC:
8228                 if (!wdev->ssid_len)
8229                         return -ENOTCONN;
8230                 break;
8231         case NL80211_IFTYPE_MESH_POINT:
8232                 if (!wdev->mesh_id_len)
8233                         return -ENOTCONN;
8234                 break;
8235         default:
8236                 return -EOPNOTSUPP;
8237         }
8238
8239         memset(&params, 0, sizeof(params));
8240         params.beacon_csa.ftm_responder = -1;
8241
8242         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
8243             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
8244                 return -EINVAL;
8245
8246         /* only important for AP, IBSS and mesh create IEs internally */
8247         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
8248                 return -EINVAL;
8249
8250         /* Even though the attribute is u32, the specification says
8251          * u8, so let's make sure we don't overflow.
8252          */
8253         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
8254         if (cs_count > 255)
8255                 return -EINVAL;
8256
8257         params.count = cs_count;
8258
8259         if (!need_new_beacon)
8260                 goto skip_beacons;
8261
8262         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
8263         if (err)
8264                 return err;
8265
8266         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
8267                                info->attrs[NL80211_ATTR_CSA_IES],
8268                                nl80211_policy, info->extack);
8269         if (err)
8270                 return err;
8271
8272         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
8273         if (err)
8274                 return err;
8275
8276         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8277                 return -EINVAL;
8278
8279         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8280         if (!len || (len % sizeof(u16)))
8281                 return -EINVAL;
8282
8283         params.n_counter_offsets_beacon = len / sizeof(u16);
8284         if (rdev->wiphy.max_num_csa_counters &&
8285             (params.n_counter_offsets_beacon >
8286              rdev->wiphy.max_num_csa_counters))
8287                 return -EINVAL;
8288
8289         params.counter_offsets_beacon =
8290                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8291
8292         /* sanity checks - counters should fit and be the same */
8293         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8294                 u16 offset = params.counter_offsets_beacon[i];
8295
8296                 if (offset >= params.beacon_csa.tail_len)
8297                         return -EINVAL;
8298
8299                 if (params.beacon_csa.tail[offset] != params.count)
8300                         return -EINVAL;
8301         }
8302
8303         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8304                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8305                 if (!len || (len % sizeof(u16)))
8306                         return -EINVAL;
8307
8308                 params.n_counter_offsets_presp = len / sizeof(u16);
8309                 if (rdev->wiphy.max_num_csa_counters &&
8310                     (params.n_counter_offsets_presp >
8311                      rdev->wiphy.max_num_csa_counters))
8312                         return -EINVAL;
8313
8314                 params.counter_offsets_presp =
8315                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8316
8317                 /* sanity checks - counters should fit and be the same */
8318                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8319                         u16 offset = params.counter_offsets_presp[i];
8320
8321                         if (offset >= params.beacon_csa.probe_resp_len)
8322                                 return -EINVAL;
8323
8324                         if (params.beacon_csa.probe_resp[offset] !=
8325                             params.count)
8326                                 return -EINVAL;
8327                 }
8328         }
8329
8330 skip_beacons:
8331         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8332         if (err)
8333                 return err;
8334
8335         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8336                                            wdev->iftype))
8337                 return -EINVAL;
8338
8339         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8340                                             &params.chandef,
8341                                             wdev->iftype);
8342         if (err < 0)
8343                 return err;
8344
8345         if (err > 0) {
8346                 params.radar_required = true;
8347                 if (need_handle_dfs_flag &&
8348                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8349                         return -EINVAL;
8350                 }
8351         }
8352
8353         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8354                 params.block_tx = true;
8355
8356         wdev_lock(wdev);
8357         err = rdev_channel_switch(rdev, dev, &params);
8358         wdev_unlock(wdev);
8359
8360         return err;
8361 }
8362
8363 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8364                             u32 seq, int flags,
8365                             struct cfg80211_registered_device *rdev,
8366                             struct wireless_dev *wdev,
8367                             struct cfg80211_internal_bss *intbss)
8368 {
8369         struct cfg80211_bss *res = &intbss->pub;
8370         const struct cfg80211_bss_ies *ies;
8371         void *hdr;
8372         struct nlattr *bss;
8373
8374         ASSERT_WDEV_LOCK(wdev);
8375
8376         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8377                              NL80211_CMD_NEW_SCAN_RESULTS);
8378         if (!hdr)
8379                 return -1;
8380
8381         genl_dump_check_consistent(cb, hdr);
8382
8383         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8384                 goto nla_put_failure;
8385         if (wdev->netdev &&
8386             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8387                 goto nla_put_failure;
8388         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8389                               NL80211_ATTR_PAD))
8390                 goto nla_put_failure;
8391
8392         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8393         if (!bss)
8394                 goto nla_put_failure;
8395         if ((!is_zero_ether_addr(res->bssid) &&
8396              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8397                 goto nla_put_failure;
8398
8399         rcu_read_lock();
8400         /* indicate whether we have probe response data or not */
8401         if (rcu_access_pointer(res->proberesp_ies) &&
8402             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8403                 goto fail_unlock_rcu;
8404
8405         /* this pointer prefers to be pointed to probe response data
8406          * but is always valid
8407          */
8408         ies = rcu_dereference(res->ies);
8409         if (ies) {
8410                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8411                                       NL80211_BSS_PAD))
8412                         goto fail_unlock_rcu;
8413                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8414                                         ies->len, ies->data))
8415                         goto fail_unlock_rcu;
8416         }
8417
8418         /* and this pointer is always (unless driver didn't know) beacon data */
8419         ies = rcu_dereference(res->beacon_ies);
8420         if (ies && ies->from_beacon) {
8421                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8422                                       NL80211_BSS_PAD))
8423                         goto fail_unlock_rcu;
8424                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8425                                         ies->len, ies->data))
8426                         goto fail_unlock_rcu;
8427         }
8428         rcu_read_unlock();
8429
8430         if (res->beacon_interval &&
8431             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8432                 goto nla_put_failure;
8433         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8434             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8435             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8436             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8437                         jiffies_to_msecs(jiffies - intbss->ts)))
8438                 goto nla_put_failure;
8439
8440         if (intbss->parent_tsf &&
8441             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8442                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8443              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8444                      intbss->parent_bssid)))
8445                 goto nla_put_failure;
8446
8447         if (intbss->ts_boottime &&
8448             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8449                               intbss->ts_boottime, NL80211_BSS_PAD))
8450                 goto nla_put_failure;
8451
8452         if (!nl80211_put_signal(msg, intbss->pub.chains,
8453                                 intbss->pub.chain_signal,
8454                                 NL80211_BSS_CHAIN_SIGNAL))
8455                 goto nla_put_failure;
8456
8457         switch (rdev->wiphy.signal_type) {
8458         case CFG80211_SIGNAL_TYPE_MBM:
8459                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8460                         goto nla_put_failure;
8461                 break;
8462         case CFG80211_SIGNAL_TYPE_UNSPEC:
8463                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8464                         goto nla_put_failure;
8465                 break;
8466         default:
8467                 break;
8468         }
8469
8470         switch (wdev->iftype) {
8471         case NL80211_IFTYPE_P2P_CLIENT:
8472         case NL80211_IFTYPE_STATION:
8473                 if (intbss == wdev->current_bss &&
8474                     nla_put_u32(msg, NL80211_BSS_STATUS,
8475                                 NL80211_BSS_STATUS_ASSOCIATED))
8476                         goto nla_put_failure;
8477                 break;
8478         case NL80211_IFTYPE_ADHOC:
8479                 if (intbss == wdev->current_bss &&
8480                     nla_put_u32(msg, NL80211_BSS_STATUS,
8481                                 NL80211_BSS_STATUS_IBSS_JOINED))
8482                         goto nla_put_failure;
8483                 break;
8484         default:
8485                 break;
8486         }
8487
8488         nla_nest_end(msg, bss);
8489
8490         genlmsg_end(msg, hdr);
8491         return 0;
8492
8493  fail_unlock_rcu:
8494         rcu_read_unlock();
8495  nla_put_failure:
8496         genlmsg_cancel(msg, hdr);
8497         return -EMSGSIZE;
8498 }
8499
8500 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8501 {
8502         struct cfg80211_registered_device *rdev;
8503         struct cfg80211_internal_bss *scan;
8504         struct wireless_dev *wdev;
8505         int start = cb->args[2], idx = 0;
8506         int err;
8507
8508         rtnl_lock();
8509         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8510         if (err) {
8511                 rtnl_unlock();
8512                 return err;
8513         }
8514
8515         wdev_lock(wdev);
8516         spin_lock_bh(&rdev->bss_lock);
8517
8518         /*
8519          * dump_scan will be called multiple times to break up the scan results
8520          * into multiple messages.  It is unlikely that any more bss-es will be
8521          * expired after the first call, so only call only call this on the
8522          * first dump_scan invocation.
8523          */
8524         if (start == 0)
8525                 cfg80211_bss_expire(rdev);
8526
8527         cb->seq = rdev->bss_generation;
8528
8529         list_for_each_entry(scan, &rdev->bss_list, list) {
8530                 if (++idx <= start)
8531                         continue;
8532                 if (nl80211_send_bss(skb, cb,
8533                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8534                                 rdev, wdev, scan) < 0) {
8535                         idx--;
8536                         break;
8537                 }
8538         }
8539
8540         spin_unlock_bh(&rdev->bss_lock);
8541         wdev_unlock(wdev);
8542
8543         cb->args[2] = idx;
8544         rtnl_unlock();
8545
8546         return skb->len;
8547 }
8548
8549 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8550                                int flags, struct net_device *dev,
8551                                bool allow_radio_stats,
8552                                struct survey_info *survey)
8553 {
8554         void *hdr;
8555         struct nlattr *infoattr;
8556
8557         /* skip radio stats if userspace didn't request them */
8558         if (!survey->channel && !allow_radio_stats)
8559                 return 0;
8560
8561         hdr = nl80211hdr_put(msg, portid, seq, flags,
8562                              NL80211_CMD_NEW_SURVEY_RESULTS);
8563         if (!hdr)
8564                 return -ENOMEM;
8565
8566         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8567                 goto nla_put_failure;
8568
8569         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8570         if (!infoattr)
8571                 goto nla_put_failure;
8572
8573         if (survey->channel &&
8574             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8575                         survey->channel->center_freq))
8576                 goto nla_put_failure;
8577
8578         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8579             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8580                 goto nla_put_failure;
8581         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8582             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8583                 goto nla_put_failure;
8584         if ((survey->filled & SURVEY_INFO_TIME) &&
8585             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8586                         survey->time, NL80211_SURVEY_INFO_PAD))
8587                 goto nla_put_failure;
8588         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8589             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8590                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8591                 goto nla_put_failure;
8592         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8593             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8594                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8595                 goto nla_put_failure;
8596         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8597             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8598                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8599                 goto nla_put_failure;
8600         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8601             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8602                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8603                 goto nla_put_failure;
8604         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8605             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8606                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8607                 goto nla_put_failure;
8608
8609         nla_nest_end(msg, infoattr);
8610
8611         genlmsg_end(msg, hdr);
8612         return 0;
8613
8614  nla_put_failure:
8615         genlmsg_cancel(msg, hdr);
8616         return -EMSGSIZE;
8617 }
8618
8619 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8620 {
8621         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8622         struct survey_info survey;
8623         struct cfg80211_registered_device *rdev;
8624         struct wireless_dev *wdev;
8625         int survey_idx = cb->args[2];
8626         int res;
8627         bool radio_stats;
8628
8629         rtnl_lock();
8630         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8631         if (res)
8632                 goto out_err;
8633
8634         /* prepare_wdev_dump parsed the attributes */
8635         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8636
8637         if (!wdev->netdev) {
8638                 res = -EINVAL;
8639                 goto out_err;
8640         }
8641
8642         if (!rdev->ops->dump_survey) {
8643                 res = -EOPNOTSUPP;
8644                 goto out_err;
8645         }
8646
8647         while (1) {
8648                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8649                 if (res == -ENOENT)
8650                         break;
8651                 if (res)
8652                         goto out_err;
8653
8654                 /* don't send disabled channels, but do send non-channel data */
8655                 if (survey.channel &&
8656                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8657                         survey_idx++;
8658                         continue;
8659                 }
8660
8661                 if (nl80211_send_survey(skb,
8662                                 NETLINK_CB(cb->skb).portid,
8663                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8664                                 wdev->netdev, radio_stats, &survey) < 0)
8665                         goto out;
8666                 survey_idx++;
8667         }
8668
8669  out:
8670         cb->args[2] = survey_idx;
8671         res = skb->len;
8672  out_err:
8673         rtnl_unlock();
8674         return res;
8675 }
8676
8677 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8678 {
8679         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8680                                   NL80211_WPA_VERSION_2));
8681 }
8682
8683 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8684 {
8685         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8686         struct net_device *dev = info->user_ptr[1];
8687         struct ieee80211_channel *chan;
8688         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8689         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8690         enum nl80211_auth_type auth_type;
8691         struct key_parse key;
8692         bool local_state_change;
8693
8694         if (!info->attrs[NL80211_ATTR_MAC])
8695                 return -EINVAL;
8696
8697         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8698                 return -EINVAL;
8699
8700         if (!info->attrs[NL80211_ATTR_SSID])
8701                 return -EINVAL;
8702
8703         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8704                 return -EINVAL;
8705
8706         err = nl80211_parse_key(info, &key);
8707         if (err)
8708                 return err;
8709
8710         if (key.idx >= 0) {
8711                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8712                         return -EINVAL;
8713                 if (!key.p.key || !key.p.key_len)
8714                         return -EINVAL;
8715                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8716                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8717                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8718                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8719                         return -EINVAL;
8720                 if (key.idx > 3)
8721                         return -EINVAL;
8722         } else {
8723                 key.p.key_len = 0;
8724                 key.p.key = NULL;
8725         }
8726
8727         if (key.idx >= 0) {
8728                 int i;
8729                 bool ok = false;
8730
8731                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8732                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8733                                 ok = true;
8734                                 break;
8735                         }
8736                 }
8737                 if (!ok)
8738                         return -EINVAL;
8739         }
8740
8741         if (!rdev->ops->auth)
8742                 return -EOPNOTSUPP;
8743
8744         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8745             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8746                 return -EOPNOTSUPP;
8747
8748         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8749         chan = nl80211_get_valid_chan(&rdev->wiphy,
8750                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8751         if (!chan)
8752                 return -EINVAL;
8753
8754         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8755         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8756
8757         if (info->attrs[NL80211_ATTR_IE]) {
8758                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8759                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8760         }
8761
8762         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8763         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8764                 return -EINVAL;
8765
8766         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8767              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8768              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8769              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8770             !info->attrs[NL80211_ATTR_AUTH_DATA])
8771                 return -EINVAL;
8772
8773         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8774                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8775                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8776                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8777                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8778                         return -EINVAL;
8779                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8780                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8781                 /* need to include at least Auth Transaction and Status Code */
8782                 if (auth_data_len < 4)
8783                         return -EINVAL;
8784         }
8785
8786         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8787
8788         /*
8789          * Since we no longer track auth state, ignore
8790          * requests to only change local state.
8791          */
8792         if (local_state_change)
8793                 return 0;
8794
8795         wdev_lock(dev->ieee80211_ptr);
8796         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8797                                  ssid, ssid_len, ie, ie_len,
8798                                  key.p.key, key.p.key_len, key.idx,
8799                                  auth_data, auth_data_len);
8800         wdev_unlock(dev->ieee80211_ptr);
8801         return err;
8802 }
8803
8804 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8805                                      struct genl_info *info)
8806 {
8807         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8808                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8809                 return -EINVAL;
8810         }
8811
8812         if (!rdev->ops->tx_control_port ||
8813             !wiphy_ext_feature_isset(&rdev->wiphy,
8814                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8815                 return -EOPNOTSUPP;
8816
8817         return 0;
8818 }
8819
8820 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8821                                    struct genl_info *info,
8822                                    struct cfg80211_crypto_settings *settings,
8823                                    int cipher_limit)
8824 {
8825         memset(settings, 0, sizeof(*settings));
8826
8827         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8828
8829         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8830                 u16 proto;
8831
8832                 proto = nla_get_u16(
8833                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8834                 settings->control_port_ethertype = cpu_to_be16(proto);
8835                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8836                     proto != ETH_P_PAE)
8837                         return -EINVAL;
8838                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8839                         settings->control_port_no_encrypt = true;
8840         } else
8841                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8842
8843         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8844                 int r = validate_pae_over_nl80211(rdev, info);
8845
8846                 if (r < 0)
8847                         return r;
8848
8849                 settings->control_port_over_nl80211 = true;
8850         }
8851
8852         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8853                 void *data;
8854                 int len, i;
8855
8856                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8857                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8858                 settings->n_ciphers_pairwise = len / sizeof(u32);
8859
8860                 if (len % sizeof(u32))
8861                         return -EINVAL;
8862
8863                 if (settings->n_ciphers_pairwise > cipher_limit)
8864                         return -EINVAL;
8865
8866                 memcpy(settings->ciphers_pairwise, data, len);
8867
8868                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8869                         if (!cfg80211_supported_cipher_suite(
8870                                         &rdev->wiphy,
8871                                         settings->ciphers_pairwise[i]))
8872                                 return -EINVAL;
8873         }
8874
8875         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8876                 settings->cipher_group =
8877                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8878                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8879                                                      settings->cipher_group))
8880                         return -EINVAL;
8881         }
8882
8883         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8884                 settings->wpa_versions =
8885                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8886                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8887                         return -EINVAL;
8888         }
8889
8890         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8891                 void *data;
8892                 int len;
8893
8894                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8895                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8896                 settings->n_akm_suites = len / sizeof(u32);
8897
8898                 if (len % sizeof(u32))
8899                         return -EINVAL;
8900
8901                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8902                         return -EINVAL;
8903
8904                 memcpy(settings->akm_suites, data, len);
8905         }
8906
8907         if (info->attrs[NL80211_ATTR_PMK]) {
8908                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8909                         return -EINVAL;
8910                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8911                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8912                         return -EINVAL;
8913                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8914         }
8915
8916         return 0;
8917 }
8918
8919 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8920 {
8921         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8922         struct net_device *dev = info->user_ptr[1];
8923         struct ieee80211_channel *chan;
8924         struct cfg80211_assoc_request req = {};
8925         const u8 *bssid, *ssid;
8926         int err, ssid_len = 0;
8927
8928         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8929             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8930                 return -EPERM;
8931
8932         if (!info->attrs[NL80211_ATTR_MAC] ||
8933             !info->attrs[NL80211_ATTR_SSID] ||
8934             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8935                 return -EINVAL;
8936
8937         if (!rdev->ops->assoc)
8938                 return -EOPNOTSUPP;
8939
8940         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8941             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8942                 return -EOPNOTSUPP;
8943
8944         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8945
8946         chan = nl80211_get_valid_chan(&rdev->wiphy,
8947                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8948         if (!chan)
8949                 return -EINVAL;
8950
8951         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8952         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8953
8954         if (info->attrs[NL80211_ATTR_IE]) {
8955                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8956                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8957         }
8958
8959         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8960                 enum nl80211_mfp mfp =
8961                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8962                 if (mfp == NL80211_MFP_REQUIRED)
8963                         req.use_mfp = true;
8964                 else if (mfp != NL80211_MFP_NO)
8965                         return -EINVAL;
8966         }
8967
8968         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8969                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8970
8971         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8972                 req.flags |= ASSOC_REQ_DISABLE_HT;
8973
8974         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8975                 memcpy(&req.ht_capa_mask,
8976                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8977                        sizeof(req.ht_capa_mask));
8978
8979         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8980                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8981                         return -EINVAL;
8982                 memcpy(&req.ht_capa,
8983                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8984                        sizeof(req.ht_capa));
8985         }
8986
8987         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8988                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8989
8990         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8991                 memcpy(&req.vht_capa_mask,
8992                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8993                        sizeof(req.vht_capa_mask));
8994
8995         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8996                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8997                         return -EINVAL;
8998                 memcpy(&req.vht_capa,
8999                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9000                        sizeof(req.vht_capa));
9001         }
9002
9003         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9004                 if (!((rdev->wiphy.features &
9005                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9006                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9007                     !wiphy_ext_feature_isset(&rdev->wiphy,
9008                                              NL80211_EXT_FEATURE_RRM))
9009                         return -EINVAL;
9010                 req.flags |= ASSOC_REQ_USE_RRM;
9011         }
9012
9013         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
9014                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
9015                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
9016                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
9017                         return -EINVAL;
9018                 req.fils_nonces =
9019                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
9020         }
9021
9022         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
9023         if (!err) {
9024                 wdev_lock(dev->ieee80211_ptr);
9025
9026                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
9027                                           ssid, ssid_len, &req);
9028
9029                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9030                         dev->ieee80211_ptr->conn_owner_nlportid =
9031                                 info->snd_portid;
9032                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9033                                bssid, ETH_ALEN);
9034                 }
9035
9036                 wdev_unlock(dev->ieee80211_ptr);
9037         }
9038
9039         return err;
9040 }
9041
9042 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
9043 {
9044         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9045         struct net_device *dev = info->user_ptr[1];
9046         const u8 *ie = NULL, *bssid;
9047         int ie_len = 0, err;
9048         u16 reason_code;
9049         bool local_state_change;
9050
9051         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9052             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9053                 return -EPERM;
9054
9055         if (!info->attrs[NL80211_ATTR_MAC])
9056                 return -EINVAL;
9057
9058         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9059                 return -EINVAL;
9060
9061         if (!rdev->ops->deauth)
9062                 return -EOPNOTSUPP;
9063
9064         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9065             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9066                 return -EOPNOTSUPP;
9067
9068         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9069
9070         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9071         if (reason_code == 0) {
9072                 /* Reason Code 0 is reserved */
9073                 return -EINVAL;
9074         }
9075
9076         if (info->attrs[NL80211_ATTR_IE]) {
9077                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9078                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9079         }
9080
9081         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9082
9083         wdev_lock(dev->ieee80211_ptr);
9084         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
9085                                    local_state_change);
9086         wdev_unlock(dev->ieee80211_ptr);
9087         return err;
9088 }
9089
9090 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
9091 {
9092         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9093         struct net_device *dev = info->user_ptr[1];
9094         const u8 *ie = NULL, *bssid;
9095         int ie_len = 0, err;
9096         u16 reason_code;
9097         bool local_state_change;
9098
9099         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9100             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9101                 return -EPERM;
9102
9103         if (!info->attrs[NL80211_ATTR_MAC])
9104                 return -EINVAL;
9105
9106         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9107                 return -EINVAL;
9108
9109         if (!rdev->ops->disassoc)
9110                 return -EOPNOTSUPP;
9111
9112         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9113             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9114                 return -EOPNOTSUPP;
9115
9116         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9117
9118         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9119         if (reason_code == 0) {
9120                 /* Reason Code 0 is reserved */
9121                 return -EINVAL;
9122         }
9123
9124         if (info->attrs[NL80211_ATTR_IE]) {
9125                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9126                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9127         }
9128
9129         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9130
9131         wdev_lock(dev->ieee80211_ptr);
9132         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
9133                                      local_state_change);
9134         wdev_unlock(dev->ieee80211_ptr);
9135         return err;
9136 }
9137
9138 static bool
9139 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
9140                          int mcast_rate[NUM_NL80211_BANDS],
9141                          int rateval)
9142 {
9143         struct wiphy *wiphy = &rdev->wiphy;
9144         bool found = false;
9145         int band, i;
9146
9147         for (band = 0; band < NUM_NL80211_BANDS; band++) {
9148                 struct ieee80211_supported_band *sband;
9149
9150                 sband = wiphy->bands[band];
9151                 if (!sband)
9152                         continue;
9153
9154                 for (i = 0; i < sband->n_bitrates; i++) {
9155                         if (sband->bitrates[i].bitrate == rateval) {
9156                                 mcast_rate[band] = i + 1;
9157                                 found = true;
9158                                 break;
9159                         }
9160                 }
9161         }
9162
9163         return found;
9164 }
9165
9166 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
9167 {
9168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9169         struct net_device *dev = info->user_ptr[1];
9170         struct cfg80211_ibss_params ibss;
9171         struct wiphy *wiphy;
9172         struct cfg80211_cached_keys *connkeys = NULL;
9173         int err;
9174
9175         memset(&ibss, 0, sizeof(ibss));
9176
9177         if (!info->attrs[NL80211_ATTR_SSID] ||
9178             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9179                 return -EINVAL;
9180
9181         ibss.beacon_interval = 100;
9182
9183         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
9184                 ibss.beacon_interval =
9185                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9186
9187         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
9188                                            ibss.beacon_interval);
9189         if (err)
9190                 return err;
9191
9192         if (!rdev->ops->join_ibss)
9193                 return -EOPNOTSUPP;
9194
9195         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9196                 return -EOPNOTSUPP;
9197
9198         wiphy = &rdev->wiphy;
9199
9200         if (info->attrs[NL80211_ATTR_MAC]) {
9201                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9202
9203                 if (!is_valid_ether_addr(ibss.bssid))
9204                         return -EINVAL;
9205         }
9206         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9207         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9208
9209         if (info->attrs[NL80211_ATTR_IE]) {
9210                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9211                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9212         }
9213
9214         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
9215         if (err)
9216                 return err;
9217
9218         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
9219                                      NL80211_IFTYPE_ADHOC))
9220                 return -EINVAL;
9221
9222         switch (ibss.chandef.width) {
9223         case NL80211_CHAN_WIDTH_5:
9224         case NL80211_CHAN_WIDTH_10:
9225         case NL80211_CHAN_WIDTH_20_NOHT:
9226                 break;
9227         case NL80211_CHAN_WIDTH_20:
9228         case NL80211_CHAN_WIDTH_40:
9229                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9230                         return -EINVAL;
9231                 break;
9232         case NL80211_CHAN_WIDTH_80:
9233         case NL80211_CHAN_WIDTH_80P80:
9234         case NL80211_CHAN_WIDTH_160:
9235                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
9236                         return -EINVAL;
9237                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9238                                              NL80211_EXT_FEATURE_VHT_IBSS))
9239                         return -EINVAL;
9240                 break;
9241         default:
9242                 return -EINVAL;
9243         }
9244
9245         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
9246         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
9247
9248         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
9249                 u8 *rates =
9250                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9251                 int n_rates =
9252                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
9253                 struct ieee80211_supported_band *sband =
9254                         wiphy->bands[ibss.chandef.chan->band];
9255
9256                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9257                                              &ibss.basic_rates);
9258                 if (err)
9259                         return err;
9260         }
9261
9262         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9263                 memcpy(&ibss.ht_capa_mask,
9264                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9265                        sizeof(ibss.ht_capa_mask));
9266
9267         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9268                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9269                         return -EINVAL;
9270                 memcpy(&ibss.ht_capa,
9271                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9272                        sizeof(ibss.ht_capa));
9273         }
9274
9275         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9276             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9277                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9278                 return -EINVAL;
9279
9280         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9281                 bool no_ht = false;
9282
9283                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9284                 if (IS_ERR(connkeys))
9285                         return PTR_ERR(connkeys);
9286
9287                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9288                     no_ht) {
9289                         kzfree(connkeys);
9290                         return -EINVAL;
9291                 }
9292         }
9293
9294         ibss.control_port =
9295                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9296
9297         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9298                 int r = validate_pae_over_nl80211(rdev, info);
9299
9300                 if (r < 0) {
9301                         kzfree(connkeys);
9302                         return r;
9303                 }
9304
9305                 ibss.control_port_over_nl80211 = true;
9306         }
9307
9308         ibss.userspace_handles_dfs =
9309                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9310
9311         wdev_lock(dev->ieee80211_ptr);
9312         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9313         if (err)
9314                 kzfree(connkeys);
9315         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9316                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9317         wdev_unlock(dev->ieee80211_ptr);
9318
9319         return err;
9320 }
9321
9322 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9323 {
9324         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9325         struct net_device *dev = info->user_ptr[1];
9326
9327         if (!rdev->ops->leave_ibss)
9328                 return -EOPNOTSUPP;
9329
9330         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9331                 return -EOPNOTSUPP;
9332
9333         return cfg80211_leave_ibss(rdev, dev, false);
9334 }
9335
9336 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9337 {
9338         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9339         struct net_device *dev = info->user_ptr[1];
9340         int mcast_rate[NUM_NL80211_BANDS];
9341         u32 nla_rate;
9342         int err;
9343
9344         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9345             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9346             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9347                 return -EOPNOTSUPP;
9348
9349         if (!rdev->ops->set_mcast_rate)
9350                 return -EOPNOTSUPP;
9351
9352         memset(mcast_rate, 0, sizeof(mcast_rate));
9353
9354         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9355                 return -EINVAL;
9356
9357         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9358         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9359                 return -EINVAL;
9360
9361         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9362
9363         return err;
9364 }
9365
9366 static struct sk_buff *
9367 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9368                             struct wireless_dev *wdev, int approxlen,
9369                             u32 portid, u32 seq, enum nl80211_commands cmd,
9370                             enum nl80211_attrs attr,
9371                             const struct nl80211_vendor_cmd_info *info,
9372                             gfp_t gfp)
9373 {
9374         struct sk_buff *skb;
9375         void *hdr;
9376         struct nlattr *data;
9377
9378         skb = nlmsg_new(approxlen + 100, gfp);
9379         if (!skb)
9380                 return NULL;
9381
9382         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9383         if (!hdr) {
9384                 kfree_skb(skb);
9385                 return NULL;
9386         }
9387
9388         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9389                 goto nla_put_failure;
9390
9391         if (info) {
9392                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9393                                 info->vendor_id))
9394                         goto nla_put_failure;
9395                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9396                                 info->subcmd))
9397                         goto nla_put_failure;
9398         }
9399
9400         if (wdev) {
9401                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9402                                       wdev_id(wdev), NL80211_ATTR_PAD))
9403                         goto nla_put_failure;
9404                 if (wdev->netdev &&
9405                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9406                                 wdev->netdev->ifindex))
9407                         goto nla_put_failure;
9408         }
9409
9410         data = nla_nest_start(skb, attr);
9411         if (!data)
9412                 goto nla_put_failure;
9413
9414         ((void **)skb->cb)[0] = rdev;
9415         ((void **)skb->cb)[1] = hdr;
9416         ((void **)skb->cb)[2] = data;
9417
9418         return skb;
9419
9420  nla_put_failure:
9421         kfree_skb(skb);
9422         return NULL;
9423 }
9424
9425 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9426                                            struct wireless_dev *wdev,
9427                                            enum nl80211_commands cmd,
9428                                            enum nl80211_attrs attr,
9429                                            unsigned int portid,
9430                                            int vendor_event_idx,
9431                                            int approxlen, gfp_t gfp)
9432 {
9433         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9434         const struct nl80211_vendor_cmd_info *info;
9435
9436         switch (cmd) {
9437         case NL80211_CMD_TESTMODE:
9438                 if (WARN_ON(vendor_event_idx != -1))
9439                         return NULL;
9440                 info = NULL;
9441                 break;
9442         case NL80211_CMD_VENDOR:
9443                 if (WARN_ON(vendor_event_idx < 0 ||
9444                             vendor_event_idx >= wiphy->n_vendor_events))
9445                         return NULL;
9446                 info = &wiphy->vendor_events[vendor_event_idx];
9447                 break;
9448         default:
9449                 WARN_ON(1);
9450                 return NULL;
9451         }
9452
9453         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
9454                                            cmd, attr, info, gfp);
9455 }
9456 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9457
9458 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9459 {
9460         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9461         void *hdr = ((void **)skb->cb)[1];
9462         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
9463         struct nlattr *data = ((void **)skb->cb)[2];
9464         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9465
9466         /* clear CB data for netlink core to own from now on */
9467         memset(skb->cb, 0, sizeof(skb->cb));
9468
9469         nla_nest_end(skb, data);
9470         genlmsg_end(skb, hdr);
9471
9472         if (nlhdr->nlmsg_pid) {
9473                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
9474                                 nlhdr->nlmsg_pid);
9475         } else {
9476                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9477                         mcgrp = NL80211_MCGRP_VENDOR;
9478
9479                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
9480                                         skb, 0, mcgrp, gfp);
9481         }
9482 }
9483 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9484
9485 #ifdef CONFIG_NL80211_TESTMODE
9486 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9487 {
9488         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9489         struct wireless_dev *wdev =
9490                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9491         int err;
9492
9493         if (!rdev->ops->testmode_cmd)
9494                 return -EOPNOTSUPP;
9495
9496         if (IS_ERR(wdev)) {
9497                 err = PTR_ERR(wdev);
9498                 if (err != -EINVAL)
9499                         return err;
9500                 wdev = NULL;
9501         } else if (wdev->wiphy != &rdev->wiphy) {
9502                 return -EINVAL;
9503         }
9504
9505         if (!info->attrs[NL80211_ATTR_TESTDATA])
9506                 return -EINVAL;
9507
9508         rdev->cur_cmd_info = info;
9509         err = rdev_testmode_cmd(rdev, wdev,
9510                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9511                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9512         rdev->cur_cmd_info = NULL;
9513
9514         return err;
9515 }
9516
9517 static int nl80211_testmode_dump(struct sk_buff *skb,
9518                                  struct netlink_callback *cb)
9519 {
9520         struct cfg80211_registered_device *rdev;
9521         int err;
9522         long phy_idx;
9523         void *data = NULL;
9524         int data_len = 0;
9525
9526         rtnl_lock();
9527
9528         if (cb->args[0]) {
9529                 /*
9530                  * 0 is a valid index, but not valid for args[0],
9531                  * so we need to offset by 1.
