net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2023 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         for_each_rdev(rdev) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 static int validate_he_capa(const struct nlattr *attr,
 289                             struct netlink_ext_ack *extack)
 290 {
 291         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 292                 return -EINVAL;
 293
 294         return 0;
 295 }
 296
 297 /* policy for the attributes */
 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 299
 300 static const struct nla_policy
 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 302         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 303         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 304                                         .len = U8_MAX },
 305         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 306                                              .len = U8_MAX },
 307 };
 308
 309 static const struct nla_policy
 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 311         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 312         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 313         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 314                 NLA_POLICY_MAX(NLA_U8, 15),
 315         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 316         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 317                 NLA_POLICY_MAX(NLA_U8, 15),
 318         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 319                 NLA_POLICY_MAX(NLA_U8, 31),
 320         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 321         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 322         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 323         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 324         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 325         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 326         [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
 327 };
 328
 329 static const struct nla_policy
 330 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 331         [NL80211_PMSR_TYPE_FTM] =
 332                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 333 };
 334
 335 static const struct nla_policy
 336 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 337         [NL80211_PMSR_REQ_ATTR_DATA] =
 338                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 339         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 340 };
 341
 342 static const struct nla_policy
 343 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 344         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 345         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 346         [NL80211_PMSR_PEER_ATTR_REQ] =
 347                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 348         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 349 };
 350
 351 static const struct nla_policy
 352 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 353         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 354         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 355         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 356         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 357         [NL80211_PMSR_ATTR_PEERS] =
 358                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 359 };
 360
 361 static const struct nla_policy
 362 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 363         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 364                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 365         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 366                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 367         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 368                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 369         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 370                 NLA_POLICY_EXACT_LEN(8),
 371         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 372                 NLA_POLICY_EXACT_LEN(8),
 373         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 374 };
 375
 376 static const struct nla_policy
 377 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 378         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 379         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 380         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 381 };
 382
 383 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 384         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 385                                     .len = NL80211_MAX_SUPP_RATES },
 386         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 387                                 .len = NL80211_MAX_SUPP_HT_RATES },
 388         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 389         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 390         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 391         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 392                                                    NL80211_RATE_INFO_HE_GI_0_8,
 393                                                    NL80211_RATE_INFO_HE_GI_3_2),
 394         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 395                                                    NL80211_RATE_INFO_HE_1XLTF,
 396                                                    NL80211_RATE_INFO_HE_4XLTF),
 397 };
 398
 399 static const struct nla_policy
 400 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 401         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 402         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 403         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 404         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 405         [NL80211_TID_CONFIG_ATTR_NOACK] =
 406                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 407         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 408         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 409         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 410                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 411         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 412                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 413         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 414                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 415         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 416                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 417         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 418                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 419 };
 420
 421 static const struct nla_policy
 422 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 423         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 424         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 425         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 426                         NLA_POLICY_RANGE(NLA_BINARY,
 427                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 428                                          IEEE80211_MAX_DATA_LEN),
 429 };
 430
 431 static const struct nla_policy
 432 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 433         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 434         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 435                                                        .len = IEEE80211_MAX_DATA_LEN }
 436 };
 437
 438 static const struct nla_policy
 439 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 440         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 441         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 442 };
 443
 444 static const struct nla_policy
 445 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 446         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 447         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 448 };
 449
 450 static const struct nla_policy
 451 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 452         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 453         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 454                                                 NLA_POLICY_MIN(NLA_U8, 1),
 455         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 456         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 457         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 462         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 463         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 464 };
 465
 466 static const struct netlink_range_validation nl80211_punct_bitmap_range = {
 467         .min = 0,
 468         .max = 0xffff,
 469 };
 470
 471 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 472         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 473         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 474         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 475                                       .len = 20-1 },
 476         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 477
 478         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 479         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 480         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 481                                                 NL80211_EDMG_CHANNELS_MIN,
 482                                                 NL80211_EDMG_CHANNELS_MAX),
 483         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 484                                                 NL80211_EDMG_BW_CONFIG_MIN,
 485                                                 NL80211_EDMG_BW_CONFIG_MAX),
 486
 487         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 488         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 489         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 490         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 491
 492         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 493         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 494         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 496         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 497         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 498
 499         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 500         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 501         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 502
 503         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 504         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 505
 506         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 507         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 508                                     .len = WLAN_MAX_KEY_LEN },
 509         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 510         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 511         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 512         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 513         [NL80211_ATTR_KEY_TYPE] =
 514                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 515
 516         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 517         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 518         [NL80211_ATTR_BEACON_HEAD] =
 519                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 520                                        IEEE80211_MAX_DATA_LEN),
 521         [NL80211_ATTR_BEACON_TAIL] =
 522                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 523                                        IEEE80211_MAX_DATA_LEN),
 524         [NL80211_ATTR_STA_AID] =
 525                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 526         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 527         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 528         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 529                                                .len = NL80211_MAX_SUPP_RATES },
 530         [NL80211_ATTR_STA_PLINK_ACTION] =
 531                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 532         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 533                 NLA_POLICY_RANGE(NLA_U8,
 534                                  NL80211_TX_POWER_AUTOMATIC,
 535                                  NL80211_TX_POWER_FIXED),
 536         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 537         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 538         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 539         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 540                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 541         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 542
 543         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 544         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 545         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 546
 547         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 548         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 549         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 550         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 551                                            .len = NL80211_MAX_SUPP_RATES },
 552         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 553
 554         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 555         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 556
 557         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 558
 559         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 560         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 561                                                    validate_ie_attr,
 562                                                    IEEE80211_MAX_DATA_LEN),
 563         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 564         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 565
 566         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 567                                 .len = IEEE80211_MAX_SSID_LEN },
 568         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 569         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 570         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 571         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 572         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 573                                                   NL80211_MFP_NO,
 574                                                   NL80211_MFP_OPTIONAL),
 575         [NL80211_ATTR_STA_FLAGS2] =
 576                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 577         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 578         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 579         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 581         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 582         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 583         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 584         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 585         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 586         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 587         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 588         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 589         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 590         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 591         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 592                                  .len = IEEE80211_MAX_DATA_LEN },
 593         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 594         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 595                                                    NL80211_PS_DISABLED,
 596                                                    NL80211_PS_ENABLED),
 597         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 598         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 599         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 600         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 601         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 602         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 603         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 604         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 605         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 606         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 607         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 608         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 609         [NL80211_ATTR_STA_PLINK_STATE] =
 610                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 611         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 612         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 613         [NL80211_ATTR_MESH_PEER_AID] =
 614                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 615         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 616         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 617         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 618         [NL80211_ATTR_HIDDEN_SSID] =
 619                 NLA_POLICY_RANGE(NLA_U32,
 620                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 621                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 622         [NL80211_ATTR_IE_PROBE_RESP] =
 623                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 624                                        IEEE80211_MAX_DATA_LEN),
 625         [NL80211_ATTR_IE_ASSOC_RESP] =
 626                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 627                                        IEEE80211_MAX_DATA_LEN),
 628         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 629         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 630         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 631         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 632         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 633         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 634         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 635         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 636         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 637         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 638         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 639         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 640                                       .len = IEEE80211_MAX_DATA_LEN },
 641         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 642         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 643         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 644                 .len = NL80211_HT_CAPABILITY_LEN
 645         },
 646         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 647         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 648         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 649         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 650         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 651
 652         /* need to include at least Auth Transaction and Status Code */
 653         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 654
 655         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 656         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 657         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 658         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 659         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 660                 NLA_POLICY_RANGE(NLA_U32,
 661                                  NL80211_MESH_POWER_UNKNOWN + 1,
 662                                  NL80211_MESH_POWER_MAX),
 663         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 664         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 665         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 666         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 667         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 668         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 669         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 670                 .len = NL80211_VHT_CAPABILITY_LEN,
 671         },
 672         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 673         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 674                                   .len = IEEE80211_MAX_DATA_LEN },
 675         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 676         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 677                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 678         [NL80211_ATTR_PEER_AID] =
 679                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 680         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 681         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 682         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 683         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 684         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 685         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 686         /*
 687          * The value of the Length field of the Supported Operating
 688          * Classes element is between 2 and 253.
 689          */
 690         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 691                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 692         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 693         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 694         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 695         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 696         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 697         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 698                                                   IEEE80211_QOS_MAP_LEN_MIN,
 699                                                   IEEE80211_QOS_MAP_LEN_MAX),
 700         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 701         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 702         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 703         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 704         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 705         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 706         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 707         [NL80211_ATTR_USER_PRIO] =
 708                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 709         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 710         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 711         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 712         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 713         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 714         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 715         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 716         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 717         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 718         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 719         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 720                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 721         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 722                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 723         },
 724         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 725         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 726         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 727         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 728         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 729                                     .len = FILS_MAX_KEK_LEN },
 730         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 731         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 732         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 733         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 734         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 735                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 736         },
 737         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 738         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 739                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 740         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 741                                           .len = FILS_ERP_MAX_REALM_LEN },
 742         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 743         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 744                                         .len = FILS_ERP_MAX_RRK_LEN },
 745         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 746         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 747         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 748         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 749         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 750
 751         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 752         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 753         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 754         [NL80211_ATTR_HE_CAPABILITY] =
 755                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 756                                        NL80211_HE_MAX_CAPABILITY_LEN),
 757         [NL80211_ATTR_FTM_RESPONDER] =
 758                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 759         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 760         [NL80211_ATTR_PEER_MEASUREMENTS] =
 761                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 762         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 763         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 764                                         .len = SAE_PASSWORD_MAX_LEN },
 765         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 766         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 767         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 768         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 769         [NL80211_ATTR_TID_CONFIG] =
 770                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 771         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 772         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 773         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 774         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 775         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 776         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 777         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 778                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 779         [NL80211_ATTR_FILS_DISCOVERY] =
 780                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 781         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 782                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 783         [NL80211_ATTR_S1G_CAPABILITY] =
 784                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 785         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 786                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 787         [NL80211_ATTR_SAE_PWE] =
 788                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 789                                  NL80211_SAE_PWE_BOTH),
 790         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 791         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 792         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 793         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 794         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 795         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 796         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 797         [NL80211_ATTR_MBSSID_CONFIG] =
 798                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 799         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 800         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 801         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 802         [NL80211_ATTR_EHT_CAPABILITY] =
 803                 NLA_POLICY_RANGE(NLA_BINARY,
 804                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 805                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 806         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 807         [NL80211_ATTR_MLO_LINKS] =
 808                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 809         [NL80211_ATTR_MLO_LINK_ID] =
 810                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
 811         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 812         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 813         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 814         [NL80211_ATTR_PUNCT_BITMAP] =
 815                 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
 816
 817         [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
 818         [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
 819         [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
 820         [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
 821 };
 822
 823 /* policy for the key attributes */
 824 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 825         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 826         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 827         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 828         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 829         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 830         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 831         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 832         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 833         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 834 };
 835
 836 /* policy for the key default flags */
 837 static const struct nla_policy
 838 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 839         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 840         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 841 };
 842
 843 #ifdef CONFIG_PM
 844 /* policy for WoWLAN attributes */
 845 static const struct nla_policy
 846 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 847         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 848         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 849         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 850         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 851         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 852         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 853         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 854         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 855         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 856         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 857 };
 858
 859 static const struct nla_policy
 860 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 861         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 862         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 863         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 864         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 865         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 866         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 867         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 868                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 869         },
 870         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 871                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 872         },
 873         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 874         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 875         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 876 };
 877 #endif /* CONFIG_PM */
 878
 879 /* policy for coalesce rule attributes */
 880 static const struct nla_policy
 881 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 882         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 883         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 884                 NLA_POLICY_RANGE(NLA_U32,
 885                                  NL80211_COALESCE_CONDITION_MATCH,
 886                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 887         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 888 };
 889
 890 /* policy for GTK rekey offload attributes */
 891 static const struct nla_policy
 892 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 893         [NL80211_REKEY_DATA_KEK] = {
 894                 .type = NLA_BINARY,
 895                 .len = NL80211_KEK_EXT_LEN
 896         },
 897         [NL80211_REKEY_DATA_KCK] = {
 898                 .type = NLA_BINARY,
 899                 .len = NL80211_KCK_EXT_LEN_32
 900         },
 901         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 902         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 903 };
 904
 905 static const struct nla_policy
 906 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 907         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 908         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 909         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 910         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 911         [NL80211_BAND_LC]    = { .type = NLA_S32 },
 912 };
 913
 914 static const struct nla_policy
 915 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 916         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 917                                                  .len = IEEE80211_MAX_SSID_LEN },
 918         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 919         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 920         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 921                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 922 };
 923
 924 static const struct nla_policy
 925 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 926         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 927         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 928 };
 929
 930 static const struct nla_policy
 931 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 932         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 933         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 934         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 935                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 936         },
 937 };
 938
 939 /* policy for NAN function attributes */
 940 static const struct nla_policy
 941 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 942         [NL80211_NAN_FUNC_TYPE] =
 943                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 944         [NL80211_NAN_FUNC_SERVICE_ID] = {
 945                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 946         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 947         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 948         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 949         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 950         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 951         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 952         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 953         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 954         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 955                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 956         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 957         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 958         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 959         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 960         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 961 };
 962
 963 /* policy for Service Response Filter attributes */
 964 static const struct nla_policy
 965 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 966         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 967         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 968                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 969         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 970         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 971 };
 972
 973 /* policy for packet pattern attributes */
 974 static const struct nla_policy
 975 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 976         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 977         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 978         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 979 };
 980
 981 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 982                                      struct cfg80211_registered_device **rdev,
 983                                      struct wireless_dev **wdev,
 984                                      struct nlattr **attrbuf)
 985 {
 986         int err;
 987
 988         if (!cb->args[0]) {
 989                 struct nlattr **attrbuf_free = NULL;
 990
 991                 if (!attrbuf) {
 992                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 993                                           GFP_KERNEL);
 994                         if (!attrbuf)
 995                                 return -ENOMEM;
 996                         attrbuf_free = attrbuf;
 997                 }
 998
 999                 err = nlmsg_parse_deprecated(cb->nlh,
1000                                              GENL_HDRLEN + nl80211_fam.hdrsize,
1001                                              attrbuf, nl80211_fam.maxattr,
1002                                              nl80211_policy, NULL);
1003                 if (err) {
1004                         kfree(attrbuf_free);
1005                         return err;
1006                 }
1007
1008                 rtnl_lock();
1009                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1010                                                    attrbuf);
1011                 kfree(attrbuf_free);
1012                 if (IS_ERR(*wdev)) {
1013                         rtnl_unlock();
1014                         return PTR_ERR(*wdev);
1015                 }
1016                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1017                 mutex_lock(&(*rdev)->wiphy.mtx);
1018                 rtnl_unlock();
1019                 /* 0 is the first index - add 1 to parse only once */
1020                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1021                 cb->args[1] = (*wdev)->identifier;
1022         } else {
1023                 /* subtract the 1 again here */
1024                 struct wiphy *wiphy;
1025                 struct wireless_dev *tmp;
1026
1027                 rtnl_lock();
1028                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1029                 if (!wiphy) {
1030                         rtnl_unlock();
1031                         return -ENODEV;
1032                 }
1033                 *rdev = wiphy_to_rdev(wiphy);
1034                 *wdev = NULL;
1035
1036                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1037                         if (tmp->identifier == cb->args[1]) {
1038                                 *wdev = tmp;
1039                                 break;
1040                         }
1041                 }
1042
1043                 if (!*wdev) {
1044                         rtnl_unlock();
1045                         return -ENODEV;
1046                 }
1047                 mutex_lock(&(*rdev)->wiphy.mtx);
1048                 rtnl_unlock();
1049         }
1050
1051         return 0;
1052 }
1053
1054 /* message building helper */
1055 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1056                      int flags, u8 cmd)
1057 {
1058         /* since there is no private header just add the generic one */
1059         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1060 }
1061
1062 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1063                                      const struct ieee80211_reg_rule *rule)
1064 {
1065         int j;
1066         struct nlattr *nl_wmm_rules =
1067                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1068
1069         if (!nl_wmm_rules)
1070                 goto nla_put_failure;
1071
1072         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1073                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1074
1075                 if (!nl_wmm_rule)
1076                         goto nla_put_failure;
1077
1078                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1079                                 rule->wmm_rule.client[j].cw_min) ||
1080                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1081                                 rule->wmm_rule.client[j].cw_max) ||
1082                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1083                                rule->wmm_rule.client[j].aifsn) ||
1084                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1085                                 rule->wmm_rule.client[j].cot))
1086                         goto nla_put_failure;
1087
1088                 nla_nest_end(msg, nl_wmm_rule);
1089         }
1090         nla_nest_end(msg, nl_wmm_rules);
1091
1092         return 0;
1093
1094 nla_put_failure:
1095         return -ENOBUFS;
1096 }
1097
1098 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1099                                    struct ieee80211_channel *chan,
1100                                    bool large)
1101 {
1102         /* Some channels must be completely excluded from the
1103          * list to protect old user-space tools from breaking
1104          */
1105         if (!large && chan->flags &
1106             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1107                 return 0;
1108         if (!large && chan->freq_offset)
1109                 return 0;
1110
1111         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1112                         chan->center_freq))
1113                 goto nla_put_failure;
1114
1115         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1116                 goto nla_put_failure;
1117
1118         if ((chan->flags & IEEE80211_CHAN_PSD) &&
1119             nla_put_s8(msg, NL80211_FREQUENCY_ATTR_PSD, chan->psd))
1120                 goto nla_put_failure;
1121
1122         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1123             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1124                 goto nla_put_failure;
1125         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1126                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1127                         goto nla_put_failure;
1128                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1129                         goto nla_put_failure;
1130         }
1131         if (chan->flags & IEEE80211_CHAN_RADAR) {
1132                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1133                         goto nla_put_failure;
1134                 if (large) {
1135                         u32 time;
1136
1137                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1138
1139                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1140                                         chan->dfs_state))
1141                                 goto nla_put_failure;
1142                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1143                                         time))
1144                                 goto nla_put_failure;
1145                         if (nla_put_u32(msg,
1146                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1147                                         chan->dfs_cac_ms))
1148                                 goto nla_put_failure;
1149                 }
1150         }
1151
1152         if (large) {
1153                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1154                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1155                         goto nla_put_failure;
1156                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1157                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1158                         goto nla_put_failure;
1159                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1160                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1161                         goto nla_put_failure;
1162                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1163                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1164                         goto nla_put_failure;
1165                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1166                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1167                         goto nla_put_failure;
1168                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1169                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1170                         goto nla_put_failure;
1171                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1172                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1173                         goto nla_put_failure;
1174                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1175                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1176                         goto nla_put_failure;
1177                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1178                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1179                         goto nla_put_failure;
1180                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1181                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1182                         goto nla_put_failure;
1183                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1184                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1185                         goto nla_put_failure;
1186                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1187                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1188                         goto nla_put_failure;
1189                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1190                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1191                         goto nla_put_failure;
1192                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1193                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1194                         goto nla_put_failure;
1195                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1196                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1197                         goto nla_put_failure;
1198                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1199                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1200                         goto nla_put_failure;
1201         }
1202
1203         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1204                         DBM_TO_MBM(chan->max_power)))
1205                 goto nla_put_failure;
1206
1207         if (large) {
1208                 const struct ieee80211_reg_rule *rule =
1209                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1210
1211                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1212                         if (nl80211_msg_put_wmm_rules(msg, rule))
1213                                 goto nla_put_failure;
1214                 }
1215         }
1216
1217         return 0;
1218
1219  nla_put_failure:
1220         return -ENOBUFS;
1221 }
1222
1223 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1224                                   struct cfg80211_txq_stats *txqstats,
1225                                   int attrtype)
1226 {
1227         struct nlattr *txqattr;
1228
1229 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1230         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1231             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1232                 return false;                                             \
1233         } while (0)
1234
1235         txqattr = nla_nest_start_noflag(msg, attrtype);
1236         if (!txqattr)
1237                 return false;
1238
1239         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1240         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1241         PUT_TXQVAL_U32(FLOWS, flows);
1242         PUT_TXQVAL_U32(DROPS, drops);
1243         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1244         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1245         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1246         PUT_TXQVAL_U32(COLLISIONS, collisions);
1247         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1248         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1249         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1250         nla_nest_end(msg, txqattr);
1251
1252 #undef PUT_TXQVAL_U32
1253         return true;
1254 }
1255
1256 /* netlink command implementations */
1257
1258 /**
1259  * nl80211_link_id - return link ID
1260  * @attrs: attributes to look at
1261  *
1262  * Returns: the link ID or 0 if not given
1263  *
1264  * Note this function doesn't do any validation of the link
1265  * ID validity wrt. links that were actually added, so it must
1266  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1267  * or if additional validation is done.
1268  */
1269 static unsigned int nl80211_link_id(struct nlattr **attrs)
1270 {
1271         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1272
1273         if (!linkid)
1274                 return 0;
1275
1276         return nla_get_u8(linkid);
1277 }
1278
1279 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1280 {
1281         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1282
1283         if (!linkid)
1284                 return -1;
1285
1286         return nla_get_u8(linkid);
1287 }
1288
1289 struct key_parse {
1290         struct key_params p;
1291         int idx;
1292         int type;
1293         bool def, defmgmt, defbeacon;
1294         bool def_uni, def_multi;
1295 };
1296
1297 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1298                                  struct key_parse *k)
1299 {
1300         struct nlattr *tb[NL80211_KEY_MAX + 1];
1301         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1302                                               nl80211_key_policy,
1303                                               info->extack);
1304         if (err)
1305                 return err;
1306
1307         k->def = !!tb[NL80211_KEY_DEFAULT];
1308         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1309         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1310
1311         if (k->def) {
1312                 k->def_uni = true;
1313                 k->def_multi = true;
1314         }
1315         if (k->defmgmt || k->defbeacon)
1316                 k->def_multi = true;
1317
1318         if (tb[NL80211_KEY_IDX])
1319                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1320
1321         if (tb[NL80211_KEY_DATA]) {
1322                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1323                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1324         }
1325
1326         if (tb[NL80211_KEY_SEQ]) {
1327                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1328                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1329         }
1330
1331         if (tb[NL80211_KEY_CIPHER])
1332                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1333
1334         if (tb[NL80211_KEY_TYPE])
1335                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1336
1337         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1338                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1339
1340                 err = nla_parse_nested_deprecated(kdt,
1341                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1342                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1343                                                   nl80211_key_default_policy,
1344                                                   info->extack);
1345                 if (err)
1346                         return err;
1347
1348                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1349                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1350         }
1351
1352         if (tb[NL80211_KEY_MODE])
1353                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1354
1355         return 0;
1356 }
1357
1358 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1359 {
1360         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1361                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1362                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1363         }
1364
1365         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1366                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1367                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1368         }
1369
1370         if (info->attrs[NL80211_ATTR_KEY_IDX])
1371                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1372
1373         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1374                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1375
1376         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1377         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1378
1379         if (k->def) {
1380                 k->def_uni = true;
1381                 k->def_multi = true;
1382         }
1383         if (k->defmgmt)
1384                 k->def_multi = true;
1385
1386         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1387                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1388
1389         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1390                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1391                 int err = nla_parse_nested_deprecated(kdt,
1392                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1393                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1394                                                       nl80211_key_default_policy,
1395                                                       info->extack);
1396                 if (err)
1397                         return err;
1398
1399                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1400                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1401         }
1402
1403         return 0;
1404 }
1405
1406 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1407 {
1408         int err;
1409
1410         memset(k, 0, sizeof(*k));
1411         k->idx = -1;
1412         k->type = -1;
1413
1414         if (info->attrs[NL80211_ATTR_KEY])
1415                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1416         else
1417                 err = nl80211_parse_key_old(info, k);
1418
1419         if (err)
1420                 return err;
1421
1422         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1423             (k->defbeacon ? 1 : 0) > 1) {
1424                 GENL_SET_ERR_MSG(info,
1425                                  "key with multiple default flags is invalid");
1426                 return -EINVAL;
1427         }
1428
1429         if (k->defmgmt || k->defbeacon) {
1430                 if (k->def_uni || !k->def_multi) {
1431                         GENL_SET_ERR_MSG(info,
1432                                          "defmgmt/defbeacon key must be mcast");
1433                         return -EINVAL;
1434                 }
1435         }
1436
1437         if (k->idx != -1) {
1438                 if (k->defmgmt) {
1439                         if (k->idx < 4 || k->idx > 5) {
1440                                 GENL_SET_ERR_MSG(info,
1441                                                  "defmgmt key idx not 4 or 5");
1442                                 return -EINVAL;
1443                         }
1444                 } else if (k->defbeacon) {
1445                         if (k->idx < 6 || k->idx > 7) {
1446                                 GENL_SET_ERR_MSG(info,
1447                                                  "defbeacon key idx not 6 or 7");
1448                                 return -EINVAL;
1449                         }
1450                 } else if (k->def) {
1451                         if (k->idx < 0 || k->idx > 3) {
1452                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1453                                 return -EINVAL;
1454                         }
1455                 } else {
1456                         if (k->idx < 0 || k->idx > 7) {
1457                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1458                                 return -EINVAL;
1459                         }
1460                 }
1461         }
1462
1463         return 0;
1464 }
1465
1466 static struct cfg80211_cached_keys *
1467 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1468                        struct genl_info *info, bool *no_ht)
1469 {
1470         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1471         struct key_parse parse;
1472         struct nlattr *key;
1473         struct cfg80211_cached_keys *result;
1474         int rem, err, def = 0;
1475         bool have_key = false;
1476
1477         nla_for_each_nested(key, keys, rem) {
1478                 have_key = true;
1479                 break;
1480         }
1481
1482         if (!have_key)
1483                 return NULL;
1484
1485         result = kzalloc(sizeof(*result), GFP_KERNEL);
1486         if (!result)
1487                 return ERR_PTR(-ENOMEM);
1488
1489         result->def = -1;
1490
1491         nla_for_each_nested(key, keys, rem) {
1492                 memset(&parse, 0, sizeof(parse));
1493                 parse.idx = -1;
1494
1495                 err = nl80211_parse_key_new(info, key, &parse);
1496                 if (err)
1497                         goto error;
1498                 err = -EINVAL;
1499                 if (!parse.p.key)
1500                         goto error;
1501                 if (parse.idx < 0 || parse.idx > 3) {
1502                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1503                         goto error;
1504                 }
1505                 if (parse.def) {
1506                         if (def) {
1507                                 GENL_SET_ERR_MSG(info,
1508                                                  "only one key can be default");
1509                                 goto error;
1510                         }
1511                         def = 1;
1512                         result->def = parse.idx;
1513                         if (!parse.def_uni || !parse.def_multi)
1514                                 goto error;
1515                 } else if (parse.defmgmt)
1516                         goto error;
1517                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1518                                                      parse.idx, false, NULL);
1519                 if (err)
1520                         goto error;
1521                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1522                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1523                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1524                         err = -EINVAL;
1525                         goto error;
1526                 }
1527                 result->params[parse.idx].cipher = parse.p.cipher;
1528                 result->params[parse.idx].key_len = parse.p.key_len;
1529                 result->params[parse.idx].key = result->data[parse.idx];
1530                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1531
1532                 /* must be WEP key if we got here */
1533                 if (no_ht)
1534                         *no_ht = true;
1535         }
1536
1537         if (result->def < 0) {
1538                 err = -EINVAL;
1539                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1540                 goto error;
1541         }
1542
1543         return result;
1544  error:
1545         kfree(result);
1546         return ERR_PTR(err);
1547 }
1548
1549 static int nl80211_key_allowed(struct wireless_dev *wdev)
1550 {
1551         lockdep_assert_wiphy(wdev->wiphy);
1552
1553         switch (wdev->iftype) {
1554         case NL80211_IFTYPE_AP:
1555         case NL80211_IFTYPE_AP_VLAN:
1556         case NL80211_IFTYPE_P2P_GO:
1557         case NL80211_IFTYPE_MESH_POINT:
1558                 break;
1559         case NL80211_IFTYPE_ADHOC:
1560                 if (wdev->u.ibss.current_bss)
1561                         return 0;
1562                 return -ENOLINK;
1563         case NL80211_IFTYPE_STATION:
1564         case NL80211_IFTYPE_P2P_CLIENT:
1565                 if (wdev->connected)
1566                         return 0;
1567                 return -ENOLINK;
1568         case NL80211_IFTYPE_NAN:
1569                 if (wiphy_ext_feature_isset(wdev->wiphy,
1570                                             NL80211_EXT_FEATURE_SECURE_NAN))
1571                         return 0;
1572                 return -EINVAL;
1573         case NL80211_IFTYPE_UNSPECIFIED:
1574         case NL80211_IFTYPE_OCB:
1575         case NL80211_IFTYPE_MONITOR:
1576         case NL80211_IFTYPE_P2P_DEVICE:
1577         case NL80211_IFTYPE_WDS:
1578         case NUM_NL80211_IFTYPES:
1579                 return -EINVAL;
1580         }
1581
1582         return 0;
1583 }
1584
1585 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1586                                                         u32 freq)
1587 {
1588         struct ieee80211_channel *chan;
1589
1590         chan = ieee80211_get_channel_khz(wiphy, freq);
1591         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1592                 return NULL;
1593         return chan;
1594 }
1595
1596 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1597 {
1598         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1599         int i;
1600
1601         if (!nl_modes)
1602                 goto nla_put_failure;
1603
1604         i = 0;
1605         while (ifmodes) {
1606                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1607                         goto nla_put_failure;
1608                 ifmodes >>= 1;
1609                 i++;
1610         }
1611
1612         nla_nest_end(msg, nl_modes);
1613         return 0;
1614
1615 nla_put_failure:
1616         return -ENOBUFS;
1617 }
1618
1619 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1620                                           struct sk_buff *msg,
1621                                           bool large)
1622 {
1623         struct nlattr *nl_combis;
1624         int i, j;
1625
1626         nl_combis = nla_nest_start_noflag(msg,
1627                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1628         if (!nl_combis)
1629                 goto nla_put_failure;
1630
1631         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1632                 const struct ieee80211_iface_combination *c;
1633                 struct nlattr *nl_combi, *nl_limits;
1634
1635                 c = &wiphy->iface_combinations[i];
1636
1637                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1638                 if (!nl_combi)
1639                         goto nla_put_failure;
1640
1641                 nl_limits = nla_nest_start_noflag(msg,
1642                                                   NL80211_IFACE_COMB_LIMITS);
1643                 if (!nl_limits)
1644                         goto nla_put_failure;
1645
1646                 for (j = 0; j < c->n_limits; j++) {
1647                         struct nlattr *nl_limit;
1648
1649                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1650                         if (!nl_limit)
1651                                 goto nla_put_failure;
1652                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1653                                         c->limits[j].max))
1654                                 goto nla_put_failure;
1655                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1656                                                 c->limits[j].types))
1657                                 goto nla_put_failure;
1658                         nla_nest_end(msg, nl_limit);
1659                 }
1660
1661                 nla_nest_end(msg, nl_limits);
1662
1663                 if (c->beacon_int_infra_match &&
1664                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1665                         goto nla_put_failure;
1666                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1667                                 c->num_different_channels) ||
1668                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1669                                 c->max_interfaces))
1670                         goto nla_put_failure;
1671                 if (large &&
1672                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1673                                 c->radar_detect_widths) ||
1674                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1675                                 c->radar_detect_regions)))
1676                         goto nla_put_failure;
1677                 if (c->beacon_int_min_gcd &&
1678                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1679                                 c->beacon_int_min_gcd))
1680                         goto nla_put_failure;
1681
1682                 nla_nest_end(msg, nl_combi);
1683         }
1684
1685         nla_nest_end(msg, nl_combis);
1686
1687         return 0;
1688 nla_put_failure:
1689         return -ENOBUFS;
1690 }
1691
1692 #ifdef CONFIG_PM
1693 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1694                                         struct sk_buff *msg)
1695 {
1696         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1697         struct nlattr *nl_tcp;
1698
1699         if (!tcp)
1700                 return 0;
1701
1702         nl_tcp = nla_nest_start_noflag(msg,
1703                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1704         if (!nl_tcp)
1705                 return -ENOBUFS;
1706
1707         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1708                         tcp->data_payload_max))
1709                 return -ENOBUFS;
1710
1711         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1712                         tcp->data_payload_max))
1713                 return -ENOBUFS;
1714
1715         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1716                 return -ENOBUFS;
1717
1718         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1719                                 sizeof(*tcp->tok), tcp->tok))
1720                 return -ENOBUFS;
1721
1722         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1723                         tcp->data_interval_max))
1724                 return -ENOBUFS;
1725
1726         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1727                         tcp->wake_payload_max))
1728                 return -ENOBUFS;
1729
1730         nla_nest_end(msg, nl_tcp);
1731         return 0;
1732 }
1733
1734 static int nl80211_send_wowlan(struct sk_buff *msg,
1735                                struct cfg80211_registered_device *rdev,
1736                                bool large)
1737 {
1738         struct nlattr *nl_wowlan;
1739
1740         if (!rdev->wiphy.wowlan)
1741                 return 0;
1742
1743         nl_wowlan = nla_nest_start_noflag(msg,
1744                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1745         if (!nl_wowlan)
1746                 return -ENOBUFS;
1747
1748         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1749              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1750             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1751              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1752             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1753              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1754             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1755              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1756             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1757              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1758             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1759              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1760             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1761              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1762             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1763              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1764                 return -ENOBUFS;
1765
1766         if (rdev->wiphy.wowlan->n_patterns) {
1767                 struct nl80211_pattern_support pat = {
1768                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1769                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1770                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1771                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1772                 };
1773
1774                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1775                             sizeof(pat), &pat))
1776                         return -ENOBUFS;
1777         }
1778
1779         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1780             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1781                         rdev->wiphy.wowlan->max_nd_match_sets))
1782                 return -ENOBUFS;
1783
1784         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1785                 return -ENOBUFS;
1786
1787         nla_nest_end(msg, nl_wowlan);
1788
1789         return 0;
1790 }
1791 #endif
1792
1793 static int nl80211_send_coalesce(struct sk_buff *msg,
1794                                  struct cfg80211_registered_device *rdev)
1795 {
1796         struct nl80211_coalesce_rule_support rule;
1797
1798         if (!rdev->wiphy.coalesce)
1799                 return 0;
1800
1801         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1802         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1803         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1804         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1805         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1806         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1807
1808         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1809                 return -ENOBUFS;
1810
1811         return 0;
1812 }
1813
1814 static int
1815 nl80211_send_iftype_data(struct sk_buff *msg,
1816                          const struct ieee80211_supported_band *sband,
1817                          const struct ieee80211_sband_iftype_data *iftdata)
1818 {
1819         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1820         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1821
1822         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1823                                 iftdata->types_mask))
1824                 return -ENOBUFS;
1825
1826         if (he_cap->has_he) {
1827                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1828                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1829                             he_cap->he_cap_elem.mac_cap_info) ||
1830                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1831                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1832                             he_cap->he_cap_elem.phy_cap_info) ||
1833                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1834                             sizeof(he_cap->he_mcs_nss_supp),
1835                             &he_cap->he_mcs_nss_supp) ||
1836                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1837                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1838                         return -ENOBUFS;
1839         }
1840
1841         if (eht_cap->has_eht && he_cap->has_he) {
1842                 u8 mcs_nss_size, ppe_thresh_size;
1843                 u16 ppe_thres_hdr;
1844                 bool is_ap;
1845
1846                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1847                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1848
1849                 mcs_nss_size =
1850                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1851                                                    &eht_cap->eht_cap_elem,
1852                                                    is_ap);
1853
1854                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1855                 ppe_thresh_size =
1856                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1857                                                eht_cap->eht_cap_elem.phy_cap_info);
1858
1859                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1860                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1861                             eht_cap->eht_cap_elem.mac_cap_info) ||
1862                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1863                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1864                             eht_cap->eht_cap_elem.phy_cap_info) ||
1865                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1866                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1867                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1868                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1869                         return -ENOBUFS;
1870         }
1871
1872         if (sband->band == NL80211_BAND_6GHZ &&
1873             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1874                     sizeof(iftdata->he_6ghz_capa),
1875                     &iftdata->he_6ghz_capa))
1876                 return -ENOBUFS;
1877
1878         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1879             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1880                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1881                 return -ENOBUFS;
1882
1883         return 0;
1884 }
1885
1886 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1887                                       struct ieee80211_supported_band *sband,
1888                                       bool large)
1889 {
1890         struct nlattr *nl_rates, *nl_rate;
1891         struct ieee80211_rate *rate;
1892         int i;
1893
1894         /* add HT info */
1895         if (sband->ht_cap.ht_supported &&
1896             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1897                      sizeof(sband->ht_cap.mcs),
1898                      &sband->ht_cap.mcs) ||
1899              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1900                          sband->ht_cap.cap) ||
1901              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1902                         sband->ht_cap.ampdu_factor) ||
1903              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1904                         sband->ht_cap.ampdu_density)))
1905                 return -ENOBUFS;
1906
1907         /* add VHT info */
1908         if (sband->vht_cap.vht_supported &&
1909             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1910                      sizeof(sband->vht_cap.vht_mcs),
1911                      &sband->vht_cap.vht_mcs) ||
1912              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1913                          sband->vht_cap.cap)))
1914                 return -ENOBUFS;
1915
1916         if (large && sband->n_iftype_data) {
1917                 struct nlattr *nl_iftype_data =
1918                         nla_nest_start_noflag(msg,
1919                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1920                 const struct ieee80211_sband_iftype_data *iftd;
1921                 int err;
1922
1923                 if (!nl_iftype_data)
1924                         return -ENOBUFS;
1925
1926                 for_each_sband_iftype_data(sband, i, iftd) {
1927                         struct nlattr *iftdata;
1928
1929                         iftdata = nla_nest_start_noflag(msg, i + 1);
1930                         if (!iftdata)
1931                                 return -ENOBUFS;
1932
1933                         err = nl80211_send_iftype_data(msg, sband, iftd);
1934                         if (err)
1935                                 return err;
1936
1937                         nla_nest_end(msg, iftdata);
1938                 }
1939
1940                 nla_nest_end(msg, nl_iftype_data);
1941         }
1942
1943         /* add EDMG info */
1944         if (large && sband->edmg_cap.channels &&
1945             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1946                        sband->edmg_cap.channels) ||
1947             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1948                        sband->edmg_cap.bw_config)))
1949
1950                 return -ENOBUFS;
1951
1952         /* add bitrates */
1953         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1954         if (!nl_rates)
1955                 return -ENOBUFS;
1956
1957         for (i = 0; i < sband->n_bitrates; i++) {
1958                 nl_rate = nla_nest_start_noflag(msg, i);
1959                 if (!nl_rate)
1960                         return -ENOBUFS;
1961
1962                 rate = &sband->bitrates[i];
1963                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1964                                 rate->bitrate))
1965                         return -ENOBUFS;
1966                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1967                     nla_put_flag(msg,
1968                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1969                         return -ENOBUFS;
1970
1971                 nla_nest_end(msg, nl_rate);
1972         }
1973
1974         nla_nest_end(msg, nl_rates);
1975
1976         /* S1G capabilities */
1977         if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
1978             (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
1979                      sizeof(sband->s1g_cap.cap),
1980                      sband->s1g_cap.cap) ||
1981              nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
1982                      sizeof(sband->s1g_cap.nss_mcs),
1983                      sband->s1g_cap.nss_mcs)))
1984                 return -ENOBUFS;
1985
1986         return 0;
1987 }
1988
1989 static int
1990 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1991                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1992 {
1993         u16 stypes;
1994         struct nlattr *nl_ftypes, *nl_ifs;
1995         enum nl80211_iftype ift;
1996         int i;
1997
1998         if (!mgmt_stypes)
1999                 return 0;
2000
2001         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
2002         if (!nl_ifs)
2003                 return -ENOBUFS;
2004
2005         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2006                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2007                 if (!nl_ftypes)
2008                         return -ENOBUFS;
2009                 i = 0;
2010                 stypes = mgmt_stypes[ift].tx;
2011                 while (stypes) {
2012                         if ((stypes & 1) &&
2013                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2014                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2015                                 return -ENOBUFS;
2016                         stypes >>= 1;
2017                         i++;
2018                 }
2019                 nla_nest_end(msg, nl_ftypes);
2020         }
2021
2022         nla_nest_end(msg, nl_ifs);
2023
2024         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2025         if (!nl_ifs)
2026                 return -ENOBUFS;
2027
2028         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2029                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2030                 if (!nl_ftypes)
2031                         return -ENOBUFS;
2032                 i = 0;
2033                 stypes = mgmt_stypes[ift].rx;
2034                 while (stypes) {
2035                         if ((stypes & 1) &&
2036                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2037                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2038                                 return -ENOBUFS;
2039                         stypes >>= 1;
2040                         i++;
2041                 }
2042                 nla_nest_end(msg, nl_ftypes);
2043         }
2044         nla_nest_end(msg, nl_ifs);
2045
2046         return 0;
2047 }
2048
2049 #define CMD(op, n)                                                      \
2050          do {                                                           \
2051                 if (rdev->ops->op) {                                    \
2052                         i++;                                            \
2053                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2054                                 goto nla_put_failure;                   \
2055                 }                                                       \
2056         } while (0)
2057
2058 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2059                                         struct sk_buff *msg)
2060 {
2061         int i = 0;
2062
2063         /*
2064          * do *NOT* add anything into this function, new things need to be
2065          * advertised only to new versions of userspace that can deal with
2066          * the split (and they can't possibly care about new features...