9532                  */
9533                 phy_idx = cb->args[0] - 1;
9534
9535                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9536                 if (!rdev) {
9537                         err = -ENOENT;
9538                         goto out_err;
9539                 }
9540         } else {
9541                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9542
9543                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9544                                   attrbuf, nl80211_fam.maxattr,
9545                                   nl80211_policy, NULL);
9546                 if (err)
9547                         goto out_err;
9548
9549                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9550                 if (IS_ERR(rdev)) {
9551                         err = PTR_ERR(rdev);
9552                         goto out_err;
9553                 }
9554                 phy_idx = rdev->wiphy_idx;
9555
9556                 if (attrbuf[NL80211_ATTR_TESTDATA])
9557                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9558         }
9559
9560         if (cb->args[1]) {
9561                 data = nla_data((void *)cb->args[1]);
9562                 data_len = nla_len((void *)cb->args[1]);
9563         }
9564
9565         if (!rdev->ops->testmode_dump) {
9566                 err = -EOPNOTSUPP;
9567                 goto out_err;
9568         }
9569
9570         while (1) {
9571                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9572                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9573                                            NL80211_CMD_TESTMODE);
9574                 struct nlattr *tmdata;
9575
9576                 if (!hdr)
9577                         break;
9578
9579                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9580                         genlmsg_cancel(skb, hdr);
9581                         break;
9582                 }
9583
9584                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9585                 if (!tmdata) {
9586                         genlmsg_cancel(skb, hdr);
9587                         break;
9588                 }
9589                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9590                 nla_nest_end(skb, tmdata);
9591
9592                 if (err == -ENOBUFS || err == -ENOENT) {
9593                         genlmsg_cancel(skb, hdr);
9594                         break;
9595                 } else if (err) {
9596                         genlmsg_cancel(skb, hdr);
9597                         goto out_err;
9598                 }
9599
9600                 genlmsg_end(skb, hdr);
9601         }
9602
9603         err = skb->len;
9604         /* see above */
9605         cb->args[0] = phy_idx + 1;
9606  out_err:
9607         rtnl_unlock();
9608         return err;
9609 }
9610 #endif
9611
9612 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9613 {
9614         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9615         struct net_device *dev = info->user_ptr[1];
9616         struct cfg80211_connect_params connect;
9617         struct wiphy *wiphy;
9618         struct cfg80211_cached_keys *connkeys = NULL;
9619         int err;
9620
9621         memset(&connect, 0, sizeof(connect));
9622
9623         if (!info->attrs[NL80211_ATTR_SSID] ||
9624             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9625                 return -EINVAL;
9626
9627         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9628                 connect.auth_type =
9629                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9630                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9631                                              NL80211_CMD_CONNECT))
9632                         return -EINVAL;
9633         } else
9634                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9635
9636         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9637
9638         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9639             !wiphy_ext_feature_isset(&rdev->wiphy,
9640                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9641                 return -EINVAL;
9642         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9643
9644         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9645                                       NL80211_MAX_NR_CIPHER_SUITES);
9646         if (err)
9647                 return err;
9648
9649         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9650             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9651                 return -EOPNOTSUPP;
9652
9653         wiphy = &rdev->wiphy;
9654
9655         connect.bg_scan_period = -1;
9656         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9657                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9658                 connect.bg_scan_period =
9659                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9660         }
9661
9662         if (info->attrs[NL80211_ATTR_MAC])
9663                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9664         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9665                 connect.bssid_hint =
9666                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9667         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9668         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9669
9670         if (info->attrs[NL80211_ATTR_IE]) {
9671                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9672                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9673         }
9674
9675         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9676                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9677                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9678                     !wiphy_ext_feature_isset(&rdev->wiphy,
9679                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9680                         return -EOPNOTSUPP;
9681         } else {
9682                 connect.mfp = NL80211_MFP_NO;
9683         }
9684
9685         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9686                 connect.prev_bssid =
9687                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9688
9689         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9690                 connect.channel = nl80211_get_valid_chan(
9691                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9692                 if (!connect.channel)
9693                         return -EINVAL;
9694         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9695                 connect.channel_hint = nl80211_get_valid_chan(
9696                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9697                 if (!connect.channel_hint)
9698                         return -EINVAL;
9699         }
9700
9701         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9702                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9703                 if (IS_ERR(connkeys))
9704                         return PTR_ERR(connkeys);
9705         }
9706
9707         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9708                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9709
9710         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9711                 memcpy(&connect.ht_capa_mask,
9712                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9713                        sizeof(connect.ht_capa_mask));
9714
9715         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9716                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9717                         kzfree(connkeys);
9718                         return -EINVAL;
9719                 }
9720                 memcpy(&connect.ht_capa,
9721                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9722                        sizeof(connect.ht_capa));
9723         }
9724
9725         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9726                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9727
9728         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9729                 memcpy(&connect.vht_capa_mask,
9730                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9731                        sizeof(connect.vht_capa_mask));
9732
9733         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9734                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9735                         kzfree(connkeys);
9736                         return -EINVAL;
9737                 }
9738                 memcpy(&connect.vht_capa,
9739                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9740                        sizeof(connect.vht_capa));
9741         }
9742
9743         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9744                 if (!((rdev->wiphy.features &
9745                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9746                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9747                     !wiphy_ext_feature_isset(&rdev->wiphy,
9748                                              NL80211_EXT_FEATURE_RRM)) {
9749                         kzfree(connkeys);
9750                         return -EINVAL;
9751                 }
9752                 connect.flags |= ASSOC_REQ_USE_RRM;
9753         }
9754
9755         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9756         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9757                 kzfree(connkeys);
9758                 return -EOPNOTSUPP;
9759         }
9760
9761         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9762                 /* bss selection makes no sense if bssid is set */
9763                 if (connect.bssid) {
9764                         kzfree(connkeys);
9765                         return -EINVAL;
9766                 }
9767
9768                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9769                                        wiphy, &connect.bss_select);
9770                 if (err) {
9771                         kzfree(connkeys);
9772                         return err;
9773                 }
9774         }
9775
9776         if (wiphy_ext_feature_isset(&rdev->wiphy,
9777                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9778             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9779             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9780             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9781             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9782                 connect.fils_erp_username =
9783                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9784                 connect.fils_erp_username_len =
9785                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9786                 connect.fils_erp_realm =
9787                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9788                 connect.fils_erp_realm_len =
9789                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9790                 connect.fils_erp_next_seq_num =
9791                         nla_get_u16(
9792                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9793                 connect.fils_erp_rrk =
9794                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9795                 connect.fils_erp_rrk_len =
9796                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9797         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9798                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9799                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9800                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9801                 kzfree(connkeys);
9802                 return -EINVAL;
9803         }
9804
9805         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9806                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9807                         kzfree(connkeys);
9808                         GENL_SET_ERR_MSG(info,
9809                                          "external auth requires connection ownership");
9810                         return -EINVAL;
9811                 }
9812                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9813         }
9814
9815         wdev_lock(dev->ieee80211_ptr);
9816
9817         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9818                                connect.prev_bssid);
9819         if (err)
9820                 kzfree(connkeys);
9821
9822         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9823                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9824                 if (connect.bssid)
9825                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9826                                connect.bssid, ETH_ALEN);
9827                 else
9828                         memset(dev->ieee80211_ptr->disconnect_bssid,
9829                                0, ETH_ALEN);
9830         }
9831
9832         wdev_unlock(dev->ieee80211_ptr);
9833
9834         return err;
9835 }
9836
9837 static int nl80211_update_connect_params(struct sk_buff *skb,
9838                                          struct genl_info *info)
9839 {
9840         struct cfg80211_connect_params connect = {};
9841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9842         struct net_device *dev = info->user_ptr[1];
9843         struct wireless_dev *wdev = dev->ieee80211_ptr;
9844         bool fils_sk_offload;
9845         u32 auth_type;
9846         u32 changed = 0;
9847         int ret;
9848
9849         if (!rdev->ops->update_connect_params)
9850                 return -EOPNOTSUPP;
9851
9852         if (info->attrs[NL80211_ATTR_IE]) {
9853                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9854                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9855                 changed |= UPDATE_ASSOC_IES;
9856         }
9857
9858         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9859                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9860
9861         /*
9862          * when driver supports fils-sk offload all attributes must be
9863          * provided. So the else covers "fils-sk-not-all" and
9864          * "no-fils-sk-any".
9865          */
9866         if (fils_sk_offload &&
9867             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9868             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9869             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9870             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9871                 connect.fils_erp_username =
9872                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9873                 connect.fils_erp_username_len =
9874                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9875                 connect.fils_erp_realm =
9876                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9877                 connect.fils_erp_realm_len =
9878                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9879                 connect.fils_erp_next_seq_num =
9880                         nla_get_u16(
9881                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9882                 connect.fils_erp_rrk =
9883                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9884                 connect.fils_erp_rrk_len =
9885                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9886                 changed |= UPDATE_FILS_ERP_INFO;
9887         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9888                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9889                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9890                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9891                 return -EINVAL;
9892         }
9893
9894         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9895                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9896                 if (!nl80211_valid_auth_type(rdev, auth_type,
9897                                              NL80211_CMD_CONNECT))
9898                         return -EINVAL;
9899
9900                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9901                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9902                         return -EINVAL;
9903
9904                 connect.auth_type = auth_type;
9905                 changed |= UPDATE_AUTH_TYPE;
9906         }
9907
9908         wdev_lock(dev->ieee80211_ptr);
9909         if (!wdev->current_bss)
9910                 ret = -ENOLINK;
9911         else
9912                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9913         wdev_unlock(dev->ieee80211_ptr);
9914
9915         return ret;
9916 }
9917
9918 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9919 {
9920         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9921         struct net_device *dev = info->user_ptr[1];
9922         u16 reason;
9923         int ret;
9924
9925         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9926             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9927                 return -EPERM;
9928
9929         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9930                 reason = WLAN_REASON_DEAUTH_LEAVING;
9931         else
9932                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9933
9934         if (reason == 0)
9935                 return -EINVAL;
9936
9937         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9938             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9939                 return -EOPNOTSUPP;
9940
9941         wdev_lock(dev->ieee80211_ptr);
9942         ret = cfg80211_disconnect(rdev, dev, reason, true);
9943         wdev_unlock(dev->ieee80211_ptr);
9944         return ret;
9945 }
9946
9947 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9948 {
9949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9950         struct net *net;
9951         int err;
9952
9953         if (info->attrs[NL80211_ATTR_PID]) {
9954                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9955
9956                 net = get_net_ns_by_pid(pid);
9957         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9958                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9959
9960                 net = get_net_ns_by_fd(fd);
9961         } else {
9962                 return -EINVAL;
9963         }
9964
9965         if (IS_ERR(net))
9966                 return PTR_ERR(net);
9967
9968         err = 0;
9969
9970         /* check if anything to do */
9971         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9972                 err = cfg80211_switch_netns(rdev, net);
9973
9974         put_net(net);
9975         return err;
9976 }
9977
9978 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9979 {
9980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9981         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9982                         struct cfg80211_pmksa *pmksa) = NULL;
9983         struct net_device *dev = info->user_ptr[1];
9984         struct cfg80211_pmksa pmksa;
9985
9986         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9987
9988         if (!info->attrs[NL80211_ATTR_PMKID])
9989                 return -EINVAL;
9990
9991         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9992
9993         if (info->attrs[NL80211_ATTR_MAC]) {
9994                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9995         } else if (info->attrs[NL80211_ATTR_SSID] &&
9996                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9997                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9998                     info->attrs[NL80211_ATTR_PMK])) {
9999                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10000                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10001                 pmksa.cache_id =
10002                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
10003         } else {
10004                 return -EINVAL;
10005         }
10006         if (info->attrs[NL80211_ATTR_PMK]) {
10007                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10008                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
10009         }
10010
10011         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10012             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
10013             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
10014               wiphy_ext_feature_isset(&rdev->wiphy,
10015                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
10016                 return -EOPNOTSUPP;
10017
10018         switch (info->genlhdr->cmd) {
10019         case NL80211_CMD_SET_PMKSA:
10020                 rdev_ops = rdev->ops->set_pmksa;
10021                 break;
10022         case NL80211_CMD_DEL_PMKSA:
10023                 rdev_ops = rdev->ops->del_pmksa;
10024                 break;
10025         default:
10026                 WARN_ON(1);
10027                 break;
10028         }
10029
10030         if (!rdev_ops)
10031                 return -EOPNOTSUPP;
10032
10033         return rdev_ops(&rdev->wiphy, dev, &pmksa);
10034 }
10035
10036 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
10037 {
10038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10039         struct net_device *dev = info->user_ptr[1];
10040
10041         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10042             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10043                 return -EOPNOTSUPP;
10044
10045         if (!rdev->ops->flush_pmksa)
10046                 return -EOPNOTSUPP;
10047
10048         return rdev_flush_pmksa(rdev, dev);
10049 }
10050
10051 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
10052 {
10053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10054         struct net_device *dev = info->user_ptr[1];
10055         u8 action_code, dialog_token;
10056         u32 peer_capability = 0;
10057         u16 status_code;
10058         u8 *peer;
10059         bool initiator;
10060
10061         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10062             !rdev->ops->tdls_mgmt)
10063                 return -EOPNOTSUPP;
10064
10065         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
10066             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
10067             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
10068             !info->attrs[NL80211_ATTR_IE] ||
10069             !info->attrs[NL80211_ATTR_MAC])
10070                 return -EINVAL;
10071
10072         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10073         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
10074         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
10075         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
10076         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
10077         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
10078                 peer_capability =
10079                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
10080
10081         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
10082                               dialog_token, status_code, peer_capability,
10083                               initiator,
10084                               nla_data(info->attrs[NL80211_ATTR_IE]),
10085                               nla_len(info->attrs[NL80211_ATTR_IE]));
10086 }
10087
10088 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
10089 {
10090         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10091         struct net_device *dev = info->user_ptr[1];
10092         enum nl80211_tdls_operation operation;
10093         u8 *peer;
10094
10095         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
10096             !rdev->ops->tdls_oper)
10097                 return -EOPNOTSUPP;
10098
10099         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
10100             !info->attrs[NL80211_ATTR_MAC])
10101                 return -EINVAL;
10102
10103         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
10104         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
10105
10106         return rdev_tdls_oper(rdev, dev, peer, operation);
10107 }
10108
10109 static int nl80211_remain_on_channel(struct sk_buff *skb,
10110                                      struct genl_info *info)
10111 {
10112         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10113         struct wireless_dev *wdev = info->user_ptr[1];
10114         struct cfg80211_chan_def chandef;
10115         const struct cfg80211_chan_def *compat_chandef;
10116         struct sk_buff *msg;
10117         void *hdr;
10118         u64 cookie;
10119         u32 duration;
10120         int err;
10121
10122         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10123             !info->attrs[NL80211_ATTR_DURATION])
10124                 return -EINVAL;
10125
10126         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10127
10128         if (!rdev->ops->remain_on_channel ||
10129             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
10130                 return -EOPNOTSUPP;
10131
10132         /*
10133          * We should be on that channel for at least a minimum amount of
10134          * time (10ms) but no longer than the driver supports.
10135          */
10136         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10137             duration > rdev->wiphy.max_remain_on_channel_duration)
10138                 return -EINVAL;
10139
10140         err = nl80211_parse_chandef(rdev, info, &chandef);
10141         if (err)
10142                 return err;
10143
10144         wdev_lock(wdev);
10145         if (!cfg80211_off_channel_oper_allowed(wdev) &&
10146             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
10147                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
10148                                                              &chandef);
10149                 if (compat_chandef != &chandef) {
10150                         wdev_unlock(wdev);
10151                         return -EBUSY;
10152                 }
10153         }
10154         wdev_unlock(wdev);
10155
10156         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10157         if (!msg)
10158                 return -ENOMEM;
10159
10160         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10161                              NL80211_CMD_REMAIN_ON_CHANNEL);
10162         if (!hdr) {
10163                 err = -ENOBUFS;
10164                 goto free_msg;
10165         }
10166
10167         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
10168                                      duration, &cookie);
10169
10170         if (err)
10171                 goto free_msg;
10172
10173         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10174                               NL80211_ATTR_PAD))
10175                 goto nla_put_failure;
10176
10177         genlmsg_end(msg, hdr);
10178
10179         return genlmsg_reply(msg, info);
10180
10181  nla_put_failure:
10182         err = -ENOBUFS;
10183  free_msg:
10184         nlmsg_free(msg);
10185         return err;
10186 }
10187
10188 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
10189                                             struct genl_info *info)
10190 {
10191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10192         struct wireless_dev *wdev = info->user_ptr[1];
10193         u64 cookie;
10194
10195         if (!info->attrs[NL80211_ATTR_COOKIE])
10196                 return -EINVAL;
10197
10198         if (!rdev->ops->cancel_remain_on_channel)
10199                 return -EOPNOTSUPP;
10200
10201         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10202
10203         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
10204 }
10205
10206 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
10207                                        struct genl_info *info)
10208 {
10209         struct cfg80211_bitrate_mask mask;
10210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10211         struct net_device *dev = info->user_ptr[1];
10212         int err;
10213
10214         if (!rdev->ops->set_bitrate_mask)
10215                 return -EOPNOTSUPP;
10216
10217         err = nl80211_parse_tx_bitrate_mask(info, &mask);
10218         if (err)
10219                 return err;
10220
10221         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
10222 }
10223
10224 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
10225 {
10226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10227         struct wireless_dev *wdev = info->user_ptr[1];
10228         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
10229
10230         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
10231                 return -EINVAL;
10232
10233         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
10234                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
10235
10236         switch (wdev->iftype) {
10237         case NL80211_IFTYPE_STATION:
10238         case NL80211_IFTYPE_ADHOC:
10239         case NL80211_IFTYPE_P2P_CLIENT:
10240         case NL80211_IFTYPE_AP:
10241         case NL80211_IFTYPE_AP_VLAN:
10242         case NL80211_IFTYPE_MESH_POINT:
10243         case NL80211_IFTYPE_P2P_GO:
10244         case NL80211_IFTYPE_P2P_DEVICE:
10245                 break;
10246         case NL80211_IFTYPE_NAN:
10247         default:
10248                 return -EOPNOTSUPP;
10249         }
10250
10251         /* not much point in registering if we can't reply */
10252         if (!rdev->ops->mgmt_tx)
10253                 return -EOPNOTSUPP;
10254
10255         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10256                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10257                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10258 }
10259
10260 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10261 {
10262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10263         struct wireless_dev *wdev = info->user_ptr[1];
10264         struct cfg80211_chan_def chandef;
10265         int err;
10266         void *hdr = NULL;
10267         u64 cookie;
10268         struct sk_buff *msg = NULL;
10269         struct cfg80211_mgmt_tx_params params = {
10270                 .dont_wait_for_ack =
10271                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10272         };
10273
10274         if (!info->attrs[NL80211_ATTR_FRAME])
10275                 return -EINVAL;
10276
10277         if (!rdev->ops->mgmt_tx)
10278                 return -EOPNOTSUPP;
10279
10280         switch (wdev->iftype) {
10281         case NL80211_IFTYPE_P2P_DEVICE:
10282                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10283                         return -EINVAL;
10284         case NL80211_IFTYPE_STATION:
10285         case NL80211_IFTYPE_ADHOC:
10286         case NL80211_IFTYPE_P2P_CLIENT:
10287         case NL80211_IFTYPE_AP:
10288         case NL80211_IFTYPE_AP_VLAN:
10289         case NL80211_IFTYPE_MESH_POINT:
10290         case NL80211_IFTYPE_P2P_GO:
10291                 break;
10292         case NL80211_IFTYPE_NAN:
10293         default:
10294                 return -EOPNOTSUPP;
10295         }
10296
10297         if (info->attrs[NL80211_ATTR_DURATION]) {
10298                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10299                         return -EINVAL;
10300                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10301
10302                 /*
10303                  * We should wait on the channel for at least a minimum amount
10304                  * of time (10ms) but no longer than the driver supports.