2067          */
2068         CMD(add_virtual_intf, NEW_INTERFACE);
2069         CMD(change_virtual_intf, SET_INTERFACE);
2070         CMD(add_key, NEW_KEY);
2071         CMD(start_ap, START_AP);
2072         CMD(add_station, NEW_STATION);
2073         CMD(add_mpath, NEW_MPATH);
2074         CMD(update_mesh_config, SET_MESH_CONFIG);
2075         CMD(change_bss, SET_BSS);
2076         CMD(auth, AUTHENTICATE);
2077         CMD(assoc, ASSOCIATE);
2078         CMD(deauth, DEAUTHENTICATE);
2079         CMD(disassoc, DISASSOCIATE);
2080         CMD(join_ibss, JOIN_IBSS);
2081         CMD(join_mesh, JOIN_MESH);
2082         CMD(set_pmksa, SET_PMKSA);
2083         CMD(del_pmksa, DEL_PMKSA);
2084         CMD(flush_pmksa, FLUSH_PMKSA);
2085         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2086                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2087         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2088         CMD(mgmt_tx, FRAME);
2089         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2090         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2091                 i++;
2092                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2093                         goto nla_put_failure;
2094         }
2095         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2096             rdev->ops->join_mesh) {
2097                 i++;
2098                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2099                         goto nla_put_failure;
2100         }
2101         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2102                 CMD(tdls_mgmt, TDLS_MGMT);
2103                 CMD(tdls_oper, TDLS_OPER);
2104         }
2105         if (rdev->wiphy.max_sched_scan_reqs)
2106                 CMD(sched_scan_start, START_SCHED_SCAN);
2107         CMD(probe_client, PROBE_CLIENT);
2108         CMD(set_noack_map, SET_NOACK_MAP);
2109         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2110                 i++;
2111                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2112                         goto nla_put_failure;
2113         }
2114         CMD(start_p2p_device, START_P2P_DEVICE);
2115         CMD(set_mcast_rate, SET_MCAST_RATE);
2116 #ifdef CONFIG_NL80211_TESTMODE
2117         CMD(testmode_cmd, TESTMODE);
2118 #endif
2119
2120         if (rdev->ops->connect || rdev->ops->auth) {
2121                 i++;
2122                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2123                         goto nla_put_failure;
2124         }
2125
2126         if (rdev->ops->disconnect || rdev->ops->deauth) {
2127                 i++;
2128                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2129                         goto nla_put_failure;
2130         }
2131
2132         return i;
2133  nla_put_failure:
2134         return -ENOBUFS;
2135 }
2136
2137 static int
2138 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2139                            struct sk_buff *msg)
2140 {
2141         struct nlattr *ftm;
2142
2143         if (!cap->ftm.supported)
2144                 return 0;
2145
2146         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2147         if (!ftm)
2148                 return -ENOBUFS;
2149
2150         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2151                 return -ENOBUFS;
2152         if (cap->ftm.non_asap &&
2153             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2154                 return -ENOBUFS;
2155         if (cap->ftm.request_lci &&
2156             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2157                 return -ENOBUFS;
2158         if (cap->ftm.request_civicloc &&
2159             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2160                 return -ENOBUFS;
2161         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2162                         cap->ftm.preambles))
2163                 return -ENOBUFS;
2164         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2165                         cap->ftm.bandwidths))
2166                 return -ENOBUFS;
2167         if (cap->ftm.max_bursts_exponent >= 0 &&
2168             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2169                         cap->ftm.max_bursts_exponent))
2170                 return -ENOBUFS;
2171         if (cap->ftm.max_ftms_per_burst &&
2172             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2173                         cap->ftm.max_ftms_per_burst))
2174                 return -ENOBUFS;
2175         if (cap->ftm.trigger_based &&
2176             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2177                 return -ENOBUFS;
2178         if (cap->ftm.non_trigger_based &&
2179             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2180                 return -ENOBUFS;
2181
2182         nla_nest_end(msg, ftm);
2183         return 0;
2184 }
2185
2186 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2187                                   struct sk_buff *msg)
2188 {
2189         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2190         struct nlattr *pmsr, *caps;
2191
2192         if (!cap)
2193                 return 0;
2194
2195         /*
2196          * we don't need to clean up anything here since the caller
2197          * will genlmsg_cancel() if we fail
2198          */
2199
2200         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2201         if (!pmsr)
2202                 return -ENOBUFS;
2203
2204         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2205                 return -ENOBUFS;
2206
2207         if (cap->report_ap_tsf &&
2208             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2209                 return -ENOBUFS;
2210
2211         if (cap->randomize_mac_addr &&
2212             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2213                 return -ENOBUFS;
2214
2215         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2216         if (!caps)
2217                 return -ENOBUFS;
2218
2219         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2220                 return -ENOBUFS;
2221
2222         nla_nest_end(msg, caps);
2223         nla_nest_end(msg, pmsr);
2224
2225         return 0;
2226 }
2227
2228 static int
2229 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2230                               struct sk_buff *msg)
2231 {
2232         int i;
2233         struct nlattr *nested, *nested_akms;
2234         const struct wiphy_iftype_akm_suites *iftype_akms;
2235
2236         if (!rdev->wiphy.num_iftype_akm_suites ||
2237             !rdev->wiphy.iftype_akm_suites)
2238                 return 0;
2239
2240         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2241         if (!nested)
2242                 return -ENOBUFS;
2243
2244         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2245                 nested_akms = nla_nest_start(msg, i + 1);
2246                 if (!nested_akms)
2247                         return -ENOBUFS;
2248
2249                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2250
2251                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2252                                         iftype_akms->iftypes_mask))
2253                         return -ENOBUFS;
2254
2255                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2256                             sizeof(u32) * iftype_akms->n_akm_suites,
2257                             iftype_akms->akm_suites)) {
2258                         return -ENOBUFS;
2259                 }
2260                 nla_nest_end(msg, nested_akms);
2261         }
2262
2263         nla_nest_end(msg, nested);
2264
2265         return 0;
2266 }
2267
2268 static int
2269 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2270                                struct sk_buff *msg)
2271 {
2272         struct nlattr *supp;
2273
2274         if (!rdev->wiphy.tid_config_support.vif &&
2275             !rdev->wiphy.tid_config_support.peer)
2276                 return 0;
2277
2278         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2279         if (!supp)
2280                 return -ENOSPC;
2281
2282         if (rdev->wiphy.tid_config_support.vif &&
2283             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2284                               rdev->wiphy.tid_config_support.vif,
2285                               NL80211_TID_CONFIG_ATTR_PAD))
2286                 goto fail;
2287
2288         if (rdev->wiphy.tid_config_support.peer &&
2289             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2290                               rdev->wiphy.tid_config_support.peer,
2291                               NL80211_TID_CONFIG_ATTR_PAD))
2292                 goto fail;
2293
2294         /* for now we just use the same value ... makes more sense */
2295         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2296                        rdev->wiphy.tid_config_support.max_retry))
2297                 goto fail;
2298         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2299                        rdev->wiphy.tid_config_support.max_retry))
2300                 goto fail;
2301
2302         nla_nest_end(msg, supp);
2303
2304         return 0;
2305 fail:
2306         nla_nest_cancel(msg, supp);
2307         return -ENOBUFS;
2308 }
2309
2310 static int
2311 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2312                       struct sk_buff *msg)
2313 {
2314         struct nlattr *sar_capa, *specs, *sub_freq_range;
2315         u8 num_freq_ranges;
2316         int i;
2317
2318         if (!rdev->wiphy.sar_capa)
2319                 return 0;
2320
2321         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2322
2323         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2324         if (!sar_capa)
2325                 return -ENOSPC;
2326
2327         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2328                 goto fail;
2329
2330         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2331         if (!specs)
2332                 goto fail;
2333
2334         /* report supported freq_ranges */
2335         for (i = 0; i < num_freq_ranges; i++) {
2336                 sub_freq_range = nla_nest_start(msg, i + 1);
2337                 if (!sub_freq_range)
2338                         goto fail;
2339
2340                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2341                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2342                         goto fail;
2343
2344                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2345                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2346                         goto fail;
2347
2348                 nla_nest_end(msg, sub_freq_range);
2349         }
2350
2351         nla_nest_end(msg, specs);
2352         nla_nest_end(msg, sar_capa);
2353
2354         return 0;
2355 fail:
2356         nla_nest_cancel(msg, sar_capa);
2357         return -ENOBUFS;
2358 }
2359
2360 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2361 {
2362         struct nlattr *config;
2363
2364         if (!wiphy->mbssid_max_interfaces)
2365                 return 0;
2366
2367         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2368         if (!config)
2369                 return -ENOBUFS;
2370
2371         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2372                        wiphy->mbssid_max_interfaces))
2373                 goto fail;
2374
2375         if (wiphy->ema_max_profile_periodicity &&
2376             nla_put_u8(msg,
2377                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2378                        wiphy->ema_max_profile_periodicity))
2379                 goto fail;
2380
2381         nla_nest_end(msg, config);
2382         return 0;
2383
2384 fail:
2385         nla_nest_cancel(msg, config);
2386         return -ENOBUFS;
2387 }
2388
2389 struct nl80211_dump_wiphy_state {
2390         s64 filter_wiphy;
2391         long start;
2392         long split_start, band_start, chan_start, capa_start;
2393         bool split;
2394 };
2395
2396 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2397                               enum nl80211_commands cmd,
2398                               struct sk_buff *msg, u32 portid, u32 seq,
2399                               int flags, struct nl80211_dump_wiphy_state *state)
2400 {
2401         void *hdr;
2402         struct nlattr *nl_bands, *nl_band;
2403         struct nlattr *nl_freqs, *nl_freq;
2404         struct nlattr *nl_cmds;
2405         enum nl80211_band band;
2406         struct ieee80211_channel *chan;
2407         int i;
2408         const struct ieee80211_txrx_stypes *mgmt_stypes =
2409                                 rdev->wiphy.mgmt_stypes;
2410         u32 features;
2411
2412         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2413         if (!hdr)
2414                 return -ENOBUFS;
2415
2416         if (WARN_ON(!state))
2417                 return -EINVAL;
2418
2419         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2420             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2421                            wiphy_name(&rdev->wiphy)) ||
2422             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2423                         cfg80211_rdev_list_generation))
2424                 goto nla_put_failure;
2425
2426         if (cmd != NL80211_CMD_NEW_WIPHY)
2427                 goto finish;
2428
2429         switch (state->split_start) {
2430         case 0:
2431                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2432                                rdev->wiphy.retry_short) ||
2433                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2434                                rdev->wiphy.retry_long) ||
2435                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2436                                 rdev->wiphy.frag_threshold) ||
2437                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2438                                 rdev->wiphy.rts_threshold) ||
2439                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2440                                rdev->wiphy.coverage_class) ||
2441                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2442                                rdev->wiphy.max_scan_ssids) ||
2443                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2444                                rdev->wiphy.max_sched_scan_ssids) ||
2445                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2446                                 rdev->wiphy.max_scan_ie_len) ||
2447                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2448                                 rdev->wiphy.max_sched_scan_ie_len) ||
2449                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2450                                rdev->wiphy.max_match_sets))
2451                         goto nla_put_failure;
2452
2453                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2454                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2455                         goto nla_put_failure;
2456                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2457                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2458                         goto nla_put_failure;
2459                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2460                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2461                         goto nla_put_failure;
2462                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2463                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2464                         goto nla_put_failure;
2465                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2466                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2467                         goto nla_put_failure;
2468                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2469                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2470                         goto nla_put_failure;
2471                 state->split_start++;
2472                 if (state->split)
2473                         break;
2474                 fallthrough;
2475         case 1:
2476                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2477                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2478                             rdev->wiphy.cipher_suites))
2479                         goto nla_put_failure;
2480
2481                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2482                                rdev->wiphy.max_num_pmkids))
2483                         goto nla_put_failure;
2484
2485                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2486                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2487                         goto nla_put_failure;
2488
2489                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2490                                 rdev->wiphy.available_antennas_tx) ||
2491                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2492                                 rdev->wiphy.available_antennas_rx))
2493                         goto nla_put_failure;
2494
2495                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2496                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2497                                 rdev->wiphy.probe_resp_offload))
2498                         goto nla_put_failure;
2499
2500                 if ((rdev->wiphy.available_antennas_tx ||
2501                      rdev->wiphy.available_antennas_rx) &&
2502                     rdev->ops->get_antenna) {
2503                         u32 tx_ant = 0, rx_ant = 0;
2504                         int res;
2505
2506                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2507                         if (!res) {
2508                                 if (nla_put_u32(msg,
2509                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2510                                                 tx_ant) ||
2511                                     nla_put_u32(msg,
2512                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2513                                                 rx_ant))
2514                                         goto nla_put_failure;
2515                         }
2516                 }
2517
2518                 state->split_start++;
2519                 if (state->split)
2520                         break;
2521                 fallthrough;
2522         case 2:
2523                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2524                                         rdev->wiphy.interface_modes))
2525                                 goto nla_put_failure;
2526                 state->split_start++;
2527                 if (state->split)
2528                         break;
2529                 fallthrough;
2530         case 3:
2531                 nl_bands = nla_nest_start_noflag(msg,
2532                                                  NL80211_ATTR_WIPHY_BANDS);
2533                 if (!nl_bands)
2534                         goto nla_put_failure;
2535
2536                 for (band = state->band_start;
2537                      band < (state->split ?
2538                                 NUM_NL80211_BANDS :
2539                                 NL80211_BAND_60GHZ + 1);
2540                      band++) {
2541                         struct ieee80211_supported_band *sband;
2542
2543                         /* omit higher bands for ancient software */
2544                         if (band > NL80211_BAND_5GHZ && !state->split)
2545                                 break;
2546
2547                         sband = rdev->wiphy.bands[band];
2548
2549                         if (!sband)
2550                                 continue;
2551
2552                         nl_band = nla_nest_start_noflag(msg, band);
2553                         if (!nl_band)
2554                                 goto nla_put_failure;
2555
2556                         switch (state->chan_start) {
2557                         case 0:
2558                                 if (nl80211_send_band_rateinfo(msg, sband,
2559                                                                state->split))
2560                                         goto nla_put_failure;
2561                                 state->chan_start++;
2562                                 if (state->split)
2563                                         break;
2564                                 fallthrough;
2565                         default:
2566                                 /* add frequencies */
2567                                 nl_freqs = nla_nest_start_noflag(msg,
2568                                                                  NL80211_BAND_ATTR_FREQS);
2569                                 if (!nl_freqs)
2570                                         goto nla_put_failure;
2571
2572                                 for (i = state->chan_start - 1;
2573                                      i < sband->n_channels;
2574                                      i++) {
2575                                         nl_freq = nla_nest_start_noflag(msg,
2576                                                                         i);
2577                                         if (!nl_freq)
2578                                                 goto nla_put_failure;
2579
2580                                         chan = &sband->channels[i];
2581
2582                                         if (nl80211_msg_put_channel(
2583                                                         msg, &rdev->wiphy, chan,
2584                                                         state->split))
2585                                                 goto nla_put_failure;
2586
2587                                         nla_nest_end(msg, nl_freq);
2588                                         if (state->split)
2589                                                 break;
2590                                 }
2591                                 if (i < sband->n_channels)
2592                                         state->chan_start = i + 2;
2593                                 else
2594                                         state->chan_start = 0;
2595                                 nla_nest_end(msg, nl_freqs);
2596                         }
2597
2598                         nla_nest_end(msg, nl_band);
2599
2600                         if (state->split) {
2601                                 /* start again here */
2602                                 if (state->chan_start)
2603                                         band--;
2604                                 break;
2605                         }
2606                 }
2607                 nla_nest_end(msg, nl_bands);
2608
2609                 if (band < NUM_NL80211_BANDS)
2610                         state->band_start = band + 1;
2611                 else
2612                         state->band_start = 0;
2613
2614                 /* if bands & channels are done, continue outside */
2615                 if (state->band_start == 0 && state->chan_start == 0)
2616                         state->split_start++;
2617                 if (state->split)
2618                         break;
2619                 fallthrough;
2620         case 4:
2621                 nl_cmds = nla_nest_start_noflag(msg,
2622                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2623                 if (!nl_cmds)
2624                         goto nla_put_failure;
2625
2626                 i = nl80211_add_commands_unsplit(rdev, msg);
2627                 if (i < 0)
2628                         goto nla_put_failure;
2629                 if (state->split) {
2630                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2631                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2632                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2633                                 CMD(channel_switch, CHANNEL_SWITCH);
2634                         CMD(set_qos_map, SET_QOS_MAP);
2635                         if (rdev->wiphy.features &
2636                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2637                                 CMD(add_tx_ts, ADD_TX_TS);
2638                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2639                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2640                         CMD(update_ft_ies, UPDATE_FT_IES);
2641                         if (rdev->wiphy.sar_capa)
2642                                 CMD(set_sar_specs, SET_SAR_SPECS);
2643                 }
2644 #undef CMD
2645
2646                 nla_nest_end(msg, nl_cmds);
2647                 state->split_start++;
2648                 if (state->split)
2649                         break;
2650                 fallthrough;
2651         case 5:
2652                 if (rdev->ops->remain_on_channel &&
2653                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2654                     nla_put_u32(msg,
2655                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2656                                 rdev->wiphy.max_remain_on_channel_duration))
2657                         goto nla_put_failure;
2658
2659                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2660                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2661                         goto nla_put_failure;
2662
2663                 state->split_start++;
2664                 if (state->split)
2665                         break;
2666                 fallthrough;
2667         case 6:
2668 #ifdef CONFIG_PM
2669                 if (nl80211_send_wowlan(msg, rdev, state->split))
2670                         goto nla_put_failure;
2671                 state->split_start++;
2672                 if (state->split)
2673                         break;
2674 #else
2675                 state->split_start++;
2676 #endif
2677                 fallthrough;
2678         case 7:
2679                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2680                                         rdev->wiphy.software_iftypes))
2681                         goto nla_put_failure;
2682
2683                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2684                                                    state->split))
2685                         goto nla_put_failure;
2686
2687                 state->split_start++;
2688                 if (state->split)
2689                         break;
2690                 fallthrough;
2691         case 8:
2692                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2693                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2694                                 rdev->wiphy.ap_sme_capa))
2695                         goto nla_put_failure;
2696
2697                 features = rdev->wiphy.features;
2698                 /*
2699                  * We can only add the per-channel limit information if the
2700                  * dump is split, otherwise it makes it too big. Therefore
2701                  * only advertise it in that case.
2702                  */
2703                 if (state->split)
2704                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2705                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2706                         goto nla_put_failure;
2707
2708                 if (rdev->wiphy.ht_capa_mod_mask &&
2709                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2710                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2711                             rdev->wiphy.ht_capa_mod_mask))
2712                         goto nla_put_failure;
2713
2714                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2715                     rdev->wiphy.max_acl_mac_addrs &&
2716                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2717                                 rdev->wiphy.max_acl_mac_addrs))
2718                         goto nla_put_failure;
2719
2720                 /*
2721                  * Any information below this point is only available to
2722                  * applications that can deal with it being split. This
2723                  * helps ensure that newly added capabilities don't break
2724                  * older tools by overrunning their buffers.
2725                  *
2726                  * We still increment split_start so that in the split
2727                  * case we'll continue with more data in the next round,
2728                  * but break unconditionally so unsplit data stops here.
2729                  */
2730                 if (state->split)
2731                         state->split_start++;
2732                 else
2733                         state->split_start = 0;
2734                 break;
2735         case 9:
2736                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2737                         goto nla_put_failure;
2738
2739                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2740                                 rdev->wiphy.max_sched_scan_plans) ||
2741                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2742                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2743                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2744                                 rdev->wiphy.max_sched_scan_plan_iterations))
2745                         goto nla_put_failure;
2746
2747                 if (rdev->wiphy.extended_capabilities &&
2748                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2749                              rdev->wiphy.extended_capabilities_len,
2750                              rdev->wiphy.extended_capabilities) ||
2751                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2752                              rdev->wiphy.extended_capabilities_len,
2753                              rdev->wiphy.extended_capabilities_mask)))
2754                         goto nla_put_failure;
2755
2756                 if (rdev->wiphy.vht_capa_mod_mask &&
2757                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2758                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2759                             rdev->wiphy.vht_capa_mod_mask))
2760                         goto nla_put_failure;
2761
2762                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2763                             rdev->wiphy.perm_addr))
2764                         goto nla_put_failure;
2765
2766                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2767                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2768                             rdev->wiphy.addr_mask))
2769                         goto nla_put_failure;
2770
2771                 if (rdev->wiphy.n_addresses > 1) {
2772                         void *attr;
2773
2774                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2775                         if (!attr)
2776                                 goto nla_put_failure;
2777
2778                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2779                                 if (nla_put(msg, i + 1, ETH_ALEN,
2780                                             rdev->wiphy.addresses[i].addr))
2781                                         goto nla_put_failure;
2782
2783                         nla_nest_end(msg, attr);
2784                 }
2785
2786                 state->split_start++;
2787                 break;
2788         case 10:
2789                 if (nl80211_send_coalesce(msg, rdev))
2790                         goto nla_put_failure;
2791
2792                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2793                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2794                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2795                         goto nla_put_failure;
2796
2797                 if (rdev->wiphy.max_ap_assoc_sta &&
2798                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2799                                 rdev->wiphy.max_ap_assoc_sta))
2800                         goto nla_put_failure;
2801
2802                 state->split_start++;
2803                 break;
2804         case 11:
2805                 if (rdev->wiphy.n_vendor_commands) {
2806                         const struct nl80211_vendor_cmd_info *info;
2807                         struct nlattr *nested;
2808
2809                         nested = nla_nest_start_noflag(msg,
2810                                                        NL80211_ATTR_VENDOR_DATA);
2811                         if (!nested)
2812                                 goto nla_put_failure;
2813
2814                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2815                                 info = &rdev->wiphy.vendor_commands[i].info;
2816                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2817                                         goto nla_put_failure;
2818                         }
2819                         nla_nest_end(msg, nested);
2820                 }
2821
2822                 if (rdev->wiphy.n_vendor_events) {
2823                         const struct nl80211_vendor_cmd_info *info;
2824                         struct nlattr *nested;
2825
2826                         nested = nla_nest_start_noflag(msg,
2827                                                        NL80211_ATTR_VENDOR_EVENTS);
2828                         if (!nested)
2829                                 goto nla_put_failure;
2830
2831                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2832                                 info = &rdev->wiphy.vendor_events[i];
2833                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2834                                         goto nla_put_failure;
2835                         }
2836                         nla_nest_end(msg, nested);
2837                 }
2838                 state->split_start++;
2839                 break;
2840         case 12:
2841                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2842                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2843                                rdev->wiphy.max_num_csa_counters))
2844                         goto nla_put_failure;
2845
2846                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2847                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2848                         goto nla_put_failure;
2849
2850                 if (rdev->wiphy.max_sched_scan_reqs &&
2851                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2852                                 rdev->wiphy.max_sched_scan_reqs))
2853                         goto nla_put_failure;
2854
2855                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2856                             sizeof(rdev->wiphy.ext_features),
2857                             rdev->wiphy.ext_features))
2858                         goto nla_put_failure;
2859
2860                 if (rdev->wiphy.bss_select_support) {
2861                         struct nlattr *nested;
2862                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2863
2864                         nested = nla_nest_start_noflag(msg,
2865                                                        NL80211_ATTR_BSS_SELECT);
2866                         if (!nested)
2867                                 goto nla_put_failure;
2868
2869                         i = 0;
2870                         while (bss_select_support) {
2871                                 if ((bss_select_support & 1) &&
2872                                     nla_put_flag(msg, i))
2873                                         goto nla_put_failure;
2874                                 i++;
2875                                 bss_select_support >>= 1;
2876                         }
2877                         nla_nest_end(msg, nested);
2878                 }
2879
2880                 state->split_start++;
2881                 break;
2882         case 13:
2883                 if (rdev->wiphy.num_iftype_ext_capab &&
2884                     rdev->wiphy.iftype_ext_capab) {
2885                         struct nlattr *nested_ext_capab, *nested;
2886
2887                         nested = nla_nest_start_noflag(msg,
2888                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2889                         if (!nested)
2890                                 goto nla_put_failure;
2891
2892                         for (i = state->capa_start;
2893                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2894                                 const struct wiphy_iftype_ext_capab *capab;
2895
2896                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2897
2898                                 nested_ext_capab = nla_nest_start_noflag(msg,
2899                                                                          i);
2900                                 if (!nested_ext_capab ||
2901                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2902                                                 capab->iftype) ||
2903                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2904                                             capab->extended_capabilities_len,
2905                                             capab->extended_capabilities) ||
2906                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2907                                             capab->extended_capabilities_len,
2908                                             capab->extended_capabilities_mask))
2909                                         goto nla_put_failure;
2910
2911                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2912                                     (nla_put_u16(msg,
2913                                                  NL80211_ATTR_EML_CAPABILITY,
2914                                                  capab->eml_capabilities) ||
2915                                      nla_put_u16(msg,
2916                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
2917                                                  capab->mld_capa_and_ops)))
2918                                         goto nla_put_failure;
2919
2920                                 nla_nest_end(msg, nested_ext_capab);
2921                                 if (state->split)
2922                                         break;
2923                         }
2924                         nla_nest_end(msg, nested);
2925                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2926                                 state->capa_start = i + 1;
2927                                 break;
2928                         }
2929                 }
2930
2931                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2932                                 rdev->wiphy.nan_supported_bands))
2933                         goto nla_put_failure;
2934
2935                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2936                                             NL80211_EXT_FEATURE_TXQS)) {
2937                         struct cfg80211_txq_stats txqstats = {};
2938                         int res;
2939
2940                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2941                         if (!res &&
2942                             !nl80211_put_txq_stats(msg, &txqstats,
2943                                                    NL80211_ATTR_TXQ_STATS))
2944                                 goto nla_put_failure;
2945
2946                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2947                                         rdev->wiphy.txq_limit))
2948                                 goto nla_put_failure;
2949                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2950                                         rdev->wiphy.txq_memory_limit))
2951                                 goto nla_put_failure;
2952                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2953                                         rdev->wiphy.txq_quantum))
2954                                 goto nla_put_failure;
2955                 }
2956
2957                 state->split_start++;
2958                 break;
2959         case 14:
2960                 if (nl80211_send_pmsr_capa(rdev, msg))
2961                         goto nla_put_failure;
2962
2963                 state->split_start++;
2964                 break;
2965         case 15:
2966                 if (rdev->wiphy.akm_suites &&
2967                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2968                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2969                             rdev->wiphy.akm_suites))
2970                         goto nla_put_failure;
2971
2972                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2973                         goto nla_put_failure;
2974
2975                 if (nl80211_put_tid_config_support(rdev, msg))
2976                         goto nla_put_failure;
2977                 state->split_start++;
2978                 break;
2979         case 16:
2980                 if (nl80211_put_sar_specs(rdev, msg))
2981                         goto nla_put_failure;
2982
2983                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2984                         goto nla_put_failure;
2985
2986                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2987                                 rdev->wiphy.max_num_akm_suites))
2988                         goto nla_put_failure;
2989
2990                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2991                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2992
2993                 if (rdev->wiphy.hw_timestamp_max_peers &&
2994                     nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
2995                                 rdev->wiphy.hw_timestamp_max_peers))
2996                         goto nla_put_failure;
2997
2998                 /* done */
2999                 state->split_start = 0;
3000                 break;
3001         }
3002  finish:
3003         genlmsg_end(msg, hdr);
3004         return 0;
3005
3006  nla_put_failure:
3007         genlmsg_cancel(msg, hdr);
3008         return -EMSGSIZE;
3009 }
3010
3011 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3012                                     struct netlink_callback *cb,
3013                                     struct nl80211_dump_wiphy_state *state)
3014 {
3015         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3016         int ret;
3017
3018         if (!tb)
3019                 return -ENOMEM;
3020
3021         ret = nlmsg_parse_deprecated(cb->nlh,
3022                                      GENL_HDRLEN + nl80211_fam.hdrsize,
3023                                      tb, nl80211_fam.maxattr,
3024                                      nl80211_policy, NULL);
3025         /* ignore parse errors for backward compatibility */
3026         if (ret) {
3027                 ret = 0;
3028                 goto out;
3029         }
3030
3031         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3032         if (tb[NL80211_ATTR_WIPHY])
3033                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3034         if (tb[NL80211_ATTR_WDEV])
3035                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3036         if (tb[NL80211_ATTR_IFINDEX]) {
3037                 struct net_device *netdev;
3038                 struct cfg80211_registered_device *rdev;
3039                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3040
3041                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3042                 if (!netdev) {
3043                         ret = -ENODEV;
3044                         goto out;
3045                 }
3046                 if (netdev->ieee80211_ptr) {
3047                         rdev = wiphy_to_rdev(
3048                                 netdev->ieee80211_ptr->wiphy);
3049                         state->filter_wiphy = rdev->wiphy_idx;
3050                 }
3051         }
3052
3053         ret = 0;
3054 out:
3055         kfree(tb);
3056         return ret;
3057 }
3058
3059 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3060 {
3061         int idx = 0, ret;
3062         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3063         struct cfg80211_registered_device *rdev;
3064
3065         rtnl_lock();
3066         if (!state) {
3067                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3068                 if (!state) {
3069                         rtnl_unlock();
3070                         return -ENOMEM;
3071                 }
3072                 state->filter_wiphy = -1;
3073                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3074                 if (ret) {
3075                         kfree(state);
3076                         rtnl_unlock();
3077                         return ret;
3078                 }
3079                 cb->args[0] = (long)state;
3080         }
3081
3082         for_each_rdev(rdev) {
3083                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3084                         continue;
3085                 if (++idx <= state->start)
3086                         continue;
3087                 if (state->filter_wiphy != -1 &&
3088                     state->filter_wiphy != rdev->wiphy_idx)
3089                         continue;
3090                 wiphy_lock(&rdev->wiphy);
3091                 /* attempt to fit multiple wiphy data chunks into the skb */
3092                 do {
3093                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3094                                                  skb,
3095                                                  NETLINK_CB(cb->skb).portid,
3096                                                  cb->nlh->nlmsg_seq,
3097                                                  NLM_F_MULTI, state);
3098                         if (ret < 0) {
3099                                 /*
3100                                  * If sending the wiphy data didn't fit (ENOBUFS
3101                                  * or EMSGSIZE returned), this SKB is still
3102                                  * empty (so it's not too big because another
3103                                  * wiphy dataset is already in the skb) and
3104                                  * we've not tried to adjust the dump allocation
3105                                  * yet ... then adjust the alloc size to be
3106                                  * bigger, and return 1 but with the empty skb.