10305                  */
10306                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10307                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10308                         return -EINVAL;
10309         }
10310
10311         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10312
10313         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10314                 return -EINVAL;
10315
10316         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10317
10318         /* get the channel if any has been specified, otherwise pass NULL to
10319          * the driver. The latter will use the current one
10320          */
10321         chandef.chan = NULL;
10322         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10323                 err = nl80211_parse_chandef(rdev, info, &chandef);
10324                 if (err)
10325                         return err;
10326         }
10327
10328         if (!chandef.chan && params.offchan)
10329                 return -EINVAL;
10330
10331         wdev_lock(wdev);
10332         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10333                 wdev_unlock(wdev);
10334                 return -EBUSY;
10335         }
10336         wdev_unlock(wdev);
10337
10338         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10339         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10340
10341         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10342                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10343                 int i;
10344
10345                 if (len % sizeof(u16))
10346                         return -EINVAL;
10347
10348                 params.n_csa_offsets = len / sizeof(u16);
10349                 params.csa_offsets =
10350                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10351
10352                 /* check that all the offsets fit the frame */
10353                 for (i = 0; i < params.n_csa_offsets; i++) {
10354                         if (params.csa_offsets[i] >= params.len)
10355                                 return -EINVAL;
10356                 }
10357         }
10358
10359         if (!params.dont_wait_for_ack) {
10360                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10361                 if (!msg)
10362                         return -ENOMEM;
10363
10364                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10365                                      NL80211_CMD_FRAME);
10366                 if (!hdr) {
10367                         err = -ENOBUFS;
10368                         goto free_msg;
10369                 }
10370         }
10371
10372         params.chan = chandef.chan;
10373         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10374         if (err)
10375                 goto free_msg;
10376
10377         if (msg) {
10378                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10379                                       NL80211_ATTR_PAD))
10380                         goto nla_put_failure;
10381
10382                 genlmsg_end(msg, hdr);
10383                 return genlmsg_reply(msg, info);
10384         }
10385
10386         return 0;
10387
10388  nla_put_failure:
10389         err = -ENOBUFS;
10390  free_msg:
10391         nlmsg_free(msg);
10392         return err;
10393 }
10394
10395 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10396 {
10397         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10398         struct wireless_dev *wdev = info->user_ptr[1];
10399         u64 cookie;
10400
10401         if (!info->attrs[NL80211_ATTR_COOKIE])
10402                 return -EINVAL;
10403
10404         if (!rdev->ops->mgmt_tx_cancel_wait)
10405                 return -EOPNOTSUPP;
10406
10407         switch (wdev->iftype) {
10408         case NL80211_IFTYPE_STATION:
10409         case NL80211_IFTYPE_ADHOC:
10410         case NL80211_IFTYPE_P2P_CLIENT:
10411         case NL80211_IFTYPE_AP:
10412         case NL80211_IFTYPE_AP_VLAN:
10413         case NL80211_IFTYPE_P2P_GO:
10414         case NL80211_IFTYPE_P2P_DEVICE:
10415                 break;
10416         case NL80211_IFTYPE_NAN:
10417         default:
10418                 return -EOPNOTSUPP;
10419         }
10420
10421         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10422
10423         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10424 }
10425
10426 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10427 {
10428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10429         struct wireless_dev *wdev;
10430         struct net_device *dev = info->user_ptr[1];
10431         u8 ps_state;
10432         bool state;
10433         int err;
10434
10435         if (!info->attrs[NL80211_ATTR_PS_STATE])
10436                 return -EINVAL;
10437
10438         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10439
10440         wdev = dev->ieee80211_ptr;
10441
10442         if (!rdev->ops->set_power_mgmt)
10443                 return -EOPNOTSUPP;
10444
10445         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10446
10447         if (state == wdev->ps)
10448                 return 0;
10449
10450         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10451         if (!err)
10452                 wdev->ps = state;
10453         return err;
10454 }
10455
10456 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10457 {
10458         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10459         enum nl80211_ps_state ps_state;
10460         struct wireless_dev *wdev;
10461         struct net_device *dev = info->user_ptr[1];
10462         struct sk_buff *msg;
10463         void *hdr;
10464         int err;
10465
10466         wdev = dev->ieee80211_ptr;
10467
10468         if (!rdev->ops->set_power_mgmt)
10469                 return -EOPNOTSUPP;
10470
10471         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10472         if (!msg)
10473                 return -ENOMEM;
10474
10475         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10476                              NL80211_CMD_GET_POWER_SAVE);
10477         if (!hdr) {
10478                 err = -ENOBUFS;
10479                 goto free_msg;
10480         }
10481
10482         if (wdev->ps)
10483                 ps_state = NL80211_PS_ENABLED;
10484         else
10485                 ps_state = NL80211_PS_DISABLED;
10486
10487         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10488                 goto nla_put_failure;
10489
10490         genlmsg_end(msg, hdr);
10491         return genlmsg_reply(msg, info);
10492
10493  nla_put_failure:
10494         err = -ENOBUFS;
10495  free_msg:
10496         nlmsg_free(msg);
10497         return err;
10498 }
10499
10500 static const struct nla_policy
10501 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10502         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10503         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10504         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10505         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10506         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10507         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10508         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10509 };
10510
10511 static int nl80211_set_cqm_txe(struct genl_info *info,
10512                                u32 rate, u32 pkts, u32 intvl)
10513 {
10514         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10515         struct net_device *dev = info->user_ptr[1];
10516         struct wireless_dev *wdev = dev->ieee80211_ptr;
10517
10518         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10519                 return -EINVAL;
10520
10521         if (!rdev->ops->set_cqm_txe_config)
10522                 return -EOPNOTSUPP;
10523
10524         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10525             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10526                 return -EOPNOTSUPP;
10527
10528         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10529 }
10530
10531 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10532                                     struct net_device *dev)
10533 {
10534         struct wireless_dev *wdev = dev->ieee80211_ptr;
10535         s32 last, low, high;
10536         u32 hyst;
10537         int i, n, low_index;
10538         int err;
10539
10540         /* RSSI reporting disabled? */
10541         if (!wdev->cqm_config)
10542                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10543
10544         /*
10545          * Obtain current RSSI value if possible, if not and no RSSI threshold
10546          * event has been received yet, we should receive an event after a
10547          * connection is established and enough beacons received to calculate
10548          * the average.
10549          */
10550         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10551             rdev->ops->get_station) {
10552                 struct station_info sinfo = {};
10553                 u8 *mac_addr;
10554
10555                 mac_addr = wdev->current_bss->pub.bssid;
10556
10557                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10558                 if (err)
10559                         return err;
10560
10561                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10562                         wdev->cqm_config->last_rssi_event_value =
10563                                 (s8) sinfo.rx_beacon_signal_avg;
10564         }
10565
10566         last = wdev->cqm_config->last_rssi_event_value;
10567         hyst = wdev->cqm_config->rssi_hyst;
10568         n = wdev->cqm_config->n_rssi_thresholds;
10569
10570         for (i = 0; i < n; i++)
10571                 if (last < wdev->cqm_config->rssi_thresholds[i])
10572                         break;
10573
10574         low_index = i - 1;
10575         if (low_index >= 0) {
10576                 low_index = array_index_nospec(low_index, n);
10577                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10578         } else {
10579                 low = S32_MIN;
10580         }
10581         if (i < n) {
10582                 i = array_index_nospec(i, n);
10583                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10584         } else {
10585                 high = S32_MAX;
10586         }
10587
10588         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10589 }
10590
10591 static int nl80211_set_cqm_rssi(struct genl_info *info,
10592                                 const s32 *thresholds, int n_thresholds,
10593                                 u32 hysteresis)
10594 {
10595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10596         struct net_device *dev = info->user_ptr[1];
10597         struct wireless_dev *wdev = dev->ieee80211_ptr;
10598         int i, err;
10599         s32 prev = S32_MIN;
10600
10601         /* Check all values negative and sorted */
10602         for (i = 0; i < n_thresholds; i++) {
10603                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10604                         return -EINVAL;
10605
10606                 prev = thresholds[i];
10607         }
10608
10609         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10610             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10611                 return -EOPNOTSUPP;
10612
10613         wdev_lock(wdev);
10614         cfg80211_cqm_config_free(wdev);
10615         wdev_unlock(wdev);
10616
10617         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10618                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10619                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10620
10621                 return rdev_set_cqm_rssi_config(rdev, dev,
10622                                                 thresholds[0], hysteresis);
10623         }
10624
10625         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10626                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10627                 return -EOPNOTSUPP;
10628
10629         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10630                 n_thresholds = 0;
10631
10632         wdev_lock(wdev);
10633         if (n_thresholds) {
10634                 struct cfg80211_cqm_config *cqm_config;
10635
10636                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10637                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10638                 if (!cqm_config) {
10639                         err = -ENOMEM;
10640                         goto unlock;
10641                 }
10642
10643                 cqm_config->rssi_hyst = hysteresis;
10644                 cqm_config->n_rssi_thresholds = n_thresholds;
10645                 memcpy(cqm_config->rssi_thresholds, thresholds,
10646                        n_thresholds * sizeof(s32));
10647
10648                 wdev->cqm_config = cqm_config;
10649         }
10650
10651         err = cfg80211_cqm_rssi_update(rdev, dev);
10652
10653 unlock:
10654         wdev_unlock(wdev);
10655
10656         return err;
10657 }
10658
10659 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10660 {
10661         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10662         struct nlattr *cqm;
10663         int err;
10664
10665         cqm = info->attrs[NL80211_ATTR_CQM];
10666         if (!cqm)
10667                 return -EINVAL;
10668
10669         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10670                                nl80211_attr_cqm_policy, info->extack);
10671         if (err)
10672                 return err;
10673
10674         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10675             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10676                 const s32 *thresholds =
10677                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10678                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10679                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10680
10681                 if (len % 4)
10682                         return -EINVAL;
10683
10684                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10685                                             hysteresis);
10686         }
10687
10688         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10689             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10690             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10691                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10692                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10693                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10694
10695                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10696         }
10697
10698         return -EINVAL;
10699 }
10700
10701 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10702 {
10703         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10704         struct net_device *dev = info->user_ptr[1];
10705         struct ocb_setup setup = {};
10706         int err;
10707
10708         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10709         if (err)
10710                 return err;
10711
10712         return cfg80211_join_ocb(rdev, dev, &setup);
10713 }
10714
10715 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10716 {
10717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10718         struct net_device *dev = info->user_ptr[1];
10719
10720         return cfg80211_leave_ocb(rdev, dev);
10721 }
10722
10723 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10724 {
10725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10726         struct net_device *dev = info->user_ptr[1];
10727         struct mesh_config cfg;
10728         struct mesh_setup setup;
10729         int err;
10730
10731         /* start with default */
10732         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10733         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10734
10735         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10736                 /* and parse parameters if given */
10737                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10738                 if (err)
10739                         return err;
10740         }
10741
10742         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10743             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10744                 return -EINVAL;
10745
10746         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10747         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10748
10749         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10750             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10751                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10752                         return -EINVAL;
10753
10754         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10755                 setup.beacon_interval =
10756                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10757
10758                 err = cfg80211_validate_beacon_int(rdev,
10759                                                    NL80211_IFTYPE_MESH_POINT,
10760                                                    setup.beacon_interval);
10761                 if (err)
10762                         return err;
10763         }
10764
10765         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10766                 setup.dtim_period =
10767                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10768                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10769                         return -EINVAL;
10770         }
10771
10772         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10773                 /* parse additional setup parameters if given */
10774                 err = nl80211_parse_mesh_setup(info, &setup);
10775                 if (err)
10776                         return err;
10777         }
10778
10779         if (setup.user_mpm)
10780                 cfg.auto_open_plinks = false;
10781
10782         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10783                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10784                 if (err)
10785                         return err;
10786         } else {
10787                 /* __cfg80211_join_mesh() will sort it out */
10788                 setup.chandef.chan = NULL;
10789         }
10790
10791         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10792                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10793                 int n_rates =
10794                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10795                 struct ieee80211_supported_band *sband;
10796
10797                 if (!setup.chandef.chan)
10798                         return -EINVAL;
10799
10800                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10801
10802                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10803                                              &setup.basic_rates);
10804                 if (err)
10805                         return err;
10806         }
10807
10808         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10809                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10810                 if (err)
10811                         return err;
10812
10813                 if (!setup.chandef.chan)
10814                         return -EINVAL;
10815
10816                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10817                                               &setup.beacon_rate);
10818                 if (err)
10819                         return err;
10820         }
10821
10822         setup.userspace_handles_dfs =
10823                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10824
10825         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10826                 int r = validate_pae_over_nl80211(rdev, info);
10827
10828                 if (r < 0)
10829                         return r;
10830
10831                 setup.control_port_over_nl80211 = true;
10832         }
10833
10834         wdev_lock(dev->ieee80211_ptr);
10835         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10836         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10837                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10838         wdev_unlock(dev->ieee80211_ptr);
10839
10840         return err;
10841 }
10842
10843 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10844 {
10845         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10846         struct net_device *dev = info->user_ptr[1];
10847
10848         return cfg80211_leave_mesh(rdev, dev);
10849 }
10850
10851 #ifdef CONFIG_PM
10852 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10853                                         struct cfg80211_registered_device *rdev)
10854 {
10855         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10856         struct nlattr *nl_pats, *nl_pat;
10857         int i, pat_len;
10858
10859         if (!wowlan->n_patterns)
10860                 return 0;
10861
10862         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10863         if (!nl_pats)
10864                 return -ENOBUFS;
10865
10866         for (i = 0; i < wowlan->n_patterns; i++) {
10867                 nl_pat = nla_nest_start(msg, i + 1);
10868                 if (!nl_pat)
10869                         return -ENOBUFS;
10870                 pat_len = wowlan->patterns[i].pattern_len;
10871                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10872                             wowlan->patterns[i].mask) ||
10873                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10874                             wowlan->patterns[i].pattern) ||
10875                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10876                                 wowlan->patterns[i].pkt_offset))
10877                         return -ENOBUFS;
10878                 nla_nest_end(msg, nl_pat);
10879         }
10880         nla_nest_end(msg, nl_pats);
10881
10882         return 0;
10883 }
10884
10885 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10886                                    struct cfg80211_wowlan_tcp *tcp)
10887 {
10888         struct nlattr *nl_tcp;
10889
10890         if (!tcp)
10891                 return 0;
10892
10893         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10894         if (!nl_tcp)
10895                 return -ENOBUFS;
10896
10897         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10898             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10899             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10900             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10901             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10902             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10903                     tcp->payload_len, tcp->payload) ||
10904             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10905                         tcp->data_interval) ||
10906             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10907                     tcp->wake_len, tcp->wake_data) ||
10908             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10909                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10910                 return -ENOBUFS;
10911
10912         if (tcp->payload_seq.len &&
10913             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10914                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10915                 return -ENOBUFS;
10916
10917         if (tcp->payload_tok.len &&
10918             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10919                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10920                     &tcp->payload_tok))
10921                 return -ENOBUFS;
10922
10923         nla_nest_end(msg, nl_tcp);
10924
10925         return 0;
10926 }
10927
10928 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10929                                   struct cfg80211_sched_scan_request *req)
10930 {
10931         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10932         int i;
10933
10934         if (!req)
10935                 return 0;
10936
10937         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10938         if (!nd)
10939                 return -ENOBUFS;
10940
10941         if (req->n_scan_plans == 1 &&
10942             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10943                         req->scan_plans[0].interval * 1000))
10944                 return -ENOBUFS;
10945
10946         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10947                 return -ENOBUFS;
10948
10949         if (req->relative_rssi_set) {
10950                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10951
10952                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10953                                req->relative_rssi))
10954                         return -ENOBUFS;
10955
10956                 rssi_adjust.band = req->rssi_adjust.band;
10957                 rssi_adjust.delta = req->rssi_adjust.delta;
10958                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10959                             sizeof(rssi_adjust), &rssi_adjust))
10960                         return -ENOBUFS;
10961         }
10962
10963         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10964         if (!freqs)
10965                 return -ENOBUFS;
10966
10967         for (i = 0; i < req->n_channels; i++) {
10968                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10969                         return -ENOBUFS;
10970         }
10971
10972         nla_nest_end(msg, freqs);
10973
10974         if (req->n_match_sets) {
10975                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10976                 if (!matches)
10977                         return -ENOBUFS;
10978
10979                 for (i = 0; i < req->n_match_sets; i++) {
10980                         match = nla_nest_start(msg, i);
10981                         if (!match)
10982                                 return -ENOBUFS;
10983
10984                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10985                                     req->match_sets[i].ssid.ssid_len,
10986                                     req->match_sets[i].ssid.ssid))
10987                                 return -ENOBUFS;
10988                         nla_nest_end(msg, match);
10989                 }
10990                 nla_nest_end(msg, matches);
10991         }
10992
10993         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10994         if (!scan_plans)
10995                 return -ENOBUFS;
10996
10997         for (i = 0; i < req->n_scan_plans; i++) {
10998                 scan_plan = nla_nest_start(msg, i + 1);
10999                 if (!scan_plan)
11000                         return -ENOBUFS;
11001
11002                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
11003                                 req->scan_plans[i].interval) ||
11004                     (req->scan_plans[i].iterations &&
11005                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
11006                                  req->scan_plans[i].iterations)))
11007                         return -ENOBUFS;
11008                 nla_nest_end(msg, scan_plan);
11009         }
11010         nla_nest_end(msg, scan_plans);
11011
11012         nla_nest_end(msg, nd);
11013
11014         return 0;
11015 }
11016
11017 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
11018 {
11019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11020         struct sk_buff *msg;
11021         void *hdr;
11022         u32 size = NLMSG_DEFAULT_SIZE;
11023
11024         if (!rdev->wiphy.wowlan)
11025                 return -EOPNOTSUPP;
11026
11027         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
11028                 /* adjust size to have room for all the data */
11029                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
11030                         rdev->wiphy.wowlan_config->tcp->payload_len +
11031                         rdev->wiphy.wowlan_config->tcp->wake_len +
11032                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
11033         }
11034
11035         msg = nlmsg_new(size, GFP_KERNEL);
11036         if (!msg)
11037                 return -ENOMEM;
11038
11039         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11040                              NL80211_CMD_GET_WOWLAN);
11041         if (!hdr)
11042                 goto nla_put_failure;
11043
11044         if (rdev->wiphy.wowlan_config) {
11045                 struct nlattr *nl_wowlan;
11046
11047                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
11048                 if (!nl_wowlan)
11049                         goto nla_put_failure;
11050
11051                 if ((rdev->wiphy.wowlan_config->any &&
11052                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
11053                     (rdev->wiphy.wowlan_config->disconnect &&
11054                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
11055                     (rdev->wiphy.wowlan_config->magic_pkt &&
11056                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
11057                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
11058                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
11059                     (rdev->wiphy.wowlan_config->eap_identity_req &&
11060                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
11061                     (rdev->wiphy.wowlan_config->four_way_handshake &&
11062                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
11063                     (rdev->wiphy.wowlan_config->rfkill_release &&
11064                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
11065                         goto nla_put_failure;
11066
11067                 if (nl80211_send_wowlan_patterns(msg, rdev))
11068                         goto nla_put_failure;
11069
11070                 if (nl80211_send_wowlan_tcp(msg,
11071                                             rdev->wiphy.wowlan_config->tcp))
11072                         goto nla_put_failure;
11073
11074                 if (nl80211_send_wowlan_nd(
11075                             msg,
11076                             rdev->wiphy.wowlan_config->nd_config))
11077                         goto nla_put_failure;
11078
11079                 nla_nest_end(msg, nl_wowlan);
11080         }
11081
11082         genlmsg_end(msg, hdr);
11083         return genlmsg_reply(msg, info);
11084
11085 nla_put_failure:
11086         nlmsg_free(msg);
11087         return -ENOBUFS;
11088 }
11089
11090 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
11091                                     struct nlattr *attr,
11092                                     struct cfg80211_wowlan *trig)
11093 {
11094         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
11095         struct cfg80211_wowlan_tcp *cfg;
11096         struct nl80211_wowlan_tcp_data_token *tok = NULL;
11097         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
11098         u32 size;
11099         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
11100         int err, port;
11101
11102         if (!rdev->wiphy.wowlan->tcp)
11103                 return -EINVAL;
11104
11105         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
11106                                nl80211_wowlan_tcp_policy, NULL);
11107         if (err)
11108                 return err;
11109
11110         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
11111             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
11112             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
11113             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
11114             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
11115             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
11116             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
11117             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
11118                 return -EINVAL;
11119
11120         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
11121         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
11122                 return -EINVAL;
11123
11124         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
11125                         rdev->wiphy.wowlan->tcp->data_interval_max ||
11126             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
11127                 return -EINVAL;
11128
11129         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
11130         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
11131                 return -EINVAL;
11132
11133         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
11134         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
11135                 return -EINVAL;
11136
11137         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
11138                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11139
11140                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
11141                 tokens_size = tokln - sizeof(*tok);
11142
11143                 if (!tok->len || tokens_size % tok->len)
11144                         return -EINVAL;
11145                 if (!rdev->wiphy.wowlan->tcp->tok)
11146                         return -EINVAL;
11147                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
11148                         return -EINVAL;
11149                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
11150                         return -EINVAL;
11151                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
11152                         return -EINVAL;
11153                 if (tok->offset + tok->len > data_size)
11154                         return -EINVAL;
11155         }
11156
11157         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
11158                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
11159                 if (!rdev->wiphy.wowlan->tcp->seq)
11160                         return -EINVAL;
11161                 if (seq->len == 0 || seq->len > 4)
11162                         return -EINVAL;
11163                 if (seq->len + seq->offset > data_size)
11164                         return -EINVAL;
11165         }
11166
11167         size = sizeof(*cfg);
11168         size += data_size;
11169         size += wake_size + wake_mask_size;
11170         size += tokens_size;
11171
11172         cfg = kzalloc(size, GFP_KERNEL);
11173         if (!cfg)
11174                 return -ENOMEM;
11175         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
11176         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
11177         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
11178                ETH_ALEN);
11179         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
11180                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
11181         else
11182                 port = 0;
11183 #ifdef CONFIG_INET
11184         /* allocate a socket and port for it and use it */
11185         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
11186                             IPPROTO_TCP, &cfg->sock, 1);
11187         if (err) {
11188                 kfree(cfg);
11189                 return err;
11190         }
11191         if (inet_csk_get_port(cfg->sock->sk, port)) {
11192                 sock_release(cfg->sock);
11193                 kfree(cfg);
11194                 return -EADDRINUSE;
11195         }
11196         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
11197 #else
11198         if (!port) {
11199                 kfree(cfg);
11200                 return -EINVAL;
11201         }
11202         cfg->src_port = port;
11203 #endif
11204
11205         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
11206         cfg->payload_len = data_size;
11207         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
11208         memcpy((void *)cfg->payload,
11209                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
11210                data_size);
11211         if (seq)
11212                 cfg->payload_seq = *seq;
11213         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
11214         cfg->wake_len = wake_size;
11215         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
11216         memcpy((void *)cfg->wake_data,
11217                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
11218                wake_size);
11219         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
11220                          data_size + wake_size;
11221         memcpy((void *)cfg->wake_mask,
11222                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
11223                wake_mask_size);
11224         if (tok) {
11225                 cfg->tokens_size = tokens_size;
11226                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
11227         }
11228
11229         trig->tcp = cfg;
11230
11231         return 0;
11232 }
11233
11234 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
11235                                    const struct wiphy_wowlan_support *wowlan,
11236                                    struct nlattr *attr,
11237                                    struct cfg80211_wowlan *trig)
11238 {
11239         struct nlattr **tb;
11240         int err;
11241
11242         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
11243         if (!tb)
11244                 return -ENOMEM;
11245
11246         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
11247                 err = -EOPNOTSUPP;
11248                 goto out;
11249         }
11250
11251         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
11252                                NULL);
11253         if (err)
11254                 goto out;
11255
11256         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11257                                                    wowlan->max_nd_match_sets);
11258         err = PTR_ERR_OR_ZERO(trig->nd_config);
11259         if (err)
11260                 trig->nd_config = NULL;
11261
11262 out:
11263         kfree(tb);
11264         return err;
11265 }
11266
11267 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11268 {
11269         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11270         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11271         struct cfg80211_wowlan new_triggers = {};
11272         struct cfg80211_wowlan *ntrig;
11273         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11274         int err, i;
11275         bool prev_enabled = rdev->wiphy.wowlan_config;
11276         bool regular = false;
11277
11278         if (!wowlan)
11279                 return -EOPNOTSUPP;
11280
11281         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11282                 cfg80211_rdev_free_wowlan(rdev);
11283                 rdev->wiphy.wowlan_config = NULL;
11284                 goto set_wakeup;
11285         }
11286
11287         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
11288                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11289                                nl80211_wowlan_policy, info->extack);
11290         if (err)
11291                 return err;
11292
11293         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11294                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11295                         return -EINVAL;
11296                 new_triggers.any = true;
11297         }
11298
11299         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11300                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11301                         return -EINVAL;
11302                 new_triggers.disconnect = true;
11303                 regular = true;
11304         }
11305
11306         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11307                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11308                         return -EINVAL;
11309                 new_triggers.magic_pkt = true;
11310                 regular = true;
11311         }
11312
11313         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11314                 return -EINVAL;
11315
11316         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11317                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11318                         return -EINVAL;
11319                 new_triggers.gtk_rekey_failure = true;
11320                 regular = true;
11321         }
11322
11323         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11324                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11325                         return -EINVAL;
11326                 new_triggers.eap_identity_req = true;
11327                 regular = true;
11328         }
11329
11330         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11331                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11332                         return -EINVAL;
11333                 new_triggers.four_way_handshake = true;
11334                 regular = true;
11335         }
11336
11337         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11338                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11339                         return -EINVAL;
11340                 new_triggers.rfkill_release = true;
11341                 regular = true;
11342         }
11343
11344         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11345                 struct nlattr *pat;
11346                 int n_patterns = 0;
11347                 int rem, pat_len, mask_len, pkt_offset;
11348                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11349
11350                 regular = true;
11351
11352                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11353                                     rem)
11354                         n_patterns++;
11355                 if (n_patterns > wowlan->n_patterns)
11356                         return -EINVAL;
11357
11358                 new_triggers.patterns = kcalloc(n_patterns,
11359                                                 sizeof(new_triggers.patterns[0]),
11360                                                 GFP_KERNEL);
11361                 if (!new_triggers.patterns)
11362                         return -ENOMEM;
11363
11364                 new_triggers.n_patterns = n_patterns;
11365                 i = 0;
11366
11367                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11368                                     rem) {
11369                         u8 *mask_pat;
11370
11371                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11372                                                nl80211_packet_pattern_policy,
11373                                                info->extack);
11374                         if (err)
11375                                 goto error;
11376
11377                         err = -EINVAL;
11378                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11379                             !pat_tb[NL80211_PKTPAT_PATTERN])
11380                                 goto error;
11381                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11382                         mask_len = DIV_ROUND_UP(pat_len, 8);
11383                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11384                                 goto error;
11385                         if (pat_len > wowlan->pattern_max_len ||
11386                             pat_len < wowlan->pattern_min_len)
11387                                 goto error;
11388
11389                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11390                                 pkt_offset = 0;
11391                         else
11392                                 pkt_offset = nla_get_u32(
11393                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11394                         if (pkt_offset > wowlan->max_pkt_offset)
11395                                 goto error;
11396                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11397
11398                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11399                         if (!mask_pat) {
11400                                 err = -ENOMEM;
11401                                 goto error;
11402                         }
11403                         new_triggers.patterns[i].mask = mask_pat;
11404                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11405                                mask_len);
11406                         mask_pat += mask_len;
11407                         new_triggers.patterns[i].pattern = mask_pat;
11408                         new_triggers.patterns[i].pattern_len = pat_len;
11409                         memcpy(mask_pat,
11410                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11411                                pat_len);
11412                         i++;
11413                 }
11414         }
11415
11416         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11417                 regular = true;
11418                 err = nl80211_parse_wowlan_tcp(
11419                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11420                         &new_triggers);
11421                 if (err)
11422                         goto error;
11423         }
11424
11425         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11426                 regular = true;
11427                 err = nl80211_parse_wowlan_nd(
11428                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11429                         &new_triggers);
11430                 if (err)
11431                         goto error;
11432         }
11433
11434         /* The 'any' trigger means the device continues operating more or less
11435          * as in its normal operation mode and wakes up the host on most of the
11436          * normal interrupts (like packet RX, ...)