3107                                  * This results in an empty message being RX'ed
3108                                  * in userspace, but that is ignored.
3109                                  *
3110                                  * We can then retry with the larger buffer.
3111                                  */
3112                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3113                                     !skb->len && !state->split &&
3114                                     cb->min_dump_alloc < 4096) {
3115                                         cb->min_dump_alloc = 4096;
3116                                         state->split_start = 0;
3117                                         wiphy_unlock(&rdev->wiphy);
3118                                         rtnl_unlock();
3119                                         return 1;
3120                                 }
3121                                 idx--;
3122                                 break;
3123                         }
3124                 } while (state->split_start > 0);
3125                 wiphy_unlock(&rdev->wiphy);
3126                 break;
3127         }
3128         rtnl_unlock();
3129
3130         state->start = idx;
3131
3132         return skb->len;
3133 }
3134
3135 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3136 {
3137         kfree((void *)cb->args[0]);
3138         return 0;
3139 }
3140
3141 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3142 {
3143         struct sk_buff *msg;
3144         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3145         struct nl80211_dump_wiphy_state state = {};
3146
3147         msg = nlmsg_new(4096, GFP_KERNEL);
3148         if (!msg)
3149                 return -ENOMEM;
3150
3151         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3152                                info->snd_portid, info->snd_seq, 0,
3153                                &state) < 0) {
3154                 nlmsg_free(msg);
3155                 return -ENOBUFS;
3156         }
3157
3158         return genlmsg_reply(msg, info);
3159 }
3160
3161 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3162         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3163         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3164         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3165         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3166         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3167 };
3168
3169 static int parse_txq_params(struct nlattr *tb[],
3170                             struct ieee80211_txq_params *txq_params)
3171 {
3172         u8 ac;
3173
3174         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3175             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3176             !tb[NL80211_TXQ_ATTR_AIFS])
3177                 return -EINVAL;
3178
3179         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3180         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3181         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3182         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3183         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3184
3185         if (ac >= NL80211_NUM_ACS)
3186                 return -EINVAL;
3187         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3188         return 0;
3189 }
3190
3191 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3192 {
3193         /*
3194          * You can only set the channel explicitly for some interfaces,
3195          * most have their channel managed via their respective
3196          * "establish a connection" command (connect, join, ...)
3197          *
3198          * For AP/GO and mesh mode, the channel can be set with the
3199          * channel userspace API, but is only stored and passed to the
3200          * low-level driver when the AP starts or the mesh is joined.
3201          * This is for backward compatibility, userspace can also give
3202          * the channel in the start-ap or join-mesh commands instead.
3203          *
3204          * Monitors are special as they are normally slaved to
3205          * whatever else is going on, so they have their own special
3206          * operation to set the monitor channel if possible.
3207          */
3208         return !wdev ||
3209                 wdev->iftype == NL80211_IFTYPE_AP ||
3210                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3211                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3212                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3213 }
3214
3215 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3216                                       struct genl_info *info,
3217                                       const struct cfg80211_chan_def *chandef,
3218                                       u16 *punct_bitmap)
3219 {
3220         if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3221                 return -EINVAL;
3222
3223         *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3224         if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3225                 return -EINVAL;
3226
3227         return 0;
3228 }
3229
3230 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3231                           struct genl_info *info,
3232                           struct cfg80211_chan_def *chandef)
3233 {
3234         struct netlink_ext_ack *extack = info->extack;
3235         struct nlattr **attrs = info->attrs;
3236         u32 control_freq;
3237
3238         if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3239                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3240                                     "Frequency is missing");
3241                 return -EINVAL;
3242         }
3243
3244         control_freq = MHZ_TO_KHZ(
3245                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3246         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3247                 control_freq +=
3248                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3249
3250         memset(chandef, 0, sizeof(*chandef));
3251         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3252         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3253         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3254         chandef->freq1_offset = control_freq % 1000;
3255         chandef->center_freq2 = 0;
3256
3257         /* Primary channel not allowed */
3258         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3259                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3260                                     "Channel is disabled");
3261                 return -EINVAL;
3262         }
3263
3264         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3265                 enum nl80211_channel_type chantype;
3266
3267                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3268
3269                 switch (chantype) {
3270                 case NL80211_CHAN_NO_HT:
3271                 case NL80211_CHAN_HT20:
3272                 case NL80211_CHAN_HT40PLUS:
3273                 case NL80211_CHAN_HT40MINUS:
3274                         cfg80211_chandef_create(chandef, chandef->chan,
3275                                                 chantype);
3276                         /* user input for center_freq is incorrect */
3277                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3278                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3279                                 NL_SET_ERR_MSG_ATTR(extack,
3280                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3281                                                     "bad center frequency 1");
3282                                 return -EINVAL;
3283                         }
3284                         /* center_freq2 must be zero */
3285                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3286                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3287                                 NL_SET_ERR_MSG_ATTR(extack,
3288                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3289                                                     "center frequency 2 can't be used");
3290                                 return -EINVAL;
3291                         }
3292                         break;
3293                 default:
3294                         NL_SET_ERR_MSG_ATTR(extack,
3295                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3296                                             "invalid channel type");
3297                         return -EINVAL;
3298                 }
3299         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3300                 chandef->width =
3301                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3302                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3303                         /* User input error for channel width doesn't match channel  */
3304                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3305                                 NL_SET_ERR_MSG_ATTR(extack,
3306                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3307                                                     "bad channel width");
3308                                 return -EINVAL;
3309                         }
3310                 }
3311                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3312                         chandef->center_freq1 =
3313                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3314                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3315                                 chandef->freq1_offset = nla_get_u32(
3316                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3317                         else
3318                                 chandef->freq1_offset = 0;
3319                 }
3320                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3321                         chandef->center_freq2 =
3322                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3323         }
3324
3325         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3326                 chandef->edmg.channels =
3327                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3328
3329                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3330                         chandef->edmg.bw_config =
3331                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3332         } else {
3333                 chandef->edmg.bw_config = 0;
3334                 chandef->edmg.channels = 0;
3335         }
3336
3337         if (!cfg80211_chandef_valid(chandef)) {
3338                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3339                 return -EINVAL;
3340         }
3341
3342         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3343                                      IEEE80211_CHAN_DISABLED)) {
3344                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3345                 return -EINVAL;
3346         }
3347
3348         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3349              chandef->width == NL80211_CHAN_WIDTH_10) &&
3350             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3351                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3352                 return -EINVAL;
3353         }
3354
3355         return 0;
3356 }
3357
3358 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3359                                  struct net_device *dev,
3360                                  struct genl_info *info,
3361                                  int _link_id)
3362 {
3363         struct cfg80211_chan_def chandef;
3364         int result;
3365         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3366         struct wireless_dev *wdev = NULL;
3367         int link_id = _link_id;
3368
3369         if (dev)
3370                 wdev = dev->ieee80211_ptr;
3371         if (!nl80211_can_set_dev_channel(wdev))
3372                 return -EOPNOTSUPP;
3373         if (wdev)
3374                 iftype = wdev->iftype;
3375
3376         if (link_id < 0) {
3377                 if (wdev && wdev->valid_links)
3378                         return -EINVAL;
3379                 link_id = 0;
3380         }
3381
3382         result = nl80211_parse_chandef(rdev, info, &chandef);
3383         if (result)
3384                 return result;
3385
3386         switch (iftype) {
3387         case NL80211_IFTYPE_AP:
3388         case NL80211_IFTYPE_P2P_GO:
3389                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3390                                                    iftype))
3391                         return -EINVAL;
3392                 if (wdev->links[link_id].ap.beacon_interval) {
3393                         struct ieee80211_channel *cur_chan;
3394
3395                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3396                             !(rdev->wiphy.features &
3397                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3398                                 return -EBUSY;
3399
3400                         /* Only allow dynamic channel width changes */
3401                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3402                         if (chandef.chan != cur_chan)
3403                                 return -EBUSY;
3404
3405                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3406                                                        &chandef);
3407                         if (result)
3408                                 return result;
3409                         wdev->links[link_id].ap.chandef = chandef;
3410                 } else {
3411                         wdev->u.ap.preset_chandef = chandef;
3412                 }
3413                 return 0;
3414         case NL80211_IFTYPE_MESH_POINT:
3415                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3416         case NL80211_IFTYPE_MONITOR:
3417                 return cfg80211_set_monitor_channel(rdev, &chandef);
3418         default:
3419                 break;
3420         }
3421
3422         return -EINVAL;
3423 }
3424
3425 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3426 {
3427         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3428         int link_id = nl80211_link_id_or_invalid(info->attrs);
3429         struct net_device *netdev = info->user_ptr[1];
3430
3431         return __nl80211_set_channel(rdev, netdev, info, link_id);
3432 }
3433
3434 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3435 {
3436         struct cfg80211_registered_device *rdev = NULL;
3437         struct net_device *netdev = NULL;
3438         struct wireless_dev *wdev;
3439         int result = 0, rem_txq_params = 0;
3440         struct nlattr *nl_txq_params;
3441         u32 changed;
3442         u8 retry_short = 0, retry_long = 0;
3443         u32 frag_threshold = 0, rts_threshold = 0;
3444         u8 coverage_class = 0;
3445         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3446
3447         rtnl_lock();
3448         /*
3449          * Try to find the wiphy and netdev. Normally this
3450          * function shouldn't need the netdev, but this is
3451          * done for backward compatibility -- previously
3452          * setting the channel was done per wiphy, but now
3453          * it is per netdev. Previous userland like hostapd
3454          * also passed a netdev to set_wiphy, so that it is
3455          * possible to let that go to the right netdev!
3456          */
3457
3458         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3459                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3460
3461                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3462                 if (netdev && netdev->ieee80211_ptr)
3463                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3464                 else
3465                         netdev = NULL;
3466         }
3467
3468         if (!netdev) {
3469                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3470                                                   info->attrs);
3471                 if (IS_ERR(rdev)) {
3472                         rtnl_unlock();
3473                         return PTR_ERR(rdev);
3474                 }
3475                 wdev = NULL;
3476                 netdev = NULL;
3477                 result = 0;
3478         } else
3479                 wdev = netdev->ieee80211_ptr;
3480
3481         wiphy_lock(&rdev->wiphy);
3482
3483         /*
3484          * end workaround code, by now the rdev is available
3485          * and locked, and wdev may or may not be NULL.
3486          */
3487
3488         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3489                 result = cfg80211_dev_rename(
3490                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3491         rtnl_unlock();
3492
3493         if (result)
3494                 goto out;
3495
3496         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3497                 struct ieee80211_txq_params txq_params;
3498                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3499
3500                 if (!rdev->ops->set_txq_params) {
3501                         result = -EOPNOTSUPP;
3502                         goto out;
3503                 }
3504
3505                 if (!netdev) {
3506                         result = -EINVAL;
3507                         goto out;
3508                 }
3509
3510                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3511                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3512                         result = -EINVAL;
3513                         goto out;
3514                 }
3515
3516                 if (!netif_running(netdev)) {
3517                         result = -ENETDOWN;
3518                         goto out;
3519                 }
3520
3521                 nla_for_each_nested(nl_txq_params,
3522                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3523                                     rem_txq_params) {
3524                         result = nla_parse_nested_deprecated(tb,
3525                                                              NL80211_TXQ_ATTR_MAX,
3526                                                              nl_txq_params,
3527                                                              txq_params_policy,
3528                                                              info->extack);
3529                         if (result)
3530                                 goto out;
3531                         result = parse_txq_params(tb, &txq_params);
3532                         if (result)
3533                                 goto out;
3534
3535                         txq_params.link_id =
3536                                 nl80211_link_id_or_invalid(info->attrs);
3537
3538                         if (txq_params.link_id >= 0 &&
3539                             !(netdev->ieee80211_ptr->valid_links &
3540                               BIT(txq_params.link_id)))
3541                                 result = -ENOLINK;
3542                         else if (txq_params.link_id >= 0 &&
3543                                  !netdev->ieee80211_ptr->valid_links)
3544                                 result = -EINVAL;
3545                         else
3546                                 result = rdev_set_txq_params(rdev, netdev,
3547                                                              &txq_params);
3548                         if (result)
3549                                 goto out;
3550                 }
3551         }
3552
3553         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3554                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3555
3556                 if (wdev) {
3557                         result = __nl80211_set_channel(
3558                                 rdev,
3559                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3560                                 info, link_id);
3561                 } else {
3562                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3563                 }
3564
3565                 if (result)
3566                         goto out;
3567         }
3568
3569         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3570                 struct wireless_dev *txp_wdev = wdev;
3571                 enum nl80211_tx_power_setting type;
3572                 int idx, mbm = 0;
3573
3574                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3575                         txp_wdev = NULL;
3576
3577                 if (!rdev->ops->set_tx_power) {
3578                         result = -EOPNOTSUPP;
3579                         goto out;
3580                 }
3581
3582                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3583                 type = nla_get_u32(info->attrs[idx]);
3584
3585                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3586                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3587                         result = -EINVAL;
3588                         goto out;
3589                 }
3590
3591                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3592                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3593                         mbm = nla_get_u32(info->attrs[idx]);
3594                 }
3595
3596                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3597                 if (result)
3598                         goto out;
3599         }
3600
3601         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3602             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3603                 u32 tx_ant, rx_ant;
3604
3605                 if ((!rdev->wiphy.available_antennas_tx &&
3606                      !rdev->wiphy.available_antennas_rx) ||
3607                     !rdev->ops->set_antenna) {
3608                         result = -EOPNOTSUPP;
3609                         goto out;
3610                 }
3611
3612                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3613                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3614
3615                 /* reject antenna configurations which don't match the
3616                  * available antenna masks, except for the "all" mask */
3617                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3618                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3619                         result = -EINVAL;
3620                         goto out;
3621                 }
3622
3623                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3624                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3625
3626                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3627                 if (result)
3628                         goto out;
3629         }
3630
3631         changed = 0;
3632
3633         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3634                 retry_short = nla_get_u8(
3635                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3636
3637                 changed |= WIPHY_PARAM_RETRY_SHORT;
3638         }
3639
3640         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3641                 retry_long = nla_get_u8(
3642                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3643
3644                 changed |= WIPHY_PARAM_RETRY_LONG;
3645         }
3646
3647         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3648                 frag_threshold = nla_get_u32(
3649                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3650                 if (frag_threshold < 256) {
3651                         result = -EINVAL;
3652                         goto out;
3653                 }
3654
3655                 if (frag_threshold != (u32) -1) {
3656                         /*
3657                          * Fragments (apart from the last one) are required to
3658                          * have even length. Make the fragmentation code
3659                          * simpler by stripping LSB should someone try to use
3660                          * odd threshold value.
3661                          */
3662                         frag_threshold &= ~0x1;
3663                 }
3664                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3665         }
3666
3667         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3668                 rts_threshold = nla_get_u32(
3669                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3670                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3671         }
3672
3673         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3674                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3675                         result = -EINVAL;
3676                         goto out;
3677                 }
3678
3679                 coverage_class = nla_get_u8(
3680                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3681                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3682         }
3683
3684         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3685                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3686                         result = -EOPNOTSUPP;
3687                         goto out;
3688                 }
3689
3690                 changed |= WIPHY_PARAM_DYN_ACK;
3691         }
3692
3693         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3694                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3695                                              NL80211_EXT_FEATURE_TXQS)) {
3696                         result = -EOPNOTSUPP;
3697                         goto out;
3698                 }
3699                 txq_limit = nla_get_u32(
3700                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3701                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3702         }
3703
3704         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3705                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3706                                              NL80211_EXT_FEATURE_TXQS)) {
3707                         result = -EOPNOTSUPP;
3708                         goto out;
3709                 }
3710                 txq_memory_limit = nla_get_u32(
3711                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3712                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3713         }
3714
3715         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3716                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3717                                              NL80211_EXT_FEATURE_TXQS)) {
3718                         result = -EOPNOTSUPP;
3719                         goto out;
3720                 }
3721                 txq_quantum = nla_get_u32(
3722                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3723                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3724         }
3725
3726         if (changed) {
3727                 u8 old_retry_short, old_retry_long;
3728                 u32 old_frag_threshold, old_rts_threshold;
3729                 u8 old_coverage_class;
3730                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3731
3732                 if (!rdev->ops->set_wiphy_params) {
3733                         result = -EOPNOTSUPP;
3734                         goto out;
3735                 }
3736
3737                 old_retry_short = rdev->wiphy.retry_short;
3738                 old_retry_long = rdev->wiphy.retry_long;
3739                 old_frag_threshold = rdev->wiphy.frag_threshold;
3740                 old_rts_threshold = rdev->wiphy.rts_threshold;
3741                 old_coverage_class = rdev->wiphy.coverage_class;
3742                 old_txq_limit = rdev->wiphy.txq_limit;
3743                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3744                 old_txq_quantum = rdev->wiphy.txq_quantum;
3745
3746                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3747                         rdev->wiphy.retry_short = retry_short;
3748                 if (changed & WIPHY_PARAM_RETRY_LONG)
3749                         rdev->wiphy.retry_long = retry_long;
3750                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3751                         rdev->wiphy.frag_threshold = frag_threshold;
3752                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3753                         rdev->wiphy.rts_threshold = rts_threshold;
3754                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3755                         rdev->wiphy.coverage_class = coverage_class;
3756                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3757                         rdev->wiphy.txq_limit = txq_limit;
3758                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3759                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3760                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3761                         rdev->wiphy.txq_quantum = txq_quantum;
3762
3763                 result = rdev_set_wiphy_params(rdev, changed);
3764                 if (result) {
3765                         rdev->wiphy.retry_short = old_retry_short;
3766                         rdev->wiphy.retry_long = old_retry_long;
3767                         rdev->wiphy.frag_threshold = old_frag_threshold;
3768                         rdev->wiphy.rts_threshold = old_rts_threshold;
3769                         rdev->wiphy.coverage_class = old_coverage_class;
3770                         rdev->wiphy.txq_limit = old_txq_limit;
3771                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3772                         rdev->wiphy.txq_quantum = old_txq_quantum;
3773                         goto out;
3774                 }
3775         }
3776
3777         result = 0;
3778
3779 out:
3780         wiphy_unlock(&rdev->wiphy);
3781         return result;
3782 }
3783
3784 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3785 {
3786         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3787                 return -EINVAL;
3788
3789         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3790                         chandef->chan->center_freq))
3791                 return -ENOBUFS;
3792         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3793                         chandef->chan->freq_offset))
3794                 return -ENOBUFS;
3795         switch (chandef->width) {
3796         case NL80211_CHAN_WIDTH_20_NOHT:
3797         case NL80211_CHAN_WIDTH_20:
3798         case NL80211_CHAN_WIDTH_40:
3799                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3800                                 cfg80211_get_chandef_type(chandef)))
3801                         return -ENOBUFS;
3802                 break;
3803         default:
3804                 break;
3805         }
3806         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3807                 return -ENOBUFS;
3808         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3809                 return -ENOBUFS;
3810         if (chandef->center_freq2 &&
3811             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3812                 return -ENOBUFS;
3813         return 0;
3814 }
3815 EXPORT_SYMBOL(nl80211_send_chandef);
3816
3817 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3818                               struct cfg80211_registered_device *rdev,
3819                               struct wireless_dev *wdev,
3820                               enum nl80211_commands cmd)
3821 {
3822         struct net_device *dev = wdev->netdev;
3823         void *hdr;
3824
3825         lockdep_assert_wiphy(&rdev->wiphy);
3826
3827         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3828                 cmd != NL80211_CMD_DEL_INTERFACE &&
3829                 cmd != NL80211_CMD_SET_INTERFACE);
3830
3831         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3832         if (!hdr)
3833                 return -1;
3834
3835         if (dev &&
3836             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3837              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3838                 goto nla_put_failure;
3839
3840         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3841             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3842             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3843                               NL80211_ATTR_PAD) ||
3844             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3845             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3846                         rdev->devlist_generation ^
3847                         (cfg80211_rdev_list_generation << 2)) ||
3848             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3849                 goto nla_put_failure;
3850
3851         if (rdev->ops->get_channel && !wdev->valid_links) {
3852                 struct cfg80211_chan_def chandef = {};
3853                 int ret;
3854
3855                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3856                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3857                         goto nla_put_failure;
3858         }
3859
3860         if (rdev->ops->get_tx_power) {
3861                 int dbm, ret;
3862
3863                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3864                 if (ret == 0 &&
3865                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3866                                 DBM_TO_MBM(dbm)))
3867                         goto nla_put_failure;
3868         }
3869
3870         switch (wdev->iftype) {
3871         case NL80211_IFTYPE_AP:
3872         case NL80211_IFTYPE_P2P_GO:
3873                 if (wdev->u.ap.ssid_len &&
3874                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3875                             wdev->u.ap.ssid))
3876                         goto nla_put_failure;
3877                 break;
3878         case NL80211_IFTYPE_STATION:
3879         case NL80211_IFTYPE_P2P_CLIENT:
3880                 if (wdev->u.client.ssid_len &&
3881                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3882                             wdev->u.client.ssid))
3883                         goto nla_put_failure;
3884                 break;
3885         case NL80211_IFTYPE_ADHOC:
3886                 if (wdev->u.ibss.ssid_len &&
3887                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3888                             wdev->u.ibss.ssid))
3889                         goto nla_put_failure;
3890                 break;
3891         default:
3892                 /* nothing */
3893                 break;
3894         }
3895
3896         if (rdev->ops->get_txq_stats) {
3897                 struct cfg80211_txq_stats txqstats = {};
3898                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3899
3900                 if (ret == 0 &&
3901                     !nl80211_put_txq_stats(msg, &txqstats,
3902                                            NL80211_ATTR_TXQ_STATS))
3903                         goto nla_put_failure;
3904         }
3905
3906         if (wdev->valid_links) {
3907                 unsigned int link_id;
3908                 struct nlattr *links = nla_nest_start(msg,
3909                                                       NL80211_ATTR_MLO_LINKS);
3910
3911                 if (!links)
3912                         goto nla_put_failure;
3913
3914                 for_each_valid_link(wdev, link_id) {
3915                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
3916                         struct cfg80211_chan_def chandef = {};
3917                         int ret;
3918
3919                         if (!link)
3920                                 goto nla_put_failure;
3921
3922                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3923                                 goto nla_put_failure;
3924                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3925                                     wdev->links[link_id].addr))
3926                                 goto nla_put_failure;
3927
3928                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3929                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3930                                 goto nla_put_failure;
3931
3932                         nla_nest_end(msg, link);
3933                 }
3934
3935                 nla_nest_end(msg, links);
3936         }
3937
3938         genlmsg_end(msg, hdr);
3939         return 0;
3940
3941  nla_put_failure:
3942         genlmsg_cancel(msg, hdr);
3943         return -EMSGSIZE;
3944 }
3945
3946 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3947 {
3948         int wp_idx = 0;
3949         int if_idx = 0;
3950         int wp_start = cb->args[0];
3951         int if_start = cb->args[1];
3952         int filter_wiphy = -1;
3953         struct cfg80211_registered_device *rdev;
3954         struct wireless_dev *wdev;
3955         int ret;
3956
3957         rtnl_lock();
3958         if (!cb->args[2]) {
3959                 struct nl80211_dump_wiphy_state state = {
3960                         .filter_wiphy = -1,
3961                 };
3962
3963                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3964                 if (ret)
3965                         goto out_unlock;
3966
3967                 filter_wiphy = state.filter_wiphy;
3968
3969                 /*
3970                  * if filtering, set cb->args[2] to +1 since 0 is the default
3971                  * value needed to determine that parsing is necessary.
3972                  */
3973                 if (filter_wiphy >= 0)
3974                         cb->args[2] = filter_wiphy + 1;
3975                 else
3976                         cb->args[2] = -1;
3977         } else if (cb->args[2] > 0) {
3978                 filter_wiphy = cb->args[2] - 1;
3979         }
3980
3981         for_each_rdev(rdev) {
3982                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3983                         continue;
3984                 if (wp_idx < wp_start) {
3985                         wp_idx++;
3986                         continue;
3987                 }
3988
3989                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3990                         continue;
3991
3992                 if_idx = 0;
3993
3994                 wiphy_lock(&rdev->wiphy);
3995                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3996                         if (if_idx < if_start) {
3997                                 if_idx++;
3998                                 continue;
3999                         }
4000                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4001                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
4002                                                rdev, wdev,
4003                                                NL80211_CMD_NEW_INTERFACE) < 0) {
4004                                 wiphy_unlock(&rdev->wiphy);
4005                                 goto out;
4006                         }
4007                         if_idx++;
4008                 }
4009                 wiphy_unlock(&rdev->wiphy);
4010
4011                 wp_idx++;
4012         }
4013  out:
4014         cb->args[0] = wp_idx;
4015         cb->args[1] = if_idx;
4016
4017         ret = skb->len;
4018  out_unlock:
4019         rtnl_unlock();
4020
4021         return ret;
4022 }
4023
4024 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4025 {
4026         struct sk_buff *msg;
4027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4028         struct wireless_dev *wdev = info->user_ptr[1];
4029
4030         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4031         if (!msg)
4032                 return -ENOMEM;
4033
4034         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4035                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4036                 nlmsg_free(msg);
4037                 return -ENOBUFS;
4038         }
4039
4040         return genlmsg_reply(msg, info);
4041 }
4042
4043 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4044         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4045         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4046         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4047         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4048         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4049         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4050 };
4051
4052 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4053 {
4054         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4055         int flag;
4056
4057         *mntrflags = 0;
4058
4059         if (!nla)
4060                 return -EINVAL;
4061
4062         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4063                 return -EINVAL;
4064
4065         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4066                 if (flags[flag])
4067                         *mntrflags |= (1<<flag);
4068
4069         *mntrflags |= MONITOR_FLAG_CHANGED;
4070
4071         return 0;
4072 }
4073
4074 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4075                                      enum nl80211_iftype type,
4076                                      struct genl_info *info,
4077                                      struct vif_params *params)
4078 {
4079         bool change = false;
4080         int err;
4081
4082         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4083                 if (type != NL80211_IFTYPE_MONITOR)
4084                         return -EINVAL;
4085
4086                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4087                                           &params->flags);
4088                 if (err)
4089                         return err;
4090
4091                 change = true;
4092         }
4093
4094         if (params->flags & MONITOR_FLAG_ACTIVE &&
4095             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4096                 return -EOPNOTSUPP;
4097
4098         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4099                 const u8 *mumimo_groups;
4100                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4101
4102                 if (type != NL80211_IFTYPE_MONITOR)
4103                         return -EINVAL;
4104
4105                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4106                         return -EOPNOTSUPP;
4107
4108                 mumimo_groups =
4109                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4110
4111                 /* bits 0 and 63 are reserved and must be zero */
4112                 if ((mumimo_groups[0] & BIT(0)) ||
4113                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4114                         return -EINVAL;
4115
4116                 params->vht_mumimo_groups = mumimo_groups;
4117                 change = true;
4118         }
4119
4120         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4121                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4122
4123                 if (type != NL80211_IFTYPE_MONITOR)
4124                         return -EINVAL;
4125
4126                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4127                         return -EOPNOTSUPP;
4128
4129                 params->vht_mumimo_follow_addr =
4130                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4131                 change = true;
4132         }
4133
4134         return change ? 1 : 0;
4135 }
4136
4137 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4138                                struct net_device *netdev, u8 use_4addr,
4139                                enum nl80211_iftype iftype)
4140 {
4141         if (!use_4addr) {
4142                 if (netdev && netif_is_bridge_port(netdev))
4143                         return -EBUSY;
4144                 return 0;
4145         }
4146
4147         switch (iftype) {
4148         case NL80211_IFTYPE_AP_VLAN:
4149                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4150                         return 0;
4151                 break;
4152         case NL80211_IFTYPE_STATION:
4153                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4154                         return 0;
4155                 break;
4156         default:
4157                 break;
4158         }
4159
4160         return -EOPNOTSUPP;
4161 }
4162
4163 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4164 {
4165         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4166         struct vif_params params;
4167         int err;
4168         enum nl80211_iftype otype, ntype;
4169         struct net_device *dev = info->user_ptr[1];
4170         bool change = false;
4171
4172         memset(&params, 0, sizeof(params));
4173
4174         otype = ntype = dev->ieee80211_ptr->iftype;
4175
4176         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4177                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4178                 if (otype != ntype)
4179                         change = true;
4180         }
4181
4182         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4183                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4184
4185                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4186                         return -EINVAL;
4187                 if (netif_running(dev))
4188                         return -EBUSY;
4189
4190                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4191                              IEEE80211_MAX_MESH_ID_LEN);
4192                 wdev->u.mesh.id_up_len =
4193                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4194                 memcpy(wdev->u.mesh.id,
4195                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4196                        wdev->u.mesh.id_up_len);
4197         }
4198
4199         if (info->attrs[NL80211_ATTR_4ADDR]) {
4200                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4201                 change = true;
4202                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4203                 if (err)
4204                         return err;
4205         } else {
4206                 params.use_4addr = -1;
4207         }
4208
4209         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4210         if (err < 0)
4211                 return err;
4212         if (err > 0)
4213                 change = true;
4214
4215         if (change)
4216                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4217         else
4218                 err = 0;
4219
4220         if (!err && params.use_4addr != -1)
4221                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4222
4223         if (change && !err) {
4224                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4225
4226                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4227         }
4228
4229         return err;
4230 }
4231
4232 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4233 {
4234         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4235         struct vif_params params;
4236         struct wireless_dev *wdev;
4237         struct sk_buff *msg;
4238         int err;
4239         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4240
4241         memset(&params, 0, sizeof(params));
4242
4243         if (!info->attrs[NL80211_ATTR_IFNAME])
4244                 return -EINVAL;
4245
4246         if (info->attrs[NL80211_ATTR_IFTYPE])
4247                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4248
4249         if (!rdev->ops->add_virtual_intf)
4250                 return -EOPNOTSUPP;
4251
4252         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4253              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4254             info->attrs[NL80211_ATTR_MAC]) {
4255                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4256                            ETH_ALEN);
4257                 if (!is_valid_ether_addr(params.macaddr))
4258                         return -EADDRNOTAVAIL;
4259         }
4260
4261         if (info->attrs[NL80211_ATTR_4ADDR]) {
4262                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4263                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4264                 if (err)
4265                         return err;
4266         }
4267
4268         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4269                 return -EOPNOTSUPP;
4270
4271         err = nl80211_parse_mon_options(rdev, type, info, &params);
4272         if (err < 0)
4273                 return err;
4274
4275         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4276         if (!msg)
4277                 return -ENOMEM;
4278
4279         wdev = rdev_add_virtual_intf(rdev,
4280                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4281                                 NET_NAME_USER, type, &params);
4282         if (WARN_ON(!wdev)) {
4283                 nlmsg_free(msg);
4284                 return -EPROTO;
4285         } else if (IS_ERR(wdev)) {
4286                 nlmsg_free(msg);
4287                 return PTR_ERR(wdev);
4288         }
4289
4290         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4291                 wdev->owner_nlportid = info->snd_portid;
4292
4293         switch (type) {
4294         case NL80211_IFTYPE_MESH_POINT:
4295                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4296                         break;
4297                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4298                              IEEE80211_MAX_MESH_ID_LEN);
4299                 wdev->u.mesh.id_up_len =
4300                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4301                 memcpy(wdev->u.mesh.id,
4302                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4303                        wdev->u.mesh.id_up_len);
4304                 break;
4305         case NL80211_IFTYPE_NAN:
4306         case NL80211_IFTYPE_P2P_DEVICE:
4307                 /*
4308                  * P2P Device and NAN do not have a netdev, so don't go
4309                  * through the netdev notifier and must be added here
4310                  */
4311                 cfg80211_init_wdev(wdev);
4312                 cfg80211_register_wdev(rdev, wdev);
4313                 break;
4314         default:
4315                 break;
4316         }
4317
4318         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4319                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4320                 nlmsg_free(msg);
4321                 return -ENOBUFS;
4322         }
4323
4324         return genlmsg_reply(msg, info);
4325 }
4326
4327 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4328 {
4329         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4330         int ret;
4331
4332         /* to avoid failing a new interface creation due to pending removal */
4333         cfg80211_destroy_ifaces(rdev);
4334
4335         wiphy_lock(&rdev->wiphy);
4336         ret = _nl80211_new_interface(skb, info);
4337         wiphy_unlock(&rdev->wiphy);
4338
4339         return ret;
4340 }
4341
4342 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4343 {
4344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4345         struct wireless_dev *wdev = info->user_ptr[1];
4346
4347         if (!rdev->ops->del_virtual_intf)
4348                 return -EOPNOTSUPP;
4349
4350         /*
4351          * We hold RTNL, so this is safe, without RTNL opencount cannot
4352          * reach 0, and thus the rdev cannot be deleted.
4353          *
4354          * We need to do it for the dev_close(), since that will call
4355          * the netdev notifiers, and we need to acquire the mutex there
4356          * but don't know if we get there from here or from some other
4357          * place (e.g. "ip link set ... down").
4358          */
4359         mutex_unlock(&rdev->wiphy.mtx);
4360
4361         /*
4362          * If we remove a wireless device without a netdev then clear
4363          * user_ptr[1] so that nl80211_post_doit won't dereference it
4364          * to check if it needs to do dev_put(). Otherwise it crashes
4365          * since the wdev has been freed, unlike with a netdev where
4366          * we need the dev_put() for the netdev to really be freed.
4367          */
4368         if (!wdev->netdev)
4369                 info->user_ptr[1] = NULL;
4370         else
4371                 dev_close(wdev->netdev);
4372
4373         mutex_lock(&rdev->wiphy.mtx);
4374
4375         return cfg80211_remove_virtual_intf(rdev, wdev);
4376 }
4377
4378 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4379 {
4380         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4381         struct net_device *dev = info->user_ptr[1];
4382         u16 noack_map;
4383
4384         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4385                 return -EINVAL;
4386
4387         if (!rdev->ops->set_noack_map)
4388                 return -EOPNOTSUPP;
4389
4390         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4391
4392         return rdev_set_noack_map(rdev, dev, noack_map);
4393 }
4394
4395 static int nl80211_validate_key_link_id(struct genl_info *info,
4396                                         struct wireless_dev *wdev,
4397                                         int link_id, bool pairwise)
4398 {
4399         if (pairwise) {
4400                 if (link_id != -1) {
4401                         GENL_SET_ERR_MSG(info,
4402                                          "link ID not allowed for pairwise key");
4403                         return -EINVAL;
4404                 }
4405
4406                 return 0;
4407         }
4408
4409         if (wdev->valid_links) {
4410                 if (link_id == -1) {
4411                         GENL_SET_ERR_MSG(info,
4412                                          "link ID must for MLO group key");
4413                         return -EINVAL;
4414                 }
4415                 if (!(wdev->valid_links & BIT(link_id))) {
4416                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4417                         return -EINVAL;
4418                 }
4419         } else if (link_id != -1) {
4420                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4421                 return -EINVAL;
4422         }
4423
4424         return 0;
4425 }
4426
4427 struct get_key_cookie {
4428         struct sk_buff *msg;
4429         int error;
4430         int idx;
4431 };
4432
4433 static void get_key_callback(void *c, struct key_params *params)
4434 {
4435         struct nlattr *key;
4436         struct get_key_cookie *cookie = c;
4437
4438         if ((params->key &&
4439              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4440                      params->key_len, params->key)) ||
4441             (params->seq &&
4442              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4443                      params->seq_len, params->seq)) ||
4444             (params->cipher &&
4445              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4446                          params->cipher)))
4447                 goto nla_put_failure;
4448
4449         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4450         if (!key)
4451                 goto nla_put_failure;
4452
4453         if ((params->key &&
4454              nla_put(cookie->msg, NL80211_KEY_DATA,
4455                      params->key_len, params->key)) ||
4456             (params->seq &&
4457              nla_put(cookie->msg, NL80211_KEY_SEQ,
4458                      params->seq_len, params->seq)) ||
4459             (params->cipher &&
4460              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4461                          params->cipher)))
4462                 goto nla_put_failure;
4463
4464         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4465                 goto nla_put_failure;
4466
4467         nla_nest_end(cookie->msg, key);
4468
4469         return;
4470  nla_put_failure:
4471         cookie->error = 1;
4472 }
4473
4474 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4475 {
4476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4477         int err;
4478         struct net_device *dev = info->user_ptr[1];
4479         u8 key_idx = 0;
4480         const u8 *mac_addr = NULL;
4481         bool pairwise;
4482         struct get_key_cookie cookie = {
4483                 .error = 0,
4484         };
4485         void *hdr;
4486         struct sk_buff *msg;
4487         bool bigtk_support = false;
4488         int link_id = nl80211_link_id_or_invalid(info->attrs);
4489         struct wireless_dev *wdev = dev->ieee80211_ptr;
4490
4491         if (wiphy_ext_feature_isset(&rdev->wiphy,
4492                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4493                 bigtk_support = true;
4494
4495         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4496              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4497             wiphy_ext_feature_isset(&rdev->wiphy,
4498                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4499                 bigtk_support = true;
4500
4501         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4502                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4503
4504                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4505                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4506                         return -EINVAL;
4507                 }
4508         }
4509
4510         if (info->attrs[NL80211_ATTR_MAC])
4511                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4512
4513         pairwise = !!mac_addr;
4514         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4515                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4516
4517                 if (kt != NL80211_KEYTYPE_GROUP &&
4518                     kt != NL80211_KEYTYPE_PAIRWISE)
4519                         return -EINVAL;
4520                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4521         }
4522
4523         if (!rdev->ops->get_key)
4524                 return -EOPNOTSUPP;
4525
4526         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4527                 return -ENOENT;
4528
4529         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4530         if (!msg)
4531                 return -ENOMEM;
4532
4533         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4534                              NL80211_CMD_NEW_KEY);
4535         if (!hdr)
4536                 goto nla_put_failure;
4537
4538         cookie.msg = msg;
4539         cookie.idx = key_idx;
4540
4541         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4542             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4543                 goto nla_put_failure;
4544         if (mac_addr &&
4545             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4546                 goto nla_put_failure;
4547
4548         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4549         if (err)
4550                 goto free_msg;
4551
4552         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4553                            &cookie, get_key_callback);
4554
4555         if (err)
4556                 goto free_msg;
4557
4558         if (cookie.error)
4559                 goto nla_put_failure;
4560
4561         genlmsg_end(msg, hdr);
4562         return genlmsg_reply(msg, info);
4563
4564  nla_put_failure:
4565         err = -ENOBUFS;
4566  free_msg:
4567         nlmsg_free(msg);
4568         return err;
4569 }
4570
4571 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4572 {
4573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4574         struct key_parse key;
4575         int err;
4576         struct net_device *dev = info->user_ptr[1];
4577         int link_id = nl80211_link_id_or_invalid(info->attrs);
4578         struct wireless_dev *wdev = dev->ieee80211_ptr;
4579
4580         err = nl80211_parse_key(info, &key);
4581         if (err)
4582                 return err;
4583
4584         if (key.idx < 0)
4585                 return -EINVAL;
4586
4587         /* Only support setting default key and
4588          * Extended Key ID action NL80211_KEY_SET_TX.
4589          */
4590         if (!key.def && !key.defmgmt && !key.defbeacon &&
4591             !(key.p.mode == NL80211_KEY_SET_TX))
4592                 return -EINVAL;
4593
4594         if (key.def) {
4595                 if (!rdev->ops->set_default_key)
4596                         return -EOPNOTSUPP;
4597
4598                 err = nl80211_key_allowed(wdev);
4599                 if (err)
4600                         return err;
4601
4602                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4603                 if (err)
4604                         return err;
4605
4606                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4607                                            key.def_uni, key.def_multi);
4608
4609                 if (err)
4610                         return err;
4611
4612 #ifdef CONFIG_CFG80211_WEXT
4613                 wdev->wext.default_key = key.idx;
4614 #endif
4615                 return 0;
4616         } else if (key.defmgmt) {
4617                 if (key.def_uni || !key.def_multi)
4618                         return -EINVAL;
4619
4620                 if (!rdev->ops->set_default_mgmt_key)
4621                         return -EOPNOTSUPP;
4622
4623                 err = nl80211_key_allowed(wdev);
4624                 if (err)
4625                         return err;
4626
4627                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4628                 if (err)
4629                         return err;
4630
4631                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4632                 if (err)
4633                         return err;
4634
4635 #ifdef CONFIG_CFG80211_WEXT
4636                 wdev->wext.default_mgmt_key = key.idx;
4637 #endif
4638                 return 0;
4639         } else if (key.defbeacon) {
4640                 if (key.def_uni || !key.def_multi)
4641                         return -EINVAL;
4642
4643                 if (!rdev->ops->set_default_beacon_key)
4644                         return -EOPNOTSUPP;
4645
4646                 err = nl80211_key_allowed(wdev);
4647                 if (err)
4648                         return err;
4649
4650                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4651                 if (err)
4652                         return err;
4653
4654                 return rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4655         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4656                    wiphy_ext_feature_isset(&rdev->wiphy,
4657                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4658                 u8 *mac_addr = NULL;
4659
4660                 if (info->attrs[NL80211_ATTR_MAC])
4661                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4662
4663                 if (!mac_addr || key.idx < 0 || key.idx > 1)
4664                         return -EINVAL;
4665
4666                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4667                 if (err)
4668                         return err;
4669
4670                 return rdev_add_key(rdev, dev, link_id, key.idx,
4671                                     NL80211_KEYTYPE_PAIRWISE,
4672                                     mac_addr, &key.p);
4673         }
4674
4675         return -EINVAL;
4676 }
4677
4678 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4679 {
4680         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4681         int err;
4682         struct net_device *dev = info->user_ptr[1];
4683         struct key_parse key;
4684         const u8 *mac_addr = NULL;
4685         int link_id = nl80211_link_id_or_invalid(info->attrs);
4686         struct wireless_dev *wdev = dev->ieee80211_ptr;
4687
4688         err = nl80211_parse_key(info, &key);
4689         if (err)
4690                 return err;
4691
4692         if (!key.p.key) {
4693                 GENL_SET_ERR_MSG(info, "no key");
4694                 return -EINVAL;
4695         }
4696
4697         if (info->attrs[NL80211_ATTR_MAC])
4698                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4699
4700         if (key.type == -1) {
4701                 if (mac_addr)
4702                         key.type = NL80211_KEYTYPE_PAIRWISE;
4703                 else
4704                         key.type = NL80211_KEYTYPE_GROUP;
4705         }
4706
4707         /* for now */
4708         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4709             key.type != NL80211_KEYTYPE_GROUP) {
4710                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4711                 return -EINVAL;
4712         }
4713
4714         if (key.type == NL80211_KEYTYPE_GROUP &&
4715             info->attrs[NL80211_ATTR_VLAN_ID])
4716                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4717
4718         if (!rdev->ops->add_key)
4719                 return -EOPNOTSUPP;
4720
4721         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4722                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4723                                            mac_addr)) {
4724                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4725                 return -EINVAL;
4726         }
4727
4728         err = nl80211_key_allowed(wdev);
4729         if (err)
4730                 GENL_SET_ERR_MSG(info, "key not allowed");
4731
4732         if (!err)
4733                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4734                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4735
4736         if (!err) {
4737                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4738                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4739                                     mac_addr, &key.p);
4740                 if (err)
4741                         GENL_SET_ERR_MSG(info, "key addition failed");
4742         }
4743
4744         return err;
4745 }
4746
4747 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4748 {
4749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4750         int err;
4751         struct net_device *dev = info->user_ptr[1];
4752         u8 *mac_addr = NULL;
4753         struct key_parse key;
4754         int link_id = nl80211_link_id_or_invalid(info->attrs);
4755         struct wireless_dev *wdev = dev->ieee80211_ptr;
4756
4757         err = nl80211_parse_key(info, &key);
4758         if (err)
4759                 return err;
4760
4761         if (info->attrs[NL80211_ATTR_MAC])
4762                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4763
4764         if (key.type == -1) {
4765                 if (mac_addr)
4766                         key.type = NL80211_KEYTYPE_PAIRWISE;
4767                 else
4768                         key.type = NL80211_KEYTYPE_GROUP;
4769         }
4770
4771         /* for now */
4772         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4773             key.type != NL80211_KEYTYPE_GROUP)
4774                 return -EINVAL;
4775
4776         if (!cfg80211_valid_key_idx(rdev, key.idx,
4777                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4778                 return -EINVAL;
4779
4780         if (!rdev->ops->del_key)
4781                 return -EOPNOTSUPP;
4782
4783         err = nl80211_key_allowed(wdev);
4784
4785         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4786             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4787                 err = -ENOENT;
4788
4789         if (!err)
4790                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4791                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4792
4793         if (!err)
4794                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4795                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4796                                    mac_addr);
4797
4798 #ifdef CONFIG_CFG80211_WEXT
4799         if (!err) {
4800                 if (key.idx == wdev->wext.default_key)
4801                         wdev->wext.default_key = -1;
4802                 else if (key.idx == wdev->wext.default_mgmt_key)
4803                         wdev->wext.default_mgmt_key = -1;
4804         }
4805 #endif
4806
4807         return err;
4808 }
4809
4810 /* This function returns an error or the number of nested attributes */
4811 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4812 {
4813         struct nlattr *attr;
4814         int n_entries = 0, tmp;
4815
4816         nla_for_each_nested(attr, nl_attr, tmp) {
4817                 if (nla_len(attr) != ETH_ALEN)
4818                         return -EINVAL;
4819
4820                 n_entries++;
4821         }
4822
4823         return n_entries;
4824 }
4825
4826 /*
4827  * This function parses ACL information and allocates memory for ACL data.
4828  * On successful return, the calling function is responsible to free the
4829  * ACL buffer returned by this function.
4830  */
4831 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4832                                                 struct genl_info *info)
4833 {
4834         enum nl80211_acl_policy acl_policy;
4835         struct nlattr *attr;
4836         struct cfg80211_acl_data *acl;
4837         int i = 0, n_entries, tmp;
4838
4839         if (!wiphy->max_acl_mac_addrs)
4840                 return ERR_PTR(-EOPNOTSUPP);
4841
4842         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4843                 return ERR_PTR(-EINVAL);
4844
4845         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4846         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4847             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4848                 return ERR_PTR(-EINVAL);
4849
4850         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4851                 return ERR_PTR(-EINVAL);
4852
4853         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4854         if (n_entries < 0)
4855                 return ERR_PTR(n_entries);
4856
4857         if (n_entries > wiphy->max_acl_mac_addrs)
4858                 return ERR_PTR(-ENOTSUPP);
4859
4860         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4861         if (!acl)
4862                 return ERR_PTR(-ENOMEM);
4863         acl->n_acl_entries = n_entries;
4864
4865         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4866                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4867                 i++;
4868         }
4869         acl->acl_policy = acl_policy;
4870
4871         return acl;
4872 }
4873
4874 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4875 {
4876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4877         struct net_device *dev = info->user_ptr[1];
4878         struct cfg80211_acl_data *acl;
4879         int err;
4880
4881         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4882             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4883                 return -EOPNOTSUPP;
4884
4885         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4886                 return -EINVAL;
4887
4888         acl = parse_acl_data(&rdev->wiphy, info);
4889         if (IS_ERR(acl))
4890                 return PTR_ERR(acl);
4891
4892         err = rdev_set_mac_acl(rdev, dev, acl);
4893
4894         kfree(acl);
4895
4896         return err;
4897 }
4898
4899 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4900                            u8 *rates, u8 rates_len)
4901 {
4902         u8 i;
4903         u32 mask = 0;
4904
4905         for (i = 0; i < rates_len; i++) {
4906                 int rate = (rates[i] & 0x7f) * 5;
4907                 int ridx;
4908
4909                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4910                         struct ieee80211_rate *srate =
4911                                 &sband->bitrates[ridx];
4912                         if (rate == srate->bitrate) {
4913                                 mask |= 1 << ridx;
4914                                 break;
4915                         }
4916                 }
4917                 if (ridx == sband->n_bitrates)
4918                         return 0; /* rate not found */
4919         }
4920
4921         return mask;
4922 }
4923
4924 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4925                                u8 *rates, u8 rates_len,
4926                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4927 {
4928         u8 i;
4929
4930         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4931
4932         for (i = 0; i < rates_len; i++) {
4933                 int ridx, rbit;
4934
4935                 ridx = rates[i] / 8;
4936                 rbit = BIT(rates[i] % 8);
4937
4938                 /* check validity */
4939                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4940                         return false;
4941
4942                 /* check availability */
4943                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4944                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4945                         mcs[ridx] |= rbit;
4946                 else
4947                         return false;
4948         }
4949
4950         return true;
4951 }
4952
4953 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4954 {
4955         u16 mcs_mask = 0;
4956
4957         switch (vht_mcs_map) {
4958         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4959                 break;
4960         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4961                 mcs_mask = 0x00FF;
4962                 break;
4963         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4964                 mcs_mask = 0x01FF;
4965                 break;
4966         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4967                 mcs_mask = 0x03FF;
4968                 break;
4969         default:
4970                 break;
4971         }
4972
4973         return mcs_mask;
4974 }
4975
4976 static void vht_build_mcs_mask(u16 vht_mcs_map,
4977                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4978 {
4979         u8 nss;
4980
4981         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4982                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4983                 vht_mcs_map >>= 2;
4984         }
4985 }
4986
4987 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4988                              struct nl80211_txrate_vht *txrate,
4989                              u16 mcs[NL80211_VHT_NSS_MAX])
4990 {
4991         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4992         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4993         u8 i;
4994
4995         if (!sband->vht_cap.vht_supported)
4996                 return false;
4997
4998         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4999
5000         /* Build vht_mcs_mask from VHT capabilities */
5001         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5002
5003         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5004                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5005                         mcs[i] = txrate->mcs[i];
5006                 else
5007                         return false;
5008         }
5009
5010         return true;
5011 }
5012
5013 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5014 {
5015         switch (he_mcs_map) {
5016         case IEEE80211_HE_MCS_NOT_SUPPORTED:
5017                 return 0;
5018         case IEEE80211_HE_MCS_SUPPORT_0_7:
5019                 return 0x00FF;
5020         case IEEE80211_HE_MCS_SUPPORT_0_9:
5021                 return 0x03FF;
5022         case IEEE80211_HE_MCS_SUPPORT_0_11:
5023                 return 0xFFF;
5024         default:
5025                 break;
5026         }
5027         return 0;
5028 }
5029
5030 static void he_build_mcs_mask(u16 he_mcs_map,
5031                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5032 {
5033         u8 nss;
5034
5035         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5036                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5037                 he_mcs_map >>= 2;
5038         }
5039 }
5040
5041 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5042                            const struct ieee80211_sta_he_cap *he_cap)
5043 {
5044         struct net_device *dev = info->user_ptr[1];
5045         struct wireless_dev *wdev = dev->ieee80211_ptr;
5046         struct cfg80211_chan_def *chandef;
5047         __le16 tx_mcs;
5048
5049         chandef = wdev_chandef(wdev, link_id);
5050         if (!chandef) {
5051                 /*
5052                  * This is probably broken, but we never maintained
5053                  * a chandef in these cases, so it always was.
5054                  */
5055                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5056         }
5057
5058         switch (chandef->width) {
5059         case NL80211_CHAN_WIDTH_80P80:
5060                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5061                 break;
5062         case NL80211_CHAN_WIDTH_160:
5063                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5064                 break;
5065         default:
5066                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5067                 break;
5068         }
5069
5070         return le16_to_cpu(tx_mcs);
5071 }
5072
5073 static bool he_set_mcs_mask(struct genl_info *info,
5074                             struct wireless_dev *wdev,
5075                             struct ieee80211_supported_band *sband,
5076                             struct nl80211_txrate_he *txrate,
5077                             u16 mcs[NL80211_HE_NSS_MAX],
5078                             unsigned int link_id)
5079 {
5080         const struct ieee80211_sta_he_cap *he_cap;
5081         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5082         u16 tx_mcs_map = 0;
5083         u8 i;
5084
5085         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5086         if (!he_cap)
5087                 return false;
5088
5089         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5090
5091         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5092
5093         /* Build he_mcs_mask from HE capabilities */
5094         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5095
5096         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5097                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5098                         mcs[i] = txrate->mcs[i];
5099                 else
5100                         return false;
5101         }
5102
5103         return true;
5104 }
5105
5106 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5107                                          struct nlattr *attrs[],
5108                                          enum nl80211_attrs attr,
5109                                          struct cfg80211_bitrate_mask *mask,
5110                                          struct net_device *dev,
5111                                          bool default_all_enabled,
5112                                          unsigned int link_id)
5113 {
5114         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5115         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5116         struct wireless_dev *wdev = dev->ieee80211_ptr;
5117         int rem, i;
5118         struct nlattr *tx_rates;
5119         struct ieee80211_supported_band *sband;
5120         u16 vht_tx_mcs_map, he_tx_mcs_map;
5121
5122         memset(mask, 0, sizeof(*mask));
5123         /* Default to all rates enabled */
5124         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5125                 const struct ieee80211_sta_he_cap *he_cap;
5126
5127                 if (!default_all_enabled)
5128                         break;
5129
5130                 sband = rdev->wiphy.bands[i];
5131
5132                 if (!sband)
5133                         continue;
5134
5135                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5136                 memcpy(mask->control[i].ht_mcs,
5137                        sband->ht_cap.mcs.rx_mask,
5138                        sizeof(mask->control[i].ht_mcs));
5139
5140                 if (sband->vht_cap.vht_supported) {
5141                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5142                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5143                 }
5144
5145                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5146                 if (!he_cap)
5147                         continue;
5148
5149                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5150                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5151
5152                 mask->control[i].he_gi = 0xFF;
5153                 mask->control[i].he_ltf = 0xFF;
5154         }
5155
5156         /* if no rates are given set it back to the defaults */
5157         if (!attrs[attr])
5158                 goto out;
5159
5160         /* The nested attribute uses enum nl80211_band as the index. This maps
5161          * directly to the enum nl80211_band values used in cfg80211.
5162          */
5163         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5164         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5165                 enum nl80211_band band = nla_type(tx_rates);
5166                 int err;
5167
5168                 if (band < 0 || band >= NUM_NL80211_BANDS)
5169                         return -EINVAL;
5170                 sband = rdev->wiphy.bands[band];
5171                 if (sband == NULL)
5172                         return -EINVAL;
5173                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5174                                                   tx_rates,
5175                                                   nl80211_txattr_policy,
5176                                                   info->extack);
5177                 if (err)
5178                         return err;
5179                 if (tb[NL80211_TXRATE_LEGACY]) {
5180                         mask->control[band].legacy = rateset_to_mask(
5181                                 sband,
5182                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5183                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5184                         if ((mask->control[band].legacy == 0) &&
5185                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5186                                 return -EINVAL;
5187                 }
5188                 if (tb[NL80211_TXRATE_HT]) {
5189                         if (!ht_rateset_to_mask(
5190                                         sband,
5191                                         nla_data(tb[NL80211_TXRATE_HT]),
5192                                         nla_len(tb[NL80211_TXRATE_HT]),
5193                                         mask->control[band].ht_mcs))
5194                                 return -EINVAL;
5195                 }
5196
5197                 if (tb[NL80211_TXRATE_VHT]) {
5198                         if (!vht_set_mcs_mask(
5199                                         sband,
5200                                         nla_data(tb[NL80211_TXRATE_VHT]),
5201                                         mask->control[band].vht_mcs))
5202                                 return -EINVAL;
5203                 }
5204
5205                 if (tb[NL80211_TXRATE_GI]) {
5206                         mask->control[band].gi =
5207                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5208                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5209                                 return -EINVAL;
5210                 }
5211                 if (tb[NL80211_TXRATE_HE] &&
5212                     !he_set_mcs_mask(info, wdev, sband,
5213                                      nla_data(tb[NL80211_TXRATE_HE]),
5214                                      mask->control[band].he_mcs,
5215                                      link_id))
5216                         return -EINVAL;
5217
5218                 if (tb[NL80211_TXRATE_HE_GI])
5219                         mask->control[band].he_gi =
5220                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5221                 if (tb[NL80211_TXRATE_HE_LTF])
5222                         mask->control[band].he_ltf =
5223                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5224
5225                 if (mask->control[band].legacy == 0) {
5226                         /* don't allow empty legacy rates if HT, VHT or HE
5227                          * are not even supported.