11437          * It therefore makes little sense to combine with the more constrained
11438          * wakeup trigger modes.
11439          */
11440         if (new_triggers.any && regular) {
11441                 err = -EINVAL;
11442                 goto error;
11443         }
11444
11445         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11446         if (!ntrig) {
11447                 err = -ENOMEM;
11448                 goto error;
11449         }
11450         cfg80211_rdev_free_wowlan(rdev);
11451         rdev->wiphy.wowlan_config = ntrig;
11452
11453  set_wakeup:
11454         if (rdev->ops->set_wakeup &&
11455             prev_enabled != !!rdev->wiphy.wowlan_config)
11456                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11457
11458         return 0;
11459  error:
11460         for (i = 0; i < new_triggers.n_patterns; i++)
11461                 kfree(new_triggers.patterns[i].mask);
11462         kfree(new_triggers.patterns);
11463         if (new_triggers.tcp && new_triggers.tcp->sock)
11464                 sock_release(new_triggers.tcp->sock);
11465         kfree(new_triggers.tcp);
11466         kfree(new_triggers.nd_config);
11467         return err;
11468 }
11469 #endif
11470
11471 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11472                                        struct cfg80211_registered_device *rdev)
11473 {
11474         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11475         int i, j, pat_len;
11476         struct cfg80211_coalesce_rules *rule;
11477
11478         if (!rdev->coalesce->n_rules)
11479                 return 0;
11480
11481         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11482         if (!nl_rules)
11483                 return -ENOBUFS;
11484
11485         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11486                 nl_rule = nla_nest_start(msg, i + 1);
11487                 if (!nl_rule)
11488                         return -ENOBUFS;
11489
11490                 rule = &rdev->coalesce->rules[i];
11491                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11492                                 rule->delay))
11493                         return -ENOBUFS;
11494
11495                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11496                                 rule->condition))
11497                         return -ENOBUFS;
11498
11499                 nl_pats = nla_nest_start(msg,
11500                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11501                 if (!nl_pats)
11502                         return -ENOBUFS;
11503
11504                 for (j = 0; j < rule->n_patterns; j++) {
11505                         nl_pat = nla_nest_start(msg, j + 1);
11506                         if (!nl_pat)
11507                                 return -ENOBUFS;
11508                         pat_len = rule->patterns[j].pattern_len;
11509                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11510                                     DIV_ROUND_UP(pat_len, 8),
11511                                     rule->patterns[j].mask) ||
11512                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11513                                     rule->patterns[j].pattern) ||
11514                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11515                                         rule->patterns[j].pkt_offset))
11516                                 return -ENOBUFS;
11517                         nla_nest_end(msg, nl_pat);
11518                 }
11519                 nla_nest_end(msg, nl_pats);
11520                 nla_nest_end(msg, nl_rule);
11521         }
11522         nla_nest_end(msg, nl_rules);
11523
11524         return 0;
11525 }
11526
11527 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11528 {
11529         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11530         struct sk_buff *msg;
11531         void *hdr;
11532
11533         if (!rdev->wiphy.coalesce)
11534                 return -EOPNOTSUPP;
11535
11536         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11537         if (!msg)
11538                 return -ENOMEM;
11539
11540         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11541                              NL80211_CMD_GET_COALESCE);
11542         if (!hdr)
11543                 goto nla_put_failure;
11544
11545         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11546                 goto nla_put_failure;
11547
11548         genlmsg_end(msg, hdr);
11549         return genlmsg_reply(msg, info);
11550
11551 nla_put_failure:
11552         nlmsg_free(msg);
11553         return -ENOBUFS;
11554 }
11555
11556 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11557 {
11558         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11559         int i, j;
11560         struct cfg80211_coalesce_rules *rule;
11561
11562         if (!coalesce)
11563                 return;
11564
11565         for (i = 0; i < coalesce->n_rules; i++) {
11566                 rule = &coalesce->rules[i];
11567                 for (j = 0; j < rule->n_patterns; j++)
11568                         kfree(rule->patterns[j].mask);
11569                 kfree(rule->patterns);
11570         }
11571         kfree(coalesce->rules);
11572         kfree(coalesce);
11573         rdev->coalesce = NULL;
11574 }
11575
11576 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11577                                        struct nlattr *rule,
11578                                        struct cfg80211_coalesce_rules *new_rule)
11579 {
11580         int err, i;
11581         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11582         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11583         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11584         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11585
11586         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11587                                nl80211_coalesce_policy, NULL);
11588         if (err)
11589                 return err;
11590
11591         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11592                 new_rule->delay =
11593                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11594         if (new_rule->delay > coalesce->max_delay)
11595                 return -EINVAL;
11596
11597         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11598                 new_rule->condition =
11599                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11600
11601         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11602                 return -EINVAL;
11603
11604         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11605                             rem)
11606                 n_patterns++;
11607         if (n_patterns > coalesce->n_patterns)
11608                 return -EINVAL;
11609
11610         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11611                                      GFP_KERNEL);
11612         if (!new_rule->patterns)
11613                 return -ENOMEM;
11614
11615         new_rule->n_patterns = n_patterns;
11616         i = 0;
11617
11618         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11619                             rem) {
11620                 u8 *mask_pat;
11621
11622                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11623                                        nl80211_packet_pattern_policy, NULL);
11624                 if (err)
11625                         return err;
11626
11627                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11628                     !pat_tb[NL80211_PKTPAT_PATTERN])
11629                         return -EINVAL;
11630                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11631                 mask_len = DIV_ROUND_UP(pat_len, 8);
11632                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11633                         return -EINVAL;
11634                 if (pat_len > coalesce->pattern_max_len ||
11635                     pat_len < coalesce->pattern_min_len)
11636                         return -EINVAL;
11637
11638                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11639                         pkt_offset = 0;
11640                 else
11641                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11642                 if (pkt_offset > coalesce->max_pkt_offset)
11643                         return -EINVAL;
11644                 new_rule->patterns[i].pkt_offset = pkt_offset;
11645
11646                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11647                 if (!mask_pat)
11648                         return -ENOMEM;
11649
11650                 new_rule->patterns[i].mask = mask_pat;
11651                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11652                        mask_len);
11653
11654                 mask_pat += mask_len;
11655                 new_rule->patterns[i].pattern = mask_pat;
11656                 new_rule->patterns[i].pattern_len = pat_len;
11657                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11658                        pat_len);
11659                 i++;
11660         }
11661
11662         return 0;
11663 }
11664
11665 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11666 {
11667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11668         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11669         struct cfg80211_coalesce new_coalesce = {};
11670         struct cfg80211_coalesce *n_coalesce;
11671         int err, rem_rule, n_rules = 0, i, j;
11672         struct nlattr *rule;
11673         struct cfg80211_coalesce_rules *tmp_rule;
11674
11675         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11676                 return -EOPNOTSUPP;
11677
11678         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11679                 cfg80211_rdev_free_coalesce(rdev);
11680                 rdev_set_coalesce(rdev, NULL);
11681                 return 0;
11682         }
11683
11684         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11685                             rem_rule)
11686                 n_rules++;
11687         if (n_rules > coalesce->n_rules)
11688                 return -EINVAL;
11689
11690         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11691                                      GFP_KERNEL);
11692         if (!new_coalesce.rules)
11693                 return -ENOMEM;
11694
11695         new_coalesce.n_rules = n_rules;
11696         i = 0;
11697
11698         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11699                             rem_rule) {
11700                 err = nl80211_parse_coalesce_rule(rdev, rule,
11701                                                   &new_coalesce.rules[i]);
11702                 if (err)
11703                         goto error;
11704
11705                 i++;
11706         }
11707
11708         err = rdev_set_coalesce(rdev, &new_coalesce);
11709         if (err)
11710                 goto error;
11711
11712         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11713         if (!n_coalesce) {
11714                 err = -ENOMEM;
11715                 goto error;
11716         }
11717         cfg80211_rdev_free_coalesce(rdev);
11718         rdev->coalesce = n_coalesce;
11719
11720         return 0;
11721 error:
11722         for (i = 0; i < new_coalesce.n_rules; i++) {
11723                 tmp_rule = &new_coalesce.rules[i];
11724                 for (j = 0; j < tmp_rule->n_patterns; j++)
11725                         kfree(tmp_rule->patterns[j].mask);
11726                 kfree(tmp_rule->patterns);
11727         }
11728         kfree(new_coalesce.rules);
11729
11730         return err;
11731 }
11732
11733 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11734 {
11735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11736         struct net_device *dev = info->user_ptr[1];
11737         struct wireless_dev *wdev = dev->ieee80211_ptr;
11738         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11739         struct cfg80211_gtk_rekey_data rekey_data;
11740         int err;
11741
11742         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11743                 return -EINVAL;
11744
11745         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11746                                info->attrs[NL80211_ATTR_REKEY_DATA],
11747                                nl80211_rekey_policy, info->extack);
11748         if (err)
11749                 return err;
11750
11751         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11752             !tb[NL80211_REKEY_DATA_KCK])
11753                 return -EINVAL;
11754         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11755                 return -ERANGE;
11756         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11757                 return -ERANGE;
11758         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11759                 return -ERANGE;
11760
11761         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11762         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11763         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11764
11765         wdev_lock(wdev);
11766         if (!wdev->current_bss) {
11767                 err = -ENOTCONN;
11768                 goto out;
11769         }
11770
11771         if (!rdev->ops->set_rekey_data) {
11772                 err = -EOPNOTSUPP;
11773                 goto out;
11774         }
11775
11776         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11777  out:
11778         wdev_unlock(wdev);
11779         return err;
11780 }
11781
11782 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11783                                              struct genl_info *info)
11784 {
11785         struct net_device *dev = info->user_ptr[1];
11786         struct wireless_dev *wdev = dev->ieee80211_ptr;
11787
11788         if (wdev->iftype != NL80211_IFTYPE_AP &&
11789             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11790                 return -EINVAL;
11791
11792         if (wdev->ap_unexpected_nlportid)
11793                 return -EBUSY;
11794
11795         wdev->ap_unexpected_nlportid = info->snd_portid;
11796         return 0;
11797 }
11798
11799 static int nl80211_probe_client(struct sk_buff *skb,
11800                                 struct genl_info *info)
11801 {
11802         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11803         struct net_device *dev = info->user_ptr[1];
11804         struct wireless_dev *wdev = dev->ieee80211_ptr;
11805         struct sk_buff *msg;
11806         void *hdr;
11807         const u8 *addr;
11808         u64 cookie;
11809         int err;
11810
11811         if (wdev->iftype != NL80211_IFTYPE_AP &&
11812             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11813                 return -EOPNOTSUPP;
11814
11815         if (!info->attrs[NL80211_ATTR_MAC])
11816                 return -EINVAL;
11817
11818         if (!rdev->ops->probe_client)
11819                 return -EOPNOTSUPP;
11820
11821         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11822         if (!msg)
11823                 return -ENOMEM;
11824
11825         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11826                              NL80211_CMD_PROBE_CLIENT);
11827         if (!hdr) {
11828                 err = -ENOBUFS;
11829                 goto free_msg;
11830         }
11831
11832         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11833
11834         err = rdev_probe_client(rdev, dev, addr, &cookie);
11835         if (err)
11836                 goto free_msg;
11837
11838         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11839                               NL80211_ATTR_PAD))
11840                 goto nla_put_failure;
11841
11842         genlmsg_end(msg, hdr);
11843
11844         return genlmsg_reply(msg, info);
11845
11846  nla_put_failure:
11847         err = -ENOBUFS;
11848  free_msg:
11849         nlmsg_free(msg);
11850         return err;
11851 }
11852
11853 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11854 {
11855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11856         struct cfg80211_beacon_registration *reg, *nreg;
11857         int rv;
11858
11859         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11860                 return -EOPNOTSUPP;
11861
11862         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11863         if (!nreg)
11864                 return -ENOMEM;
11865
11866         /* First, check if already registered. */
11867         spin_lock_bh(&rdev->beacon_registrations_lock);
11868         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11869                 if (reg->nlportid == info->snd_portid) {
11870                         rv = -EALREADY;
11871                         goto out_err;
11872                 }
11873         }
11874         /* Add it to the list */
11875         nreg->nlportid = info->snd_portid;
11876         list_add(&nreg->list, &rdev->beacon_registrations);
11877
11878         spin_unlock_bh(&rdev->beacon_registrations_lock);
11879
11880         return 0;
11881 out_err:
11882         spin_unlock_bh(&rdev->beacon_registrations_lock);
11883         kfree(nreg);
11884         return rv;
11885 }
11886
11887 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11888 {
11889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11890         struct wireless_dev *wdev = info->user_ptr[1];
11891         int err;
11892
11893         if (!rdev->ops->start_p2p_device)
11894                 return -EOPNOTSUPP;
11895
11896         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11897                 return -EOPNOTSUPP;
11898
11899         if (wdev_running(wdev))
11900                 return 0;
11901
11902         if (rfkill_blocked(rdev->rfkill))
11903                 return -ERFKILL;
11904
11905         err = rdev_start_p2p_device(rdev, wdev);
11906         if (err)
11907                 return err;
11908
11909         wdev->is_running = true;
11910         rdev->opencount++;
11911
11912         return 0;
11913 }
11914
11915 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11916 {
11917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11918         struct wireless_dev *wdev = info->user_ptr[1];
11919
11920         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11921                 return -EOPNOTSUPP;
11922
11923         if (!rdev->ops->stop_p2p_device)
11924                 return -EOPNOTSUPP;
11925
11926         cfg80211_stop_p2p_device(rdev, wdev);
11927
11928         return 0;
11929 }
11930
11931 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11932 {
11933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11934         struct wireless_dev *wdev = info->user_ptr[1];
11935         struct cfg80211_nan_conf conf = {};
11936         int err;
11937
11938         if (wdev->iftype != NL80211_IFTYPE_NAN)
11939                 return -EOPNOTSUPP;
11940
11941         if (wdev_running(wdev))
11942                 return -EEXIST;
11943
11944         if (rfkill_blocked(rdev->rfkill))
11945                 return -ERFKILL;
11946
11947         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11948                 return -EINVAL;
11949
11950         conf.master_pref =
11951                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11952
11953         if (info->attrs[NL80211_ATTR_BANDS]) {
11954                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11955
11956                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11957                         return -EOPNOTSUPP;
11958
11959                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11960                         return -EINVAL;
11961
11962                 conf.bands = bands;
11963         }
11964
11965         err = rdev_start_nan(rdev, wdev, &conf);
11966         if (err)
11967                 return err;
11968
11969         wdev->is_running = true;
11970         rdev->opencount++;
11971
11972         return 0;
11973 }
11974
11975 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11976 {
11977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11978         struct wireless_dev *wdev = info->user_ptr[1];
11979
11980         if (wdev->iftype != NL80211_IFTYPE_NAN)
11981                 return -EOPNOTSUPP;
11982
11983         cfg80211_stop_nan(rdev, wdev);
11984
11985         return 0;
11986 }
11987
11988 static int validate_nan_filter(struct nlattr *filter_attr)
11989 {
11990         struct nlattr *attr;
11991         int len = 0, n_entries = 0, rem;
11992
11993         nla_for_each_nested(attr, filter_attr, rem) {
11994                 len += nla_len(attr);
11995                 n_entries++;
11996         }
11997
11998         if (len >= U8_MAX)
11999                 return -EINVAL;
12000
12001         return n_entries;
12002 }
12003
12004 static int handle_nan_filter(struct nlattr *attr_filter,
12005                              struct cfg80211_nan_func *func,
12006                              bool tx)
12007 {
12008         struct nlattr *attr;
12009         int n_entries, rem, i;
12010         struct cfg80211_nan_func_filter *filter;
12011
12012         n_entries = validate_nan_filter(attr_filter);
12013         if (n_entries < 0)
12014                 return n_entries;
12015
12016         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
12017
12018         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
12019         if (!filter)
12020                 return -ENOMEM;
12021
12022         i = 0;
12023         nla_for_each_nested(attr, attr_filter, rem) {
12024                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
12025                 filter[i].len = nla_len(attr);
12026                 i++;
12027         }
12028         if (tx) {
12029                 func->num_tx_filters = n_entries;
12030                 func->tx_filters = filter;
12031         } else {
12032                 func->num_rx_filters = n_entries;
12033                 func->rx_filters = filter;
12034         }
12035
12036         return 0;
12037 }
12038
12039 static int nl80211_nan_add_func(struct sk_buff *skb,
12040                                 struct genl_info *info)
12041 {
12042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12043         struct wireless_dev *wdev = info->user_ptr[1];
12044         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
12045         struct cfg80211_nan_func *func;
12046         struct sk_buff *msg = NULL;
12047         void *hdr = NULL;
12048         int err = 0;
12049
12050         if (wdev->iftype != NL80211_IFTYPE_NAN)
12051                 return -EOPNOTSUPP;
12052
12053         if (!wdev_running(wdev))
12054                 return -ENOTCONN;
12055
12056         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
12057                 return -EINVAL;
12058
12059         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
12060                                info->attrs[NL80211_ATTR_NAN_FUNC],
12061                                nl80211_nan_func_policy, info->extack);
12062         if (err)
12063                 return err;
12064
12065         func = kzalloc(sizeof(*func), GFP_KERNEL);
12066         if (!func)
12067                 return -ENOMEM;
12068
12069         func->cookie = cfg80211_assign_cookie(rdev);
12070
12071         if (!tb[NL80211_NAN_FUNC_TYPE] ||
12072             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
12073                 err = -EINVAL;
12074                 goto out;
12075         }
12076
12077
12078         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
12079
12080         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
12081                 err = -EINVAL;
12082                 goto out;
12083         }
12084
12085         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
12086                sizeof(func->service_id));
12087
12088         func->close_range =
12089                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
12090
12091         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
12092                 func->serv_spec_info_len =
12093                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
12094                 func->serv_spec_info =
12095                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
12096                                 func->serv_spec_info_len,
12097                                 GFP_KERNEL);
12098                 if (!func->serv_spec_info) {
12099                         err = -ENOMEM;
12100                         goto out;
12101                 }
12102         }
12103
12104         if (tb[NL80211_NAN_FUNC_TTL])
12105                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
12106
12107         switch (func->type) {
12108         case NL80211_NAN_FUNC_PUBLISH:
12109                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
12110                         err = -EINVAL;
12111                         goto out;
12112                 }
12113
12114                 func->publish_type =
12115                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
12116                 func->publish_bcast =
12117                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
12118
12119                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
12120                         func->publish_bcast) {
12121                         err = -EINVAL;
12122                         goto out;
12123                 }
12124                 break;
12125         case NL80211_NAN_FUNC_SUBSCRIBE:
12126                 func->subscribe_active =
12127                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
12128                 break;
12129         case NL80211_NAN_FUNC_FOLLOW_UP:
12130                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
12131                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
12132                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
12133                         err = -EINVAL;
12134                         goto out;
12135                 }
12136
12137                 func->followup_id =
12138                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
12139                 func->followup_reqid =
12140                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
12141                 memcpy(func->followup_dest.addr,
12142                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
12143                        sizeof(func->followup_dest.addr));
12144                 if (func->ttl) {
12145                         err = -EINVAL;
12146                         goto out;
12147                 }
12148                 break;
12149         default:
12150                 err = -EINVAL;
12151                 goto out;
12152         }
12153
12154         if (tb[NL80211_NAN_FUNC_SRF]) {
12155                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
12156
12157                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
12158                                        tb[NL80211_NAN_FUNC_SRF],
12159                                        nl80211_nan_srf_policy, info->extack);
12160                 if (err)
12161                         goto out;
12162
12163                 func->srf_include =
12164                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
12165
12166                 if (srf_tb[NL80211_NAN_SRF_BF]) {
12167                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
12168                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
12169                                 err = -EINVAL;
12170                                 goto out;
12171                         }
12172
12173                         func->srf_bf_len =
12174                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
12175                         func->srf_bf =
12176                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
12177                                         func->srf_bf_len, GFP_KERNEL);
12178                         if (!func->srf_bf) {
12179                                 err = -ENOMEM;
12180                                 goto out;
12181                         }
12182
12183                         func->srf_bf_idx =
12184                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
12185                 } else {
12186                         struct nlattr *attr, *mac_attr =
12187                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
12188                         int n_entries, rem, i = 0;
12189
12190                         if (!mac_attr) {
12191                                 err = -EINVAL;
12192                                 goto out;
12193                         }
12194
12195                         n_entries = validate_acl_mac_addrs(mac_attr);
12196                         if (n_entries <= 0) {
12197                                 err = -EINVAL;
12198                                 goto out;
12199                         }
12200
12201                         func->srf_num_macs = n_entries;
12202                         func->srf_macs =
12203                                 kcalloc(n_entries, sizeof(*func->srf_macs),
12204                                         GFP_KERNEL);
12205                         if (!func->srf_macs) {
12206                                 err = -ENOMEM;
12207                                 goto out;
12208                         }
12209
12210                         nla_for_each_nested(attr, mac_attr, rem)
12211                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
12212                                        sizeof(*func->srf_macs));
12213                 }
12214         }
12215
12216         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
12217                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
12218                                         func, true);
12219                 if (err)
12220                         goto out;
12221         }
12222
12223         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
12224                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
12225                                         func, false);
12226                 if (err)
12227                         goto out;
12228         }
12229
12230         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12231         if (!msg) {
12232                 err = -ENOMEM;
12233                 goto out;
12234         }
12235
12236         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12237                              NL80211_CMD_ADD_NAN_FUNCTION);
12238         /* This can't really happen - we just allocated 4KB */
12239         if (WARN_ON(!hdr)) {
12240                 err = -ENOMEM;
12241                 goto out;
12242         }
12243
12244         err = rdev_add_nan_func(rdev, wdev, func);
12245 out:
12246         if (err < 0) {
12247                 cfg80211_free_nan_func(func);
12248                 nlmsg_free(msg);
12249                 return err;
12250         }
12251
12252         /* propagate the instance id and cookie to userspace  */
12253         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12254                               NL80211_ATTR_PAD))
12255                 goto nla_put_failure;
12256
12257         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12258         if (!func_attr)
12259                 goto nla_put_failure;
12260
12261         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12262                        func->instance_id))
12263                 goto nla_put_failure;
12264
12265         nla_nest_end(msg, func_attr);
12266
12267         genlmsg_end(msg, hdr);
12268         return genlmsg_reply(msg, info);
12269
12270 nla_put_failure:
12271         nlmsg_free(msg);
12272         return -ENOBUFS;
12273 }
12274
12275 static int nl80211_nan_del_func(struct sk_buff *skb,
12276                                struct genl_info *info)
12277 {
12278         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12279         struct wireless_dev *wdev = info->user_ptr[1];
12280         u64 cookie;
12281
12282         if (wdev->iftype != NL80211_IFTYPE_NAN)
12283                 return -EOPNOTSUPP;
12284
12285         if (!wdev_running(wdev))
12286                 return -ENOTCONN;
12287
12288         if (!info->attrs[NL80211_ATTR_COOKIE])
12289                 return -EINVAL;
12290
12291         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12292
12293         rdev_del_nan_func(rdev, wdev, cookie);
12294
12295         return 0;
12296 }
12297
12298 static int nl80211_nan_change_config(struct sk_buff *skb,
12299                                      struct genl_info *info)
12300 {
12301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12302         struct wireless_dev *wdev = info->user_ptr[1];
12303         struct cfg80211_nan_conf conf = {};
12304         u32 changed = 0;
12305
12306         if (wdev->iftype != NL80211_IFTYPE_NAN)
12307                 return -EOPNOTSUPP;
12308
12309         if (!wdev_running(wdev))
12310                 return -ENOTCONN;
12311
12312         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12313                 conf.master_pref =
12314                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12315                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12316                         return -EINVAL;
12317
12318                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12319         }
12320
12321         if (info->attrs[NL80211_ATTR_BANDS]) {
12322                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12323
12324                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12325                         return -EOPNOTSUPP;
12326
12327                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12328                         return -EINVAL;
12329
12330                 conf.bands = bands;
12331                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12332         }
12333
12334         if (!changed)
12335                 return -EINVAL;
12336
12337         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12338 }
12339
12340 void cfg80211_nan_match(struct wireless_dev *wdev,
12341                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12342 {
12343         struct wiphy *wiphy = wdev->wiphy;
12344         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12345         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12346         struct sk_buff *msg;
12347         void *hdr;
12348
12349         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12350                 return;
12351
12352         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12353         if (!msg)
12354                 return;
12355
12356         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12357         if (!hdr) {
12358                 nlmsg_free(msg);
12359                 return;
12360         }
12361
12362         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12363             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12364                                          wdev->netdev->ifindex)) ||
12365             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12366                               NL80211_ATTR_PAD))
12367                 goto nla_put_failure;
12368
12369         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12370                               NL80211_ATTR_PAD) ||
12371             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12372                 goto nla_put_failure;
12373
12374         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12375         if (!match_attr)
12376                 goto nla_put_failure;
12377
12378         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12379         if (!local_func_attr)
12380                 goto nla_put_failure;
12381
12382         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12383                 goto nla_put_failure;
12384
12385         nla_nest_end(msg, local_func_attr);
12386
12387         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12388         if (!peer_func_attr)
12389                 goto nla_put_failure;
12390
12391         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12392             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12393                 goto nla_put_failure;
12394
12395         if (match->info && match->info_len &&
12396             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12397                     match->info))
12398                 goto nla_put_failure;
12399
12400         nla_nest_end(msg, peer_func_attr);
12401         nla_nest_end(msg, match_attr);
12402         genlmsg_end(msg, hdr);
12403
12404         if (!wdev->owner_nlportid)
12405                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12406                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12407         else
12408                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12409                                 wdev->owner_nlportid);
12410
12411         return;
12412
12413 nla_put_failure:
12414         nlmsg_free(msg);
12415 }
12416 EXPORT_SYMBOL(cfg80211_nan_match);
12417
12418 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12419                                   u8 inst_id,
12420                                   enum nl80211_nan_func_term_reason reason,
12421                                   u64 cookie, gfp_t gfp)
12422 {
12423         struct wiphy *wiphy = wdev->wiphy;
12424         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12425         struct sk_buff *msg;
12426         struct nlattr *func_attr;
12427         void *hdr;
12428
12429         if (WARN_ON(!inst_id))
12430                 return;
12431
12432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12433         if (!msg)
12434                 return;
12435
12436         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12437         if (!hdr) {
12438                 nlmsg_free(msg);
12439                 return;
12440         }
12441
12442         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12443             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12444                                          wdev->netdev->ifindex)) ||
12445             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12446                               NL80211_ATTR_PAD))
12447                 goto nla_put_failure;
12448
12449         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12450                               NL80211_ATTR_PAD))
12451                 goto nla_put_failure;
12452
12453         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12454         if (!func_attr)
12455                 goto nla_put_failure;
12456
12457         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12458             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12459                 goto nla_put_failure;
12460
12461         nla_nest_end(msg, func_attr);
12462         genlmsg_end(msg, hdr);
12463
12464         if (!wdev->owner_nlportid)
12465                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12466                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12467         else
12468                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12469                                 wdev->owner_nlportid);
12470
12471         return;
12472
12473 nla_put_failure:
12474         nlmsg_free(msg);
12475 }
12476 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12477
12478 static int nl80211_get_protocol_features(struct sk_buff *skb,
12479                                          struct genl_info *info)
12480 {
12481         void *hdr;
12482         struct sk_buff *msg;
12483
12484         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12485         if (!msg)