5228                          */
5229                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5230                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5231                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5232                                 return -EINVAL;
5233
5234                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5235                                 if (mask->control[band].ht_mcs[i])
5236                                         goto out;
5237
5238                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5239                                 if (mask->control[band].vht_mcs[i])
5240                                         goto out;
5241
5242                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5243                                 if (mask->control[band].he_mcs[i])
5244                                         goto out;
5245
5246                         /* legacy and mcs rates may not be both empty */
5247                         return -EINVAL;
5248                 }
5249         }
5250
5251 out:
5252         return 0;
5253 }
5254
5255 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5256                                    enum nl80211_band band,
5257                                    struct cfg80211_bitrate_mask *beacon_rate)
5258 {
5259         u32 count_ht, count_vht, count_he, i;
5260         u32 rate = beacon_rate->control[band].legacy;
5261
5262         /* Allow only one rate */
5263         if (hweight32(rate) > 1)
5264                 return -EINVAL;
5265
5266         count_ht = 0;
5267         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5268                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5269                         return -EINVAL;
5270                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5271                         count_ht++;
5272                         if (count_ht > 1)
5273                                 return -EINVAL;
5274                 }
5275                 if (count_ht && rate)
5276                         return -EINVAL;
5277         }
5278
5279         count_vht = 0;
5280         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5281                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5282                         return -EINVAL;
5283                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5284                         count_vht++;
5285                         if (count_vht > 1)
5286                                 return -EINVAL;
5287                 }
5288                 if (count_vht && rate)
5289                         return -EINVAL;
5290         }
5291
5292         count_he = 0;
5293         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5294                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5295                         return -EINVAL;
5296                 } else if (beacon_rate->control[band].he_mcs[i]) {
5297                         count_he++;
5298                         if (count_he > 1)
5299                                 return -EINVAL;
5300                 }
5301                 if (count_he && rate)
5302                         return -EINVAL;
5303         }
5304
5305         if ((count_ht && count_vht && count_he) ||
5306             (!rate && !count_ht && !count_vht && !count_he))
5307                 return -EINVAL;
5308
5309         if (rate &&
5310             !wiphy_ext_feature_isset(&rdev->wiphy,
5311                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5312                 return -EINVAL;
5313         if (count_ht &&
5314             !wiphy_ext_feature_isset(&rdev->wiphy,
5315                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5316                 return -EINVAL;
5317         if (count_vht &&
5318             !wiphy_ext_feature_isset(&rdev->wiphy,
5319                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5320                 return -EINVAL;
5321         if (count_he &&
5322             !wiphy_ext_feature_isset(&rdev->wiphy,
5323                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5324                 return -EINVAL;
5325
5326         return 0;
5327 }
5328
5329 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5330                                        struct net_device *dev,
5331                                        struct nlattr *attrs,
5332                                        struct cfg80211_mbssid_config *config,
5333                                        u8 num_elems)
5334 {
5335         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5336
5337         if (!wiphy->mbssid_max_interfaces)
5338                 return -EOPNOTSUPP;
5339
5340         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5341                              NULL) ||
5342             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5343                 return -EINVAL;
5344
5345         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5346         if (config->ema) {
5347                 if (!wiphy->ema_max_profile_periodicity)
5348                         return -EOPNOTSUPP;
5349
5350                 if (num_elems > wiphy->ema_max_profile_periodicity)
5351                         return -EINVAL;
5352         }
5353
5354         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5355         if (config->index >= wiphy->mbssid_max_interfaces ||
5356             (!config->index && !num_elems))
5357                 return -EINVAL;
5358
5359         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5360                 u32 tx_ifindex =
5361                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5362
5363                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5364                     (config->index && tx_ifindex == dev->ifindex))
5365                         return -EINVAL;
5366
5367                 if (tx_ifindex != dev->ifindex) {
5368                         struct net_device *tx_netdev =
5369                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5370
5371                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5372                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5373                             tx_netdev->ieee80211_ptr->iftype !=
5374                                                         NL80211_IFTYPE_AP) {
5375                                 dev_put(tx_netdev);
5376                                 return -EINVAL;
5377                         }
5378
5379                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5380                 } else {
5381                         config->tx_wdev = dev->ieee80211_ptr;
5382                 }
5383         } else if (!config->index) {
5384                 config->tx_wdev = dev->ieee80211_ptr;
5385         } else {
5386                 return -EINVAL;
5387         }
5388
5389         return 0;
5390 }
5391
5392 static struct cfg80211_mbssid_elems *
5393 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5394 {
5395         struct nlattr *nl_elems;
5396         struct cfg80211_mbssid_elems *elems;
5397         int rem_elems;
5398         u8 i = 0, num_elems = 0;
5399
5400         if (!wiphy->mbssid_max_interfaces)
5401                 return ERR_PTR(-EINVAL);
5402
5403         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5404                 if (num_elems >= 255)
5405                         return ERR_PTR(-EINVAL);
5406                 num_elems++;
5407         }
5408
5409         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5410         if (!elems)
5411                 return ERR_PTR(-ENOMEM);
5412         elems->cnt = num_elems;
5413
5414         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5415                 elems->elem[i].data = nla_data(nl_elems);
5416                 elems->elem[i].len = nla_len(nl_elems);
5417                 i++;
5418         }
5419         return elems;
5420 }
5421
5422 static struct cfg80211_rnr_elems *
5423 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5424                         struct netlink_ext_ack *extack)
5425 {
5426         struct nlattr *nl_elems;
5427         struct cfg80211_rnr_elems *elems;
5428         int rem_elems;
5429         u8 i = 0, num_elems = 0;
5430
5431         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5432                 int ret;
5433
5434                 ret = validate_ie_attr(nl_elems, extack);
5435                 if (ret)
5436                         return ERR_PTR(ret);
5437
5438                 num_elems++;
5439         }
5440
5441         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5442         if (!elems)
5443                 return ERR_PTR(-ENOMEM);
5444         elems->cnt = num_elems;
5445
5446         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5447                 elems->elem[i].data = nla_data(nl_elems);
5448                 elems->elem[i].len = nla_len(nl_elems);
5449                 i++;
5450         }
5451         return elems;
5452 }
5453
5454 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5455                                       struct cfg80211_he_bss_color *he_bss_color)
5456 {
5457         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5458         int err;
5459
5460         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5461                                he_bss_color_policy, NULL);
5462         if (err)
5463                 return err;
5464
5465         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5466                 return -EINVAL;
5467
5468         he_bss_color->color =
5469                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5470         he_bss_color->enabled =
5471                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5472         he_bss_color->partial =
5473                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5474
5475         return 0;
5476 }
5477
5478 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5479                                 struct nlattr *attrs[],
5480                                 struct cfg80211_beacon_data *bcn,
5481                                 struct netlink_ext_ack *extack)
5482 {
5483         bool haveinfo = false;
5484         int err;
5485
5486         memset(bcn, 0, sizeof(*bcn));
5487
5488         bcn->link_id = nl80211_link_id(attrs);
5489
5490         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5491                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5492                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5493                 if (!bcn->head_len)
5494                         return -EINVAL;
5495                 haveinfo = true;
5496         }
5497
5498         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5499                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5500                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5501                 haveinfo = true;
5502         }
5503
5504         if (!haveinfo)
5505                 return -EINVAL;
5506
5507         if (attrs[NL80211_ATTR_IE]) {
5508                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5509                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5510         }
5511
5512         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5513                 bcn->proberesp_ies =
5514                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5515                 bcn->proberesp_ies_len =
5516                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5517         }
5518
5519         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5520                 bcn->assocresp_ies =
5521                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5522                 bcn->assocresp_ies_len =
5523                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5524         }
5525
5526         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5527                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5528                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5529         }
5530
5531         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5532                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5533
5534                 err = nla_parse_nested_deprecated(tb,
5535                                                   NL80211_FTM_RESP_ATTR_MAX,
5536                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5537                                                   NULL, NULL);
5538                 if (err)
5539                         return err;
5540
5541                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5542                     wiphy_ext_feature_isset(&rdev->wiphy,
5543                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5544                         bcn->ftm_responder = 1;
5545                 else
5546                         return -EOPNOTSUPP;
5547
5548                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5549                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5550                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5551                 }
5552
5553                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5554                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5555                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5556                 }
5557         } else {
5558                 bcn->ftm_responder = -1;
5559         }
5560
5561         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5562                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5563                                                  &bcn->he_bss_color);
5564                 if (err)
5565                         return err;
5566                 bcn->he_bss_color_valid = true;
5567         }
5568
5569         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5570                 struct cfg80211_mbssid_elems *mbssid =
5571                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5572                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5573
5574                 if (IS_ERR(mbssid))
5575                         return PTR_ERR(mbssid);
5576
5577                 bcn->mbssid_ies = mbssid;
5578
5579                 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5580                         struct cfg80211_rnr_elems *rnr =
5581                                 nl80211_parse_rnr_elems(&rdev->wiphy,
5582                                                         attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5583                                                         extack);
5584
5585                         if (IS_ERR(rnr))
5586                                 return PTR_ERR(rnr);
5587
5588                         if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5589                                 return -EINVAL;
5590
5591                         bcn->rnr_ies = rnr;
5592                 }
5593         }
5594
5595         return 0;
5596 }
5597
5598 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5599                                     struct ieee80211_he_obss_pd *he_obss_pd)
5600 {
5601         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5602         int err;
5603
5604         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5605                                he_obss_pd_policy, NULL);
5606         if (err)
5607                 return err;
5608
5609         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5610                 return -EINVAL;
5611
5612         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5613
5614         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5615                 he_obss_pd->min_offset =
5616                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5617         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5618                 he_obss_pd->max_offset =
5619                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5620         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5621                 he_obss_pd->non_srg_max_offset =
5622                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5623
5624         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5625                 return -EINVAL;
5626
5627         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5628                 memcpy(he_obss_pd->bss_color_bitmap,
5629                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5630                        sizeof(he_obss_pd->bss_color_bitmap));
5631
5632         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5633                 memcpy(he_obss_pd->partial_bssid_bitmap,
5634                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5635                        sizeof(he_obss_pd->partial_bssid_bitmap));
5636
5637         he_obss_pd->enable = true;
5638
5639         return 0;
5640 }
5641
5642 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5643                                         struct nlattr *attrs,
5644                                         struct cfg80211_fils_discovery *fd)
5645 {
5646         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5647         int ret;
5648
5649         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5650                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5651                 return -EINVAL;
5652
5653         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5654                                NULL, NULL);
5655         if (ret)
5656                 return ret;
5657
5658         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] &&
5659             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] &&
5660             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]) {
5661                 fd->update = true;
5662                 return 0;
5663         }
5664
5665         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5666             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5667             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5668                 return -EINVAL;
5669
5670         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5671         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5672         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5673         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5674         fd->update = true;
5675         return 0;
5676 }
5677
5678 static int
5679 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5680                                      struct nlattr *attrs,
5681                                      struct cfg80211_unsol_bcast_probe_resp *presp)
5682 {
5683         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5684         int ret;
5685
5686         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5687                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5688                 return -EINVAL;
5689
5690         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5691                                attrs, NULL, NULL);
5692         if (ret)
5693                 return ret;
5694
5695         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] &&
5696             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]) {
5697                 presp->update = true;
5698                 return 0;
5699         }
5700
5701         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5702             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5703                 return -EINVAL;
5704
5705         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5706         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5707         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5708         presp->update = true;
5709         return 0;
5710 }
5711
5712 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5713                                             const struct element *rates)
5714 {
5715         int i;
5716
5717         if (!rates)
5718                 return;
5719
5720         for (i = 0; i < rates->datalen; i++) {
5721                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5722                         params->ht_required = true;
5723                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5724                         params->vht_required = true;
5725                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5726                         params->he_required = true;
5727                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5728                         params->sae_h2e_required = true;
5729         }
5730 }
5731
5732 /*
5733  * Since the nl80211 API didn't include, from the beginning, attributes about
5734  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5735  * benefit of drivers that rebuild IEs in the firmware.
5736  */
5737 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5738 {
5739         const struct cfg80211_beacon_data *bcn = &params->beacon;
5740         size_t ies_len = bcn->tail_len;
5741         const u8 *ies = bcn->tail;
5742         const struct element *rates;
5743         const struct element *cap;
5744
5745         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5746         nl80211_check_ap_rate_selectors(params, rates);
5747
5748         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5749         nl80211_check_ap_rate_selectors(params, rates);
5750
5751         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5752         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5753                 params->ht_cap = (void *)cap->data;
5754         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5755         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5756                 params->vht_cap = (void *)cap->data;
5757         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5758         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5759                 params->he_cap = (void *)(cap->data + 1);
5760         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5761         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5762                 params->he_oper = (void *)(cap->data + 1);
5763         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5764         if (cap) {
5765                 if (!cap->datalen)
5766                         return -EINVAL;
5767                 params->eht_cap = (void *)(cap->data + 1);
5768                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5769                                                 (const u8 *)params->eht_cap,
5770                                                 cap->datalen - 1, true))
5771                         return -EINVAL;
5772         }
5773         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5774         if (cap) {
5775                 if (!cap->datalen)
5776                         return -EINVAL;
5777                 params->eht_oper = (void *)(cap->data + 1);
5778                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5779                                                 cap->datalen - 1))
5780                         return -EINVAL;
5781         }
5782         return 0;
5783 }
5784
5785 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5786                                    struct cfg80211_ap_settings *params)
5787 {
5788         struct wireless_dev *wdev;
5789
5790         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5791                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5792                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5793                         continue;
5794
5795                 if (!wdev->u.ap.preset_chandef.chan)
5796                         continue;
5797
5798                 params->chandef = wdev->u.ap.preset_chandef;
5799                 return true;
5800         }
5801
5802         return false;
5803 }
5804
5805 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5806                                     enum nl80211_auth_type auth_type,
5807                                     enum nl80211_commands cmd)
5808 {
5809         if (auth_type > NL80211_AUTHTYPE_MAX)
5810                 return false;
5811
5812         switch (cmd) {
5813         case NL80211_CMD_AUTHENTICATE:
5814                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5815                     auth_type == NL80211_AUTHTYPE_SAE)
5816                         return false;
5817                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5818                                              NL80211_EXT_FEATURE_FILS_STA) &&
5819                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5820                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5821                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5822                         return false;
5823                 return true;
5824         case NL80211_CMD_CONNECT:
5825                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5826                     !wiphy_ext_feature_isset(&rdev->wiphy,
5827                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5828                     auth_type == NL80211_AUTHTYPE_SAE)
5829                         return false;
5830
5831                 /* FILS with SK PFS or PK not supported yet */
5832                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5833                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5834                         return false;
5835                 if (!wiphy_ext_feature_isset(
5836                             &rdev->wiphy,
5837                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5838                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5839                         return false;
5840                 return true;
5841         case NL80211_CMD_START_AP:
5842                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5843                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5844                     auth_type == NL80211_AUTHTYPE_SAE)
5845                         return false;
5846                 /* FILS not supported yet */
5847                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5848                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5849                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5850                         return false;
5851                 return true;
5852         default:
5853                 return false;
5854         }
5855 }
5856
5857 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5858                                     unsigned int link_id)
5859 {
5860         struct wiphy *wiphy = wdev->wiphy;
5861         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5862         struct sk_buff *msg;
5863         void *hdr;
5864
5865         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5866         if (!msg)
5867                 return;
5868
5869         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5870         if (!hdr)
5871                 goto out;
5872
5873         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5874             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5875             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5876                               NL80211_ATTR_PAD) ||
5877             (wdev->u.ap.ssid_len &&
5878              nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5879                      wdev->u.ap.ssid)) ||
5880             (wdev->valid_links &&
5881              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5882                 goto out;
5883
5884         genlmsg_end(msg, hdr);
5885
5886         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5887                                 NL80211_MCGRP_MLME, GFP_KERNEL);
5888         return;
5889 out:
5890         nlmsg_free(msg);
5891 }
5892
5893 static int nl80211_validate_ap_phy_operation(struct cfg80211_ap_settings *params)
5894 {
5895         struct ieee80211_channel *channel = params->chandef.chan;
5896
5897         if ((params->he_cap ||  params->he_oper) &&
5898             (channel->flags & IEEE80211_CHAN_NO_HE))
5899                 return -EOPNOTSUPP;
5900
5901         if ((params->eht_cap || params->eht_oper) &&
5902             (channel->flags & IEEE80211_CHAN_NO_EHT))
5903                 return -EOPNOTSUPP;
5904
5905         return 0;
5906 }
5907
5908 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5909 {
5910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5911         unsigned int link_id = nl80211_link_id(info->attrs);
5912         struct net_device *dev = info->user_ptr[1];
5913         struct wireless_dev *wdev = dev->ieee80211_ptr;
5914         struct cfg80211_ap_settings *params;
5915         int err;
5916
5917         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5918             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5919                 return -EOPNOTSUPP;
5920
5921         if (!rdev->ops->start_ap)
5922                 return -EOPNOTSUPP;
5923
5924         if (wdev->links[link_id].ap.beacon_interval)
5925                 return -EALREADY;
5926
5927         /* these are required for START_AP */
5928         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5929             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5930             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5931                 return -EINVAL;
5932
5933         params = kzalloc(sizeof(*params), GFP_KERNEL);
5934         if (!params)
5935                 return -ENOMEM;
5936
5937         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
5938                                    info->extack);
5939         if (err)
5940                 goto out;
5941
5942         params->beacon_interval =
5943                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5944         params->dtim_period =
5945                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5946
5947         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5948                                            params->beacon_interval);
5949         if (err)
5950                 goto out;
5951
5952         /*
5953          * In theory, some of these attributes should be required here
5954          * but since they were not used when the command was originally
5955          * added, keep them optional for old user space programs to let
5956          * them continue to work with drivers that do not need the
5957          * additional information -- drivers must check!
5958          */
5959         if (info->attrs[NL80211_ATTR_SSID]) {
5960                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5961                 params->ssid_len =
5962                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5963                 if (params->ssid_len == 0) {
5964                         err = -EINVAL;
5965                         goto out;
5966                 }
5967
5968                 if (wdev->u.ap.ssid_len &&
5969                     (wdev->u.ap.ssid_len != params->ssid_len ||
5970                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5971                         /* require identical SSID for MLO */
5972                         err = -EINVAL;
5973                         goto out;
5974                 }
5975         } else if (wdev->valid_links) {
5976                 /* require SSID for MLO */
5977                 err = -EINVAL;
5978                 goto out;
5979         }
5980
5981         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5982                 params->hidden_ssid = nla_get_u32(
5983                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5984
5985         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5986
5987         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5988                 params->auth_type = nla_get_u32(
5989                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5990                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5991                                              NL80211_CMD_START_AP)) {
5992                         err = -EINVAL;
5993                         goto out;
5994                 }
5995         } else
5996                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5997
5998         err = nl80211_crypto_settings(rdev, info, &params->crypto,
5999                                       NL80211_MAX_NR_CIPHER_SUITES);
6000         if (err)
6001                 goto out;
6002
6003         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6004                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6005                         err = -EOPNOTSUPP;
6006                         goto out;
6007                 }
6008                 params->inactivity_timeout = nla_get_u16(
6009                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6010         }
6011
6012         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6013                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6014                         err = -EINVAL;
6015                         goto out;
6016                 }
6017                 params->p2p_ctwindow =
6018                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6019                 if (params->p2p_ctwindow != 0 &&
6020                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6021                         err = -EINVAL;
6022                         goto out;
6023                 }
6024         }
6025
6026         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6027                 u8 tmp;
6028
6029                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6030                         err = -EINVAL;
6031                         goto out;
6032                 }
6033                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6034                 params->p2p_opp_ps = tmp;
6035                 if (params->p2p_opp_ps != 0 &&
6036                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6037                         err = -EINVAL;
6038                         goto out;
6039                 }
6040         }
6041
6042         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6043                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6044                 if (err)
6045                         goto out;
6046         } else if (wdev->valid_links) {
6047                 /* with MLD need to specify the channel configuration */
6048                 err = -EINVAL;
6049                 goto out;
6050         } else if (wdev->u.ap.preset_chandef.chan) {
6051                 params->chandef = wdev->u.ap.preset_chandef;
6052         } else if (!nl80211_get_ap_channel(rdev, params)) {
6053                 err = -EINVAL;
6054                 goto out;
6055         }
6056
6057         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
6058                 err = nl80211_parse_punct_bitmap(rdev, info,
6059                                                  &params->chandef,
6060                                                  &params->punct_bitmap);
6061                 if (err)
6062                         goto out;
6063         }
6064
6065         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
6066                                            wdev->iftype)) {
6067                 err = -EINVAL;
6068                 goto out;
6069         }
6070
6071         if (info->attrs[NL80211_ATTR_TX_RATES]) {
6072                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6073                                                     NL80211_ATTR_TX_RATES,
6074                                                     &params->beacon_rate,
6075                                                     dev, false, link_id);
6076                 if (err)
6077                         goto out;
6078
6079                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6080                                               &params->beacon_rate);
6081                 if (err)
6082                         goto out;
6083         }
6084
6085         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6086                 params->smps_mode =
6087                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6088                 switch (params->smps_mode) {
6089                 case NL80211_SMPS_OFF:
6090                         break;
6091                 case NL80211_SMPS_STATIC:
6092                         if (!(rdev->wiphy.features &
6093                               NL80211_FEATURE_STATIC_SMPS)) {
6094                                 err = -EINVAL;
6095                                 goto out;
6096                         }
6097                         break;
6098                 case NL80211_SMPS_DYNAMIC:
6099                         if (!(rdev->wiphy.features &
6100                               NL80211_FEATURE_DYNAMIC_SMPS)) {
6101                                 err = -EINVAL;
6102                                 goto out;
6103                         }
6104                         break;
6105                 default:
6106                         err = -EINVAL;
6107                         goto out;
6108                 }
6109         } else {
6110                 params->smps_mode = NL80211_SMPS_OFF;
6111         }
6112
6113         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6114         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6115                 err = -EOPNOTSUPP;
6116                 goto out;
6117         }
6118
6119         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6120                 params->acl = parse_acl_data(&rdev->wiphy, info);
6121                 if (IS_ERR(params->acl)) {
6122                         err = PTR_ERR(params->acl);
6123                         params->acl = NULL;
6124                         goto out;
6125                 }
6126         }
6127
6128         params->twt_responder =
6129                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6130
6131         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6132                 err = nl80211_parse_he_obss_pd(
6133                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
6134                                         &params->he_obss_pd);
6135                 if (err)
6136                         goto out;
6137         }
6138
6139         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6140                 err = nl80211_parse_fils_discovery(rdev,
6141                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6142                                                    &params->fils_discovery);
6143                 if (err)
6144                         goto out;
6145         }
6146
6147         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6148                 err = nl80211_parse_unsol_bcast_probe_resp(
6149                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6150                         &params->unsol_bcast_probe_resp);
6151                 if (err)
6152                         goto out;
6153         }
6154
6155         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6156                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6157                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6158                                                   &params->mbssid_config,
6159                                                   params->beacon.mbssid_ies ?
6160                                                         params->beacon.mbssid_ies->cnt :
6161                                                         0);
6162                 if (err)
6163                         goto out;
6164         }
6165
6166         if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6167                 err = -EINVAL;
6168                 goto out;
6169         }
6170
6171         err = nl80211_calculate_ap_params(params);
6172         if (err)
6173                 goto out;
6174
6175         err = nl80211_validate_ap_phy_operation(params);
6176         if (err)
6177                 goto out;
6178
6179         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6180                 params->flags = nla_get_u32(
6181                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6182         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6183                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6184
6185         if (wdev->conn_owner_nlportid &&
6186             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6187             wdev->conn_owner_nlportid != info->snd_portid) {
6188                 err = -EINVAL;
6189                 goto out;
6190         }
6191
6192         /* FIXME: validate MLO/link-id against driver capabilities */
6193
6194         err = rdev_start_ap(rdev, dev, params);
6195         if (!err) {
6196                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6197                 wdev->links[link_id].ap.chandef = params->chandef;
6198                 wdev->u.ap.ssid_len = params->ssid_len;
6199                 memcpy(wdev->u.ap.ssid, params->ssid,
6200                        params->ssid_len);
6201
6202                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6203                         wdev->conn_owner_nlportid = info->snd_portid;
6204
6205                 nl80211_send_ap_started(wdev, link_id);
6206         }
6207 out:
6208         kfree(params->acl);
6209         kfree(params->beacon.mbssid_ies);
6210         if (params->mbssid_config.tx_wdev &&
6211             params->mbssid_config.tx_wdev->netdev &&
6212             params->mbssid_config.tx_wdev->netdev != dev)
6213                 dev_put(params->mbssid_config.tx_wdev->netdev);
6214         kfree(params->beacon.rnr_ies);
6215         kfree(params);
6216
6217         return err;
6218 }
6219
6220 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6221 {
6222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6223         unsigned int link_id = nl80211_link_id(info->attrs);
6224         struct net_device *dev = info->user_ptr[1];
6225         struct wireless_dev *wdev = dev->ieee80211_ptr;
6226         struct cfg80211_ap_update *params;
6227         struct nlattr *attr;
6228         int err;
6229
6230         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6231             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6232                 return -EOPNOTSUPP;
6233
6234         if (!rdev->ops->change_beacon)
6235                 return -EOPNOTSUPP;
6236
6237         if (!wdev->links[link_id].ap.beacon_interval)
6238                 return -EINVAL;
6239
6240         params = kzalloc(sizeof(*params), GFP_KERNEL);
6241         if (!params)
6242                 return -ENOMEM;
6243
6244         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
6245                                    info->extack);
6246         if (err)
6247                 goto out;
6248
6249         attr = info->attrs[NL80211_ATTR_FILS_DISCOVERY];
6250         if (attr) {
6251                 err = nl80211_parse_fils_discovery(rdev, attr,
6252                                                    &params->fils_discovery);
6253                 if (err)
6254                         goto out;
6255         }
6256
6257         attr = info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP];
6258         if (attr) {
6259                 err = nl80211_parse_unsol_bcast_probe_resp(rdev, attr,
6260                                                            &params->unsol_bcast_probe_resp);
6261                 if (err)
6262                         goto out;
6263         }
6264
6265         err = rdev_change_beacon(rdev, dev, params);
6266
6267 out:
6268         kfree(params->beacon.mbssid_ies);
6269         kfree(params->beacon.rnr_ies);
6270         kfree(params);
6271         return err;
6272 }
6273
6274 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6275 {
6276         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6277         unsigned int link_id = nl80211_link_id(info->attrs);
6278         struct net_device *dev = info->user_ptr[1];
6279
6280         return cfg80211_stop_ap(rdev, dev, link_id, false);
6281 }
6282
6283 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6284         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6285         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6286         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6287         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6288         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6289         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6290 };
6291
6292 static int parse_station_flags(struct genl_info *info,
6293                                enum nl80211_iftype iftype,
6294                                struct station_parameters *params)
6295 {
6296         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6297         struct nlattr *nla;
6298         int flag;
6299
6300         /*
6301          * Try parsing the new attribute first so userspace
6302          * can specify both for older kernels.
6303          */
6304         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6305         if (nla) {
6306                 struct nl80211_sta_flag_update *sta_flags;
6307
6308                 sta_flags = nla_data(nla);
6309                 params->sta_flags_mask = sta_flags->mask;
6310                 params->sta_flags_set = sta_flags->set;
6311                 params->sta_flags_set &= params->sta_flags_mask;
6312                 if ((params->sta_flags_mask |
6313                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6314                         return -EINVAL;
6315                 return 0;
6316         }
6317
6318         /* if present, parse the old attribute */
6319
6320         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6321         if (!nla)
6322                 return 0;
6323
6324         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6325                 return -EINVAL;
6326
6327         /*
6328          * Only allow certain flags for interface types so that
6329          * other attributes are silently ignored. Remember that
6330          * this is backward compatibility code with old userspace
6331          * and shouldn't be hit in other cases anyway.
6332          */
6333         switch (iftype) {
6334         case NL80211_IFTYPE_AP:
6335         case NL80211_IFTYPE_AP_VLAN:
6336         case NL80211_IFTYPE_P2P_GO:
6337                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6338                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6339                                          BIT(NL80211_STA_FLAG_WME) |
6340                                          BIT(NL80211_STA_FLAG_MFP);
6341                 break;
6342         case NL80211_IFTYPE_P2P_CLIENT:
6343         case NL80211_IFTYPE_STATION:
6344                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6345                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6346                 break;
6347         case NL80211_IFTYPE_MESH_POINT:
6348                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6349                                          BIT(NL80211_STA_FLAG_MFP) |
6350                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6351                 break;
6352         default:
6353                 return -EINVAL;
6354         }
6355
6356         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6357                 if (flags[flag]) {
6358                         params->sta_flags_set |= (1<<flag);
6359
6360                         /* no longer support new API additions in old API */
6361                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6362                                 return -EINVAL;
6363                 }
6364         }
6365
6366         return 0;
6367 }
6368
6369 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6370 {
6371         struct nlattr *rate;
6372         u32 bitrate;
6373         u16 bitrate_compat;
6374         enum nl80211_rate_info rate_flg;
6375
6376         rate = nla_nest_start_noflag(msg, attr);
6377         if (!rate)
6378                 return false;
6379
6380         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6381         bitrate = cfg80211_calculate_bitrate(info);
6382         /* report 16-bit bitrate only if we can */
6383         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6384         if (bitrate > 0 &&
6385             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6386                 return false;
6387         if (bitrate_compat > 0 &&
6388             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6389                 return false;
6390
6391         switch (info->bw) {
6392         case RATE_INFO_BW_1:
6393                 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6394                 break;
6395         case RATE_INFO_BW_2:
6396                 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6397                 break;
6398         case RATE_INFO_BW_4:
6399                 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6400                 break;
6401         case RATE_INFO_BW_5:
6402                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6403                 break;
6404         case RATE_INFO_BW_8:
6405                 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6406                 break;
6407         case RATE_INFO_BW_10:
6408                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6409                 break;
6410         case RATE_INFO_BW_16:
6411                 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6412                 break;
6413         default:
6414                 WARN_ON(1);
6415                 fallthrough;
6416         case RATE_INFO_BW_20:
6417                 rate_flg = 0;
6418                 break;
6419         case RATE_INFO_BW_40:
6420                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6421                 break;
6422         case RATE_INFO_BW_80:
6423                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6424                 break;
6425         case RATE_INFO_BW_160:
6426                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6427                 break;
6428         case RATE_INFO_BW_HE_RU:
6429                 rate_flg = 0;
6430                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6431                 break;
6432         case RATE_INFO_BW_320:
6433                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6434                 break;
6435         case RATE_INFO_BW_EHT_RU:
6436                 rate_flg = 0;
6437                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6438                 break;
6439         }
6440
6441         if (rate_flg && nla_put_flag(msg, rate_flg))
6442                 return false;
6443
6444         if (info->flags & RATE_INFO_FLAGS_MCS) {
6445                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6446                         return false;
6447                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6448                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6449                         return false;
6450         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6451                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6452                         return false;
6453                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6454                         return false;
6455                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6456                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6457                         return false;
6458         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6459                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6460                         return false;
6461                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6462                         return false;
6463                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6464                         return false;
6465                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6466                         return false;
6467                 if (info->bw == RATE_INFO_BW_HE_RU &&
6468                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6469                                info->he_ru_alloc))
6470                         return false;
6471         } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6472                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6473                         return false;
6474                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6475                         return false;
6476                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6477                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6478                         return false;
6479         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6480                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6481                         return false;
6482                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6483                         return false;
6484                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6485                         return false;
6486                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6487                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6488                                info->eht_ru_alloc))
6489                         return false;
6490         }
6491
6492         nla_nest_end(msg, rate);
6493         return true;
6494 }
6495
6496 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6497                                int id)
6498 {
6499         void *attr;
6500         int i = 0;
6501
6502         if (!mask)
6503                 return true;
6504
6505         attr = nla_nest_start_noflag(msg, id);
6506         if (!attr)
6507                 return false;
6508
6509         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6510                 if (!(mask & BIT(i)))
6511                         continue;
6512
6513                 if (nla_put_u8(msg, i, signal[i]))
6514                         return false;
6515         }
6516
6517         nla_nest_end(msg, attr);
6518
6519         return true;
6520 }
6521
6522 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6523                                 u32 seq, int flags,
6524                                 struct cfg80211_registered_device *rdev,
6525                                 struct net_device *dev,
6526                                 const u8 *mac_addr, struct station_info *sinfo)
6527 {
6528         void *hdr;
6529         struct nlattr *sinfoattr, *bss_param;
6530
6531         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6532         if (!hdr) {
6533                 cfg80211_sinfo_release_content(sinfo);
6534                 return -1;
6535         }
6536
6537         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6538             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6539             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6540                 goto nla_put_failure;
6541
6542         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6543         if (!sinfoattr)
6544                 goto nla_put_failure;
6545
6546 #define PUT_SINFO(attr, memb, type) do {                                \
6547         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6548         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6549             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6550                              sinfo->memb))                              \
6551                 goto nla_put_failure;                                   \
6552         } while (0)
6553 #define PUT_SINFO_U64(attr, memb) do {                                  \
6554         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6555             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6556                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6557                 goto nla_put_failure;                                   \
6558         } while (0)
6559
6560         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6561         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6562         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6563
6564         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6565                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6566             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6567                         (u32)sinfo->rx_bytes))
6568                 goto nla_put_failure;
6569
6570         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6571                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6572             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6573                         (u32)sinfo->tx_bytes))
6574                 goto nla_put_failure;
6575
6576         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6577         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6578         PUT_SINFO(LLID, llid, u16);
6579         PUT_SINFO(PLID, plid, u16);
6580         PUT_SINFO(PLINK_STATE, plink_state, u8);
6581         PUT_SINFO_U64(RX_DURATION, rx_duration);
6582         PUT_SINFO_U64(TX_DURATION, tx_duration);
6583
6584         if (wiphy_ext_feature_isset(&rdev->wiphy,
6585                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6586                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6587
6588         switch (rdev->wiphy.signal_type) {
6589         case CFG80211_SIGNAL_TYPE_MBM:
6590                 PUT_SINFO(SIGNAL, signal, u8);
6591                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6592                 break;
6593         default:
6594                 break;
6595         }
6596         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6597                 if (!nl80211_put_signal(msg, sinfo->chains,
6598                                         sinfo->chain_signal,
6599                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6600                         goto nla_put_failure;
6601         }
6602         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6603                 if (!nl80211_put_signal(msg, sinfo->chains,
6604                                         sinfo->chain_signal_avg,
6605                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6606                         goto nla_put_failure;
6607         }
6608         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6609                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6610                                           NL80211_STA_INFO_TX_BITRATE))
6611                         goto nla_put_failure;
6612         }
6613         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6614                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6615                                           NL80211_STA_INFO_RX_BITRATE))
6616                         goto nla_put_failure;
6617         }
6618
6619         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6620         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6621         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6622         PUT_SINFO(TX_FAILED, tx_failed, u32);
6623         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6624         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6625         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6626         PUT_SINFO(LOCAL_PM, local_pm, u32);
6627         PUT_SINFO(PEER_PM, peer_pm, u32);
6628         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6629         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6630         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6631
6632         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6633                 bss_param = nla_nest_start_noflag(msg,
6634                                                   NL80211_STA_INFO_BSS_PARAM);
6635                 if (!bss_param)
6636                         goto nla_put_failure;
6637
6638                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6639                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6640                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6641                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6642                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6643                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6644                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6645                                sinfo->bss_param.dtim_period) ||
6646                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6647                                 sinfo->bss_param.beacon_interval))
6648                         goto nla_put_failure;
6649
6650                 nla_nest_end(msg, bss_param);
6651         }
6652         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6653             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6654                     sizeof(struct nl80211_sta_flag_update),
6655                     &sinfo->sta_flags))
6656                 goto nla_put_failure;
6657
6658         PUT_SINFO_U64(T_OFFSET, t_offset);
6659         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6660         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6661         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6662         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6663         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6664         if (wiphy_ext_feature_isset(&rdev->wiphy,
6665                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6666                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6667                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6668         }
6669
6670 #undef PUT_SINFO
6671 #undef PUT_SINFO_U64
6672
6673         if (sinfo->pertid) {
6674                 struct nlattr *tidsattr;
6675                 int tid;
6676
6677                 tidsattr = nla_nest_start_noflag(msg,
6678                                                  NL80211_STA_INFO_TID_STATS);
6679                 if (!tidsattr)
6680                         goto nla_put_failure;
6681
6682                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6683                         struct cfg80211_tid_stats *tidstats;
6684                         struct nlattr *tidattr;
6685
6686                         tidstats = &sinfo->pertid[tid];
6687
6688                         if (!tidstats->filled)
6689                                 continue;
6690
6691                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6692                         if (!tidattr)
6693                                 goto nla_put_failure;
6694
6695 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6696         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6697             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6698                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6699                 goto nla_put_failure;                                   \
6700         } while (0)
6701
6702                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6703                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6704                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6705                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6706
6707 #undef PUT_TIDVAL_U64
6708                         if ((tidstats->filled &
6709                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6710                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6711                                                    NL80211_TID_STATS_TXQ_STATS))
6712                                 goto nla_put_failure;
6713
6714                         nla_nest_end(msg, tidattr);
6715                 }
6716
6717                 nla_nest_end(msg, tidsattr);
6718         }
6719
6720         nla_nest_end(msg, sinfoattr);
6721
6722         if (sinfo->assoc_req_ies_len &&
6723             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6724                     sinfo->assoc_req_ies))
6725                 goto nla_put_failure;
6726
6727         if (sinfo->assoc_resp_ies_len &&
6728             nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6729                     sinfo->assoc_resp_ies))
6730                 goto nla_put_failure;
6731
6732         if (sinfo->mlo_params_valid) {
6733                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6734                                sinfo->assoc_link_id))
6735                         goto nla_put_failure;
6736
6737                 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6738                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6739                             sinfo->mld_addr))
6740                         goto nla_put_failure;
6741         }
6742
6743         cfg80211_sinfo_release_content(sinfo);
6744         genlmsg_end(msg, hdr);
6745         return 0;
6746
6747  nla_put_failure:
6748         cfg80211_sinfo_release_content(sinfo);
6749         genlmsg_cancel(msg, hdr);
6750         return -EMSGSIZE;
6751 }
6752
6753 static int nl80211_dump_station(struct sk_buff *skb,
6754                                 struct netlink_callback *cb)
6755 {
6756         struct station_info sinfo;
6757         struct cfg80211_registered_device *rdev;
6758         struct wireless_dev *wdev;
6759         u8 mac_addr[ETH_ALEN];
6760         int sta_idx = cb->args[2];
6761         int err;
6762
6763         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6764         if (err)
6765                 return err;
6766         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6767         __acquire(&rdev->wiphy.mtx);
6768
6769         if (!wdev->netdev) {
6770                 err = -EINVAL;
6771                 goto out_err;
6772         }
6773
6774         if (!rdev->ops->dump_station) {
6775                 err = -EOPNOTSUPP;
6776                 goto out_err;
6777         }
6778
6779         while (1) {
6780                 memset(&sinfo, 0, sizeof(sinfo));
6781                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6782                                         mac_addr, &sinfo);
6783                 if (err == -ENOENT)
6784                         break;
6785                 if (err)
6786                         goto out_err;
6787
6788                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6789                                 NETLINK_CB(cb->skb).portid,
6790                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6791                                 rdev, wdev->netdev, mac_addr,
6792                                 &sinfo) < 0)
6793                         goto out;
6794
6795                 sta_idx++;
6796         }
6797
6798  out:
6799         cb->args[2] = sta_idx;
6800         err = skb->len;
6801  out_err:
6802         wiphy_unlock(&rdev->wiphy);
6803
6804         return err;
6805 }
6806
6807 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6808 {
6809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6810         struct net_device *dev = info->user_ptr[1];
6811         struct station_info sinfo;
6812         struct sk_buff *msg;
6813         u8 *mac_addr = NULL;
6814         int err;
6815
6816         memset(&sinfo, 0, sizeof(sinfo));
6817
6818         if (!info->attrs[NL80211_ATTR_MAC])
6819                 return -EINVAL;
6820
6821         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6822
6823         if (!rdev->ops->get_station)
6824                 return -EOPNOTSUPP;
6825
6826         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6827         if (err)
6828                 return err;
6829
6830         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6831         if (!msg) {
6832                 cfg80211_sinfo_release_content(&sinfo);
6833                 return -ENOMEM;
6834         }
6835
6836         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6837                                  info->snd_portid, info->snd_seq, 0,
6838                                  rdev, dev, mac_addr, &sinfo) < 0) {
6839                 nlmsg_free(msg);
6840                 return -ENOBUFS;
6841         }
6842
6843         return genlmsg_reply(msg, info);
6844 }
6845
6846 int cfg80211_check_station_change(struct wiphy *wiphy,
6847                                   struct station_parameters *params,
6848                                   enum cfg80211_station_type statype)
6849 {
6850         if (params->listen_interval != -1 &&
6851             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6852                 return -EINVAL;
6853
6854         if (params->support_p2p_ps != -1 &&
6855             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6856                 return -EINVAL;
6857
6858         if (params->aid &&
6859             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6860             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6861                 return -EINVAL;
6862
6863         /* When you run into this, adjust the code below for the new flag */
6864         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6865
6866         switch (statype) {
6867         case CFG80211_STA_MESH_PEER_KERNEL:
6868         case CFG80211_STA_MESH_PEER_USER:
6869                 /*
6870                  * No ignoring the TDLS flag here -- the userspace mesh
6871                  * code doesn't have the bug of including TDLS in the
6872                  * mask everywhere.
6873                  */
6874                 if (params->sta_flags_mask &
6875                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6876                                   BIT(NL80211_STA_FLAG_MFP) |
6877                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6878                         return -EINVAL;
6879                 break;
6880         case CFG80211_STA_TDLS_PEER_SETUP:
6881         case CFG80211_STA_TDLS_PEER_ACTIVE:
6882                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6883                         return -EINVAL;
6884                 /* ignore since it can't change */
6885                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6886                 break;
6887         default:
6888                 /* disallow mesh-specific things */
6889                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6890                         return -EINVAL;
6891                 if (params->local_pm)
6892                         return -EINVAL;
6893                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6894                         return -EINVAL;
6895         }
6896
6897         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6898             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6899                 /* TDLS can't be set, ... */
6900                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6901                         return -EINVAL;
6902                 /*
6903                  * ... but don't bother the driver with it. This works around
6904                  * a hostapd/wpa_supplicant issue -- it always includes the
6905                  * TLDS_PEER flag in the mask even for AP mode.
6906                  */
6907                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6908         }
6909
6910         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6911             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6912                 /* reject other things that can't change */
6913                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6914                         return -EINVAL;
6915                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6916                         return -EINVAL;
6917                 if (params->link_sta_params.supported_rates)
6918                         return -EINVAL;
6919                 if (params->ext_capab || params->link_sta_params.ht_capa ||
6920                     params->link_sta_params.vht_capa ||
6921                     params->link_sta_params.he_capa ||
6922                     params->link_sta_params.eht_capa)
6923                         return -EINVAL;
6924         }
6925
6926         if (statype != CFG80211_STA_AP_CLIENT &&
6927             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6928                 if (params->vlan)
6929                         return -EINVAL;
6930         }
6931
6932         switch (statype) {
6933         case CFG80211_STA_AP_MLME_CLIENT:
6934                 /* Use this only for authorizing/unauthorizing a station */
6935                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6936                         return -EOPNOTSUPP;
6937                 break;
6938         case CFG80211_STA_AP_CLIENT:
6939         case CFG80211_STA_AP_CLIENT_UNASSOC:
6940                 /* accept only the listed bits */
6941                 if (params->sta_flags_mask &
6942                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6943                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6944                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6945                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6946                                   BIT(NL80211_STA_FLAG_WME) |
6947                                   BIT(NL80211_STA_FLAG_MFP)))
6948                         return -EINVAL;
6949
6950                 /* but authenticated/associated only if driver handles it */
6951                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6952                     params->sta_flags_mask &
6953                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6954                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6955                         return -EINVAL;
6956                 break;
6957         case CFG80211_STA_IBSS:
6958         case CFG80211_STA_AP_STA:
6959                 /* reject any changes other than AUTHORIZED */
6960                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6961                         return -EINVAL;
6962                 break;
6963         case CFG80211_STA_TDLS_PEER_SETUP:
6964                 /* reject any changes other than AUTHORIZED or WME */
6965                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6966                                                BIT(NL80211_STA_FLAG_WME)))
6967                         return -EINVAL;
6968                 /* force (at least) rates when authorizing */
6969                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6970                     !params->link_sta_params.supported_rates)
6971                         return -EINVAL;
6972                 break;
6973         case CFG80211_STA_TDLS_PEER_ACTIVE:
6974                 /* reject any changes */
6975                 return -EINVAL;
6976         case CFG80211_STA_MESH_PEER_KERNEL:
6977                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6978                         return -EINVAL;
6979                 break;
6980         case CFG80211_STA_MESH_PEER_USER:
6981                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6982                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6983                         return -EINVAL;
6984                 break;
6985         }
6986
6987         /*
6988          * Older kernel versions ignored this attribute entirely, so don't
6989          * reject attempts to update it but mark it as unused instead so the
6990          * driver won't look at the data.
6991          */
6992         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6993             statype != CFG80211_STA_TDLS_PEER_SETUP)
6994                 params->link_sta_params.opmode_notif_used = false;
6995
6996         return 0;
6997 }
6998 EXPORT_SYMBOL(cfg80211_check_station_change);
6999
7000 /*
7001  * Get vlan interface making sure it is running and on the right wiphy.
7002  */
7003 static struct net_device *get_vlan(struct genl_info *info,
7004                                    struct cfg80211_registered_device *rdev)
7005 {
7006         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
7007         struct net_device *v;
7008         int ret;
7009
7010         if (!vlanattr)
7011                 return NULL;
7012
7013         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
7014         if (!v)
7015                 return ERR_PTR(-ENODEV);
7016
7017         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7018                 ret = -EINVAL;
7019                 goto error;
7020         }
7021
7022         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7023             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7024             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7025                 ret = -EINVAL;
7026                 goto error;
7027         }
7028
7029         if (!netif_running(v)) {
7030                 ret = -ENETDOWN;
7031                 goto error;
7032         }
7033
7034         return v;
7035  error:
7036         dev_put(v);
7037         return ERR_PTR(ret);
7038 }
7039
7040 static int nl80211_parse_sta_wme(struct genl_info *info,
7041                                  struct station_parameters *params)
7042 {
7043         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7044         struct nlattr *nla;
7045         int err;
7046
7047         /* parse WME attributes if present */
7048         if (!info->attrs[NL80211_ATTR_STA_WME])
7049                 return 0;
7050
7051         nla = info->attrs[NL80211_ATTR_STA_WME];
7052         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7053                                           nl80211_sta_wme_policy,
7054                                           info->extack);
7055         if (err)
7056                 return err;
7057
7058         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7059                 params->uapsd_queues = nla_get_u8(
7060                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
7061         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7062                 return -EINVAL;
7063
7064         if (tb[NL80211_STA_WME_MAX_SP])
7065                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7066
7067         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7068                 return -EINVAL;
7069
7070         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7071
7072         return 0;
7073 }
7074
7075 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7076                                       struct station_parameters *params)
7077 {
7078         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7079                 params->supported_channels =
7080                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7081                 params->supported_channels_len =
7082                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7083                 /*
7084                  * Need to include at least one (first channel, number of
7085                  * channels) tuple for each subband (checked in policy),
7086                  * and must have proper tuples for the rest of the data as well.
7087                  */
7088                 if (params->supported_channels_len % 2)
7089                         return -EINVAL;
7090         }
7091
7092         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7093                 params->supported_oper_classes =
7094                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7095                 params->supported_oper_classes_len =
7096                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7097         }
7098         return 0;
7099 }
7100
7101 static int nl80211_set_station_tdls(struct genl_info *info,
7102                                     struct station_parameters *params)
7103 {
7104         int err;
7105         /* Dummy STA entry gets updated once the peer capabilities are known */
7106         if (info->attrs[NL80211_ATTR_PEER_AID])
7107                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7108         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7109                 params->link_sta_params.ht_capa =
7110                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7111         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7112                 params->link_sta_params.vht_capa =
7113                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7114         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7115                 params->link_sta_params.he_capa =
7116                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7117                 params->link_sta_params.he_capa_len =
7118                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7119
7120                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7121                         params->link_sta_params.eht_capa =
7122                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7123                         params->link_sta_params.eht_capa_len =
7124                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7125
7126                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7127                                                         (const u8 *)params->link_sta_params.eht_capa,
7128                                                         params->link_sta_params.eht_capa_len,
7129                                                         false))
7130                                 return -EINVAL;
7131                 }
7132         }
7133
7134         err = nl80211_parse_sta_channel_info(info, params);
7135         if (err)
7136                 return err;
7137
7138         return nl80211_parse_sta_wme(info, params);
7139 }
7140
7141 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7142                                              struct sta_txpwr *txpwr,
7143                                              bool *txpwr_set)
7144 {
7145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7146         int idx;
7147
7148         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7149                 if (!rdev->ops->set_tx_power ||
7150                     !wiphy_ext_feature_isset(&rdev->wiphy,
7151                                          NL80211_EXT_FEATURE_STA_TX_PWR))
7152                         return -EOPNOTSUPP;
7153
7154                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7155                 txpwr->type = nla_get_u8(info->attrs[idx]);
7156
7157                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7158                         idx = NL80211_ATTR_STA_TX_POWER;
7159
7160                         if (info->attrs[idx])
7161                                 txpwr->power = nla_get_s16(info->attrs[idx]);
7162                         else
7163                                 return -EINVAL;
7164                 }
7165
7166                 *txpwr_set = true;
7167         } else {
7168                 *txpwr_set = false;
7169         }
7170
7171         return 0;
7172 }
7173
7174 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7175 {
7176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7177         struct net_device *dev = info->user_ptr[1];
7178         struct station_parameters params;
7179         u8 *mac_addr;
7180         int err;
7181
7182         memset(&params, 0, sizeof(params));
7183
7184         if (!rdev->ops->change_station)
7185                 return -EOPNOTSUPP;
7186
7187         /*
7188          * AID and listen_interval properties can be set only for unassociated
7189          * station. Include these parameters here and will check them in
7190          * cfg80211_check_station_change().
7191          */
7192         if (info->attrs[NL80211_ATTR_STA_AID])
7193                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7194
7195         if (info->attrs[NL80211_ATTR_VLAN_ID])
7196                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7197
7198         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7199                 params.listen_interval =
7200                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7201         else
7202                 params.listen_interval = -1;
7203
7204         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7205                 params.support_p2p_ps =
7206                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7207         else
7208                 params.support_p2p_ps = -1;
7209
7210         if (!info->attrs[NL80211_ATTR_MAC])
7211                 return -EINVAL;
7212
7213         params.link_sta_params.link_id =
7214                 nl80211_link_id_or_invalid(info->attrs);
7215
7216         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7217                 /* If MLD_ADDR attribute is set then this is an MLD station
7218                  * and the MLD_ADDR attribute holds the MLD address and the
7219                  * MAC attribute holds for the LINK address.
7220                  * In that case, the link_id is also expected to be valid.
7221                  */
7222                 if (params.link_sta_params.link_id < 0)
7223                         return -EINVAL;
7224
7225                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7226                 params.link_sta_params.mld_mac = mac_addr;
7227                 params.link_sta_params.link_mac =
7228                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7229                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7230                         return -EINVAL;
7231         } else {
7232                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7233         }
7234
7235
7236         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7237                 params.link_sta_params.supported_rates =
7238                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7239                 params.link_sta_params.supported_rates_len =
7240                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7241         }
7242
7243         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7244                 params.capability =
7245                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7246                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7247         }
7248
7249         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7250                 params.ext_capab =
7251                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7252                 params.ext_capab_len =
7253                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7254         }
7255
7256         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7257                 return -EINVAL;
7258
7259         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7260                 params.plink_action =
7261                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7262
7263         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7264                 params.plink_state =
7265                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7266                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7267                         params.peer_aid = nla_get_u16(
7268                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7269                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7270         }
7271
7272         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7273                 params.local_pm = nla_get_u32(
7274                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7275
7276         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7277                 params.link_sta_params.opmode_notif_used = true;
7278                 params.link_sta_params.opmode_notif =
7279                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7280         }
7281
7282         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7283                 params.link_sta_params.he_6ghz_capa =
7284                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7285
7286         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7287                 params.airtime_weight =
7288                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7289
7290         if (params.airtime_weight &&
7291             !wiphy_ext_feature_isset(&rdev->wiphy,
7292                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7293                 return -EOPNOTSUPP;
7294
7295         err = nl80211_parse_sta_txpower_setting(info,
7296                                                 &params.link_sta_params.txpwr,
7297                                                 &params.link_sta_params.txpwr_set);
7298         if (err)
7299                 return err;
7300
7301         /* Include parameters for TDLS peer (will check later) */
7302         err = nl80211_set_station_tdls(info, &params);
7303         if (err)
7304                 return err;
7305
7306         params.vlan = get_vlan(info, rdev);
7307         if (IS_ERR(params.vlan))
7308                 return PTR_ERR(params.vlan);
7309
7310         switch (dev->ieee80211_ptr->iftype) {
7311         case NL80211_IFTYPE_AP:
7312         case NL80211_IFTYPE_AP_VLAN:
7313         case NL80211_IFTYPE_P2P_GO:
7314         case NL80211_IFTYPE_P2P_CLIENT:
7315         case NL80211_IFTYPE_STATION:
7316         case NL80211_IFTYPE_ADHOC:
7317         case NL80211_IFTYPE_MESH_POINT:
7318                 break;
7319         default:
7320                 err = -EOPNOTSUPP;
7321                 goto out_put_vlan;
7322         }
7323
7324         /* driver will call cfg80211_check_station_change() */
7325         err = rdev_change_station(rdev, dev, mac_addr, &params);
7326
7327  out_put_vlan:
7328         dev_put(params.vlan);
7329
7330         return err;
7331 }
7332
7333 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7334 {
7335         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7336         int err;
7337         struct net_device *dev = info->user_ptr[1];
7338         struct wireless_dev *wdev = dev->ieee80211_ptr;
7339         struct station_parameters params;
7340         u8 *mac_addr = NULL;
7341         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7342                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7343
7344         memset(&params, 0, sizeof(params));
7345
7346         if (!rdev->ops->add_station)
7347                 return -EOPNOTSUPP;
7348
7349         if (!info->attrs[NL80211_ATTR_MAC])
7350                 return -EINVAL;
7351
7352         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7353                 return -EINVAL;
7354
7355         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7356                 return -EINVAL;
7357
7358         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7359             !info->attrs[NL80211_ATTR_PEER_AID])
7360                 return -EINVAL;
7361
7362         params.link_sta_params.link_id =
7363                 nl80211_link_id_or_invalid(info->attrs);
7364
7365         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7366                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7367                 params.link_sta_params.mld_mac = mac_addr;
7368                 params.link_sta_params.link_mac =
7369                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7370                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7371                         return -EINVAL;
7372         } else {
7373                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7374         }
7375
7376         params.link_sta_params.supported_rates =
7377                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7378         params.link_sta_params.supported_rates_len =
7379                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7380         params.listen_interval =
7381                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7382
7383         if (info->attrs[NL80211_ATTR_VLAN_ID])
7384                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7385
7386         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7387                 params.support_p2p_ps =
7388                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7389         } else {
7390                 /*
7391                  * if not specified, assume it's supported for P2P GO interface,
7392                  * and is NOT supported for AP interface
7393                  */
7394                 params.support_p2p_ps =
7395                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7396         }
7397
7398         if (info->attrs[NL80211_ATTR_PEER_AID])
7399                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7400         else
7401                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7402
7403         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7404                 params.capability =
7405                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7406                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7407         }
7408
7409         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7410                 params.ext_capab =
7411                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7412                 params.ext_capab_len =
7413                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7414         }
7415
7416         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7417                 params.link_sta_params.ht_capa =
7418                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7419
7420         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7421                 params.link_sta_params.vht_capa =
7422                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7423
7424         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7425                 params.link_sta_params.he_capa =
7426                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7427                 params.link_sta_params.he_capa_len =
7428                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7429
7430                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7431                         params.link_sta_params.eht_capa =
7432                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7433                         params.link_sta_params.eht_capa_len =
7434                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7435
7436                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7437                                                         (const u8 *)params.link_sta_params.eht_capa,
7438                                                         params.link_sta_params.eht_capa_len,
7439                                                         false))
7440                                 return -EINVAL;
7441                 }
7442         }
7443
7444         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7445                 params.link_sta_params.he_6ghz_capa =
7446                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7447
7448         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7449                 params.link_sta_params.opmode_notif_used = true;
7450                 params.link_sta_params.opmode_notif =
7451                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7452         }
7453
7454         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7455                 params.plink_action =
7456                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7457
7458         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7459                 params.airtime_weight =
7460                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7461
7462         if (params.airtime_weight &&
7463             !wiphy_ext_feature_isset(&rdev->wiphy,
7464                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7465                 return -EOPNOTSUPP;
7466
7467         err = nl80211_parse_sta_txpower_setting(info,
7468                                                 &params.link_sta_params.txpwr,
7469                                                 &params.link_sta_params.txpwr_set);
7470         if (err)
7471                 return err;
7472
7473         err = nl80211_parse_sta_channel_info(info, &params);
7474         if (err)
7475                 return err;
7476
7477         err = nl80211_parse_sta_wme(info, &params);
7478         if (err)
7479                 return err;
7480
7481         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7482                 return -EINVAL;
7483
7484         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7485          * as userspace might just pass through the capabilities from the IEs
7486          * directly, rather than enforcing this restriction and returning an
7487          * error in this case.
7488          */
7489         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7490                 params.link_sta_params.ht_capa = NULL;
7491                 params.link_sta_params.vht_capa = NULL;
7492
7493                 /* HE and EHT require WME */
7494                 if (params.link_sta_params.he_capa_len ||
7495                     params.link_sta_params.he_6ghz_capa ||
7496                     params.link_sta_params.eht_capa_len)
7497                         return -EINVAL;
7498         }
7499
7500         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7501         if (params.link_sta_params.he_6ghz_capa &&
7502             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7503                 return -EINVAL;
7504
7505         /* When you run into this, adjust the code below for the new flag */
7506         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7507
7508         switch (dev->ieee80211_ptr->iftype) {
7509         case NL80211_IFTYPE_AP:
7510         case NL80211_IFTYPE_AP_VLAN:
7511         case NL80211_IFTYPE_P2P_GO:
7512                 /* ignore WME attributes if iface/sta is not capable */
7513                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7514                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7515                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7516
7517                 /* TDLS peers cannot be added */
7518                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7519                     info->attrs[NL80211_ATTR_PEER_AID])
7520                         return -EINVAL;
7521                 /* but don't bother the driver with it */
7522                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7523
7524                 /* allow authenticated/associated only if driver handles it */
7525                 if (!(rdev->wiphy.features &
7526                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7527                     params.sta_flags_mask & auth_assoc)
7528                         return -EINVAL;
7529
7530                 /* Older userspace, or userspace wanting to be compatible with
7531                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7532                  * and assoc flags in the mask, but assumes the station will be
7533                  * added as associated anyway since this was the required driver
7534                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7535                  * introduced.
7536                  * In order to not bother drivers with this quirk in the API
7537                  * set the flags in both the mask and set for new stations in
7538                  * this case.
7539                  */
7540                 if (!(params.sta_flags_mask & auth_assoc)) {
7541                         params.sta_flags_mask |= auth_assoc;
7542                         params.sta_flags_set |= auth_assoc;
7543                 }
7544
7545                 /* must be last in here for error handling */
7546                 params.vlan = get_vlan(info, rdev);
7547                 if (IS_ERR(params.vlan))
7548                         return PTR_ERR(params.vlan);
7549                 break;
7550         case NL80211_IFTYPE_MESH_POINT:
7551                 /* ignore uAPSD data */
7552                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7553
7554                 /* associated is disallowed */
7555                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7556                         return -EINVAL;
7557                 /* TDLS peers cannot be added */
7558                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7559                     info->attrs[NL80211_ATTR_PEER_AID])
7560                         return -EINVAL;
7561                 break;
7562         case NL80211_IFTYPE_STATION:
7563         case NL80211_IFTYPE_P2P_CLIENT:
7564                 /* ignore uAPSD data */
7565                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7566
7567                 /* these are disallowed */
7568                 if (params.sta_flags_mask &
7569                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7570                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7571                         return -EINVAL;
7572                 /* Only TDLS peers can be added */
7573                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7574                         return -EINVAL;
7575                 /* Can only add if TDLS ... */
7576                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7577                         return -EOPNOTSUPP;
7578                 /* ... with external setup is supported */
7579                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7580                         return -EOPNOTSUPP;
7581                 /*
7582                  * Older wpa_supplicant versions always mark the TDLS peer
7583                  * as authorized, but it shouldn't yet be.
7584                  */
7585                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7586                 break;
7587         default:
7588                 return -EOPNOTSUPP;
7589         }
7590
7591         /* be aware of params.vlan when changing code here */
7592
7593         if (wdev->valid_links) {
7594                 if (params.link_sta_params.link_id < 0) {
7595                         err = -EINVAL;
7596                         goto out;
7597                 }
7598                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7599                         err = -ENOLINK;
7600                         goto out;
7601                 }
7602         } else {
7603                 if (params.link_sta_params.link_id >= 0) {
7604                         err = -EINVAL;
7605                         goto out;
7606                 }
7607         }
7608         err = rdev_add_station(rdev, dev, mac_addr, &params);
7609 out:
7610         dev_put(params.vlan);
7611         return err;
7612 }
7613
7614 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7615 {
7616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7617         struct net_device *dev = info->user_ptr[1];
7618         struct station_del_parameters params;
7619
7620         memset(&params, 0, sizeof(params));
7621
7622         if (info->attrs[NL80211_ATTR_MAC])
7623                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7624
7625         switch (dev->ieee80211_ptr->iftype) {
7626         case NL80211_IFTYPE_AP:
7627         case NL80211_IFTYPE_AP_VLAN:
7628         case NL80211_IFTYPE_MESH_POINT:
7629         case NL80211_IFTYPE_P2P_GO:
7630                 /* always accept these */
7631                 break;
7632         case NL80211_IFTYPE_ADHOC:
7633                 /* conditionally accept */
7634                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7635                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7636                         break;
7637                 return -EINVAL;
7638         default:
7639                 return -EINVAL;
7640         }
7641
7642         if (!rdev->ops->del_station)
7643                 return -EOPNOTSUPP;
7644
7645         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7646                 params.subtype =
7647                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7648                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7649                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7650                         return -EINVAL;
7651         } else {
7652                 /* Default to Deauthentication frame */
7653                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7654         }
7655
7656         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7657                 params.reason_code =
7658                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7659                 if (params.reason_code == 0)
7660                         return -EINVAL; /* 0 is reserved */
7661         } else {
7662                 /* Default to reason code 2 */
7663                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7664         }
7665
7666         return rdev_del_station(rdev, dev, &params);
7667 }
7668
7669 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7670                                 int flags, struct net_device *dev,
7671                                 u8 *dst, u8 *next_hop,
7672                                 struct mpath_info *pinfo)
7673 {
7674         void *hdr;
7675         struct nlattr *pinfoattr;
7676
7677         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7678         if (!hdr)
7679                 return -1;
7680
7681         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7682             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7683             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7684             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7685                 goto nla_put_failure;
7686
7687         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7688         if (!pinfoattr)
7689                 goto nla_put_failure;
7690         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7691             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7692                         pinfo->frame_qlen))
7693                 goto nla_put_failure;
7694         if (((pinfo->filled & MPATH_INFO_SN) &&
7695              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7696             ((pinfo->filled & MPATH_INFO_METRIC) &&
7697              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7698                          pinfo->metric)) ||
7699             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7700              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7701                          pinfo->exptime)) ||
7702             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7703              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7704                         pinfo->flags)) ||
7705             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7706              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7707                          pinfo->discovery_timeout)) ||
7708             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7709              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7710                         pinfo->discovery_retries)) ||
7711             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7712              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7713                         pinfo->hop_count)) ||
7714             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7715              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7716                          pinfo->path_change_count)))
7717                 goto nla_put_failure;
7718
7719         nla_nest_end(msg, pinfoattr);
7720
7721         genlmsg_end(msg, hdr);
7722         return 0;
7723
7724  nla_put_failure:
7725         genlmsg_cancel(msg, hdr);
7726         return -EMSGSIZE;
7727 }
7728
7729 static int nl80211_dump_mpath(struct sk_buff *skb,
7730                               struct netlink_callback *cb)
7731 {
7732         struct mpath_info pinfo;
7733         struct cfg80211_registered_device *rdev;
7734         struct wireless_dev *wdev;
7735         u8 dst[ETH_ALEN];
7736         u8 next_hop[ETH_ALEN];
7737         int path_idx = cb->args[2];
7738         int err;
7739
7740         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7741         if (err)
7742                 return err;
7743         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7744         __acquire(&rdev->wiphy.mtx);
7745
7746         if (!rdev->ops->dump_mpath) {
7747                 err = -EOPNOTSUPP;
7748                 goto out_err;
7749         }
7750
7751         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7752                 err = -EOPNOTSUPP;
7753                 goto out_err;
7754         }
7755
7756         while (1) {
7757                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7758                                       next_hop, &pinfo);
7759                 if (err == -ENOENT)
7760                         break;
7761                 if (err)
7762                         goto out_err;
7763
7764                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7765                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7766                                        wdev->netdev, dst, next_hop,
7767                                        &pinfo) < 0)
7768                         goto out;
7769
7770                 path_idx++;
7771         }
7772
7773  out:
7774         cb->args[2] = path_idx;
7775         err = skb->len;
7776  out_err:
7777         wiphy_unlock(&rdev->wiphy);
7778         return err;
7779 }
7780
7781 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7782 {
7783         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7784         int err;
7785         struct net_device *dev = info->user_ptr[1];
7786         struct mpath_info pinfo;
7787         struct sk_buff *msg;
7788         u8 *dst = NULL;
7789         u8 next_hop[ETH_ALEN];
7790
7791         memset(&pinfo, 0, sizeof(pinfo));
7792
7793         if (!info->attrs[NL80211_ATTR_MAC])
7794                 return -EINVAL;
7795
7796         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7797
7798         if (!rdev->ops->get_mpath)
7799                 return -EOPNOTSUPP;
7800
7801         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7802                 return -EOPNOTSUPP;
7803
7804         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7805         if (err)
7806                 return err;
7807
7808         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7809         if (!msg)
7810                 return -ENOMEM;
7811
7812         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7813                                  dev, dst, next_hop, &pinfo) < 0) {
7814                 nlmsg_free(msg);
7815                 return -ENOBUFS;
7816         }
7817
7818         return genlmsg_reply(msg, info);
7819 }
7820
7821 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7822 {
7823         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7824         struct net_device *dev = info->user_ptr[1];
7825         u8 *dst = NULL;
7826         u8 *next_hop = NULL;
7827
7828         if (!info->attrs[NL80211_ATTR_MAC])
7829                 return -EINVAL;
7830
7831         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7832                 return -EINVAL;
7833
7834         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7835         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7836
7837         if (!rdev->ops->change_mpath)
7838                 return -EOPNOTSUPP;
7839
7840         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7841                 return -EOPNOTSUPP;
7842
7843         return rdev_change_mpath(rdev, dev, dst, next_hop);
7844 }
7845
7846 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7847 {
7848         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7849         struct net_device *dev = info->user_ptr[1];
7850         u8 *dst = NULL;
7851         u8 *next_hop = NULL;
7852
7853         if (!info->attrs[NL80211_ATTR_MAC])
7854                 return -EINVAL;
7855
7856         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7857                 return -EINVAL;
7858
7859         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7860         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7861
7862         if (!rdev->ops->add_mpath)
7863                 return -EOPNOTSUPP;
7864
7865         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7866                 return -EOPNOTSUPP;
7867
7868         return rdev_add_mpath(rdev, dev, dst, next_hop);
7869 }
7870
7871 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7872 {
7873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7874         struct net_device *dev = info->user_ptr[1];
7875         u8 *dst = NULL;
7876
7877         if (info->attrs[NL80211_ATTR_MAC])
7878                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7879
7880         if (!rdev->ops->del_mpath)
7881                 return -EOPNOTSUPP;
7882
7883         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7884                 return -EOPNOTSUPP;
7885
7886         return rdev_del_mpath(rdev, dev, dst);
7887 }
7888
7889 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7890 {
7891         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7892         int err;
7893         struct net_device *dev = info->user_ptr[1];
7894         struct mpath_info pinfo;
7895         struct sk_buff *msg;
7896         u8 *dst = NULL;
7897         u8 mpp[ETH_ALEN];
7898
7899         memset(&pinfo, 0, sizeof(pinfo));
7900
7901         if (!info->attrs[NL80211_ATTR_MAC])
7902                 return -EINVAL;
7903
7904         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7905
7906         if (!rdev->ops->get_mpp)
7907                 return -EOPNOTSUPP;
7908
7909         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7910                 return -EOPNOTSUPP;
7911
7912         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7913         if (err)
7914                 return err;
7915
7916         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7917         if (!msg)
7918                 return -ENOMEM;
7919
7920         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7921                                dev, dst, mpp, &pinfo) < 0) {
7922                 nlmsg_free(msg);
7923                 return -ENOBUFS;
7924         }
7925
7926         return genlmsg_reply(msg, info);
7927 }
7928
7929 static int nl80211_dump_mpp(struct sk_buff *skb,
7930                             struct netlink_callback *cb)
7931 {
7932         struct mpath_info pinfo;
7933         struct cfg80211_registered_device *rdev;
7934         struct wireless_dev *wdev;
7935         u8 dst[ETH_ALEN];
7936         u8 mpp[ETH_ALEN];
7937         int path_idx = cb->args[2];
7938         int err;
7939
7940         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7941         if (err)
7942                 return err;
7943         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7944         __acquire(&rdev->wiphy.mtx);
7945
7946         if (!rdev->ops->dump_mpp) {
7947                 err = -EOPNOTSUPP;
7948                 goto out_err;
7949         }
7950
7951         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7952                 err = -EOPNOTSUPP;
7953                 goto out_err;
7954         }
7955
7956         while (1) {
7957                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7958                                     mpp, &pinfo);
7959                 if (err == -ENOENT)
7960                         break;
7961                 if (err)
7962                         goto out_err;
7963
7964                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7965                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7966                                        wdev->netdev, dst, mpp,
7967                                        &pinfo) < 0)
7968                         goto out;
7969
7970                 path_idx++;
7971         }
7972
7973  out:
7974         cb->args[2] = path_idx;
7975         err = skb->len;
7976  out_err:
7977         wiphy_unlock(&rdev->wiphy);
7978         return err;
7979 }
7980
7981 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7982 {
7983         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7984         struct net_device *dev = info->user_ptr[1];
7985         struct bss_parameters params;
7986
7987         memset(&params, 0, sizeof(params));
7988         params.link_id = nl80211_link_id_or_invalid(info->attrs);
7989         /* default to not changing parameters */
7990         params.use_cts_prot = -1;
7991         params.use_short_preamble = -1;
7992         params.use_short_slot_time = -1;
7993         params.ap_isolate = -1;
7994         params.ht_opmode = -1;
7995         params.p2p_ctwindow = -1;
7996         params.p2p_opp_ps = -1;
7997
7998         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7999                 params.use_cts_prot =
8000                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
8001         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
8002                 params.use_short_preamble =
8003                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
8004         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
8005                 params.use_short_slot_time =
8006                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8007         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8008                 params.basic_rates =
8009                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8010                 params.basic_rates_len =
8011                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8012         }
8013         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8014                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8015         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8016                 params.ht_opmode =
8017                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8018
8019         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8020                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8021                         return -EINVAL;
8022                 params.p2p_ctwindow =
8023                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8024                 if (params.p2p_ctwindow != 0 &&
8025                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8026                         return -EINVAL;
8027         }
8028
8029         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8030                 u8 tmp;
8031
8032                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8033                         return -EINVAL;
8034                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8035                 params.p2p_opp_ps = tmp;
8036                 if (params.p2p_opp_ps &&
8037                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8038                         return -EINVAL;
8039         }
8040
8041         if (!rdev->ops->change_bss)
8042                 return -EOPNOTSUPP;
8043
8044         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8045             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8046                 return -EOPNOTSUPP;
8047
8048         return rdev_change_bss(rdev, dev, &params);
8049 }
8050
8051 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8052 {
8053         char *data = NULL;
8054         bool is_indoor;
8055         enum nl80211_user_reg_hint_type user_reg_hint_type;
8056         u32 owner_nlportid;
8057
8058         /*
8059          * You should only get this when cfg80211 hasn't yet initialized
8060          * completely when built-in to the kernel right between the time
8061          * window between nl80211_init() and regulatory_init(), if that is
8062          * even possible.