12486                 return -ENOMEM;
12487
12488         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12489                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12490         if (!hdr)
12491                 goto nla_put_failure;
12492
12493         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12494                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12495                 goto nla_put_failure;
12496
12497         genlmsg_end(msg, hdr);
12498         return genlmsg_reply(msg, info);
12499
12500  nla_put_failure:
12501         kfree_skb(msg);
12502         return -ENOBUFS;
12503 }
12504
12505 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12506 {
12507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12508         struct cfg80211_update_ft_ies_params ft_params;
12509         struct net_device *dev = info->user_ptr[1];
12510
12511         if (!rdev->ops->update_ft_ies)
12512                 return -EOPNOTSUPP;
12513
12514         if (!info->attrs[NL80211_ATTR_MDID] ||
12515             !info->attrs[NL80211_ATTR_IE])
12516                 return -EINVAL;
12517
12518         memset(&ft_params, 0, sizeof(ft_params));
12519         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12520         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12521         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12522
12523         return rdev_update_ft_ies(rdev, dev, &ft_params);
12524 }
12525
12526 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12527                                        struct genl_info *info)
12528 {
12529         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12530         struct wireless_dev *wdev = info->user_ptr[1];
12531         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12532         u16 duration;
12533         int ret;
12534
12535         if (!rdev->ops->crit_proto_start)
12536                 return -EOPNOTSUPP;
12537
12538         if (WARN_ON(!rdev->ops->crit_proto_stop))
12539                 return -EINVAL;
12540
12541         if (rdev->crit_proto_nlportid)
12542                 return -EBUSY;
12543
12544         /* determine protocol if provided */
12545         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12546                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12547
12548         if (proto >= NUM_NL80211_CRIT_PROTO)
12549                 return -EINVAL;
12550
12551         /* timeout must be provided */
12552         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12553                 return -EINVAL;
12554
12555         duration =
12556                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12557
12558         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12559                 return -ERANGE;
12560
12561         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12562         if (!ret)
12563                 rdev->crit_proto_nlportid = info->snd_portid;
12564
12565         return ret;
12566 }
12567
12568 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12569                                       struct genl_info *info)
12570 {
12571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12572         struct wireless_dev *wdev = info->user_ptr[1];
12573
12574         if (!rdev->ops->crit_proto_stop)
12575                 return -EOPNOTSUPP;
12576
12577         if (rdev->crit_proto_nlportid) {
12578                 rdev->crit_proto_nlportid = 0;
12579                 rdev_crit_proto_stop(rdev, wdev);
12580         }
12581         return 0;
12582 }
12583
12584 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12585 {
12586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12587         struct wireless_dev *wdev =
12588                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12589         int i, err;
12590         u32 vid, subcmd;
12591
12592         if (!rdev->wiphy.vendor_commands)
12593                 return -EOPNOTSUPP;
12594
12595         if (IS_ERR(wdev)) {
12596                 err = PTR_ERR(wdev);
12597                 if (err != -EINVAL)
12598                         return err;
12599                 wdev = NULL;
12600         } else if (wdev->wiphy != &rdev->wiphy) {
12601                 return -EINVAL;
12602         }
12603
12604         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12605             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12606                 return -EINVAL;
12607
12608         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12609         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12610         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12611                 const struct wiphy_vendor_command *vcmd;
12612                 void *data = NULL;
12613                 int len = 0;
12614
12615                 vcmd = &rdev->wiphy.vendor_commands[i];
12616
12617                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12618                         continue;
12619
12620                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12621                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12622                         if (!wdev)
12623                                 return -EINVAL;
12624                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12625                             !wdev->netdev)
12626                                 return -EINVAL;
12627
12628                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12629                                 if (!wdev_running(wdev))
12630                                         return -ENETDOWN;
12631                         }
12632
12633                         if (!vcmd->doit)
12634                                 return -EOPNOTSUPP;
12635                 } else {
12636                         wdev = NULL;
12637                 }
12638
12639                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12640                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12641                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12642                 }
12643
12644                 rdev->cur_cmd_info = info;
12645                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12646                                                           data, len);
12647                 rdev->cur_cmd_info = NULL;
12648                 return err;
12649         }
12650
12651         return -EOPNOTSUPP;
12652 }
12653
12654 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12655                                        struct netlink_callback *cb,
12656                                        struct cfg80211_registered_device **rdev,
12657                                        struct wireless_dev **wdev)
12658 {
12659         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12660         u32 vid, subcmd;
12661         unsigned int i;
12662         int vcmd_idx = -1;
12663         int err;
12664         void *data = NULL;
12665         unsigned int data_len = 0;
12666
12667         if (cb->args[0]) {
12668                 /* subtract the 1 again here */
12669                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12670                 struct wireless_dev *tmp;
12671
12672                 if (!wiphy)
12673                         return -ENODEV;
12674                 *rdev = wiphy_to_rdev(wiphy);
12675                 *wdev = NULL;
12676
12677                 if (cb->args[1]) {
12678                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12679                                 if (tmp->identifier == cb->args[1] - 1) {
12680                                         *wdev = tmp;
12681                                         break;
12682                                 }
12683                         }
12684                 }
12685
12686                 /* keep rtnl locked in successful case */
12687                 return 0;
12688         }
12689
12690         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12691                           nl80211_fam.maxattr, nl80211_policy, NULL);
12692         if (err)
12693                 return err;
12694
12695         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12696             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12697                 return -EINVAL;
12698
12699         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12700         if (IS_ERR(*wdev))
12701                 *wdev = NULL;
12702
12703         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12704         if (IS_ERR(*rdev))
12705                 return PTR_ERR(*rdev);
12706
12707         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12708         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12709
12710         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12711                 const struct wiphy_vendor_command *vcmd;
12712
12713                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12714
12715                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12716                         continue;
12717
12718                 if (!vcmd->dumpit)
12719                         return -EOPNOTSUPP;
12720
12721                 vcmd_idx = i;
12722                 break;
12723         }
12724
12725         if (vcmd_idx < 0)
12726                 return -EOPNOTSUPP;
12727
12728         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12729                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12730                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12731         }
12732
12733         /* 0 is the first index - add 1 to parse only once */
12734         cb->args[0] = (*rdev)->wiphy_idx + 1;
12735         /* add 1 to know if it was NULL */
12736         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12737         cb->args[2] = vcmd_idx;
12738         cb->args[3] = (unsigned long)data;
12739         cb->args[4] = data_len;
12740
12741         /* keep rtnl locked in successful case */
12742         return 0;
12743 }
12744
12745 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12746                                    struct netlink_callback *cb)
12747 {
12748         struct cfg80211_registered_device *rdev;
12749         struct wireless_dev *wdev;
12750         unsigned int vcmd_idx;
12751         const struct wiphy_vendor_command *vcmd;
12752         void *data;
12753         int data_len;
12754         int err;
12755         struct nlattr *vendor_data;
12756
12757         rtnl_lock();
12758         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12759         if (err)
12760                 goto out;
12761
12762         vcmd_idx = cb->args[2];
12763         data = (void *)cb->args[3];
12764         data_len = cb->args[4];
12765         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12766
12767         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12768                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12769                 if (!wdev) {
12770                         err = -EINVAL;
12771                         goto out;
12772                 }
12773                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12774                     !wdev->netdev) {
12775                         err = -EINVAL;
12776                         goto out;
12777                 }
12778
12779                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12780                         if (!wdev_running(wdev)) {
12781                                 err = -ENETDOWN;
12782                                 goto out;
12783                         }
12784                 }
12785         }
12786
12787         while (1) {
12788                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12789                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12790                                            NL80211_CMD_VENDOR);
12791                 if (!hdr)
12792                         break;
12793
12794                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12795                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12796                                                wdev_id(wdev),
12797                                                NL80211_ATTR_PAD))) {
12798                         genlmsg_cancel(skb, hdr);
12799                         break;
12800                 }
12801
12802                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12803                 if (!vendor_data) {
12804                         genlmsg_cancel(skb, hdr);
12805                         break;
12806                 }
12807
12808                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12809                                    (unsigned long *)&cb->args[5]);
12810                 nla_nest_end(skb, vendor_data);
12811
12812                 if (err == -ENOBUFS || err == -ENOENT) {
12813                         genlmsg_cancel(skb, hdr);
12814                         break;
12815                 } else if (err) {
12816                         genlmsg_cancel(skb, hdr);
12817                         goto out;
12818                 }
12819
12820                 genlmsg_end(skb, hdr);
12821         }
12822
12823         err = skb->len;
12824  out:
12825         rtnl_unlock();
12826         return err;
12827 }
12828
12829 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12830                                            enum nl80211_commands cmd,
12831                                            enum nl80211_attrs attr,
12832                                            int approxlen)
12833 {
12834         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12835
12836         if (WARN_ON(!rdev->cur_cmd_info))
12837                 return NULL;
12838
12839         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12840                                            rdev->cur_cmd_info->snd_portid,
12841                                            rdev->cur_cmd_info->snd_seq,
12842                                            cmd, attr, NULL, GFP_KERNEL);
12843 }
12844 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12845
12846 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12847 {
12848         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12849         void *hdr = ((void **)skb->cb)[1];
12850         struct nlattr *data = ((void **)skb->cb)[2];
12851
12852         /* clear CB data for netlink core to own from now on */
12853         memset(skb->cb, 0, sizeof(skb->cb));
12854
12855         if (WARN_ON(!rdev->cur_cmd_info)) {
12856                 kfree_skb(skb);
12857                 return -EINVAL;
12858         }
12859
12860         nla_nest_end(skb, data);
12861         genlmsg_end(skb, hdr);
12862         return genlmsg_reply(skb, rdev->cur_cmd_info);
12863 }
12864 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12865
12866 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
12867 {
12868         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12869
12870         if (WARN_ON(!rdev->cur_cmd_info))
12871                 return 0;
12872
12873         return rdev->cur_cmd_info->snd_portid;
12874 }
12875 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
12876
12877 static int nl80211_set_qos_map(struct sk_buff *skb,
12878                                struct genl_info *info)
12879 {
12880         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12881         struct cfg80211_qos_map *qos_map = NULL;
12882         struct net_device *dev = info->user_ptr[1];
12883         u8 *pos, len, num_des, des_len, des;
12884         int ret;
12885
12886         if (!rdev->ops->set_qos_map)
12887                 return -EOPNOTSUPP;
12888
12889         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12890                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12891                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12892
12893                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12894                     len > IEEE80211_QOS_MAP_LEN_MAX)
12895                         return -EINVAL;
12896
12897                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12898                 if (!qos_map)
12899                         return -ENOMEM;
12900
12901                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12902                 if (num_des) {
12903                         des_len = num_des *
12904                                 sizeof(struct cfg80211_dscp_exception);
12905                         memcpy(qos_map->dscp_exception, pos, des_len);
12906                         qos_map->num_des = num_des;
12907                         for (des = 0; des < num_des; des++) {
12908                                 if (qos_map->dscp_exception[des].up > 7) {
12909                                         kfree(qos_map);
12910                                         return -EINVAL;
12911                                 }
12912                         }
12913                         pos += des_len;
12914                 }
12915                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12916         }
12917
12918         wdev_lock(dev->ieee80211_ptr);
12919         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12920         if (!ret)
12921                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12922         wdev_unlock(dev->ieee80211_ptr);
12923
12924         kfree(qos_map);
12925         return ret;
12926 }
12927
12928 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12929 {
12930         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12931         struct net_device *dev = info->user_ptr[1];
12932         struct wireless_dev *wdev = dev->ieee80211_ptr;
12933         const u8 *peer;
12934         u8 tsid, up;
12935         u16 admitted_time = 0;
12936         int err;
12937
12938         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12939                 return -EOPNOTSUPP;
12940
12941         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12942             !info->attrs[NL80211_ATTR_USER_PRIO])
12943                 return -EINVAL;
12944
12945         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12946         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12947
12948         /* WMM uses TIDs 0-7 even for TSPEC */
12949         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12950                 /* TODO: handle 802.11 TSPEC/admission control
12951                  * need more attributes for that (e.g. BA session requirement);
12952                  * change the WMM adminssion test above to allow both then
12953                  */
12954                 return -EINVAL;
12955         }
12956
12957         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12958
12959         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12960                 admitted_time =
12961                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12962                 if (!admitted_time)
12963                         return -EINVAL;
12964         }
12965
12966         wdev_lock(wdev);
12967         switch (wdev->iftype) {
12968         case NL80211_IFTYPE_STATION:
12969         case NL80211_IFTYPE_P2P_CLIENT:
12970                 if (wdev->current_bss)
12971                         break;
12972                 err = -ENOTCONN;
12973                 goto out;
12974         default:
12975                 err = -EOPNOTSUPP;
12976                 goto out;
12977         }
12978
12979         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12980
12981  out:
12982         wdev_unlock(wdev);
12983         return err;
12984 }
12985
12986 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12987 {
12988         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12989         struct net_device *dev = info->user_ptr[1];
12990         struct wireless_dev *wdev = dev->ieee80211_ptr;
12991         const u8 *peer;
12992         u8 tsid;
12993         int err;
12994
12995         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12996                 return -EINVAL;
12997
12998         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12999         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
13000
13001         wdev_lock(wdev);
13002         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
13003         wdev_unlock(wdev);
13004
13005         return err;
13006 }
13007
13008 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
13009                                        struct genl_info *info)
13010 {
13011         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13012         struct net_device *dev = info->user_ptr[1];
13013         struct wireless_dev *wdev = dev->ieee80211_ptr;
13014         struct cfg80211_chan_def chandef = {};
13015         const u8 *addr;
13016         u8 oper_class;
13017         int err;
13018
13019         if (!rdev->ops->tdls_channel_switch ||
13020             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13021                 return -EOPNOTSUPP;
13022
13023         switch (dev->ieee80211_ptr->iftype) {
13024         case NL80211_IFTYPE_STATION:
13025         case NL80211_IFTYPE_P2P_CLIENT:
13026                 break;
13027         default:
13028                 return -EOPNOTSUPP;
13029         }
13030
13031         if (!info->attrs[NL80211_ATTR_MAC] ||
13032             !info->attrs[NL80211_ATTR_OPER_CLASS])
13033                 return -EINVAL;
13034
13035         err = nl80211_parse_chandef(rdev, info, &chandef);
13036         if (err)
13037                 return err;
13038
13039         /*
13040          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
13041          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
13042          * specification is not defined for them.
13043          */
13044         if (chandef.chan->band == NL80211_BAND_2GHZ &&
13045             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
13046             chandef.width != NL80211_CHAN_WIDTH_20)
13047                 return -EINVAL;
13048
13049         /* we will be active on the TDLS link */
13050         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
13051                                            wdev->iftype))
13052                 return -EINVAL;
13053
13054         /* don't allow switching to DFS channels */
13055         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
13056                 return -EINVAL;
13057
13058         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13059         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
13060
13061         wdev_lock(wdev);
13062         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
13063         wdev_unlock(wdev);
13064
13065         return err;
13066 }
13067
13068 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
13069                                               struct genl_info *info)
13070 {
13071         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13072         struct net_device *dev = info->user_ptr[1];
13073         struct wireless_dev *wdev = dev->ieee80211_ptr;
13074         const u8 *addr;
13075
13076         if (!rdev->ops->tdls_channel_switch ||
13077             !rdev->ops->tdls_cancel_channel_switch ||
13078             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
13079                 return -EOPNOTSUPP;
13080
13081         switch (dev->ieee80211_ptr->iftype) {
13082         case NL80211_IFTYPE_STATION:
13083         case NL80211_IFTYPE_P2P_CLIENT:
13084                 break;
13085         default:
13086                 return -EOPNOTSUPP;
13087         }
13088
13089         if (!info->attrs[NL80211_ATTR_MAC])
13090                 return -EINVAL;
13091
13092         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13093
13094         wdev_lock(wdev);
13095         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
13096         wdev_unlock(wdev);
13097
13098         return 0;
13099 }
13100
13101 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
13102                                             struct genl_info *info)
13103 {
13104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13105         struct net_device *dev = info->user_ptr[1];
13106         struct wireless_dev *wdev = dev->ieee80211_ptr;
13107         const struct nlattr *nla;
13108         bool enabled;
13109
13110         if (!rdev->ops->set_multicast_to_unicast)
13111                 return -EOPNOTSUPP;
13112
13113         if (wdev->iftype != NL80211_IFTYPE_AP &&
13114             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13115                 return -EOPNOTSUPP;
13116
13117         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
13118         enabled = nla_get_flag(nla);
13119
13120         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
13121 }
13122
13123 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
13124 {
13125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13126         struct net_device *dev = info->user_ptr[1];
13127         struct wireless_dev *wdev = dev->ieee80211_ptr;
13128         struct cfg80211_pmk_conf pmk_conf = {};
13129         int ret;
13130
13131         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13132             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13133                 return -EOPNOTSUPP;
13134
13135         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13136                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13137                 return -EOPNOTSUPP;
13138
13139         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
13140                 return -EINVAL;
13141
13142         wdev_lock(wdev);
13143         if (!wdev->current_bss) {
13144                 ret = -ENOTCONN;
13145                 goto out;
13146         }
13147
13148         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13149         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
13150                 ret = -EINVAL;
13151                 goto out;
13152         }
13153
13154         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
13155         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
13156         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
13157             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
13158                 ret = -EINVAL;
13159                 goto out;
13160         }
13161
13162         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
13163                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13164
13165                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
13166                         ret = -EINVAL;
13167                         goto out;
13168                 }
13169
13170                 pmk_conf.pmk_r0_name =
13171                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
13172         }
13173
13174         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
13175 out:
13176         wdev_unlock(wdev);
13177         return ret;
13178 }
13179
13180 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
13181 {
13182         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13183         struct net_device *dev = info->user_ptr[1];
13184         struct wireless_dev *wdev = dev->ieee80211_ptr;
13185         const u8 *aa;
13186         int ret;
13187
13188         if (wdev->iftype != NL80211_IFTYPE_STATION &&
13189             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
13190                 return -EOPNOTSUPP;
13191
13192         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13193                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
13194                 return -EOPNOTSUPP;
13195
13196         if (!info->attrs[NL80211_ATTR_MAC])
13197                 return -EINVAL;
13198
13199         wdev_lock(wdev);
13200         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
13201         ret = rdev_del_pmk(rdev, dev, aa);
13202         wdev_unlock(wdev);
13203
13204         return ret;
13205 }
13206
13207 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
13208 {
13209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13210         struct net_device *dev = info->user_ptr[1];
13211         struct cfg80211_external_auth_params params;
13212
13213         if (!rdev->ops->external_auth)
13214                 return -EOPNOTSUPP;
13215
13216         if (!info->attrs[NL80211_ATTR_SSID] &&
13217             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
13218             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
13219                 return -EINVAL;
13220
13221         if (!info->attrs[NL80211_ATTR_BSSID])
13222                 return -EINVAL;
13223
13224         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
13225                 return -EINVAL;
13226
13227         memset(&params, 0, sizeof(params));
13228
13229         if (info->attrs[NL80211_ATTR_SSID]) {
13230                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
13231                 if (params.ssid.ssid_len == 0 ||
13232                     params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
13233                         return -EINVAL;
13234                 memcpy(params.ssid.ssid,
13235                        nla_data(info->attrs[NL80211_ATTR_SSID]),
13236                        params.ssid.ssid_len);
13237         }
13238
13239         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
13240                ETH_ALEN);
13241
13242         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13243
13244         if (info->attrs[NL80211_ATTR_PMKID])
13245                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
13246
13247         return rdev_external_auth(rdev, dev, &params);
13248 }
13249
13250 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
13251 {
13252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13253         struct net_device *dev = info->user_ptr[1];
13254         struct wireless_dev *wdev = dev->ieee80211_ptr;
13255         const u8 *buf;
13256         size_t len;
13257         u8 *dest;
13258         u16 proto;
13259         bool noencrypt;
13260         int err;
13261
13262         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13263                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13264                 return -EOPNOTSUPP;
13265
13266         if (!rdev->ops->tx_control_port)
13267                 return -EOPNOTSUPP;
13268
13269         if (!info->attrs[NL80211_ATTR_FRAME] ||
13270             !info->attrs[NL80211_ATTR_MAC] ||
13271             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13272                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13273                 return -EINVAL;
13274         }
13275
13276         wdev_lock(wdev);
13277
13278         switch (wdev->iftype) {
13279         case NL80211_IFTYPE_AP:
13280         case NL80211_IFTYPE_P2P_GO:
13281         case NL80211_IFTYPE_MESH_POINT:
13282                 break;
13283         case NL80211_IFTYPE_ADHOC:
13284         case NL80211_IFTYPE_STATION:
13285         case NL80211_IFTYPE_P2P_CLIENT:
13286                 if (wdev->current_bss)
13287                         break;
13288                 err = -ENOTCONN;
13289                 goto out;
13290         default:
13291                 err = -EOPNOTSUPP;
13292                 goto out;
13293         }
13294
13295         wdev_unlock(wdev);
13296
13297         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13298         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13299         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13300         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13301         noencrypt =
13302                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13303
13304         return rdev_tx_control_port(rdev, dev, buf, len,
13305                                     dest, cpu_to_be16(proto), noencrypt);
13306
13307  out:
13308         wdev_unlock(wdev);
13309         return err;
13310 }
13311
13312 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
13313                                            struct genl_info *info)
13314 {
13315         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13316         struct net_device *dev = info->user_ptr[1];
13317         struct wireless_dev *wdev = dev->ieee80211_ptr;
13318         struct cfg80211_ftm_responder_stats ftm_stats = {};
13319         struct sk_buff *msg;
13320         void *hdr;
13321         struct nlattr *ftm_stats_attr;
13322         int err;
13323
13324         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
13325                 return -EOPNOTSUPP;
13326
13327         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
13328         if (err)
13329                 return err;
13330
13331         if (!ftm_stats.filled)
13332                 return -ENODATA;
13333
13334         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13335         if (!msg)
13336                 return -ENOMEM;
13337
13338         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13339                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
13340         if (!hdr)
13341                 return -ENOBUFS;
13342
13343         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
13344                 goto nla_put_failure;
13345
13346         ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS);
13347         if (!ftm_stats_attr)
13348                 goto nla_put_failure;
13349
13350 #define SET_FTM(field, name, type)                                       \
13351         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13352             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
13353                              ftm_stats.field))                           \
13354                 goto nla_put_failure; } while (0)
13355 #define SET_FTM_U64(field, name)                                         \
13356         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
13357             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
13358                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
13359                 goto nla_put_failure; } while (0)
13360
13361         SET_FTM(success_num, SUCCESS_NUM, u32);
13362         SET_FTM(partial_num, PARTIAL_NUM, u32);
13363         SET_FTM(failed_num, FAILED_NUM, u32);
13364         SET_FTM(asap_num, ASAP_NUM, u32);
13365         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
13366         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
13367         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
13368         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
13369         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
13370 #undef SET_FTM
13371
13372         nla_nest_end(msg, ftm_stats_attr);
13373
13374         genlmsg_end(msg, hdr);
13375         return genlmsg_reply(msg, info);
13376
13377 nla_put_failure:
13378         nlmsg_free(msg);
13379         return -ENOBUFS;
13380 }
13381
13382 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
13383 {
13384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13385         struct cfg80211_update_owe_info owe_info;
13386         struct net_device *dev = info->user_ptr[1];
13387
13388         if (!rdev->ops->update_owe_info)
13389                 return -EOPNOTSUPP;
13390
13391         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
13392             !info->attrs[NL80211_ATTR_MAC])
13393                 return -EINVAL;
13394
13395         memset(&owe_info, 0, sizeof(owe_info));
13396         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
13397         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
13398
13399         if (info->attrs[NL80211_ATTR_IE]) {
13400                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13401                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13402         }
13403
13404         return rdev_update_owe_info(rdev, dev, &owe_info);
13405 }
13406
13407 #define NL80211_FLAG_NEED_WIPHY         0x01
13408 #define NL80211_FLAG_NEED_NETDEV        0x02
13409 #define NL80211_FLAG_NEED_RTNL          0x04
13410 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13411 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13412                                          NL80211_FLAG_CHECK_NETDEV_UP)
13413 #define NL80211_FLAG_NEED_WDEV          0x10
13414 /* If a netdev is associated, it must be UP, P2P must be started */
13415 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13416                                          NL80211_FLAG_CHECK_NETDEV_UP)
13417 #define NL80211_FLAG_CLEAR_SKB          0x20
13418
13419 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13420                             struct genl_info *info)
13421 {
13422         struct cfg80211_registered_device *rdev;
13423         struct wireless_dev *wdev;
13424         struct net_device *dev;
13425         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13426
13427         if (rtnl)
13428                 rtnl_lock();
13429
13430         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13431                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13432                 if (IS_ERR(rdev)) {
13433                         if (rtnl)
13434                                 rtnl_unlock();
13435                         return PTR_ERR(rdev);
13436                 }
13437                 info->user_ptr[0] = rdev;
13438         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13439                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13440                 ASSERT_RTNL();
13441
13442                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13443                                                   info->attrs);
13444                 if (IS_ERR(wdev)) {
13445                         if (rtnl)
13446                                 rtnl_unlock();
13447                         return PTR_ERR(wdev);
13448                 }
13449
13450                 dev = wdev->netdev;
13451                 rdev = wiphy_to_rdev(wdev->wiphy);
13452
13453                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13454                         if (!dev) {
13455                                 if (rtnl)
13456                                         rtnl_unlock();
13457                                 return -EINVAL;
13458                         }
13459
13460                         info->user_ptr[1] = dev;
13461                 } else {
13462                         info->user_ptr[1] = wdev;
13463                 }
13464
13465                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13466                     !wdev_running(wdev)) {
13467                         if (rtnl)
13468                                 rtnl_unlock();
13469                         return -ENETDOWN;
13470                 }
13471
13472                 if (dev)
13473                         dev_hold(dev);
13474
13475                 info->user_ptr[0] = rdev;
13476         }
13477
13478         return 0;
13479 }
13480
13481 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13482                               struct genl_info *info)
13483 {
13484         if (info->user_ptr[1]) {
13485                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13486                         struct wireless_dev *wdev = info->user_ptr[1];
13487
13488                         if (wdev->netdev)
13489                                 dev_put(wdev->netdev);
13490                 } else {
13491                         dev_put(info->user_ptr[1]);
13492                 }
13493         }
13494
13495         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13496                 rtnl_unlock();
13497
13498         /* If needed, clear the netlink message payload from the SKB
13499          * as it might contain key data that shouldn't stick around on
13500          * the heap after the SKB is freed. The netlink message header
13501          * is still needed for further processing, so leave it intact.
13502          */
13503         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13504                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13505
13506                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13507         }
13508 }
13509
13510 static const struct genl_ops nl80211_ops[] = {
13511         {
13512                 .cmd = NL80211_CMD_GET_WIPHY,
13513                 .doit = nl80211_get_wiphy,
13514                 .dumpit = nl80211_dump_wiphy,
13515                 .done = nl80211_dump_wiphy_done,
13516                 /* can be retrieved by unprivileged users */
13517                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13518                                   NL80211_FLAG_NEED_RTNL,
13519         },
13520         {
13521                 .cmd = NL80211_CMD_SET_WIPHY,
13522                 .doit = nl80211_set_wiphy,
13523                 .flags = GENL_UNS_ADMIN_PERM,
13524                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13525         },
13526         {
13527                 .cmd = NL80211_CMD_GET_INTERFACE,
13528                 .doit = nl80211_get_interface,
13529                 .dumpit = nl80211_dump_interface,
13530                 /* can be retrieved by unprivileged users */
13531                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13532                                   NL80211_FLAG_NEED_RTNL,
13533         },
13534         {
13535                 .cmd = NL80211_CMD_SET_INTERFACE,
13536                 .doit = nl80211_set_interface,
13537                 .flags = GENL_UNS_ADMIN_PERM,
13538                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13539                                   NL80211_FLAG_NEED_RTNL,
13540         },
13541         {
13542                 .cmd = NL80211_CMD_NEW_INTERFACE,
13543                 .doit = nl80211_new_interface,
13544                 .flags = GENL_UNS_ADMIN_PERM,
13545                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13546                                   NL80211_FLAG_NEED_RTNL,
13547         },
13548         {
13549                 .cmd = NL80211_CMD_DEL_INTERFACE,
13550                 .doit = nl80211_del_interface,
13551                 .flags = GENL_UNS_ADMIN_PERM,
13552                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13553                                   NL80211_FLAG_NEED_RTNL,
13554         },
13555         {
13556                 .cmd = NL80211_CMD_GET_KEY,
13557                 .doit = nl80211_get_key,
13558                 .flags = GENL_UNS_ADMIN_PERM,
13559                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13560                                   NL80211_FLAG_NEED_RTNL,
13561         },
13562         {
13563                 .cmd = NL80211_CMD_SET_KEY,
13564                 .doit = nl80211_set_key,
13565                 .flags = GENL_UNS_ADMIN_PERM,
13566                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13567                                   NL80211_FLAG_NEED_RTNL |
13568                                   NL80211_FLAG_CLEAR_SKB,
13569         },
13570         {
13571                 .cmd = NL80211_CMD_NEW_KEY,
13572                 .doit = nl80211_new_key,
13573                 .flags = GENL_UNS_ADMIN_PERM,
13574                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13575                                   NL80211_FLAG_NEED_RTNL |
13576                                   NL80211_FLAG_CLEAR_SKB,
13577         },
13578         {
13579                 .cmd = NL80211_CMD_DEL_KEY,
13580                 .doit = nl80211_del_key,
13581                 .flags = GENL_UNS_ADMIN_PERM,
13582                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13583                                   NL80211_FLAG_NEED_RTNL,
13584         },
13585         {
13586                 .cmd = NL80211_CMD_SET_BEACON,
13587                 .flags = GENL_UNS_ADMIN_PERM,
13588                 .doit = nl80211_set_beacon,
13589                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13590                                   NL80211_FLAG_NEED_RTNL,
13591         },
13592         {
13593                 .cmd = NL80211_CMD_START_AP,
13594                 .flags = GENL_UNS_ADMIN_PERM,
13595                 .doit = nl80211_start_ap,
13596                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13597                                   NL80211_FLAG_NEED_RTNL,
13598         },
13599         {
13600                 .cmd = NL80211_CMD_STOP_AP,
13601                 .flags = GENL_UNS_ADMIN_PERM,
13602                 .doit = nl80211_stop_ap,
13603                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13604                                   NL80211_FLAG_NEED_RTNL,
13605         },
13606         {
13607                 .cmd = NL80211_CMD_GET_STATION,
13608                 .doit = nl80211_get_station,
13609                 .dumpit = nl80211_dump_station,
13610                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13611                                   NL80211_FLAG_NEED_RTNL,
13612         },
13613         {
13614                 .cmd = NL80211_CMD_SET_STATION,
13615                 .doit = nl80211_set_station,
13616                 .flags = GENL_UNS_ADMIN_PERM,
13617                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13618                                   NL80211_FLAG_NEED_RTNL,
13619         },
13620         {
13621                 .cmd = NL80211_CMD_NEW_STATION,
13622                 .doit = nl80211_new_station,
13623                 .flags = GENL_UNS_ADMIN_PERM,
13624                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13625                                   NL80211_FLAG_NEED_RTNL,
13626         },
13627         {
13628                 .cmd = NL80211_CMD_DEL_STATION,
13629                 .doit = nl80211_del_station,
13630                 .flags = GENL_UNS_ADMIN_PERM,
13631                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13632                                   NL80211_FLAG_NEED_RTNL,
13633         },
13634         {
13635                 .cmd = NL80211_CMD_GET_MPATH,
13636                 .doit = nl80211_get_mpath,
13637                 .dumpit = nl80211_dump_mpath,
13638                 .flags = GENL_UNS_ADMIN_PERM,
13639                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13640                                   NL80211_FLAG_NEED_RTNL,
13641         },
13642         {
13643                 .cmd = NL80211_CMD_GET_MPP,
13644                 .doit = nl80211_get_mpp,
13645                 .dumpit = nl80211_dump_mpp,
13646                 .flags = GENL_UNS_ADMIN_PERM,
13647                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13648                                   NL80211_FLAG_NEED_RTNL,
13649         },
13650         {
13651                 .cmd = NL80211_CMD_SET_MPATH,
13652                 .doit = nl80211_set_mpath,
13653                 .flags = GENL_UNS_ADMIN_PERM,
13654                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13655                                   NL80211_FLAG_NEED_RTNL,
13656         },
13657         {
13658                 .cmd = NL80211_CMD_NEW_MPATH,
13659                 .doit = nl80211_new_mpath,
13660                 .flags = GENL_UNS_ADMIN_PERM,
13661                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13662                                   NL80211_FLAG_NEED_RTNL,
13663         },
13664         {
13665                 .cmd = NL80211_CMD_DEL_MPATH,
13666                 .doit = nl80211_del_mpath,
13667                 .flags = GENL_UNS_ADMIN_PERM,
13668                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13669                                   NL80211_FLAG_NEED_RTNL,
13670         },
13671         {
13672                 .cmd = NL80211_CMD_SET_BSS,
13673                 .doit = nl80211_set_bss,
13674                 .flags = GENL_UNS_ADMIN_PERM,
13675                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13676                                   NL80211_FLAG_NEED_RTNL,
13677         },
13678         {
13679                 .cmd = NL80211_CMD_GET_REG,
13680                 .doit = nl80211_get_reg_do,
13681                 .dumpit = nl80211_get_reg_dump,
13682                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13683                 /* can be retrieved by unprivileged users */
13684         },
13685 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13686         {
13687                 .cmd = NL80211_CMD_SET_REG,
13688                 .doit = nl80211_set_reg,
13689                 .flags = GENL_ADMIN_PERM,
13690                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13691         },
13692 #endif
13693         {
13694                 .cmd = NL80211_CMD_REQ_SET_REG,
13695                 .doit = nl80211_req_set_reg,
13696                 .flags = GENL_ADMIN_PERM,
13697         },
13698         {
13699                 .cmd = NL80211_CMD_RELOAD_REGDB,
13700                 .doit = nl80211_reload_regdb,
13701                 .flags = GENL_ADMIN_PERM,
13702         },
13703         {
13704                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13705                 .doit = nl80211_get_mesh_config,
13706                 /* can be retrieved by unprivileged users */
13707                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13708                                   NL80211_FLAG_NEED_RTNL,
13709         },
13710         {
13711                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13712                 .doit = nl80211_update_mesh_config,
13713                 .flags = GENL_UNS_ADMIN_PERM,
13714                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13715                                   NL80211_FLAG_NEED_RTNL,
13716         },
13717         {
13718                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13719                 .doit = nl80211_trigger_scan,
13720                 .flags = GENL_UNS_ADMIN_PERM,
13721                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13722                                   NL80211_FLAG_NEED_RTNL,
13723         },
13724         {
13725                 .cmd = NL80211_CMD_ABORT_SCAN,
13726                 .doit = nl80211_abort_scan,
13727                 .flags = GENL_UNS_ADMIN_PERM,
13728                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13729                                   NL80211_FLAG_NEED_RTNL,
13730         },
13731         {
13732                 .cmd = NL80211_CMD_GET_SCAN,
13733                 .dumpit = nl80211_dump_scan,
13734         },
13735         {
13736                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13737                 .doit = nl80211_start_sched_scan,
13738                 .flags = GENL_UNS_ADMIN_PERM,
13739                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13740                                   NL80211_FLAG_NEED_RTNL,
13741         },
13742         {
13743                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13744                 .doit = nl80211_stop_sched_scan,
13745                 .flags = GENL_UNS_ADMIN_PERM,
13746                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13747                                   NL80211_FLAG_NEED_RTNL,
13748         },
13749         {
13750                 .cmd = NL80211_CMD_AUTHENTICATE,
13751                 .doit = nl80211_authenticate,
13752                 .flags = GENL_UNS_ADMIN_PERM,
13753                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13754                                   NL80211_FLAG_NEED_RTNL |
13755                                   NL80211_FLAG_CLEAR_SKB,
13756         },
13757         {
13758                 .cmd = NL80211_CMD_ASSOCIATE,
13759                 .doit = nl80211_associate,
13760                 .flags = GENL_UNS_ADMIN_PERM,
13761                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13762                                   NL80211_FLAG_NEED_RTNL,
13763         },
13764         {
13765                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13766                 .doit = nl80211_deauthenticate,
13767                 .flags = GENL_UNS_ADMIN_PERM,
13768                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13769                                   NL80211_FLAG_NEED_RTNL,
13770         },
13771         {
13772                 .cmd = NL80211_CMD_DISASSOCIATE,
13773                 .doit = nl80211_disassociate,
13774                 .flags = GENL_UNS_ADMIN_PERM,
13775                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13776                                   NL80211_FLAG_NEED_RTNL,
13777         },
13778         {
13779                 .cmd = NL80211_CMD_JOIN_IBSS,
13780                 .doit = nl80211_join_ibss,
13781                 .flags = GENL_UNS_ADMIN_PERM,
13782                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13783                                   NL80211_FLAG_NEED_RTNL,
13784         },
13785         {
13786                 .cmd = NL80211_CMD_LEAVE_IBSS,
13787                 .doit = nl80211_leave_ibss,
13788                 .flags = GENL_UNS_ADMIN_PERM,
13789                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13790                                   NL80211_FLAG_NEED_RTNL,
13791         },
13792 #ifdef CONFIG_NL80211_TESTMODE
13793         {
13794                 .cmd = NL80211_CMD_TESTMODE,
13795                 .doit = nl80211_testmode_do,
13796                 .dumpit = nl80211_testmode_dump,
13797                 .flags = GENL_UNS_ADMIN_PERM,
13798                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13799                                   NL80211_FLAG_NEED_RTNL,
13800         },
13801 #endif
13802         {
13803                 .cmd = NL80211_CMD_CONNECT,
13804                 .doit = nl80211_connect,
13805                 .flags = GENL_UNS_ADMIN_PERM,
13806                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13807                                   NL80211_FLAG_NEED_RTNL,
13808         },
13809         {
13810                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13811                 .doit = nl80211_update_connect_params,
13812                 .flags = GENL_ADMIN_PERM,
13813                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13814                                   NL80211_FLAG_NEED_RTNL,
13815         },
13816         {
13817                 .cmd = NL80211_CMD_DISCONNECT,
13818                 .doit = nl80211_disconnect,
13819                 .flags = GENL_UNS_ADMIN_PERM,
13820                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13821                                   NL80211_FLAG_NEED_RTNL,
13822         },
13823         {
13824                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13825                 .doit = nl80211_wiphy_netns,
13826                 .flags = GENL_UNS_ADMIN_PERM,
13827                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13828                                   NL80211_FLAG_NEED_RTNL,
13829         },
13830         {
13831                 .cmd = NL80211_CMD_GET_SURVEY,
13832                 .dumpit = nl80211_dump_survey,
13833         },
13834         {
13835                 .cmd = NL80211_CMD_SET_PMKSA,
13836                 .doit = nl80211_setdel_pmksa,
13837                 .flags = GENL_UNS_ADMIN_PERM,
13838                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13839                                   NL80211_FLAG_NEED_RTNL,
13840         },
13841         {
13842                 .cmd = NL80211_CMD_DEL_PMKSA,
13843                 .doit = nl80211_setdel_pmksa,
13844                 .flags = GENL_UNS_ADMIN_PERM,
13845                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13846                                   NL80211_FLAG_NEED_RTNL,
13847         },
13848         {
13849                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13850                 .doit = nl80211_flush_pmksa,
13851                 .flags = GENL_UNS_ADMIN_PERM,
13852                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13853                                   NL80211_FLAG_NEED_RTNL,
13854         },
13855         {
13856                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13857                 .doit = nl80211_remain_on_channel,
13858                 .flags = GENL_UNS_ADMIN_PERM,
13859                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13860                                   NL80211_FLAG_NEED_RTNL,
13861         },
13862         {
13863                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13864                 .doit = nl80211_cancel_remain_on_channel,
13865                 .flags = GENL_UNS_ADMIN_PERM,
13866                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13867                                   NL80211_FLAG_NEED_RTNL,
13868         },
13869         {
13870                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13871                 .doit = nl80211_set_tx_bitrate_mask,
13872                 .flags = GENL_UNS_ADMIN_PERM,
13873                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13874                                   NL80211_FLAG_NEED_RTNL,
13875         },
13876         {
13877                 .cmd = NL80211_CMD_REGISTER_FRAME,
13878                 .doit = nl80211_register_mgmt,
13879                 .flags = GENL_UNS_ADMIN_PERM,
13880                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13881                                   NL80211_FLAG_NEED_RTNL,
13882         },
13883         {
13884                 .cmd = NL80211_CMD_FRAME,
13885                 .doit = nl80211_tx_mgmt,
13886                 .flags = GENL_UNS_ADMIN_PERM,
13887                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13888                                   NL80211_FLAG_NEED_RTNL,
13889         },
13890         {
13891                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13892                 .doit = nl80211_tx_mgmt_cancel_wait,
13893                 .flags = GENL_UNS_ADMIN_PERM,
13894                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13895                                   NL80211_FLAG_NEED_RTNL,
13896         },
13897         {
13898                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13899                 .doit = nl80211_set_power_save,
13900                 .flags = GENL_UNS_ADMIN_PERM,
13901                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13902                                   NL80211_FLAG_NEED_RTNL,
13903         },
13904         {
13905                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13906                 .doit = nl80211_get_power_save,
13907                 /* can be retrieved by unprivileged users */
13908                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13909                                   NL80211_FLAG_NEED_RTNL,
13910         },
13911         {
13912                 .cmd = NL80211_CMD_SET_CQM,
13913                 .doit = nl80211_set_cqm,
13914                 .flags = GENL_UNS_ADMIN_PERM,
13915                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13916                                   NL80211_FLAG_NEED_RTNL,
13917         },
13918         {
13919                 .cmd = NL80211_CMD_SET_CHANNEL,
13920                 .doit = nl80211_set_channel,
13921                 .flags = GENL_UNS_ADMIN_PERM,
13922                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13923                                   NL80211_FLAG_NEED_RTNL,
13924         },
13925         {
13926                 .cmd = NL80211_CMD_SET_WDS_PEER,
13927                 .doit = nl80211_set_wds_peer,
13928                 .flags = GENL_UNS_ADMIN_PERM,
13929                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13930                                   NL80211_FLAG_NEED_RTNL,
13931         },
13932         {
13933                 .cmd = NL80211_CMD_JOIN_MESH,
13934                 .doit = nl80211_join_mesh,
13935                 .flags = GENL_UNS_ADMIN_PERM,
13936                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13937                                   NL80211_FLAG_NEED_RTNL,
13938         },
13939         {
13940                 .cmd = NL80211_CMD_LEAVE_MESH,
13941                 .doit = nl80211_leave_mesh,
13942                 .flags = GENL_UNS_ADMIN_PERM,
13943                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13944                                   NL80211_FLAG_NEED_RTNL,
13945         },
13946         {
13947                 .cmd = NL80211_CMD_JOIN_OCB,
13948                 .doit = nl80211_join_ocb,
13949                 .flags = GENL_UNS_ADMIN_PERM,
13950                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13951                                   NL80211_FLAG_NEED_RTNL,
13952         },
13953         {
13954                 .cmd = NL80211_CMD_LEAVE_OCB,
13955                 .doit = nl80211_leave_ocb,
13956                 .flags = GENL_UNS_ADMIN_PERM,
13957                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13958                                   NL80211_FLAG_NEED_RTNL,
13959         },
13960 #ifdef CONFIG_PM
13961         {
13962                 .cmd = NL80211_CMD_GET_WOWLAN,
13963                 .doit = nl80211_get_wowlan,
13964                 /* can be retrieved by unprivileged users */
13965                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13966                                   NL80211_FLAG_NEED_RTNL,
13967         },
13968         {
13969                 .cmd = NL80211_CMD_SET_WOWLAN,
13970                 .doit = nl80211_set_wowlan,
13971                 .flags = GENL_UNS_ADMIN_PERM,
13972                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13973                                   NL80211_FLAG_NEED_RTNL,
13974         },
13975 #endif
13976         {
13977                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13978                 .doit = nl80211_set_rekey_data,
13979                 .flags = GENL_UNS_ADMIN_PERM,
13980                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13981                                   NL80211_FLAG_NEED_RTNL |
13982                                   NL80211_FLAG_CLEAR_SKB,
13983         },
13984         {
13985                 .cmd = NL80211_CMD_TDLS_MGMT,
13986                 .doit = nl80211_tdls_mgmt,
13987                 .flags = GENL_UNS_ADMIN_PERM,
13988                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13989                                   NL80211_FLAG_NEED_RTNL,
13990         },
13991         {
13992                 .cmd = NL80211_CMD_TDLS_OPER,
13993                 .doit = nl80211_tdls_oper,
13994                 .flags = GENL_UNS_ADMIN_PERM,
13995                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13996                                   NL80211_FLAG_NEED_RTNL,
13997         },
13998         {
13999                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
14000                 .doit = nl80211_register_unexpected_frame,
14001                 .flags = GENL_UNS_ADMIN_PERM,
14002                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14003                                   NL80211_FLAG_NEED_RTNL,
14004         },
14005         {
14006                 .cmd = NL80211_CMD_PROBE_CLIENT,
14007                 .doit = nl80211_probe_client,
14008                 .flags = GENL_UNS_ADMIN_PERM,
14009                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14010                                   NL80211_FLAG_NEED_RTNL,
14011         },
14012         {
14013                 .cmd = NL80211_CMD_REGISTER_BEACONS,
14014                 .doit = nl80211_register_beacons,
14015                 .flags = GENL_UNS_ADMIN_PERM,
14016                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14017                                   NL80211_FLAG_NEED_RTNL,
14018         },
14019         {
14020                 .cmd = NL80211_CMD_SET_NOACK_MAP,
14021                 .doit = nl80211_set_noack_map,
14022                 .flags = GENL_UNS_ADMIN_PERM,
14023                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14024                                   NL80211_FLAG_NEED_RTNL,
14025         },
14026         {
14027                 .cmd = NL80211_CMD_START_P2P_DEVICE,
14028                 .doit = nl80211_start_p2p_device,
14029                 .flags = GENL_UNS_ADMIN_PERM,
14030                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14031                                   NL80211_FLAG_NEED_RTNL,
14032         },
14033         {
14034                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
14035                 .doit = nl80211_stop_p2p_device,
14036                 .flags = GENL_UNS_ADMIN_PERM,
14037                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14038                                   NL80211_FLAG_NEED_RTNL,
14039         },
14040         {
14041                 .cmd = NL80211_CMD_START_NAN,
14042                 .doit = nl80211_start_nan,
14043                 .flags = GENL_ADMIN_PERM,
14044                 .internal_flags = NL80211_FLAG_NEED_WDEV |
14045                                   NL80211_FLAG_NEED_RTNL,
14046         },
14047         {
14048                 .cmd = NL80211_CMD_STOP_NAN,
14049                 .doit = nl80211_stop_nan,
14050                 .flags = GENL_ADMIN_PERM,
14051                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14052                                   NL80211_FLAG_NEED_RTNL,
14053         },
14054         {
14055                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
14056                 .doit = nl80211_nan_add_func,
14057                 .flags = GENL_ADMIN_PERM,
14058                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14059                                   NL80211_FLAG_NEED_RTNL,
14060         },
14061         {
14062                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
14063                 .doit = nl80211_nan_del_func,
14064                 .flags = GENL_ADMIN_PERM,
14065                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14066                                   NL80211_FLAG_NEED_RTNL,
14067         },
14068         {
14069                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
14070                 .doit = nl80211_nan_change_config,
14071                 .flags = GENL_ADMIN_PERM,
14072                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14073                                   NL80211_FLAG_NEED_RTNL,
14074         },
14075         {
14076                 .cmd = NL80211_CMD_SET_MCAST_RATE,
14077                 .doit = nl80211_set_mcast_rate,
14078                 .flags = GENL_UNS_ADMIN_PERM,
14079                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14080                                   NL80211_FLAG_NEED_RTNL,
14081         },
14082         {
14083                 .cmd = NL80211_CMD_SET_MAC_ACL,
14084                 .doit = nl80211_set_mac_acl,
14085                 .flags = GENL_UNS_ADMIN_PERM,
14086                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14087                                   NL80211_FLAG_NEED_RTNL,
14088         },
14089         {
14090                 .cmd = NL80211_CMD_RADAR_DETECT,
14091                 .doit = nl80211_start_radar_detection,
14092                 .flags = GENL_UNS_ADMIN_PERM,
14093                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14094                                   NL80211_FLAG_NEED_RTNL,
14095         },
14096         {
14097                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
14098                 .doit = nl80211_get_protocol_features,
14099         },
14100         {
14101                 .cmd = NL80211_CMD_UPDATE_FT_IES,
14102                 .doit = nl80211_update_ft_ies,
14103                 .flags = GENL_UNS_ADMIN_PERM,
14104                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14105                                   NL80211_FLAG_NEED_RTNL,
14106         },
14107         {
14108                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
14109                 .doit = nl80211_crit_protocol_start,
14110                 .flags = GENL_UNS_ADMIN_PERM,
14111                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14112                                   NL80211_FLAG_NEED_RTNL,
14113         },
14114         {
14115                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
14116                 .doit = nl80211_crit_protocol_stop,
14117                 .flags = GENL_UNS_ADMIN_PERM,
14118                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14119                                   NL80211_FLAG_NEED_RTNL,
14120         },
14121         {
14122                 .cmd = NL80211_CMD_GET_COALESCE,
14123                 .doit = nl80211_get_coalesce,
14124                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14125                                   NL80211_FLAG_NEED_RTNL,
14126         },
14127         {
14128                 .cmd = NL80211_CMD_SET_COALESCE,
14129                 .doit = nl80211_set_coalesce,
14130                 .flags = GENL_UNS_ADMIN_PERM,
14131                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14132                                   NL80211_FLAG_NEED_RTNL,
14133         },
14134         {
14135                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
14136                 .doit = nl80211_channel_switch,
14137                 .flags = GENL_UNS_ADMIN_PERM,
14138                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14139                                   NL80211_FLAG_NEED_RTNL,
14140         },
14141         {
14142                 .cmd = NL80211_CMD_VENDOR,
14143                 .doit = nl80211_vendor_cmd,
14144                 .dumpit = nl80211_vendor_cmd_dump,
14145                 .flags = GENL_UNS_ADMIN_PERM,
14146                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
14147                                   NL80211_FLAG_NEED_RTNL,
14148         },
14149         {
14150                 .cmd = NL80211_CMD_SET_QOS_MAP,
14151                 .doit = nl80211_set_qos_map,
14152                 .flags = GENL_UNS_ADMIN_PERM,
14153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14154                                   NL80211_FLAG_NEED_RTNL,
14155         },
14156         {
14157                 .cmd = NL80211_CMD_ADD_TX_TS,
14158                 .doit = nl80211_add_tx_ts,
14159                 .flags = GENL_UNS_ADMIN_PERM,
14160                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14161                                   NL80211_FLAG_NEED_RTNL,
14162         },
14163         {
14164                 .cmd = NL80211_CMD_DEL_TX_TS,
14165                 .doit = nl80211_del_tx_ts,
14166                 .flags = GENL_UNS_ADMIN_PERM,
14167                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14168                                   NL80211_FLAG_NEED_RTNL,
14169         },
14170         {
14171                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
14172                 .doit = nl80211_tdls_channel_switch,
14173                 .flags = GENL_UNS_ADMIN_PERM,
14174                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14175                                   NL80211_FLAG_NEED_RTNL,
14176         },
14177         {
14178                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
14179                 .doit = nl80211_tdls_cancel_channel_switch,
14180                 .flags = GENL_UNS_ADMIN_PERM,
14181                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14182                                   NL80211_FLAG_NEED_RTNL,
14183         },
14184         {
14185                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
14186                 .doit = nl80211_set_multicast_to_unicast,
14187                 .flags = GENL_UNS_ADMIN_PERM,
14188                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14189                                   NL80211_FLAG_NEED_RTNL,
14190         },
14191         {
14192                 .cmd = NL80211_CMD_SET_PMK,
14193                 .doit = nl80211_set_pmk,
14194                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14195                                   NL80211_FLAG_NEED_RTNL,
14196         },
14197         {
14198                 .cmd = NL80211_CMD_DEL_PMK,
14199                 .doit = nl80211_del_pmk,
14200                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14201                                   NL80211_FLAG_NEED_RTNL,
14202         },
14203         {
14204                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
14205                 .doit = nl80211_external_auth,
14206                 .flags = GENL_ADMIN_PERM,
14207                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14208                                   NL80211_FLAG_NEED_RTNL,
14209         },
14210         {
14211                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
14212                 .doit = nl80211_tx_control_port,
14213                 .flags = GENL_UNS_ADMIN_PERM,
14214                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14215                                   NL80211_FLAG_NEED_RTNL,
14216         },
14217         {
14218                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
14219                 .doit = nl80211_get_ftm_responder_stats,
14220                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
14221                                   NL80211_FLAG_NEED_RTNL,
14222         },
14223         {
14224                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
14225                 .doit = nl80211_pmsr_start,
14226                 .flags = GENL_UNS_ADMIN_PERM,
14227                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
14228                                   NL80211_FLAG_NEED_RTNL,
14229         },
14230         {
14231                 .cmd = NL80211_CMD_NOTIFY_RADAR,
14232                 .doit = nl80211_notify_radar_detection,
14233                 .flags = GENL_UNS_ADMIN_PERM,
14234                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14235                                   NL80211_FLAG_NEED_RTNL,
14236         },
14237         {
14238                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
14239                 .doit = nl80211_update_owe_info,
14240                 .flags = GENL_ADMIN_PERM,
14241                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
14242                                   NL80211_FLAG_NEED_RTNL,
14243         },
14244 };
14245
14246 static struct genl_family nl80211_fam __ro_after_init = {
14247         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
14248         .hdrsize = 0,                   /* no private header */
14249         .version = 1,                   /* no particular meaning now */
14250         .maxattr = NL80211_ATTR_MAX,
14251         .policy = nl80211_policy,
14252         .netnsok = true,
14253         .pre_doit = nl80211_pre_doit,
14254         .post_doit = nl80211_post_doit,
14255         .module = THIS_MODULE,
14256         .ops = nl80211_ops,
14257         .n_ops = ARRAY_SIZE(nl80211_ops),
14258         .mcgrps = nl80211_mcgrps,
14259         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
14260 };
14261
14262 /* notification functions */
14263
14264 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
14265                           enum nl80211_commands cmd)
14266 {
14267         struct sk_buff *msg;
14268         struct nl80211_dump_wiphy_state state = {};
14269
14270         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
14271                 cmd != NL80211_CMD_DEL_WIPHY);
14272
14273         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14274         if (!msg)
14275                 return;
14276
14277         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14278                 nlmsg_free(msg);
14279                 return;
14280         }
14281
14282         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14283                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14284 }
14285
14286 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14287                                 struct wireless_dev *wdev,
14288                                 enum nl80211_commands cmd)
14289 {
14290         struct sk_buff *msg;
14291
14292         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14293         if (!msg)
14294                 return;
14295
14296         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
14297                 nlmsg_free(msg);
14298                 return;
14299         }
14300
14301         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14302                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14303 }
14304
14305 static int nl80211_add_scan_req(struct sk_buff *msg,
14306                                 struct cfg80211_registered_device *rdev)
14307 {
14308         struct cfg80211_scan_request *req = rdev->scan_req;
14309         struct nlattr *nest;
14310         int i;
14311
14312         if (WARN_ON(!req))
14313                 return 0;
14314
14315         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
14316         if (!nest)
14317                 goto nla_put_failure;
14318         for (i = 0; i < req->n_ssids; i++) {
14319                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14320                         goto nla_put_failure;
14321         }
14322         nla_nest_end(msg, nest);
14323
14324         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14325         if (!nest)
14326                 goto nla_put_failure;
14327         for (i = 0; i < req->n_channels; i++) {
14328                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14329                         goto nla_put_failure;
14330         }
14331         nla_nest_end(msg, nest);
14332
14333         if (req->ie &&
14334             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14335                 goto nla_put_failure;
14336
14337         if (req->flags &&
14338             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14339                 goto nla_put_failure;
14340
14341         if (req->info.scan_start_tsf &&
14342             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14343                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14344              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14345                      req->info.tsf_bssid)))
14346                 goto nla_put_failure;
14347
14348         return 0;
14349  nla_put_failure:
14350         return -ENOBUFS;
14351 }
14352
14353 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14354                                  struct cfg80211_registered_device *rdev,
14355                                  struct wireless_dev *wdev,
14356                                  u32 portid, u32 seq, int flags,
14357                                  u32 cmd)
14358 {
14359         void *hdr;
14360
14361         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14362         if (!hdr)
14363                 return -1;
14364
14365         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14366             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14367                                          wdev->netdev->ifindex)) ||
14368             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14369                               NL80211_ATTR_PAD))
14370                 goto nla_put_failure;
14371
14372         /* ignore errors and send incomplete event anyway */
14373         nl80211_add_scan_req(msg, rdev);
14374
14375         genlmsg_end(msg, hdr);
14376         return 0;
14377
14378  nla_put_failure:
14379         genlmsg_cancel(msg, hdr);
14380         return -EMSGSIZE;
14381 }
14382
14383 static int
14384 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14385                             struct cfg80211_sched_scan_request *req, u32 cmd)
14386 {
14387         void *hdr;
14388
14389         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14390         if (!hdr)
14391                 return -1;
14392
14393         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14394                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14395             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14396             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14397                               NL80211_ATTR_PAD))
14398                 goto nla_put_failure;
14399
14400         genlmsg_end(msg, hdr);
14401         return 0;
14402
14403  nla_put_failure:
14404         genlmsg_cancel(msg, hdr);
14405         return -EMSGSIZE;
14406 }
14407
14408 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14409                              struct wireless_dev *wdev)
14410 {
14411         struct sk_buff *msg;
14412
14413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14414         if (!msg)
14415                 return;
14416
14417         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14418                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14419                 nlmsg_free(msg);
14420                 return;
14421         }
14422
14423         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14424                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14425 }
14426
14427 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14428                                        struct wireless_dev *wdev, bool aborted)
14429 {
14430         struct sk_buff *msg;
14431
14432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14433         if (!msg)
14434                 return NULL;
14435
14436         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14437                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14438                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14439                 nlmsg_free(msg);
14440                 return NULL;
14441         }
14442
14443         return msg;
14444 }
14445
14446 /* send message created by nl80211_build_scan_msg() */
14447 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14448                            struct sk_buff *msg)
14449 {
14450         if (!msg)
14451                 return;
14452
14453         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14454                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14455 }
14456
14457 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14458 {
14459         struct sk_buff *msg;
14460
14461         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14462         if (!msg)
14463                 return;
14464
14465         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14466                 nlmsg_free(msg);
14467                 return;
14468         }
14469
14470         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14471                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14472 }
14473
14474 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14475                                           struct regulatory_request *request)
14476 {
14477         /* Userspace can always count this one always being set */
14478         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14479                 goto nla_put_failure;
14480
14481         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14482                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14483                                NL80211_REGDOM_TYPE_WORLD))
14484                         goto nla_put_failure;
14485         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14486                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14487                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14488                         goto nla_put_failure;
14489         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14490                    request->intersect) {
14491                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14492                                NL80211_REGDOM_TYPE_INTERSECTION))
14493                         goto nla_put_failure;
14494         } else {
14495                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14496                                NL80211_REGDOM_TYPE_COUNTRY) ||
14497                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14498                                    request->alpha2))
14499                         goto nla_put_failure;
14500         }
14501
14502         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14503                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14504
14505                 if (wiphy &&
14506                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14507                         goto nla_put_failure;
14508
14509                 if (wiphy &&
14510                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14511                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14512                         goto nla_put_failure;
14513         }
14514
14515         return true;
14516
14517 nla_put_failure:
14518         return false;
14519 }
14520
14521 /*
14522  * This can happen on global regulatory changes or device specific settings
14523  * based on custom regulatory domains.