8063          */
8064         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8065                 return -EINPROGRESS;
8066
8067         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8068                 user_reg_hint_type =
8069                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8070         else
8071                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8072
8073         switch (user_reg_hint_type) {
8074         case NL80211_USER_REG_HINT_USER:
8075         case NL80211_USER_REG_HINT_CELL_BASE:
8076                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8077                         return -EINVAL;
8078
8079                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8080                 return regulatory_hint_user(data, user_reg_hint_type);
8081         case NL80211_USER_REG_HINT_INDOOR:
8082                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8083                         owner_nlportid = info->snd_portid;
8084                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8085                 } else {
8086                         owner_nlportid = 0;
8087                         is_indoor = true;
8088                 }
8089
8090                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
8091         default:
8092                 return -EINVAL;
8093         }
8094 }
8095
8096 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8097 {
8098         return reg_reload_regdb();
8099 }
8100
8101 static int nl80211_get_mesh_config(struct sk_buff *skb,
8102                                    struct genl_info *info)
8103 {
8104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8105         struct net_device *dev = info->user_ptr[1];
8106         struct wireless_dev *wdev = dev->ieee80211_ptr;
8107         struct mesh_config cur_params;
8108         int err = 0;
8109         void *hdr;
8110         struct nlattr *pinfoattr;
8111         struct sk_buff *msg;
8112
8113         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8114                 return -EOPNOTSUPP;
8115
8116         if (!rdev->ops->get_mesh_config)
8117                 return -EOPNOTSUPP;
8118
8119         /* If not connected, get default parameters */
8120         if (!wdev->u.mesh.id_len)
8121                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8122         else
8123                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8124
8125         if (err)
8126                 return err;
8127
8128         /* Draw up a netlink message to send back */
8129         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8130         if (!msg)
8131                 return -ENOMEM;
8132         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8133                              NL80211_CMD_GET_MESH_CONFIG);
8134         if (!hdr)
8135                 goto out;
8136         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8137         if (!pinfoattr)
8138                 goto nla_put_failure;
8139         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8140             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8141                         cur_params.dot11MeshRetryTimeout) ||
8142             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8143                         cur_params.dot11MeshConfirmTimeout) ||
8144             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8145                         cur_params.dot11MeshHoldingTimeout) ||
8146             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8147                         cur_params.dot11MeshMaxPeerLinks) ||
8148             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8149                        cur_params.dot11MeshMaxRetries) ||
8150             nla_put_u8(msg, NL80211_MESHCONF_TTL,
8151                        cur_params.dot11MeshTTL) ||
8152             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8153                        cur_params.element_ttl) ||
8154             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8155                        cur_params.auto_open_plinks) ||
8156             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8157                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8158             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8159                        cur_params.dot11MeshHWMPmaxPREQretries) ||
8160             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8161                         cur_params.path_refresh_time) ||
8162             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8163                         cur_params.min_discovery_timeout) ||
8164             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8165                         cur_params.dot11MeshHWMPactivePathTimeout) ||
8166             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8167                         cur_params.dot11MeshHWMPpreqMinInterval) ||
8168             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8169                         cur_params.dot11MeshHWMPperrMinInterval) ||
8170             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8171                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8172             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8173                        cur_params.dot11MeshHWMPRootMode) ||
8174             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8175                         cur_params.dot11MeshHWMPRannInterval) ||
8176             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8177                        cur_params.dot11MeshGateAnnouncementProtocol) ||
8178             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8179                        cur_params.dot11MeshForwarding) ||
8180             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8181                         cur_params.rssi_threshold) ||
8182             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8183                         cur_params.ht_opmode) ||
8184             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8185                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8186             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8187                         cur_params.dot11MeshHWMProotInterval) ||
8188             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8189                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8190             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8191                         cur_params.power_mode) ||
8192             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8193                         cur_params.dot11MeshAwakeWindowDuration) ||
8194             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8195                         cur_params.plink_timeout) ||
8196             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8197                        cur_params.dot11MeshConnectedToMeshGate) ||
8198             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8199                        cur_params.dot11MeshNolearn) ||
8200             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8201                        cur_params.dot11MeshConnectedToAuthServer))
8202                 goto nla_put_failure;
8203         nla_nest_end(msg, pinfoattr);
8204         genlmsg_end(msg, hdr);
8205         return genlmsg_reply(msg, info);
8206
8207  nla_put_failure:
8208  out:
8209         nlmsg_free(msg);
8210         return -ENOBUFS;
8211 }
8212
8213 static const struct nla_policy
8214 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8215         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8216                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8217         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8218                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8219         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8220                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8221         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8222                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8223         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8224         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8225         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8226         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8227         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8228                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8229         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8230         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8231         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8232         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8233         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8234                 NLA_POLICY_MIN(NLA_U16, 1),
8235         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8236                 NLA_POLICY_MIN(NLA_U16, 1),
8237         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8238                 NLA_POLICY_MIN(NLA_U16, 1),
8239         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8240         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8241                 NLA_POLICY_MIN(NLA_U16, 1),
8242         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8243         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8244         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8245                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8246         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8247         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8248         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8249                 NLA_POLICY_MIN(NLA_U16, 1),
8250         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8251                 NLA_POLICY_MIN(NLA_U16, 1),
8252         [NL80211_MESHCONF_POWER_MODE] =
8253                 NLA_POLICY_RANGE(NLA_U32,
8254                                  NL80211_MESH_POWER_ACTIVE,
8255                                  NL80211_MESH_POWER_MAX),
8256         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8257         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8258         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8259         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8260         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8261 };
8262
8263 static const struct nla_policy
8264         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8265         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8266         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8267         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8268         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8269         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8270         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8271         [NL80211_MESH_SETUP_IE] =
8272                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8273                                        IEEE80211_MAX_DATA_LEN),
8274         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8275 };
8276
8277 static int nl80211_parse_mesh_config(struct genl_info *info,
8278                                      struct mesh_config *cfg,
8279                                      u32 *mask_out)
8280 {
8281         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8282         u32 mask = 0;
8283         u16 ht_opmode;
8284
8285 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8286 do {                                                                    \
8287         if (tb[attr]) {                                                 \
8288                 cfg->param = fn(tb[attr]);                              \
8289                 mask |= BIT((attr) - 1);                                \
8290         }                                                               \
8291 } while (0)
8292
8293         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8294                 return -EINVAL;
8295         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8296                 return -EINVAL;
8297
8298         /* This makes sure that there aren't more than 32 mesh config
8299          * parameters (otherwise our bitfield scheme would not work.) */
8300         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8301
8302         /* Fill in the params struct */
8303         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8304                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8305         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8306                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8307                                   nla_get_u16);
8308         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8309                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8310                                   nla_get_u16);
8311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8312                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8313                                   nla_get_u16);
8314         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8315                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8316         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8317                                   NL80211_MESHCONF_TTL, nla_get_u8);
8318         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8319                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8321                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8322                                   nla_get_u8);
8323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8324                                   mask,
8325                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8326                                   nla_get_u32);
8327         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8328                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8329                                   nla_get_u8);
8330         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8331                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8332                                   nla_get_u32);
8333         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8334             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8335                 return -EINVAL;
8336         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8337                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8338                                   nla_get_u16);
8339         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8340                                   mask,
8341                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8342                                   nla_get_u32);
8343         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8344             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8345              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8346                 return -EINVAL;
8347         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8348                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8349                                   nla_get_u16);
8350         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8351                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8352                                   nla_get_u16);
8353         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8354                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8355                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8356                                   nla_get_u16);
8357         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8358                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8359         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8360                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8361                                   nla_get_u16);
8362         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8363                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8364                                   nla_get_u8);
8365         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8366                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8368                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8369                                   nla_get_s32);
8370         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8371                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8372                                   nla_get_u8);
8373         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8374                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8375                                   nla_get_u8);
8376         /*
8377          * Check HT operation mode based on
8378          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8379          */
8380         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8381                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8382
8383                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8384                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8385                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8386                         return -EINVAL;
8387
8388                 /* NON_HT_STA bit is reserved, but some programs set it */
8389                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8390
8391                 cfg->ht_opmode = ht_opmode;
8392                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8393         }
8394         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8395                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8396                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8397                                   nla_get_u32);
8398         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8399             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8400              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8401                 return -EINVAL;
8402         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8403                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8404                                   nla_get_u16);
8405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8406                                   mask,
8407                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8408                                   nla_get_u16);
8409         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8410                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8411         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8412                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8413         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8414                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8415         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8416                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8417         if (mask_out)
8418                 *mask_out = mask;
8419
8420         return 0;
8421
8422 #undef FILL_IN_MESH_PARAM_IF_SET
8423 }
8424
8425 static int nl80211_parse_mesh_setup(struct genl_info *info,
8426                                      struct mesh_setup *setup)
8427 {
8428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8429         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8430
8431         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8432                 return -EINVAL;
8433         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8434                 return -EINVAL;
8435
8436         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8437                 setup->sync_method =
8438                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8439                  IEEE80211_SYNC_METHOD_VENDOR :
8440                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8441
8442         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8443                 setup->path_sel_proto =
8444                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8445                  IEEE80211_PATH_PROTOCOL_VENDOR :
8446                  IEEE80211_PATH_PROTOCOL_HWMP;
8447
8448         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8449                 setup->path_metric =
8450                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8451                  IEEE80211_PATH_METRIC_VENDOR :
8452                  IEEE80211_PATH_METRIC_AIRTIME;
8453
8454         if (tb[NL80211_MESH_SETUP_IE]) {
8455                 struct nlattr *ieattr =
8456                         tb[NL80211_MESH_SETUP_IE];
8457                 setup->ie = nla_data(ieattr);
8458                 setup->ie_len = nla_len(ieattr);
8459         }
8460         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8461             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8462                 return -EINVAL;
8463         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8464         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8465         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8466         if (setup->is_secure)
8467                 setup->user_mpm = true;
8468
8469         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8470                 if (!setup->user_mpm)
8471                         return -EINVAL;
8472                 setup->auth_id =
8473                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8474         }
8475
8476         return 0;
8477 }
8478
8479 static int nl80211_update_mesh_config(struct sk_buff *skb,
8480                                       struct genl_info *info)
8481 {
8482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8483         struct net_device *dev = info->user_ptr[1];
8484         struct wireless_dev *wdev = dev->ieee80211_ptr;
8485         struct mesh_config cfg = {};
8486         u32 mask;
8487         int err;
8488
8489         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8490                 return -EOPNOTSUPP;
8491
8492         if (!rdev->ops->update_mesh_config)
8493                 return -EOPNOTSUPP;
8494
8495         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8496         if (err)
8497                 return err;
8498
8499         if (!wdev->u.mesh.id_len)
8500                 err = -ENOLINK;
8501
8502         if (!err)
8503                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8504
8505         return err;
8506 }
8507
8508 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8509                               struct sk_buff *msg)
8510 {
8511         struct nlattr *nl_reg_rules;
8512         unsigned int i;
8513
8514         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8515             (regdom->dfs_region &&
8516              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8517                 goto nla_put_failure;
8518
8519         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8520         if (!nl_reg_rules)
8521                 goto nla_put_failure;
8522
8523         for (i = 0; i < regdom->n_reg_rules; i++) {
8524                 struct nlattr *nl_reg_rule;
8525                 const struct ieee80211_reg_rule *reg_rule;
8526                 const struct ieee80211_freq_range *freq_range;
8527                 const struct ieee80211_power_rule *power_rule;
8528                 unsigned int max_bandwidth_khz;
8529
8530                 reg_rule = &regdom->reg_rules[i];
8531                 freq_range = &reg_rule->freq_range;
8532                 power_rule = &reg_rule->power_rule;
8533
8534                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8535                 if (!nl_reg_rule)
8536                         goto nla_put_failure;
8537
8538                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8539                 if (!max_bandwidth_khz)
8540                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8541                                                                   reg_rule);
8542
8543                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8544                                 reg_rule->flags) ||
8545                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8546                                 freq_range->start_freq_khz) ||
8547                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8548                                 freq_range->end_freq_khz) ||
8549                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8550                                 max_bandwidth_khz) ||
8551                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8552                                 power_rule->max_antenna_gain) ||
8553                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8554                                 power_rule->max_eirp) ||
8555                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8556                                 reg_rule->dfs_cac_ms))
8557                         goto nla_put_failure;
8558
8559                 if ((reg_rule->flags & NL80211_RRF_PSD) &&
8560                     nla_put_s8(msg, NL80211_ATTR_POWER_RULE_PSD,
8561                                reg_rule->psd))
8562                         goto nla_put_failure;
8563
8564                 nla_nest_end(msg, nl_reg_rule);
8565         }
8566
8567         nla_nest_end(msg, nl_reg_rules);
8568         return 0;
8569
8570 nla_put_failure:
8571         return -EMSGSIZE;
8572 }
8573
8574 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8575 {
8576         const struct ieee80211_regdomain *regdom = NULL;
8577         struct cfg80211_registered_device *rdev;
8578         struct wiphy *wiphy = NULL;
8579         struct sk_buff *msg;
8580         int err = -EMSGSIZE;
8581         void *hdr;
8582
8583         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8584         if (!msg)
8585                 return -ENOBUFS;
8586
8587         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8588                              NL80211_CMD_GET_REG);
8589         if (!hdr)
8590                 goto put_failure;
8591
8592         rtnl_lock();
8593
8594         if (info->attrs[NL80211_ATTR_WIPHY]) {
8595                 bool self_managed;
8596
8597                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8598                 if (IS_ERR(rdev)) {
8599                         err = PTR_ERR(rdev);
8600                         goto nla_put_failure;
8601                 }
8602
8603                 wiphy = &rdev->wiphy;
8604                 self_managed = wiphy->regulatory_flags &
8605                                REGULATORY_WIPHY_SELF_MANAGED;
8606
8607                 rcu_read_lock();
8608
8609                 regdom = get_wiphy_regdom(wiphy);
8610
8611                 /* a self-managed-reg device must have a private regdom */
8612                 if (WARN_ON(!regdom && self_managed)) {
8613                         err = -EINVAL;
8614                         goto nla_put_failure_rcu;
8615                 }
8616
8617                 if (regdom &&
8618                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8619                         goto nla_put_failure_rcu;
8620         } else {
8621                 rcu_read_lock();
8622         }
8623
8624         if (!wiphy && reg_last_request_cell_base() &&
8625             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8626                         NL80211_USER_REG_HINT_CELL_BASE))
8627                 goto nla_put_failure_rcu;
8628
8629         if (!regdom)
8630                 regdom = rcu_dereference(cfg80211_regdomain);
8631
8632         if (nl80211_put_regdom(regdom, msg))
8633                 goto nla_put_failure_rcu;
8634
8635         rcu_read_unlock();
8636
8637         genlmsg_end(msg, hdr);
8638         rtnl_unlock();
8639         return genlmsg_reply(msg, info);
8640
8641 nla_put_failure_rcu:
8642         rcu_read_unlock();
8643 nla_put_failure:
8644         rtnl_unlock();
8645 put_failure:
8646         nlmsg_free(msg);
8647         return err;
8648 }
8649
8650 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8651                                u32 seq, int flags, struct wiphy *wiphy,
8652                                const struct ieee80211_regdomain *regdom)
8653 {
8654         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8655                                    NL80211_CMD_GET_REG);
8656
8657         if (!hdr)
8658                 return -1;
8659
8660         genl_dump_check_consistent(cb, hdr);
8661
8662         if (nl80211_put_regdom(regdom, msg))
8663                 goto nla_put_failure;
8664
8665         if (!wiphy && reg_last_request_cell_base() &&
8666             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8667                         NL80211_USER_REG_HINT_CELL_BASE))
8668                 goto nla_put_failure;
8669
8670         if (wiphy &&
8671             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8672                 goto nla_put_failure;
8673
8674         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8675             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8676                 goto nla_put_failure;
8677
8678         genlmsg_end(msg, hdr);
8679         return 0;
8680
8681 nla_put_failure:
8682         genlmsg_cancel(msg, hdr);
8683         return -EMSGSIZE;
8684 }
8685
8686 static int nl80211_get_reg_dump(struct sk_buff *skb,
8687                                 struct netlink_callback *cb)
8688 {
8689         const struct ieee80211_regdomain *regdom = NULL;
8690         struct cfg80211_registered_device *rdev;
8691         int err, reg_idx, start = cb->args[2];
8692
8693         rcu_read_lock();
8694
8695         if (cfg80211_regdomain && start == 0) {
8696                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8697                                           NLM_F_MULTI, NULL,
8698                                           rcu_dereference(cfg80211_regdomain));
8699                 if (err < 0)
8700                         goto out_err;
8701         }
8702
8703         /* the global regdom is idx 0 */
8704         reg_idx = 1;
8705         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8706                 regdom = get_wiphy_regdom(&rdev->wiphy);
8707                 if (!regdom)
8708                         continue;
8709
8710                 if (++reg_idx <= start)
8711                         continue;
8712
8713                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8714                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8715                 if (err < 0) {
8716                         reg_idx--;
8717                         break;
8718                 }
8719         }
8720
8721         cb->args[2] = reg_idx;
8722         err = skb->len;
8723 out_err:
8724         rcu_read_unlock();
8725         return err;
8726 }
8727
8728 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8729 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8730         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8731         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8732         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8733         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8734         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8735         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8736         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8737 };
8738
8739 static int parse_reg_rule(struct nlattr *tb[],
8740         struct ieee80211_reg_rule *reg_rule)
8741 {
8742         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8743         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8744
8745         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8746                 return -EINVAL;
8747         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8748                 return -EINVAL;
8749         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8750                 return -EINVAL;
8751         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8752                 return -EINVAL;
8753         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8754                 return -EINVAL;
8755
8756         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8757
8758         freq_range->start_freq_khz =
8759                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8760         freq_range->end_freq_khz =
8761                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8762         freq_range->max_bandwidth_khz =
8763                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8764
8765         power_rule->max_eirp =
8766                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8767
8768         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8769                 power_rule->max_antenna_gain =
8770                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8771
8772         if (tb[NL80211_ATTR_DFS_CAC_TIME])
8773                 reg_rule->dfs_cac_ms =
8774                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8775
8776         return 0;
8777 }
8778
8779 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8780 {
8781         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8782         struct nlattr *nl_reg_rule;
8783         char *alpha2;
8784         int rem_reg_rules, r;
8785         u32 num_rules = 0, rule_idx = 0;
8786         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8787         struct ieee80211_regdomain *rd;
8788
8789         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8790                 return -EINVAL;
8791
8792         if (!info->attrs[NL80211_ATTR_REG_RULES])
8793                 return -EINVAL;
8794
8795         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8796
8797         if (info->attrs[NL80211_ATTR_DFS_REGION])
8798                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8799
8800         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8801                             rem_reg_rules) {
8802                 num_rules++;
8803                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8804                         return -EINVAL;
8805         }
8806
8807         rtnl_lock();
8808         if (!reg_is_valid_request(alpha2)) {
8809                 r = -EINVAL;
8810                 goto out;
8811         }
8812
8813         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8814         if (!rd) {
8815                 r = -ENOMEM;
8816                 goto out;
8817         }
8818
8819         rd->n_reg_rules = num_rules;
8820         rd->alpha2[0] = alpha2[0];
8821         rd->alpha2[1] = alpha2[1];
8822
8823         /*
8824          * Disable DFS master mode if the DFS region was
8825          * not supported or known on this kernel.
8826          */
8827         if (reg_supported_dfs_region(dfs_region))
8828                 rd->dfs_region = dfs_region;
8829
8830         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8831                             rem_reg_rules) {
8832                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8833                                                 nl_reg_rule, reg_rule_policy,
8834                                                 info->extack);
8835                 if (r)
8836                         goto bad_reg;
8837                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8838                 if (r)
8839                         goto bad_reg;
8840
8841                 rule_idx++;
8842
8843                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8844                         r = -EINVAL;
8845                         goto bad_reg;
8846                 }
8847         }
8848
8849         r = set_regdom(rd, REGD_SOURCE_CRDA);
8850         /* set_regdom takes ownership of rd */
8851         rd = NULL;
8852  bad_reg:
8853         kfree(rd);
8854  out:
8855         rtnl_unlock();
8856         return r;
8857 }
8858 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8859
8860 static int validate_scan_freqs(struct nlattr *freqs)
8861 {
8862         struct nlattr *attr1, *attr2;
8863         int n_channels = 0, tmp1, tmp2;
8864
8865         nla_for_each_nested(attr1, freqs, tmp1)
8866                 if (nla_len(attr1) != sizeof(u32))
8867                         return 0;
8868
8869         nla_for_each_nested(attr1, freqs, tmp1) {
8870                 n_channels++;
8871                 /*
8872                  * Some hardware has a limited channel list for
8873                  * scanning, and it is pretty much nonsensical
8874                  * to scan for a channel twice, so disallow that
8875                  * and don't require drivers to check that the
8876                  * channel list they get isn't longer than what
8877                  * they can scan, as long as they can scan all
8878                  * the channels they registered at once.
8879                  */
8880                 nla_for_each_nested(attr2, freqs, tmp2)
8881                         if (attr1 != attr2 &&
8882                             nla_get_u32(attr1) == nla_get_u32(attr2))
8883                                 return 0;
8884         }
8885
8886         return n_channels;
8887 }
8888
8889 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8890 {
8891         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8892 }
8893
8894 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8895                             struct cfg80211_bss_selection *bss_select)
8896 {
8897         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8898         struct nlattr *nest;
8899         int err;
8900         bool found = false;
8901         int i;
8902
8903         /* only process one nested attribute */
8904         nest = nla_data(nla);
8905         if (!nla_ok(nest, nla_len(nest)))
8906                 return -EINVAL;
8907
8908         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8909                                           nest, nl80211_bss_select_policy,
8910                                           NULL);
8911         if (err)
8912                 return err;
8913
8914         /* only one attribute may be given */
8915         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8916                 if (attr[i]) {
8917                         if (found)
8918                                 return -EINVAL;
8919                         found = true;
8920                 }
8921         }
8922
8923         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8924
8925         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8926                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8927
8928         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8929                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8930                 bss_select->param.band_pref =
8931                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8932                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8933                         return -EINVAL;
8934         }
8935
8936         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8937                 struct nl80211_bss_select_rssi_adjust *adj_param;
8938
8939                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8940                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8941                 bss_select->param.adjust.band = adj_param->band;
8942                 bss_select->param.adjust.delta = adj_param->delta;
8943                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8944                         return -EINVAL;
8945         }
8946
8947         /* user-space did not provide behaviour attribute */
8948         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8949                 return -EINVAL;
8950
8951         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8952                 return -EINVAL;
8953
8954         return 0;
8955 }
8956
8957 int nl80211_parse_random_mac(struct nlattr **attrs,
8958                              u8 *mac_addr, u8 *mac_addr_mask)
8959 {
8960         int i;
8961
8962         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8963                 eth_zero_addr(mac_addr);
8964                 eth_zero_addr(mac_addr_mask);
8965                 mac_addr[0] = 0x2;
8966                 mac_addr_mask[0] = 0x3;
8967
8968                 return 0;
8969         }
8970
8971         /* need both or none */
8972         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8973                 return -EINVAL;
8974
8975         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8976         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8977
8978         /* don't allow or configure an mcast address */
8979         if (!is_multicast_ether_addr(mac_addr_mask) ||
8980             is_multicast_ether_addr(mac_addr))
8981                 return -EINVAL;
8982
8983         /*
8984          * allow users to pass a MAC address that has bits set outside
8985          * of the mask, but don't bother drivers with having to deal
8986          * with such bits
8987          */
8988         for (i = 0; i < ETH_ALEN; i++)
8989                 mac_addr[i] &= mac_addr_mask[i];
8990
8991         return 0;
8992 }
8993
8994 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8995                                               struct ieee80211_channel *chan)
8996 {
8997         unsigned int link_id;
8998         bool all_ok = true;
8999
9000         lockdep_assert_wiphy(wdev->wiphy);
9001
9002         if (!cfg80211_beaconing_iface_active(wdev))
9003                 return true;
9004
9005         /*
9006          * FIXME: check if we have a free HW resource/link for chan
9007          *
9008          * This, as well as the FIXME below, requires knowing the link
9009          * capabilities of the hardware.
9010          */
9011
9012         /* we cannot leave radar channels */
9013         for_each_valid_link(wdev, link_id) {
9014                 struct cfg80211_chan_def *chandef;
9015
9016                 chandef = wdev_chandef(wdev, link_id);
9017                 if (!chandef || !chandef->chan)
9018                         continue;
9019
9020                 /*
9021                  * FIXME: don't require all_ok, but rather check only the
9022                  *        correct HW resource/link onto which 'chan' falls,
9023                  *        as only that link leaves the channel for doing
9024                  *        the off-channel operation.
9025                  */
9026
9027                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9028                         all_ok = false;
9029         }
9030
9031         if (all_ok)
9032                 return true;
9033
9034         return regulatory_pre_cac_allowed(wdev->wiphy);
9035 }
9036
9037 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9038                                     enum nl80211_ext_feature_index feat)
9039 {
9040         if (!(flags & flag))
9041                 return true;
9042         if (wiphy_ext_feature_isset(wiphy, feat))
9043                 return true;
9044         return false;
9045 }
9046
9047 static int
9048 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9049                          void *request, struct nlattr **attrs,
9050                          bool is_sched_scan)
9051 {
9052         u8 *mac_addr, *mac_addr_mask;
9053         u32 *flags;
9054         enum nl80211_feature_flags randomness_flag;
9055
9056         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9057                 return 0;
9058
9059         if (is_sched_scan) {
9060                 struct cfg80211_sched_scan_request *req = request;
9061
9062                 randomness_flag = wdev ?
9063                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9064                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9065                 flags = &req->flags;
9066                 mac_addr = req->mac_addr;
9067                 mac_addr_mask = req->mac_addr_mask;
9068         } else {
9069                 struct cfg80211_scan_request *req = request;
9070
9071                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9072                 flags = &req->flags;
9073                 mac_addr = req->mac_addr;
9074                 mac_addr_mask = req->mac_addr_mask;
9075         }
9076
9077         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9078
9079         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9080              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9081             !nl80211_check_scan_feat(wiphy, *flags,
9082                                      NL80211_SCAN_FLAG_LOW_SPAN,
9083                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9084             !nl80211_check_scan_feat(wiphy, *flags,
9085                                      NL80211_SCAN_FLAG_LOW_POWER,
9086                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9087             !nl80211_check_scan_feat(wiphy, *flags,
9088                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
9089                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9090             !nl80211_check_scan_feat(wiphy, *flags,
9091                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9092                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9093             !nl80211_check_scan_feat(wiphy, *flags,
9094                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9095                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9096             !nl80211_check_scan_feat(wiphy, *flags,
9097                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9098                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9099             !nl80211_check_scan_feat(wiphy, *flags,
9100                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9101                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9102             !nl80211_check_scan_feat(wiphy, *flags,
9103                                      NL80211_SCAN_FLAG_RANDOM_SN,
9104                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9105             !nl80211_check_scan_feat(wiphy, *flags,
9106                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9107                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9108                 return -EOPNOTSUPP;
9109
9110         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9111                 int err;
9112
9113                 if (!(wiphy->features & randomness_flag) ||
9114                     (wdev && wdev->connected))
9115                         return -EOPNOTSUPP;
9116
9117                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9118                 if (err)
9119                         return err;
9120         }
9121
9122         return 0;
9123 }
9124
9125 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9126 {
9127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9128         struct wireless_dev *wdev = info->user_ptr[1];
9129         struct cfg80211_scan_request *request;
9130         struct nlattr *scan_freqs = NULL;
9131         bool scan_freqs_khz = false;
9132         struct nlattr *attr;
9133         struct wiphy *wiphy;
9134         int err, tmp, n_ssids = 0, n_channels, i;
9135         size_t ie_len, size;
9136
9137         wiphy = &rdev->wiphy;
9138
9139         if (wdev->iftype == NL80211_IFTYPE_NAN)
9140                 return -EOPNOTSUPP;
9141
9142         if (!rdev->ops->scan)
9143                 return -EOPNOTSUPP;
9144
9145         if (rdev->scan_req || rdev->scan_msg)
9146                 return -EBUSY;
9147
9148         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9149                 if (!wiphy_ext_feature_isset(wiphy,
9150                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9151                         return -EOPNOTSUPP;
9152                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9153                 scan_freqs_khz = true;
9154         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9155                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9156
9157         if (scan_freqs) {
9158                 n_channels = validate_scan_freqs(scan_freqs);
9159                 if (!n_channels)
9160                         return -EINVAL;
9161         } else {
9162                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9163         }
9164
9165         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9166                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9167                         n_ssids++;
9168
9169         if (n_ssids > wiphy->max_scan_ssids)
9170                 return -EINVAL;
9171
9172         if (info->attrs[NL80211_ATTR_IE])
9173                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9174         else
9175                 ie_len = 0;
9176
9177         if (ie_len > wiphy->max_scan_ie_len)
9178                 return -EINVAL;
9179
9180         size = struct_size(request, channels, n_channels);
9181         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9182         size = size_add(size, ie_len);
9183         request = kzalloc(size, GFP_KERNEL);
9184         if (!request)
9185                 return -ENOMEM;
9186
9187         if (n_ssids)
9188                 request->ssids = (void *)&request->channels[n_channels];
9189         request->n_ssids = n_ssids;
9190         if (ie_len) {
9191                 if (n_ssids)
9192                         request->ie = (void *)(request->ssids + n_ssids);
9193                 else
9194                         request->ie = (void *)(request->channels + n_channels);
9195         }
9196
9197         i = 0;
9198         if (scan_freqs) {
9199                 /* user specified, bail out if channel not found */
9200                 nla_for_each_nested(attr, scan_freqs, tmp) {
9201                         struct ieee80211_channel *chan;
9202                         int freq = nla_get_u32(attr);
9203
9204                         if (!scan_freqs_khz)
9205                                 freq = MHZ_TO_KHZ(freq);
9206
9207                         chan = ieee80211_get_channel_khz(wiphy, freq);
9208                         if (!chan) {
9209                                 err = -EINVAL;
9210                                 goto out_free;
9211                         }
9212
9213                         /* ignore disabled channels */
9214                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9215                                 continue;
9216
9217                         request->channels[i] = chan;
9218                         i++;
9219                 }
9220         } else {
9221                 enum nl80211_band band;
9222
9223                 /* all channels */
9224                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9225                         int j;
9226
9227                         if (!wiphy->bands[band])
9228                                 continue;
9229                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9230                                 struct ieee80211_channel *chan;
9231
9232                                 chan = &wiphy->bands[band]->channels[j];
9233
9234                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9235                                         continue;
9236
9237                                 request->channels[i] = chan;
9238                                 i++;
9239                         }
9240                 }
9241         }
9242
9243         if (!i) {
9244                 err = -EINVAL;
9245                 goto out_free;
9246         }
9247
9248         request->n_channels = i;
9249
9250         for (i = 0; i < request->n_channels; i++) {
9251                 struct ieee80211_channel *chan = request->channels[i];
9252
9253                 /* if we can go off-channel to the target channel we're good */
9254                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9255                         continue;
9256
9257                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9258                         err = -EBUSY;
9259                         goto out_free;
9260                 }
9261         }
9262
9263         i = 0;
9264         if (n_ssids) {
9265                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9266                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9267                                 err = -EINVAL;
9268                                 goto out_free;
9269                         }
9270                         request->ssids[i].ssid_len = nla_len(attr);
9271                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9272                         i++;
9273                 }
9274         }
9275
9276         if (info->attrs[NL80211_ATTR_IE]) {
9277                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9278                 memcpy((void *)request->ie,
9279                        nla_data(info->attrs[NL80211_ATTR_IE]),
9280                        request->ie_len);
9281         }
9282
9283         for (i = 0; i < NUM_NL80211_BANDS; i++)
9284                 if (wiphy->bands[i])
9285                         request->rates[i] =
9286                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9287
9288         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9289                 nla_for_each_nested(attr,
9290                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9291                                     tmp) {
9292                         enum nl80211_band band = nla_type(attr);
9293
9294                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9295                                 err = -EINVAL;
9296                                 goto out_free;
9297                         }
9298
9299                         if (!wiphy->bands[band])
9300                                 continue;
9301
9302                         err = ieee80211_get_ratemask(wiphy->bands[band],
9303                                                      nla_data(attr),
9304                                                      nla_len(attr),
9305                                                      &request->rates[band]);
9306                         if (err)
9307                                 goto out_free;
9308                 }
9309         }
9310
9311         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9312                 request->duration =
9313                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9314                 request->duration_mandatory =
9315                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9316         }
9317
9318         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9319                                        false);
9320         if (err)
9321                 goto out_free;
9322
9323         request->no_cck =
9324                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9325
9326         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9327          * BSSID to scan for. This was problematic because that same attribute
9328          * was already used for another purpose (local random MAC address). The
9329          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9330          * compatibility with older userspace components, also use the
9331          * NL80211_ATTR_MAC value here if it can be determined to be used for
9332          * the specific BSSID use case instead of the random MAC address
9333          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9334          */
9335         if (info->attrs[NL80211_ATTR_BSSID])
9336                 memcpy(request->bssid,
9337                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9338         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9339                  info->attrs[NL80211_ATTR_MAC])
9340                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9341                        ETH_ALEN);
9342         else
9343                 eth_broadcast_addr(request->bssid);
9344
9345         request->wdev = wdev;
9346         request->wiphy = &rdev->wiphy;
9347         request->scan_start = jiffies;
9348
9349         rdev->scan_req = request;
9350         err = cfg80211_scan(rdev);
9351
9352         if (err)
9353                 goto out_free;
9354
9355         nl80211_send_scan_start(rdev, wdev);
9356         dev_hold(wdev->netdev);
9357
9358         return 0;
9359
9360  out_free:
9361         rdev->scan_req = NULL;
9362         kfree(request);
9363
9364         return err;
9365 }
9366
9367 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9368 {
9369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9370         struct wireless_dev *wdev = info->user_ptr[1];
9371
9372         if (!rdev->ops->abort_scan)
9373                 return -EOPNOTSUPP;
9374
9375         if (rdev->scan_msg)
9376                 return 0;
9377
9378         if (!rdev->scan_req)
9379                 return -ENOENT;
9380
9381         rdev_abort_scan(rdev, wdev);
9382         return 0;
9383 }
9384
9385 static int
9386 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9387                                struct cfg80211_sched_scan_request *request,
9388                                struct nlattr **attrs)
9389 {
9390         int tmp, err, i = 0;
9391         struct nlattr *attr;
9392
9393         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9394                 u32 interval;
9395
9396                 /*
9397                  * If scan plans are not specified,
9398                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9399                  * case one scan plan will be set with the specified scan
9400                  * interval and infinite number of iterations.