14524  */
14525 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14526                                      struct regulatory_request *request)
14527 {
14528         struct sk_buff *msg;
14529         void *hdr;
14530
14531         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14532         if (!msg)
14533                 return;
14534
14535         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14536         if (!hdr) {
14537                 nlmsg_free(msg);
14538                 return;
14539         }
14540
14541         if (nl80211_reg_change_event_fill(msg, request) == false)
14542                 goto nla_put_failure;
14543
14544         genlmsg_end(msg, hdr);
14545
14546         rcu_read_lock();
14547         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14548                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14549         rcu_read_unlock();
14550
14551         return;
14552
14553 nla_put_failure:
14554         nlmsg_free(msg);
14555 }
14556
14557 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14558                                     struct net_device *netdev,
14559                                     const u8 *buf, size_t len,
14560                                     enum nl80211_commands cmd, gfp_t gfp,
14561                                     int uapsd_queues, const u8 *req_ies,
14562                                     size_t req_ies_len)
14563 {
14564         struct sk_buff *msg;
14565         void *hdr;
14566
14567         msg = nlmsg_new(100 + len + req_ies_len, gfp);
14568         if (!msg)
14569                 return;
14570
14571         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14572         if (!hdr) {
14573                 nlmsg_free(msg);
14574                 return;
14575         }
14576
14577         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14578             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14579             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14580             (req_ies &&
14581              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
14582                 goto nla_put_failure;
14583
14584         if (uapsd_queues >= 0) {
14585                 struct nlattr *nla_wmm =
14586                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14587                 if (!nla_wmm)
14588                         goto nla_put_failure;
14589
14590                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14591                                uapsd_queues))
14592                         goto nla_put_failure;
14593
14594                 nla_nest_end(msg, nla_wmm);
14595         }
14596
14597         genlmsg_end(msg, hdr);
14598
14599         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14600                                 NL80211_MCGRP_MLME, gfp);
14601         return;
14602
14603  nla_put_failure:
14604         nlmsg_free(msg);
14605 }
14606
14607 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14608                           struct net_device *netdev, const u8 *buf,
14609                           size_t len, gfp_t gfp)
14610 {
14611         nl80211_send_mlme_event(rdev, netdev, buf, len,
14612                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0);
14613 }
14614
14615 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14616                            struct net_device *netdev, const u8 *buf,
14617                            size_t len, gfp_t gfp, int uapsd_queues,
14618                            const u8 *req_ies, size_t req_ies_len)
14619 {
14620         nl80211_send_mlme_event(rdev, netdev, buf, len,
14621                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
14622                                 req_ies, req_ies_len);
14623 }
14624
14625 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14626                          struct net_device *netdev, const u8 *buf,
14627                          size_t len, gfp_t gfp)
14628 {
14629         nl80211_send_mlme_event(rdev, netdev, buf, len,
14630                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0);
14631 }
14632
14633 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14634                            struct net_device *netdev, const u8 *buf,
14635                            size_t len, gfp_t gfp)
14636 {
14637         nl80211_send_mlme_event(rdev, netdev, buf, len,
14638                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0);
14639 }
14640
14641 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14642                                   size_t len)
14643 {
14644         struct wireless_dev *wdev = dev->ieee80211_ptr;
14645         struct wiphy *wiphy = wdev->wiphy;
14646         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14647         const struct ieee80211_mgmt *mgmt = (void *)buf;
14648         u32 cmd;
14649
14650         if (WARN_ON(len < 2))
14651                 return;
14652
14653         if (ieee80211_is_deauth(mgmt->frame_control))
14654                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14655         else
14656                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14657
14658         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14659         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
14660                                 NULL, 0);
14661 }
14662 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14663
14664 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14665                                       struct net_device *netdev, int cmd,
14666                                       const u8 *addr, gfp_t gfp)
14667 {
14668         struct sk_buff *msg;
14669         void *hdr;
14670
14671         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14672         if (!msg)
14673                 return;
14674
14675         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14676         if (!hdr) {
14677                 nlmsg_free(msg);
14678                 return;
14679         }
14680
14681         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14682             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14683             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14684             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14685                 goto nla_put_failure;
14686
14687         genlmsg_end(msg, hdr);
14688
14689         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14690                                 NL80211_MCGRP_MLME, gfp);
14691         return;
14692
14693  nla_put_failure:
14694         nlmsg_free(msg);
14695 }
14696
14697 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14698                                struct net_device *netdev, const u8 *addr,
14699                                gfp_t gfp)
14700 {
14701         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14702                                   addr, gfp);
14703 }
14704
14705 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14706                                 struct net_device *netdev, const u8 *addr,
14707                                 gfp_t gfp)
14708 {
14709         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14710                                   addr, gfp);
14711 }
14712
14713 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14714                                  struct net_device *netdev,
14715                                  struct cfg80211_connect_resp_params *cr,
14716                                  gfp_t gfp)
14717 {
14718         struct sk_buff *msg;
14719         void *hdr;
14720
14721         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14722                         cr->fils.kek_len + cr->fils.pmk_len +
14723                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14724         if (!msg)
14725                 return;
14726
14727         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14728         if (!hdr) {
14729                 nlmsg_free(msg);
14730                 return;
14731         }
14732
14733         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14734             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14735             (cr->bssid &&
14736              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14737             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14738                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14739                         cr->status) ||
14740             (cr->status < 0 &&
14741              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14742               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14743                           cr->timeout_reason))) ||
14744             (cr->req_ie &&
14745              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14746             (cr->resp_ie &&
14747              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14748                      cr->resp_ie)) ||
14749             (cr->fils.update_erp_next_seq_num &&
14750              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14751                          cr->fils.erp_next_seq_num)) ||
14752             (cr->status == WLAN_STATUS_SUCCESS &&
14753              ((cr->fils.kek &&
14754                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14755                        cr->fils.kek)) ||
14756               (cr->fils.pmk &&
14757                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14758               (cr->fils.pmkid &&
14759                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14760                 goto nla_put_failure;
14761
14762         genlmsg_end(msg, hdr);
14763
14764         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14765                                 NL80211_MCGRP_MLME, gfp);
14766         return;
14767
14768  nla_put_failure:
14769         nlmsg_free(msg);
14770 }
14771
14772 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14773                          struct net_device *netdev,
14774                          struct cfg80211_roam_info *info, gfp_t gfp)
14775 {
14776         struct sk_buff *msg;
14777         void *hdr;
14778         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14779
14780         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14781                         info->fils.kek_len + info->fils.pmk_len +
14782                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14783         if (!msg)
14784                 return;
14785
14786         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14787         if (!hdr) {
14788                 nlmsg_free(msg);
14789                 return;
14790         }
14791
14792         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14793             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14794             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14795             (info->req_ie &&
14796              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14797                      info->req_ie)) ||
14798             (info->resp_ie &&
14799              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14800                      info->resp_ie)) ||
14801             (info->fils.update_erp_next_seq_num &&
14802              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14803                          info->fils.erp_next_seq_num)) ||
14804             (info->fils.kek &&
14805              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14806                      info->fils.kek)) ||
14807             (info->fils.pmk &&
14808              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14809             (info->fils.pmkid &&
14810              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14811                 goto nla_put_failure;
14812
14813         genlmsg_end(msg, hdr);
14814
14815         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14816                                 NL80211_MCGRP_MLME, gfp);
14817         return;
14818
14819  nla_put_failure:
14820         nlmsg_free(msg);
14821 }
14822
14823 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14824                                   struct net_device *netdev, const u8 *bssid)
14825 {
14826         struct sk_buff *msg;
14827         void *hdr;
14828
14829         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14830         if (!msg)
14831                 return;
14832
14833         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14834         if (!hdr) {
14835                 nlmsg_free(msg);
14836                 return;
14837         }
14838
14839         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14840                 goto nla_put_failure;
14841
14842         genlmsg_end(msg, hdr);
14843
14844         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14845                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14846         return;
14847
14848  nla_put_failure:
14849         nlmsg_free(msg);
14850 }
14851
14852 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14853                                struct net_device *netdev, u16 reason,
14854                                const u8 *ie, size_t ie_len, bool from_ap)
14855 {
14856         struct sk_buff *msg;
14857         void *hdr;
14858
14859         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14860         if (!msg)
14861                 return;
14862
14863         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14864         if (!hdr) {
14865                 nlmsg_free(msg);
14866                 return;
14867         }
14868
14869         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14870             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14871             (reason &&
14872              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14873             (from_ap &&
14874              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14875             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14876                 goto nla_put_failure;
14877
14878         genlmsg_end(msg, hdr);
14879
14880         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14881                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14882         return;
14883
14884  nla_put_failure:
14885         nlmsg_free(msg);
14886 }
14887
14888 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14889                              struct net_device *netdev, const u8 *bssid,
14890                              gfp_t gfp)
14891 {
14892         struct sk_buff *msg;
14893         void *hdr;
14894
14895         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14896         if (!msg)
14897                 return;
14898
14899         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14900         if (!hdr) {
14901                 nlmsg_free(msg);
14902                 return;
14903         }
14904
14905         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14906             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14907             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14908                 goto nla_put_failure;
14909
14910         genlmsg_end(msg, hdr);
14911
14912         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14913                                 NL80211_MCGRP_MLME, gfp);
14914         return;
14915
14916  nla_put_failure:
14917         nlmsg_free(msg);
14918 }
14919
14920 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14921                                         const u8 *ie, u8 ie_len,
14922                                         int sig_dbm, gfp_t gfp)
14923 {
14924         struct wireless_dev *wdev = dev->ieee80211_ptr;
14925         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14926         struct sk_buff *msg;
14927         void *hdr;
14928
14929         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14930                 return;
14931
14932         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14933
14934         msg = nlmsg_new(100 + ie_len, gfp);
14935         if (!msg)
14936                 return;
14937
14938         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14939         if (!hdr) {
14940                 nlmsg_free(msg);
14941                 return;
14942         }
14943
14944         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14945             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14946             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14947             (ie_len && ie &&
14948              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
14949             (sig_dbm &&
14950              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
14951                 goto nla_put_failure;
14952
14953         genlmsg_end(msg, hdr);
14954
14955         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14956                                 NL80211_MCGRP_MLME, gfp);
14957         return;
14958
14959  nla_put_failure:
14960         nlmsg_free(msg);
14961 }
14962 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14963
14964 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14965                                  struct net_device *netdev, const u8 *addr,
14966                                  enum nl80211_key_type key_type, int key_id,
14967                                  const u8 *tsc, gfp_t gfp)
14968 {
14969         struct sk_buff *msg;
14970         void *hdr;
14971
14972         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14973         if (!msg)
14974                 return;
14975
14976         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14977         if (!hdr) {
14978                 nlmsg_free(msg);
14979                 return;
14980         }
14981
14982         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14983             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14984             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14985             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14986             (key_id != -1 &&
14987              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14988             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14989                 goto nla_put_failure;
14990
14991         genlmsg_end(msg, hdr);
14992
14993         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14994                                 NL80211_MCGRP_MLME, gfp);
14995         return;
14996
14997  nla_put_failure:
14998         nlmsg_free(msg);
14999 }
15000
15001 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
15002                                     struct ieee80211_channel *channel_before,
15003                                     struct ieee80211_channel *channel_after)
15004 {
15005         struct sk_buff *msg;
15006         void *hdr;
15007         struct nlattr *nl_freq;
15008
15009         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
15010         if (!msg)
15011                 return;
15012
15013         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
15014         if (!hdr) {
15015                 nlmsg_free(msg);
15016                 return;
15017         }
15018
15019         /*
15020          * Since we are applying the beacon hint to a wiphy we know its
15021          * wiphy_idx is valid
15022          */
15023         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
15024                 goto nla_put_failure;
15025
15026         /* Before */
15027         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
15028         if (!nl_freq)
15029                 goto nla_put_failure;
15030
15031         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
15032                 goto nla_put_failure;
15033         nla_nest_end(msg, nl_freq);
15034
15035         /* After */
15036         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
15037         if (!nl_freq)
15038                 goto nla_put_failure;
15039
15040         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
15041                 goto nla_put_failure;
15042         nla_nest_end(msg, nl_freq);
15043
15044         genlmsg_end(msg, hdr);
15045
15046         rcu_read_lock();
15047         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
15048                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
15049         rcu_read_unlock();
15050
15051         return;
15052
15053 nla_put_failure:
15054         nlmsg_free(msg);
15055 }
15056
15057 static void nl80211_send_remain_on_chan_event(
15058         int cmd, struct cfg80211_registered_device *rdev,
15059         struct wireless_dev *wdev, u64 cookie,
15060         struct ieee80211_channel *chan,
15061         unsigned int duration, gfp_t gfp)
15062 {
15063         struct sk_buff *msg;
15064         void *hdr;
15065
15066         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15067         if (!msg)
15068                 return;
15069
15070         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15071         if (!hdr) {
15072                 nlmsg_free(msg);
15073                 return;
15074         }
15075
15076         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15077             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15078                                          wdev->netdev->ifindex)) ||
15079             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15080                               NL80211_ATTR_PAD) ||
15081             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
15082             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
15083                         NL80211_CHAN_NO_HT) ||
15084             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15085                               NL80211_ATTR_PAD))
15086                 goto nla_put_failure;
15087
15088         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
15089             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
15090                 goto nla_put_failure;
15091
15092         genlmsg_end(msg, hdr);
15093
15094         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15095                                 NL80211_MCGRP_MLME, gfp);
15096         return;
15097
15098  nla_put_failure:
15099         nlmsg_free(msg);
15100 }
15101
15102 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
15103                                struct ieee80211_channel *chan,
15104                                unsigned int duration, gfp_t gfp)
15105 {
15106         struct wiphy *wiphy = wdev->wiphy;
15107         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15108
15109         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
15110         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
15111                                           rdev, wdev, cookie, chan,
15112                                           duration, gfp);
15113 }
15114 EXPORT_SYMBOL(cfg80211_ready_on_channel);
15115
15116 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
15117                                         struct ieee80211_channel *chan,
15118                                         gfp_t gfp)
15119 {
15120         struct wiphy *wiphy = wdev->wiphy;
15121         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15122
15123         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
15124         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15125                                           rdev, wdev, cookie, chan, 0, gfp);
15126 }
15127 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
15128
15129 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
15130                       struct station_info *sinfo, gfp_t gfp)
15131 {
15132         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15133         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15134         struct sk_buff *msg;
15135
15136         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
15137
15138         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15139         if (!msg)
15140                 return;
15141
15142         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
15143                                  rdev, dev, mac_addr, sinfo) < 0) {
15144                 nlmsg_free(msg);
15145                 return;
15146         }
15147
15148         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15149                                 NL80211_MCGRP_MLME, gfp);
15150 }
15151 EXPORT_SYMBOL(cfg80211_new_sta);
15152
15153 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
15154                             struct station_info *sinfo, gfp_t gfp)
15155 {
15156         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15157         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15158         struct sk_buff *msg;
15159         struct station_info empty_sinfo = {};
15160
15161         if (!sinfo)
15162                 sinfo = &empty_sinfo;
15163
15164         trace_cfg80211_del_sta(dev, mac_addr);
15165
15166         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15167         if (!msg) {
15168                 cfg80211_sinfo_release_content(sinfo);
15169                 return;
15170         }
15171
15172         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
15173                                  rdev, dev, mac_addr, sinfo) < 0) {
15174                 nlmsg_free(msg);
15175                 return;
15176         }
15177
15178         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15179                                 NL80211_MCGRP_MLME, gfp);
15180 }
15181 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
15182
15183 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
15184                           enum nl80211_connect_failed_reason reason,
15185                           gfp_t gfp)
15186 {
15187         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
15188         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15189         struct sk_buff *msg;
15190         void *hdr;
15191
15192         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
15193         if (!msg)
15194                 return;
15195
15196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
15197         if (!hdr) {
15198                 nlmsg_free(msg);
15199                 return;
15200         }
15201
15202         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15203             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
15204             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
15205                 goto nla_put_failure;
15206
15207         genlmsg_end(msg, hdr);
15208
15209         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15210                                 NL80211_MCGRP_MLME, gfp);
15211         return;
15212
15213  nla_put_failure:
15214         nlmsg_free(msg);
15215 }
15216 EXPORT_SYMBOL(cfg80211_conn_failed);
15217
15218 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
15219                                        const u8 *addr, gfp_t gfp)
15220 {
15221         struct wireless_dev *wdev = dev->ieee80211_ptr;
15222         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15223         struct sk_buff *msg;
15224         void *hdr;
15225         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
15226
15227         if (!nlportid)
15228                 return false;
15229
15230         msg = nlmsg_new(100, gfp);
15231         if (!msg)
15232                 return true;
15233
15234         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15235         if (!hdr) {
15236                 nlmsg_free(msg);
15237                 return true;
15238         }
15239
15240         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15241             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15242             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
15243                 goto nla_put_failure;
15244
15245         genlmsg_end(msg, hdr);
15246         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15247         return true;
15248
15249  nla_put_failure:
15250         nlmsg_free(msg);
15251         return true;
15252 }
15253
15254 bool cfg80211_rx_spurious_frame(struct net_device *dev,
15255                                 const u8 *addr, gfp_t gfp)
15256 {
15257         struct wireless_dev *wdev = dev->ieee80211_ptr;
15258         bool ret;
15259
15260         trace_cfg80211_rx_spurious_frame(dev, addr);
15261
15262         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15263                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
15264                 trace_cfg80211_return_bool(false);
15265                 return false;
15266         }
15267         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
15268                                          addr, gfp);
15269         trace_cfg80211_return_bool(ret);
15270         return ret;
15271 }
15272 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
15273
15274 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
15275                                         const u8 *addr, gfp_t gfp)
15276 {
15277         struct wireless_dev *wdev = dev->ieee80211_ptr;
15278         bool ret;
15279
15280         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15281
15282         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15283                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15284                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15285                 trace_cfg80211_return_bool(false);
15286                 return false;
15287         }
15288         ret = __nl80211_unexpected_frame(dev,
15289                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15290                                          addr, gfp);
15291         trace_cfg80211_return_bool(ret);
15292         return ret;
15293 }
15294 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15295
15296 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15297                       struct wireless_dev *wdev, u32 nlportid,
15298                       int freq, int sig_dbm,
15299                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15300 {
15301         struct net_device *netdev = wdev->netdev;
15302         struct sk_buff *msg;
15303         void *hdr;
15304
15305         msg = nlmsg_new(100 + len, gfp);
15306         if (!msg)
15307                 return -ENOMEM;
15308
15309         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15310         if (!hdr) {
15311                 nlmsg_free(msg);
15312                 return -ENOMEM;
15313         }
15314
15315         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15316             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15317                                         netdev->ifindex)) ||
15318             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15319                               NL80211_ATTR_PAD) ||
15320             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15321             (sig_dbm &&
15322              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15323             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15324             (flags &&
15325              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15326                 goto nla_put_failure;
15327
15328         genlmsg_end(msg, hdr);
15329
15330         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15331
15332  nla_put_failure:
15333         nlmsg_free(msg);
15334         return -ENOBUFS;
15335 }
15336
15337 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15338                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15339 {
15340         struct wiphy *wiphy = wdev->wiphy;
15341         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15342         struct net_device *netdev = wdev->netdev;
15343         struct sk_buff *msg;
15344         void *hdr;
15345
15346         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15347
15348         msg = nlmsg_new(100 + len, gfp);
15349         if (!msg)
15350                 return;
15351
15352         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15353         if (!hdr) {
15354                 nlmsg_free(msg);
15355                 return;
15356         }
15357
15358         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15359             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15360                                    netdev->ifindex)) ||
15361             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15362                               NL80211_ATTR_PAD) ||
15363             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15364             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15365                               NL80211_ATTR_PAD) ||
15366             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15367                 goto nla_put_failure;
15368
15369         genlmsg_end(msg, hdr);
15370
15371         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15372                                 NL80211_MCGRP_MLME, gfp);
15373         return;
15374
15375  nla_put_failure:
15376         nlmsg_free(msg);
15377 }
15378 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15379
15380 static int __nl80211_rx_control_port(struct net_device *dev,
15381                                      struct sk_buff *skb,
15382                                      bool unencrypted, gfp_t gfp)
15383 {
15384         struct wireless_dev *wdev = dev->ieee80211_ptr;
15385         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15386         struct ethhdr *ehdr = eth_hdr(skb);
15387         const u8 *addr = ehdr->h_source;
15388         u16 proto = be16_to_cpu(skb->protocol);
15389         struct sk_buff *msg;
15390         void *hdr;
15391         struct nlattr *frame;
15392
15393         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15394
15395         if (!nlportid)
15396                 return -ENOENT;
15397
15398         msg = nlmsg_new(100 + skb->len, gfp);
15399         if (!msg)
15400                 return -ENOMEM;
15401
15402         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15403         if (!hdr) {
15404                 nlmsg_free(msg);
15405                 return -ENOBUFS;
15406         }
15407
15408         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15409             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15410             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15411                               NL80211_ATTR_PAD) ||
15412             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15413             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15414             (unencrypted && nla_put_flag(msg,
15415                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15416                 goto nla_put_failure;
15417
15418         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15419         if (!frame)
15420                 goto nla_put_failure;
15421
15422         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15423         genlmsg_end(msg, hdr);
15424
15425         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15426
15427  nla_put_failure:
15428         nlmsg_free(msg);
15429         return -ENOBUFS;
15430 }
15431
15432 bool cfg80211_rx_control_port(struct net_device *dev,
15433                               struct sk_buff *skb, bool unencrypted)
15434 {
15435         int ret;
15436
15437         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15438         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15439         trace_cfg80211_return_bool(ret == 0);
15440         return ret == 0;
15441 }
15442 EXPORT_SYMBOL(cfg80211_rx_control_port);
15443
15444 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15445                                             const char *mac, gfp_t gfp)
15446 {
15447         struct wireless_dev *wdev = dev->ieee80211_ptr;
15448         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15449         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15450         void **cb;
15451
15452         if (!msg)
15453                 return NULL;
15454
15455         cb = (void **)msg->cb;
15456
15457         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15458         if (!cb[0]) {
15459                 nlmsg_free(msg);
15460                 return NULL;
15461         }
15462
15463         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15464             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15465                 goto nla_put_failure;
15466
15467         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15468                 goto nla_put_failure;
15469
15470         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15471         if (!cb[1])
15472                 goto nla_put_failure;
15473
15474         cb[2] = rdev;
15475
15476         return msg;
15477  nla_put_failure:
15478         nlmsg_free(msg);
15479         return NULL;
15480 }
15481
15482 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15483 {
15484         void **cb = (void **)msg->cb;
15485         struct cfg80211_registered_device *rdev = cb[2];
15486
15487         nla_nest_end(msg, cb[1]);
15488         genlmsg_end(msg, cb[0]);
15489
15490         memset(msg->cb, 0, sizeof(msg->cb));
15491
15492         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15493                                 NL80211_MCGRP_MLME, gfp);
15494 }
15495
15496 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15497                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15498                               s32 rssi_level, gfp_t gfp)
15499 {
15500         struct sk_buff *msg;
15501         struct wireless_dev *wdev = dev->ieee80211_ptr;
15502         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15503
15504         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15505
15506         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15507                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15508                 return;
15509
15510         if (wdev->cqm_config) {
15511                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15512
15513                 cfg80211_cqm_rssi_update(rdev, dev);
15514
15515                 if (rssi_level == 0)
15516                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15517         }
15518
15519         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15520         if (!msg)
15521                 return;
15522
15523         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15524                         rssi_event))
15525                 goto nla_put_failure;
15526
15527         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15528                                       rssi_level))
15529                 goto nla_put_failure;
15530
15531         cfg80211_send_cqm(msg, gfp);
15532
15533         return;
15534
15535  nla_put_failure:
15536         nlmsg_free(msg);
15537 }
15538 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15539
15540 void cfg80211_cqm_txe_notify(struct net_device *dev,
15541                              const u8 *peer, u32 num_packets,
15542                              u32 rate, u32 intvl, gfp_t gfp)
15543 {
15544         struct sk_buff *msg;
15545
15546         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15547         if (!msg)
15548                 return;
15549
15550         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15551                 goto nla_put_failure;
15552
15553         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15554                 goto nla_put_failure;
15555
15556         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15557                 goto nla_put_failure;
15558
15559         cfg80211_send_cqm(msg, gfp);
15560         return;
15561
15562  nla_put_failure:
15563         nlmsg_free(msg);
15564 }
15565 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15566
15567 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15568                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15569 {
15570         struct sk_buff *msg;
15571
15572         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15573
15574         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15575         if (!msg)
15576                 return;
15577
15578         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15579                 goto nla_put_failure;
15580
15581         cfg80211_send_cqm(msg, gfp);
15582         return;
15583
15584  nla_put_failure:
15585         nlmsg_free(msg);
15586 }
15587 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15588
15589 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15590 {
15591         struct sk_buff *msg;
15592
15593         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15594         if (!msg)
15595                 return;
15596
15597         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15598                 goto nla_put_failure;
15599
15600         cfg80211_send_cqm(msg, gfp);
15601         return;
15602
15603  nla_put_failure:
15604         nlmsg_free(msg);
15605 }
15606 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15607
15608 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15609                                      struct net_device *netdev, const u8 *bssid,
15610                                      const u8 *replay_ctr, gfp_t gfp)
15611 {
15612         struct sk_buff *msg;
15613         struct nlattr *rekey_attr;
15614         void *hdr;
15615
15616         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15617         if (!msg)
15618                 return;
15619
15620         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15621         if (!hdr) {
15622                 nlmsg_free(msg);
15623                 return;
15624         }
15625
15626         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15627             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15628             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15629                 goto nla_put_failure;
15630
15631         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15632         if (!rekey_attr)
15633                 goto nla_put_failure;
15634
15635         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15636                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15637                 goto nla_put_failure;
15638
15639         nla_nest_end(msg, rekey_attr);
15640
15641         genlmsg_end(msg, hdr);
15642
15643         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15644                                 NL80211_MCGRP_MLME, gfp);
15645         return;
15646
15647  nla_put_failure:
15648         nlmsg_free(msg);
15649 }
15650
15651 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15652                                const u8 *replay_ctr, gfp_t gfp)
15653 {
15654         struct wireless_dev *wdev = dev->ieee80211_ptr;
15655         struct wiphy *wiphy = wdev->wiphy;
15656         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15657
15658         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15659         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15660 }
15661 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15662
15663 static void
15664 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15665                                struct net_device *netdev, int index,
15666                                const u8 *bssid, bool preauth, gfp_t gfp)
15667 {
15668         struct sk_buff *msg;
15669         struct nlattr *attr;
15670         void *hdr;
15671
15672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15673         if (!msg)
15674                 return;
15675
15676         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15677         if (!hdr) {
15678                 nlmsg_free(msg);
15679                 return;
15680         }
15681
15682         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15683             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15684                 goto nla_put_failure;
15685
15686         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15687         if (!attr)
15688                 goto nla_put_failure;
15689
15690         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15691             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15692             (preauth &&
15693              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15694                 goto nla_put_failure;
15695
15696         nla_nest_end(msg, attr);
15697
15698         genlmsg_end(msg, hdr);
15699
15700         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15701                                 NL80211_MCGRP_MLME, gfp);
15702         return;
15703
15704  nla_put_failure:
15705         nlmsg_free(msg);
15706 }
15707
15708 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15709                                      const u8 *bssid, bool preauth, gfp_t gfp)
15710 {
15711         struct wireless_dev *wdev = dev->ieee80211_ptr;
15712         struct wiphy *wiphy = wdev->wiphy;
15713         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15714
15715         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15716         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15717 }
15718 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15719
15720 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15721                                      struct net_device *netdev,
15722                                      struct cfg80211_chan_def *chandef,
15723                                      gfp_t gfp,
15724                                      enum nl80211_commands notif,
15725                                      u8 count)
15726 {
15727         struct sk_buff *msg;
15728         void *hdr;
15729
15730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15731         if (!msg)
15732                 return;
15733
15734         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15735         if (!hdr) {
15736                 nlmsg_free(msg);
15737                 return;
15738         }
15739
15740         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15741                 goto nla_put_failure;
15742
15743         if (nl80211_send_chandef(msg, chandef))
15744                 goto nla_put_failure;
15745
15746         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15747             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15748                         goto nla_put_failure;
15749
15750         genlmsg_end(msg, hdr);
15751
15752         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15753                                 NL80211_MCGRP_MLME, gfp);
15754         return;
15755
15756  nla_put_failure:
15757         nlmsg_free(msg);
15758 }
15759
15760 void cfg80211_ch_switch_notify(struct net_device *dev,
15761                                struct cfg80211_chan_def *chandef)
15762 {
15763         struct wireless_dev *wdev = dev->ieee80211_ptr;
15764         struct wiphy *wiphy = wdev->wiphy;
15765         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15766
15767         ASSERT_WDEV_LOCK(wdev);
15768
15769         trace_cfg80211_ch_switch_notify(dev, chandef);
15770
15771         wdev->chandef = *chandef;
15772         wdev->preset_chandef = *chandef;
15773
15774         if (wdev->iftype == NL80211_IFTYPE_STATION &&
15775             !WARN_ON(!wdev->current_bss))
15776                 wdev->current_bss->pub.channel = chandef->chan;
15777
15778         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15779                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15780 }
15781 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15782
15783 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15784                                        struct cfg80211_chan_def *chandef,
15785                                        u8 count)
15786 {
15787         struct wireless_dev *wdev = dev->ieee80211_ptr;
15788         struct wiphy *wiphy = wdev->wiphy;
15789         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15790
15791         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15792
15793         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15794                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15795 }
15796 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15797
15798 void
15799 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15800                      const struct cfg80211_chan_def *chandef,
15801                      enum nl80211_radar_event event,
15802                      struct net_device *netdev, gfp_t gfp)
15803 {
15804         struct sk_buff *msg;
15805         void *hdr;
15806
15807         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15808         if (!msg)
15809                 return;
15810
15811         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15812         if (!hdr) {
15813                 nlmsg_free(msg);
15814                 return;
15815         }
15816
15817         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15818                 goto nla_put_failure;
15819
15820         /* NOP and radar events don't need a netdev parameter */
15821         if (netdev) {
15822                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15823
15824                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15825                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15826                                       NL80211_ATTR_PAD))
15827                         goto nla_put_failure;
15828         }
15829
15830         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15831                 goto nla_put_failure;
15832
15833         if (nl80211_send_chandef(msg, chandef))
15834                 goto nla_put_failure;
15835
15836         genlmsg_end(msg, hdr);
15837
15838         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15839                                 NL80211_MCGRP_MLME, gfp);
15840         return;
15841
15842  nla_put_failure:
15843         nlmsg_free(msg);
15844 }
15845
15846 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15847                                        struct sta_opmode_info *sta_opmode,
15848                                        gfp_t gfp)
15849 {
15850         struct sk_buff *msg;
15851         struct wireless_dev *wdev = dev->ieee80211_ptr;
15852         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15853         void *hdr;
15854
15855         if (WARN_ON(!mac))
15856                 return;
15857
15858         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15859         if (!msg)
15860                 return;
15861
15862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15863         if (!hdr) {
15864                 nlmsg_free(msg);
15865                 return;
15866         }
15867
15868         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15869                 goto nla_put_failure;
15870
15871         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15872                 goto nla_put_failure;
15873
15874         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15875                 goto nla_put_failure;
15876
15877         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15878             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15879                 goto nla_put_failure;
15880
15881         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15882             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15883                 goto nla_put_failure;
15884
15885         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15886             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15887                 goto nla_put_failure;
15888
15889         genlmsg_end(msg, hdr);
15890
15891         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15892                                 NL80211_MCGRP_MLME, gfp);
15893
15894         return;
15895
15896 nla_put_failure:
15897         nlmsg_free(msg);
15898 }
15899 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15900
15901 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15902                            u64 cookie, bool acked, s32 ack_signal,
15903                            bool is_valid_ack_signal, gfp_t gfp)
15904 {
15905         struct wireless_dev *wdev = dev->ieee80211_ptr;
15906         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15907         struct sk_buff *msg;
15908         void *hdr;
15909
15910         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15911
15912         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15913
15914         if (!msg)
15915                 return;
15916
15917         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15918         if (!hdr) {
15919                 nlmsg_free(msg);
15920                 return;
15921         }
15922
15923         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15924             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15925             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15926             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15927                               NL80211_ATTR_PAD) ||
15928             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15929             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15930                                                 ack_signal)))
15931                 goto nla_put_failure;
15932
15933         genlmsg_end(msg, hdr);
15934
15935         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15936                                 NL80211_MCGRP_MLME, gfp);
15937         return;
15938
15939  nla_put_failure:
15940         nlmsg_free(msg);
15941 }
15942 EXPORT_SYMBOL(cfg80211_probe_status);
15943
15944 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15945                                  const u8 *frame, size_t len,
15946                                  int freq, int sig_dbm)
15947 {
15948         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15949         struct sk_buff *msg;
15950         void *hdr;
15951         struct cfg80211_beacon_registration *reg;
15952
15953         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15954
15955         spin_lock_bh(&rdev->beacon_registrations_lock);
15956         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15957                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15958                 if (!msg) {
15959                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15960                         return;
15961                 }
15962
15963                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15964                 if (!hdr)
15965                         goto nla_put_failure;
15966
15967                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15968                     (freq &&
15969                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15970                     (sig_dbm &&
15971                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15972                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15973                         goto nla_put_failure;
15974
15975                 genlmsg_end(msg, hdr);
15976
15977                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15978         }
15979         spin_unlock_bh(&rdev->beacon_registrations_lock);
15980         return;
15981
15982  nla_put_failure:
15983         spin_unlock_bh(&rdev->beacon_registrations_lock);
15984         nlmsg_free(msg);
15985 }
15986 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15987
15988 #ifdef CONFIG_PM
15989 static int cfg80211_net_detect_results(struct sk_buff *msg,
15990                                        struct cfg80211_wowlan_wakeup *wakeup)
15991 {
15992         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15993         struct nlattr *nl_results, *nl_match, *nl_freqs;
15994         int i, j;
15995
15996         nl_results = nla_nest_start(
15997                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15998         if (!nl_results)
15999                 return -EMSGSIZE;
16000
16001         for (i = 0; i < nd->n_matches; i++) {
16002                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
16003
16004                 nl_match = nla_nest_start(msg, i);
16005                 if (!nl_match)
16006                         break;
16007
16008                 /* The SSID attribute is optional in nl80211, but for
16009                  * simplicity reasons it's always present in the
16010                  * cfg80211 structure.  If a driver can't pass the
16011                  * SSID, that needs to be changed.  A zero length SSID
16012                  * is still a valid SSID (wildcard), so it cannot be
16013                  * used for this purpose.
16014                  */
16015                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
16016                             match->ssid.ssid)) {
16017                         nla_nest_cancel(msg, nl_match);
16018                         goto out;
16019                 }
16020
16021                 if (match->n_channels) {
16022                         nl_freqs = nla_nest_start(
16023                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
16024                         if (!nl_freqs) {
16025                                 nla_nest_cancel(msg, nl_match);
16026                                 goto out;
16027                         }
16028
16029                         for (j = 0; j < match->n_channels; j++) {
16030                                 if (nla_put_u32(msg, j, match->channels[j])) {
16031                                         nla_nest_cancel(msg, nl_freqs);
16032                                         nla_nest_cancel(msg, nl_match);
16033                                         goto out;
16034                                 }
16035                         }
16036
16037                         nla_nest_end(msg, nl_freqs);
16038                 }
16039
16040                 nla_nest_end(msg, nl_match);
16041         }
16042
16043 out:
16044         nla_nest_end(msg, nl_results);
16045         return 0;
16046 }
16047
16048 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
16049                                    struct cfg80211_wowlan_wakeup *wakeup,
16050                                    gfp_t gfp)
16051 {
16052         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16053         struct sk_buff *msg;
16054         void *hdr;
16055         int size = 200;
16056
16057         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
16058
16059         if (wakeup)
16060                 size += wakeup->packet_present_len;
16061
16062         msg = nlmsg_new(size, gfp);
16063         if (!msg)
16064                 return;
16065
16066         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
16067         if (!hdr)
16068                 goto free_msg;
16069
16070         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16071             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16072                               NL80211_ATTR_PAD))
16073                 goto free_msg;
16074
16075         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16076                                         wdev->netdev->ifindex))
16077                 goto free_msg;
16078
16079         if (wakeup) {
16080                 struct nlattr *reasons;
16081
16082                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
16083                 if (!reasons)
16084                         goto free_msg;
16085
16086                 if (wakeup->disconnect &&
16087                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
16088                         goto free_msg;
16089                 if (wakeup->magic_pkt &&
16090                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
16091                         goto free_msg;
16092                 if (wakeup->gtk_rekey_failure &&
16093                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
16094                         goto free_msg;
16095                 if (wakeup->eap_identity_req &&
16096                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
16097                         goto free_msg;
16098                 if (wakeup->four_way_handshake &&
16099                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
16100                         goto free_msg;
16101                 if (wakeup->rfkill_release &&
16102                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
16103                         goto free_msg;
16104
16105                 if (wakeup->pattern_idx >= 0 &&
16106                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
16107                                 wakeup->pattern_idx))
16108                         goto free_msg;
16109
16110                 if (wakeup->tcp_match &&
16111                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
16112                         goto free_msg;
16113
16114                 if (wakeup->tcp_connlost &&
16115                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
16116                         goto free_msg;
16117
16118                 if (wakeup->tcp_nomoretokens &&
16119                     nla_put_flag(msg,
16120                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
16121                         goto free_msg;
16122
16123                 if (wakeup->packet) {
16124                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
16125                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
16126
16127                         if (!wakeup->packet_80211) {
16128                                 pkt_attr =
16129                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
16130                                 len_attr =
16131                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
16132                         }
16133
16134                         if (wakeup->packet_len &&
16135                             nla_put_u32(msg, len_attr, wakeup->packet_len))
16136                                 goto free_msg;
16137
16138                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
16139                                     wakeup->packet))
16140                                 goto free_msg;
16141                 }
16142
16143                 if (wakeup->net_detect &&
16144                     cfg80211_net_detect_results(msg, wakeup))
16145                                 goto free_msg;
16146
16147                 nla_nest_end(msg, reasons);
16148         }
16149
16150         genlmsg_end(msg, hdr);
16151
16152         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16153                                 NL80211_MCGRP_MLME, gfp);
16154         return;
16155
16156  free_msg:
16157         nlmsg_free(msg);
16158 }
16159 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
16160 #endif
16161
16162 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
16163                                 enum nl80211_tdls_operation oper,
16164                                 u16 reason_code, gfp_t gfp)
16165 {
16166         struct wireless_dev *wdev = dev->ieee80211_ptr;
16167         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16168         struct sk_buff *msg;
16169         void *hdr;
16170
16171         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
16172                                          reason_code);
16173
16174         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16175         if (!msg)
16176                 return;
16177
16178         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
16179         if (!hdr) {
16180                 nlmsg_free(msg);
16181                 return;
16182         }
16183
16184         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16185             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16186             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
16187             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
16188             (reason_code > 0 &&
16189              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
16190                 goto nla_put_failure;
16191
16192         genlmsg_end(msg, hdr);
16193
16194         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16195                                 NL80211_MCGRP_MLME, gfp);
16196         return;
16197
16198  nla_put_failure:
16199         nlmsg_free(msg);
16200 }
16201 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
16202
16203 static int nl80211_netlink_notify(struct notifier_block * nb,
16204                                   unsigned long state,
16205                                   void *_notify)
16206 {
16207         struct netlink_notify *notify = _notify;
16208         struct cfg80211_registered_device *rdev;
16209         struct wireless_dev *wdev;
16210         struct cfg80211_beacon_registration *reg, *tmp;
16211
16212         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
16213                 return NOTIFY_DONE;
16214
16215         rcu_read_lock();
16216
16217         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
16218                 struct cfg80211_sched_scan_request *sched_scan_req;
16219
16220                 list_for_each_entry_rcu(sched_scan_req,
16221                                         &rdev->sched_scan_req_list,
16222                                         list) {
16223                         if (sched_scan_req->owner_nlportid == notify->portid) {
16224                                 sched_scan_req->nl_owner_dead = true;
16225                                 schedule_work(&rdev->sched_scan_stop_wk);
16226                         }
16227                 }
16228
16229                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
16230                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
16231
16232                         if (wdev->owner_nlportid == notify->portid) {
16233                                 wdev->nl_owner_dead = true;
16234                                 schedule_work(&rdev->destroy_work);
16235                         } else if (wdev->conn_owner_nlportid == notify->portid) {
16236                                 schedule_work(&wdev->disconnect_wk);
16237                         }
16238
16239                         cfg80211_release_pmsr(wdev, notify->portid);
16240                 }
16241
16242                 spin_lock_bh(&rdev->beacon_registrations_lock);
16243                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
16244                                          list) {
16245                         if (reg->nlportid == notify->portid) {
16246                                 list_del(&reg->list);
16247                                 kfree(reg);
16248                                 break;
16249                         }
16250                 }
16251                 spin_unlock_bh(&rdev->beacon_registrations_lock);
16252         }
16253
16254         rcu_read_unlock();
16255
16256         /*
16257          * It is possible that the user space process that is controlling the
16258          * indoor setting disappeared, so notify the regulatory core.
16259          */
16260         regulatory_netlink_notify(notify->portid);
16261         return NOTIFY_OK;
16262 }
16263
16264 static struct notifier_block nl80211_netlink_notifier = {
16265         .notifier_call = nl80211_netlink_notify,
16266 };
16267
16268 void cfg80211_ft_event(struct net_device *netdev,
16269                        struct cfg80211_ft_event_params *ft_event)
16270 {
16271         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16272         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16273         struct sk_buff *msg;
16274         void *hdr;
16275
16276         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
16277
16278         if (!ft_event->target_ap)
16279                 return;
16280
16281         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16282                         GFP_KERNEL);
16283         if (!msg)
16284                 return;
16285
16286         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16287         if (!hdr)
16288                 goto out;
16289
16290         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16291             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16292             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16293                 goto out;
16294
16295         if (ft_event->ies &&
16296             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16297                 goto out;
16298         if (ft_event->ric_ies &&
16299             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16300                     ft_event->ric_ies))
16301                 goto out;
16302
16303         genlmsg_end(msg, hdr);
16304
16305         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16306                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16307         return;
16308  out:
16309         nlmsg_free(msg);
16310 }
16311 EXPORT_SYMBOL(cfg80211_ft_event);
16312
16313 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16314 {
16315         struct cfg80211_registered_device *rdev;
16316         struct sk_buff *msg;
16317         void *hdr;
16318         u32 nlportid;
16319
16320         rdev = wiphy_to_rdev(wdev->wiphy);
16321         if (!rdev->crit_proto_nlportid)
16322                 return;
16323
16324         nlportid = rdev->crit_proto_nlportid;
16325         rdev->crit_proto_nlportid = 0;
16326
16327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16328         if (!msg)
16329                 return;
16330
16331         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16332         if (!hdr)
16333                 goto nla_put_failure;
16334
16335         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16336             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16337                               NL80211_ATTR_PAD))
16338                 goto nla_put_failure;
16339
16340         genlmsg_end(msg, hdr);
16341
16342         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16343         return;
16344
16345  nla_put_failure:
16346         nlmsg_free(msg);
16347 }
16348 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16349
16350 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16351 {
16352         struct wiphy *wiphy = wdev->wiphy;
16353         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16354         struct sk_buff *msg;
16355         void *hdr;
16356
16357         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16358         if (!msg)
16359                 return;
16360
16361         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16362         if (!hdr)
16363                 goto out;
16364
16365         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16366             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16367             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16368                               NL80211_ATTR_PAD))
16369                 goto out;
16370
16371         genlmsg_end(msg, hdr);
16372
16373         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16374                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16375         return;
16376  out:
16377         nlmsg_free(msg);
16378 }
16379
16380 int cfg80211_external_auth_request(struct net_device *dev,
16381                                    struct cfg80211_external_auth_params *params,
16382                                    gfp_t gfp)
16383 {
16384         struct wireless_dev *wdev = dev->ieee80211_ptr;
16385         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16386         struct sk_buff *msg;
16387         void *hdr;
16388
16389         if (!wdev->conn_owner_nlportid)
16390                 return -EINVAL;
16391
16392         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16393         if (!msg)
16394                 return -ENOMEM;
16395
16396         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16397         if (!hdr)
16398                 goto nla_put_failure;
16399
16400         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16401             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16402             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16403             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16404                         params->action) ||
16405             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16406             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16407                     params->ssid.ssid))
16408                 goto nla_put_failure;
16409
16410         genlmsg_end(msg, hdr);
16411         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16412                         wdev->conn_owner_nlportid);
16413         return 0;
16414
16415  nla_put_failure:
16416         nlmsg_free(msg);
16417         return -ENOBUFS;
16418 }
16419 EXPORT_SYMBOL(cfg80211_external_auth_request);
16420
16421 void cfg80211_update_owe_info_event(struct net_device *netdev,
16422                                     struct cfg80211_update_owe_info *owe_info,
16423                                     gfp_t gfp)
16424 {
16425         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
16426         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16427         struct sk_buff *msg;
16428         void *hdr;
16429
16430         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
16431
16432         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16433         if (!msg)
16434                 return;
16435
16436         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
16437         if (!hdr)
16438                 goto nla_put_failure;
16439
16440         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16441             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16442             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
16443                 goto nla_put_failure;
16444
16445         if (!owe_info->ie_len ||
16446             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
16447                 goto nla_put_failure;
16448
16449         genlmsg_end(msg, hdr);
16450
16451         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16452                                 NL80211_MCGRP_MLME, gfp);
16453         return;
16454
16455 nla_put_failure:
16456         genlmsg_cancel(msg, hdr);
16457         nlmsg_free(msg);
16458 }
16459 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
16460
16461 /* initialisation/exit functions */
16462
16463 int __init nl80211_init(void)
16464 {
16465         int err;
16466
16467         err = genl_register_family(&nl80211_fam);
16468         if (err)
16469                 return err;
16470
16471         err = netlink_register_notifier(&nl80211_netlink_notifier);
16472         if (err)
16473                 goto err_out;
16474
16475         return 0;
16476  err_out:
16477         genl_unregister_family(&nl80211_fam);
16478         return err;
16479 }
16480
16481 void nl80211_exit(void)
16482 {
16483         netlink_unregister_notifier(&nl80211_netlink_notifier);
16484         genl_unregister_family(&nl80211_fam);
16485 }