9401                  */
9402                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9403                 if (!interval)
9404                         return -EINVAL;
9405
9406                 request->scan_plans[0].interval =
9407                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9408                 if (!request->scan_plans[0].interval)
9409                         return -EINVAL;
9410
9411                 if (request->scan_plans[0].interval >
9412                     wiphy->max_sched_scan_plan_interval)
9413                         request->scan_plans[0].interval =
9414                                 wiphy->max_sched_scan_plan_interval;
9415
9416                 return 0;
9417         }
9418
9419         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9420                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9421
9422                 if (WARN_ON(i >= n_plans))
9423                         return -EINVAL;
9424
9425                 err = nla_parse_nested_deprecated(plan,
9426                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9427                                                   attr, nl80211_plan_policy,
9428                                                   NULL);
9429                 if (err)
9430                         return err;
9431
9432                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9433                         return -EINVAL;
9434
9435                 request->scan_plans[i].interval =
9436                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9437                 if (!request->scan_plans[i].interval ||
9438                     request->scan_plans[i].interval >
9439                     wiphy->max_sched_scan_plan_interval)
9440                         return -EINVAL;
9441
9442                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9443                         request->scan_plans[i].iterations =
9444                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9445                         if (!request->scan_plans[i].iterations ||
9446                             (request->scan_plans[i].iterations >
9447                              wiphy->max_sched_scan_plan_iterations))
9448                                 return -EINVAL;
9449                 } else if (i < n_plans - 1) {
9450                         /*
9451                          * All scan plans but the last one must specify
9452                          * a finite number of iterations
9453                          */
9454                         return -EINVAL;
9455                 }
9456
9457                 i++;
9458         }
9459
9460         /*
9461          * The last scan plan must not specify the number of
9462          * iterations, it is supposed to run infinitely
9463          */
9464         if (request->scan_plans[n_plans - 1].iterations)
9465                 return  -EINVAL;
9466
9467         return 0;
9468 }
9469
9470 static int
9471 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9472                                        struct cfg80211_match_set *match_sets,
9473                                        struct nlattr *tb_band_rssi,
9474                                        s32 rssi_thold)
9475 {
9476         struct nlattr *attr;
9477         int i, tmp, ret = 0;
9478
9479         if (!wiphy_ext_feature_isset(wiphy,
9480                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9481                 if (tb_band_rssi)
9482                         ret = -EOPNOTSUPP;
9483                 else
9484                         for (i = 0; i < NUM_NL80211_BANDS; i++)
9485                                 match_sets->per_band_rssi_thold[i] =
9486                                         NL80211_SCAN_RSSI_THOLD_OFF;
9487                 return ret;
9488         }
9489
9490         for (i = 0; i < NUM_NL80211_BANDS; i++)
9491                 match_sets->per_band_rssi_thold[i] = rssi_thold;
9492
9493         nla_for_each_nested(attr, tb_band_rssi, tmp) {
9494                 enum nl80211_band band = nla_type(attr);
9495
9496                 if (band < 0 || band >= NUM_NL80211_BANDS)
9497                         return -EINVAL;
9498
9499                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9500         }
9501
9502         return 0;
9503 }
9504
9505 static struct cfg80211_sched_scan_request *
9506 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9507                          struct nlattr **attrs, int max_match_sets)
9508 {
9509         struct cfg80211_sched_scan_request *request;
9510         struct nlattr *attr;
9511         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9512         enum nl80211_band band;
9513         size_t ie_len, size;
9514         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9515         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9516
9517         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9518                 n_channels = validate_scan_freqs(
9519                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9520                 if (!n_channels)
9521                         return ERR_PTR(-EINVAL);
9522         } else {
9523                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9524         }
9525
9526         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9527                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9528                                     tmp)
9529                         n_ssids++;
9530
9531         if (n_ssids > wiphy->max_sched_scan_ssids)
9532                 return ERR_PTR(-EINVAL);
9533
9534         /*
9535          * First, count the number of 'real' matchsets. Due to an issue with
9536          * the old implementation, matchsets containing only the RSSI attribute
9537          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9538          * RSSI for all matchsets, rather than their own matchset for reporting
9539          * all APs with a strong RSSI. This is needed to be compatible with
9540          * older userspace that treated a matchset with only the RSSI as the
9541          * global RSSI for all other matchsets - if there are other matchsets.
9542          */
9543         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9544                 nla_for_each_nested(attr,
9545                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9546                                     tmp) {
9547                         struct nlattr *rssi;
9548
9549                         err = nla_parse_nested_deprecated(tb,
9550                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9551                                                           attr,
9552                                                           nl80211_match_policy,
9553                                                           NULL);
9554                         if (err)
9555                                 return ERR_PTR(err);
9556
9557                         /* SSID and BSSID are mutually exclusive */
9558                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9559                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9560                                 return ERR_PTR(-EINVAL);
9561
9562                         /* add other standalone attributes here */
9563                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9564                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9565                                 n_match_sets++;
9566                                 continue;
9567                         }
9568                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9569                         if (rssi)
9570                                 default_match_rssi = nla_get_s32(rssi);
9571                 }
9572         }
9573
9574         /* However, if there's no other matchset, add the RSSI one */
9575         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9576                 n_match_sets = 1;
9577
9578         if (n_match_sets > max_match_sets)
9579                 return ERR_PTR(-EINVAL);
9580
9581         if (attrs[NL80211_ATTR_IE])
9582                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9583         else
9584                 ie_len = 0;
9585
9586         if (ie_len > wiphy->max_sched_scan_ie_len)
9587                 return ERR_PTR(-EINVAL);
9588
9589         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9590                 /*
9591                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9592                  * each scan plan already specifies its own interval
9593                  */
9594                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9595                         return ERR_PTR(-EINVAL);
9596
9597                 nla_for_each_nested(attr,
9598                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9599                         n_plans++;
9600         } else {
9601                 /*
9602                  * The scan interval attribute is kept for backward
9603                  * compatibility. If no scan plans are specified and sched scan
9604                  * interval is specified, one scan plan will be set with this
9605                  * scan interval and infinite number of iterations.
9606                  */
9607                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9608                         return ERR_PTR(-EINVAL);
9609
9610                 n_plans = 1;
9611         }
9612
9613         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9614                 return ERR_PTR(-EINVAL);
9615
9616         if (!wiphy_ext_feature_isset(
9617                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9618             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9619              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9620                 return ERR_PTR(-EINVAL);
9621
9622         size = struct_size(request, channels, n_channels);
9623         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9624         size = size_add(size, array_size(sizeof(*request->match_sets),
9625                                          n_match_sets));
9626         size = size_add(size, array_size(sizeof(*request->scan_plans),
9627                                          n_plans));
9628         size = size_add(size, ie_len);
9629         request = kzalloc(size, GFP_KERNEL);
9630         if (!request)
9631                 return ERR_PTR(-ENOMEM);
9632
9633         if (n_ssids)
9634                 request->ssids = (void *)&request->channels[n_channels];
9635         request->n_ssids = n_ssids;
9636         if (ie_len) {
9637                 if (n_ssids)
9638                         request->ie = (void *)(request->ssids + n_ssids);
9639                 else
9640                         request->ie = (void *)(request->channels + n_channels);
9641         }
9642
9643         if (n_match_sets) {
9644                 if (request->ie)
9645                         request->match_sets = (void *)(request->ie + ie_len);
9646                 else if (n_ssids)
9647                         request->match_sets =
9648                                 (void *)(request->ssids + n_ssids);
9649                 else
9650                         request->match_sets =
9651                                 (void *)(request->channels + n_channels);
9652         }
9653         request->n_match_sets = n_match_sets;
9654
9655         if (n_match_sets)
9656                 request->scan_plans = (void *)(request->match_sets +
9657                                                n_match_sets);
9658         else if (request->ie)
9659                 request->scan_plans = (void *)(request->ie + ie_len);
9660         else if (n_ssids)
9661                 request->scan_plans = (void *)(request->ssids + n_ssids);
9662         else
9663                 request->scan_plans = (void *)(request->channels + n_channels);
9664
9665         request->n_scan_plans = n_plans;
9666
9667         i = 0;
9668         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9669                 /* user specified, bail out if channel not found */
9670                 nla_for_each_nested(attr,
9671                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9672                                     tmp) {
9673                         struct ieee80211_channel *chan;
9674
9675                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9676
9677                         if (!chan) {
9678                                 err = -EINVAL;
9679                                 goto out_free;
9680                         }
9681
9682                         /* ignore disabled channels */
9683                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9684                                 continue;
9685
9686                         request->channels[i] = chan;
9687                         i++;
9688                 }
9689         } else {
9690                 /* all channels */
9691                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9692                         int j;
9693
9694                         if (!wiphy->bands[band])
9695                                 continue;
9696                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9697                                 struct ieee80211_channel *chan;
9698
9699                                 chan = &wiphy->bands[band]->channels[j];
9700
9701                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9702                                         continue;
9703
9704                                 request->channels[i] = chan;
9705                                 i++;
9706                         }
9707                 }
9708         }
9709
9710         if (!i) {
9711                 err = -EINVAL;
9712                 goto out_free;
9713         }
9714
9715         request->n_channels = i;
9716
9717         i = 0;
9718         if (n_ssids) {
9719                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9720                                     tmp) {
9721                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9722                                 err = -EINVAL;
9723                                 goto out_free;
9724                         }
9725                         request->ssids[i].ssid_len = nla_len(attr);
9726                         memcpy(request->ssids[i].ssid, nla_data(attr),
9727                                nla_len(attr));
9728                         i++;
9729                 }
9730         }
9731
9732         i = 0;
9733         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9734                 nla_for_each_nested(attr,
9735                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9736                                     tmp) {
9737                         struct nlattr *ssid, *bssid, *rssi;
9738
9739                         err = nla_parse_nested_deprecated(tb,
9740                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9741                                                           attr,
9742                                                           nl80211_match_policy,
9743                                                           NULL);
9744                         if (err)
9745                                 goto out_free;
9746                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9747                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9748
9749                         if (!ssid && !bssid) {
9750                                 i++;
9751                                 continue;
9752                         }
9753
9754                         if (WARN_ON(i >= n_match_sets)) {
9755                                 /* this indicates a programming error,
9756                                  * the loop above should have verified
9757                                  * things properly
9758                                  */
9759                                 err = -EINVAL;
9760                                 goto out_free;
9761                         }
9762
9763                         if (ssid) {
9764                                 memcpy(request->match_sets[i].ssid.ssid,
9765                                        nla_data(ssid), nla_len(ssid));
9766                                 request->match_sets[i].ssid.ssid_len =
9767                                         nla_len(ssid);
9768                         }
9769                         if (bssid)
9770                                 memcpy(request->match_sets[i].bssid,
9771                                        nla_data(bssid), ETH_ALEN);
9772
9773                         /* special attribute - old implementation w/a */
9774                         request->match_sets[i].rssi_thold = default_match_rssi;
9775                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9776                         if (rssi)
9777                                 request->match_sets[i].rssi_thold =
9778                                         nla_get_s32(rssi);
9779
9780                         /* Parse per band RSSI attribute */
9781                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9782                                 &request->match_sets[i],
9783                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9784                                 request->match_sets[i].rssi_thold);
9785                         if (err)
9786                                 goto out_free;
9787
9788                         i++;
9789                 }
9790
9791                 /* there was no other matchset, so the RSSI one is alone */
9792                 if (i == 0 && n_match_sets)
9793                         request->match_sets[0].rssi_thold = default_match_rssi;
9794
9795                 request->min_rssi_thold = INT_MAX;
9796                 for (i = 0; i < n_match_sets; i++)
9797                         request->min_rssi_thold =
9798                                 min(request->match_sets[i].rssi_thold,
9799                                     request->min_rssi_thold);
9800         } else {
9801                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9802         }
9803
9804         if (ie_len) {
9805                 request->ie_len = ie_len;
9806                 memcpy((void *)request->ie,
9807                        nla_data(attrs[NL80211_ATTR_IE]),
9808                        request->ie_len);
9809         }
9810
9811         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9812         if (err)
9813                 goto out_free;
9814
9815         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9816                 request->delay =
9817                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9818
9819         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9820                 request->relative_rssi = nla_get_s8(
9821                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9822                 request->relative_rssi_set = true;
9823         }
9824
9825         if (request->relative_rssi_set &&
9826             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9827                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9828
9829                 rssi_adjust = nla_data(
9830                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9831                 request->rssi_adjust.band = rssi_adjust->band;
9832                 request->rssi_adjust.delta = rssi_adjust->delta;
9833                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9834                         err = -EINVAL;
9835                         goto out_free;
9836                 }
9837         }
9838
9839         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9840         if (err)
9841                 goto out_free;
9842
9843         request->scan_start = jiffies;
9844
9845         return request;
9846
9847 out_free:
9848         kfree(request);
9849         return ERR_PTR(err);
9850 }
9851
9852 static int nl80211_start_sched_scan(struct sk_buff *skb,
9853                                     struct genl_info *info)
9854 {
9855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9856         struct net_device *dev = info->user_ptr[1];
9857         struct wireless_dev *wdev = dev->ieee80211_ptr;
9858         struct cfg80211_sched_scan_request *sched_scan_req;
9859         bool want_multi;
9860         int err;
9861
9862         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9863                 return -EOPNOTSUPP;
9864
9865         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9866         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9867         if (err)
9868                 return err;
9869
9870         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9871                                                   info->attrs,
9872                                                   rdev->wiphy.max_match_sets);
9873
9874         err = PTR_ERR_OR_ZERO(sched_scan_req);
9875         if (err)
9876                 goto out_err;
9877
9878         /* leave request id zero for legacy request
9879          * or if driver does not support multi-scheduled scan
9880          */
9881         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9882                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9883
9884         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9885         if (err)
9886                 goto out_free;
9887
9888         sched_scan_req->dev = dev;
9889         sched_scan_req->wiphy = &rdev->wiphy;
9890
9891         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9892                 sched_scan_req->owner_nlportid = info->snd_portid;
9893
9894         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9895
9896         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9897         return 0;
9898
9899 out_free:
9900         kfree(sched_scan_req);
9901 out_err:
9902         return err;
9903 }
9904
9905 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9906                                    struct genl_info *info)
9907 {
9908         struct cfg80211_sched_scan_request *req;
9909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9910         u64 cookie;
9911
9912         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9913                 return -EOPNOTSUPP;
9914
9915         if (info->attrs[NL80211_ATTR_COOKIE]) {
9916                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9917                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9918         }
9919
9920         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9921                                      struct cfg80211_sched_scan_request,
9922                                      list);
9923         if (!req || req->reqid ||
9924             (req->owner_nlportid &&
9925              req->owner_nlportid != info->snd_portid))
9926                 return -ENOENT;
9927
9928         return cfg80211_stop_sched_scan_req(rdev, req, false);
9929 }
9930
9931 static int nl80211_start_radar_detection(struct sk_buff *skb,
9932                                          struct genl_info *info)
9933 {
9934         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9935         struct net_device *dev = info->user_ptr[1];
9936         struct wireless_dev *wdev = dev->ieee80211_ptr;
9937         struct wiphy *wiphy = wdev->wiphy;
9938         struct cfg80211_chan_def chandef;
9939         enum nl80211_dfs_regions dfs_region;
9940         unsigned int cac_time_ms;
9941         int err = -EINVAL;
9942
9943         flush_delayed_work(&rdev->dfs_update_channels_wk);
9944
9945         wiphy_lock(wiphy);
9946
9947         dfs_region = reg_get_dfs_region(wiphy);
9948         if (dfs_region == NL80211_DFS_UNSET)
9949                 goto unlock;
9950
9951         err = nl80211_parse_chandef(rdev, info, &chandef);
9952         if (err)
9953                 goto unlock;
9954
9955         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9956         if (err < 0)
9957                 goto unlock;
9958
9959         if (err == 0) {
9960                 err = -EINVAL;
9961                 goto unlock;
9962         }
9963
9964         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9965                 err = -EINVAL;
9966                 goto unlock;
9967         }
9968
9969         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9970                 err = cfg80211_start_background_radar_detection(rdev, wdev,
9971                                                                 &chandef);
9972                 goto unlock;
9973         }
9974
9975         if (netif_carrier_ok(dev)) {
9976                 err = -EBUSY;
9977                 goto unlock;
9978         }
9979
9980         if (wdev->cac_started) {
9981                 err = -EBUSY;
9982                 goto unlock;
9983         }
9984
9985         /* CAC start is offloaded to HW and can't be started manually */
9986         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9987                 err = -EOPNOTSUPP;
9988                 goto unlock;
9989         }
9990
9991         if (!rdev->ops->start_radar_detection) {
9992                 err = -EOPNOTSUPP;
9993                 goto unlock;
9994         }
9995
9996         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9997         if (WARN_ON(!cac_time_ms))
9998                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9999
10000         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
10001         if (!err) {
10002                 wdev->links[0].ap.chandef = chandef;
10003                 wdev->cac_started = true;
10004                 wdev->cac_start_time = jiffies;
10005                 wdev->cac_time_ms = cac_time_ms;
10006         }
10007 unlock:
10008         wiphy_unlock(wiphy);
10009
10010         return err;
10011 }
10012
10013 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10014                                           struct genl_info *info)
10015 {
10016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10017         struct net_device *dev = info->user_ptr[1];
10018         struct wireless_dev *wdev = dev->ieee80211_ptr;
10019         struct wiphy *wiphy = wdev->wiphy;
10020         struct cfg80211_chan_def chandef;
10021         enum nl80211_dfs_regions dfs_region;
10022         int err;
10023
10024         dfs_region = reg_get_dfs_region(wiphy);
10025         if (dfs_region == NL80211_DFS_UNSET) {
10026                 GENL_SET_ERR_MSG(info,
10027                                  "DFS Region is not set. Unexpected Radar indication");
10028                 return -EINVAL;
10029         }
10030
10031         err = nl80211_parse_chandef(rdev, info, &chandef);
10032         if (err) {
10033                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10034                 return err;
10035         }
10036
10037         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10038         if (err < 0) {
10039                 GENL_SET_ERR_MSG(info, "chandef is invalid");
10040                 return err;
10041         }
10042
10043         if (err == 0) {
10044                 GENL_SET_ERR_MSG(info,
10045                                  "Unexpected Radar indication for chandef/iftype");
10046                 return -EINVAL;
10047         }
10048
10049         /* Do not process this notification if radar is already detected
10050          * by kernel on this channel, and return success.
10051          */
10052         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10053                 return 0;
10054
10055         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10056
10057         cfg80211_sched_dfs_chan_update(rdev);
10058
10059         rdev->radar_chandef = chandef;
10060
10061         /* Propagate this notification to other radios as well */
10062         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10063
10064         return 0;
10065 }
10066
10067 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10068 {
10069         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10070         unsigned int link_id = nl80211_link_id(info->attrs);
10071         struct net_device *dev = info->user_ptr[1];
10072         struct wireless_dev *wdev = dev->ieee80211_ptr;
10073         struct cfg80211_csa_settings params;
10074         struct nlattr **csa_attrs = NULL;
10075         int err;
10076         bool need_new_beacon = false;
10077         bool need_handle_dfs_flag = true;
10078         int len, i;
10079         u32 cs_count;
10080
10081         if (!rdev->ops->channel_switch ||
10082             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10083                 return -EOPNOTSUPP;
10084
10085         switch (dev->ieee80211_ptr->iftype) {
10086         case NL80211_IFTYPE_AP:
10087         case NL80211_IFTYPE_P2P_GO:
10088                 need_new_beacon = true;
10089                 /* For all modes except AP the handle_dfs flag needs to be
10090                  * supplied to tell the kernel that userspace will handle radar
10091                  * events when they happen. Otherwise a switch to a channel
10092                  * requiring DFS will be rejected.
10093                  */
10094                 need_handle_dfs_flag = false;
10095
10096                 /* useless if AP is not running */
10097                 if (!wdev->links[link_id].ap.beacon_interval)
10098                         return -ENOTCONN;
10099                 break;
10100         case NL80211_IFTYPE_ADHOC:
10101                 if (!wdev->u.ibss.ssid_len)
10102                         return -ENOTCONN;
10103                 break;
10104         case NL80211_IFTYPE_MESH_POINT:
10105                 if (!wdev->u.mesh.id_len)
10106                         return -ENOTCONN;
10107                 break;
10108         default:
10109                 return -EOPNOTSUPP;
10110         }
10111
10112         memset(&params, 0, sizeof(params));
10113         params.beacon_csa.ftm_responder = -1;
10114
10115         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10116             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10117                 return -EINVAL;
10118
10119         /* only important for AP, IBSS and mesh create IEs internally */
10120         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10121                 return -EINVAL;
10122
10123         /* Even though the attribute is u32, the specification says
10124          * u8, so let's make sure we don't overflow.
10125          */
10126         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10127         if (cs_count > 255)
10128                 return -EINVAL;
10129
10130         params.count = cs_count;
10131
10132         if (!need_new_beacon)
10133                 goto skip_beacons;
10134
10135         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10136                                    info->extack);
10137         if (err)
10138                 goto free;
10139
10140         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10141                             GFP_KERNEL);
10142         if (!csa_attrs) {
10143                 err = -ENOMEM;
10144                 goto free;
10145         }
10146
10147         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10148                                           info->attrs[NL80211_ATTR_CSA_IES],
10149                                           nl80211_policy, info->extack);
10150         if (err)
10151                 goto free;
10152
10153         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10154                                    info->extack);
10155         if (err)
10156                 goto free;
10157
10158         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10159                 err = -EINVAL;
10160                 goto free;
10161         }
10162
10163         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10164         if (!len || (len % sizeof(u16))) {
10165                 err = -EINVAL;
10166                 goto free;
10167         }
10168
10169         params.n_counter_offsets_beacon = len / sizeof(u16);
10170         if (rdev->wiphy.max_num_csa_counters &&
10171             (params.n_counter_offsets_beacon >
10172              rdev->wiphy.max_num_csa_counters)) {
10173                 err = -EINVAL;
10174                 goto free;
10175         }
10176
10177         params.counter_offsets_beacon =
10178                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10179
10180         /* sanity checks - counters should fit and be the same */
10181         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10182                 u16 offset = params.counter_offsets_beacon[i];
10183
10184                 if (offset >= params.beacon_csa.tail_len) {
10185                         err = -EINVAL;
10186                         goto free;
10187                 }
10188
10189                 if (params.beacon_csa.tail[offset] != params.count) {
10190                         err = -EINVAL;
10191                         goto free;
10192                 }
10193         }
10194
10195         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10196                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10197                 if (!len || (len % sizeof(u16))) {
10198                         err = -EINVAL;
10199                         goto free;
10200                 }
10201
10202                 params.n_counter_offsets_presp = len / sizeof(u16);
10203                 if (rdev->wiphy.max_num_csa_counters &&
10204                     (params.n_counter_offsets_presp >
10205                      rdev->wiphy.max_num_csa_counters)) {
10206                         err = -EINVAL;
10207                         goto free;
10208                 }
10209
10210                 params.counter_offsets_presp =
10211                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10212
10213                 /* sanity checks - counters should fit and be the same */
10214                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10215                         u16 offset = params.counter_offsets_presp[i];
10216
10217                         if (offset >= params.beacon_csa.probe_resp_len) {
10218                                 err = -EINVAL;
10219                                 goto free;
10220                         }
10221
10222                         if (params.beacon_csa.probe_resp[offset] !=
10223                             params.count) {
10224                                 err = -EINVAL;
10225                                 goto free;
10226                         }
10227                 }
10228         }
10229
10230 skip_beacons:
10231         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10232         if (err)
10233                 goto free;
10234
10235         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10236                                            wdev->iftype)) {
10237                 err = -EINVAL;
10238                 goto free;
10239         }
10240
10241         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10242                                             &params.chandef,
10243                                             wdev->iftype);
10244         if (err < 0)
10245                 goto free;
10246
10247         if (err > 0) {
10248                 params.radar_required = true;
10249                 if (need_handle_dfs_flag &&
10250                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10251                         err = -EINVAL;
10252                         goto free;
10253                 }
10254         }
10255
10256         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10257                 params.block_tx = true;
10258
10259         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10260                 err = nl80211_parse_punct_bitmap(rdev, info,
10261                                                  &params.chandef,
10262                                                  &params.punct_bitmap);
10263                 if (err)
10264                         goto free;
10265         }
10266
10267         err = rdev_channel_switch(rdev, dev, &params);
10268
10269 free:
10270         kfree(params.beacon_after.mbssid_ies);
10271         kfree(params.beacon_csa.mbssid_ies);
10272         kfree(params.beacon_after.rnr_ies);
10273         kfree(params.beacon_csa.rnr_ies);
10274         kfree(csa_attrs);
10275         return err;
10276 }
10277
10278 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10279                             u32 seq, int flags,
10280                             struct cfg80211_registered_device *rdev,
10281                             struct wireless_dev *wdev,
10282                             struct cfg80211_internal_bss *intbss)
10283 {
10284         struct cfg80211_bss *res = &intbss->pub;
10285         const struct cfg80211_bss_ies *ies;
10286         unsigned int link_id;
10287         void *hdr;
10288         struct nlattr *bss;
10289
10290         lockdep_assert_wiphy(wdev->wiphy);
10291
10292         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10293                              NL80211_CMD_NEW_SCAN_RESULTS);
10294         if (!hdr)
10295                 return -1;
10296
10297         genl_dump_check_consistent(cb, hdr);
10298
10299         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10300                 goto nla_put_failure;
10301         if (wdev->netdev &&
10302             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10303                 goto nla_put_failure;
10304         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10305                               NL80211_ATTR_PAD))
10306                 goto nla_put_failure;
10307
10308         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10309         if (!bss)
10310                 goto nla_put_failure;
10311         if ((!is_zero_ether_addr(res->bssid) &&
10312              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10313                 goto nla_put_failure;
10314
10315         rcu_read_lock();
10316         /* indicate whether we have probe response data or not */
10317         if (rcu_access_pointer(res->proberesp_ies) &&
10318             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10319                 goto fail_unlock_rcu;
10320
10321         /* this pointer prefers to be pointed to probe response data
10322          * but is always valid
10323          */
10324         ies = rcu_dereference(res->ies);
10325         if (ies) {
10326                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10327                                       NL80211_BSS_PAD))
10328                         goto fail_unlock_rcu;
10329                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10330                                         ies->len, ies->data))
10331                         goto fail_unlock_rcu;
10332         }
10333
10334         /* and this pointer is always (unless driver didn't know) beacon data */
10335         ies = rcu_dereference(res->beacon_ies);
10336         if (ies && ies->from_beacon) {
10337                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10338                                       NL80211_BSS_PAD))
10339                         goto fail_unlock_rcu;
10340                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10341                                         ies->len, ies->data))
10342                         goto fail_unlock_rcu;
10343         }
10344         rcu_read_unlock();
10345
10346         if (res->beacon_interval &&
10347             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10348                 goto nla_put_failure;
10349         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10350             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10351             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10352                         res->channel->freq_offset) ||
10353             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10354                         jiffies_to_msecs(jiffies - intbss->ts)))
10355                 goto nla_put_failure;
10356
10357         if (intbss->parent_tsf &&
10358             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10359                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10360              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10361                      intbss->parent_bssid)))
10362                 goto nla_put_failure;
10363
10364         if (intbss->ts_boottime &&
10365             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10366                               intbss->ts_boottime, NL80211_BSS_PAD))
10367                 goto nla_put_failure;
10368
10369         if (!nl80211_put_signal(msg, intbss->pub.chains,
10370                                 intbss->pub.chain_signal,
10371                                 NL80211_BSS_CHAIN_SIGNAL))
10372                 goto nla_put_failure;
10373
10374         switch (rdev->wiphy.signal_type) {
10375         case CFG80211_SIGNAL_TYPE_MBM:
10376                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10377                         goto nla_put_failure;
10378                 break;
10379         case CFG80211_SIGNAL_TYPE_UNSPEC:
10380                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10381                         goto nla_put_failure;
10382                 break;
10383         default:
10384                 break;
10385         }
10386
10387         switch (wdev->iftype) {
10388         case NL80211_IFTYPE_P2P_CLIENT:
10389         case NL80211_IFTYPE_STATION:
10390                 for_each_valid_link(wdev, link_id) {
10391                         if (intbss == wdev->links[link_id].client.current_bss &&
10392                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10393                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10394                              (wdev->valid_links &&
10395                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10396                                           link_id) ||
10397                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10398                                        wdev->u.client.connected_addr)))))
10399                                 goto nla_put_failure;
10400                 }
10401                 break;
10402         case NL80211_IFTYPE_ADHOC:
10403                 if (intbss == wdev->u.ibss.current_bss &&
10404                     nla_put_u32(msg, NL80211_BSS_STATUS,
10405                                 NL80211_BSS_STATUS_IBSS_JOINED))
10406                         goto nla_put_failure;
10407                 break;
10408         default:
10409                 break;
10410         }
10411
10412         nla_nest_end(msg, bss);
10413
10414         genlmsg_end(msg, hdr);
10415         return 0;
10416
10417  fail_unlock_rcu:
10418         rcu_read_unlock();
10419  nla_put_failure:
10420         genlmsg_cancel(msg, hdr);
10421         return -EMSGSIZE;
10422 }
10423
10424 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10425 {
10426         struct cfg80211_registered_device *rdev;
10427         struct cfg80211_internal_bss *scan;
10428         struct wireless_dev *wdev;
10429         int start = cb->args[2], idx = 0;
10430         int err;
10431
10432         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10433         if (err)
10434                 return err;
10435         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10436         __acquire(&rdev->wiphy.mtx);
10437
10438         spin_lock_bh(&rdev->bss_lock);
10439
10440         /*
10441          * dump_scan will be called multiple times to break up the scan results
10442          * into multiple messages.  It is unlikely that any more bss-es will be
10443          * expired after the first call, so only call only call this on the
10444          * first dump_scan invocation.
10445          */
10446         if (start == 0)
10447                 cfg80211_bss_expire(rdev);
10448
10449         cb->seq = rdev->bss_generation;
10450
10451         list_for_each_entry(scan, &rdev->bss_list, list) {
10452                 if (++idx <= start)
10453                         continue;
10454                 if (nl80211_send_bss(skb, cb,
10455                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10456                                 rdev, wdev, scan) < 0) {
10457                         idx--;
10458                         break;
10459                 }
10460         }
10461
10462         spin_unlock_bh(&rdev->bss_lock);
10463
10464         cb->args[2] = idx;
10465         wiphy_unlock(&rdev->wiphy);
10466
10467         return skb->len;
10468 }
10469
10470 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10471                                int flags, struct net_device *dev,
10472                                bool allow_radio_stats,
10473                                struct survey_info *survey)
10474 {
10475         void *hdr;
10476         struct nlattr *infoattr;
10477
10478         /* skip radio stats if userspace didn't request them */
10479         if (!survey->channel && !allow_radio_stats)
10480                 return 0;
10481
10482         hdr = nl80211hdr_put(msg, portid, seq, flags,
10483                              NL80211_CMD_NEW_SURVEY_RESULTS);
10484         if (!hdr)
10485                 return -ENOMEM;
10486
10487         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10488                 goto nla_put_failure;
10489
10490         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10491         if (!infoattr)
10492                 goto nla_put_failure;
10493
10494         if (survey->channel &&
10495             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10496                         survey->channel->center_freq))
10497                 goto nla_put_failure;
10498
10499         if (survey->channel && survey->channel->freq_offset &&
10500             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10501                         survey->channel->freq_offset))
10502                 goto nla_put_failure;
10503
10504         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10505             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10506                 goto nla_put_failure;
10507         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10508             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10509                 goto nla_put_failure;
10510         if ((survey->filled & SURVEY_INFO_TIME) &&
10511             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10512                         survey->time, NL80211_SURVEY_INFO_PAD))
10513                 goto nla_put_failure;
10514         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10515             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10516                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10517                 goto nla_put_failure;
10518         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10519             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10520                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10521                 goto nla_put_failure;
10522         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10523             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10524                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10525                 goto nla_put_failure;
10526         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10527             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10528                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10529                 goto nla_put_failure;
10530         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10531             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10532                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10533                 goto nla_put_failure;
10534         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10535             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10536                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10537                 goto nla_put_failure;
10538
10539         nla_nest_end(msg, infoattr);
10540
10541         genlmsg_end(msg, hdr);
10542         return 0;
10543
10544  nla_put_failure:
10545         genlmsg_cancel(msg, hdr);
10546         return -EMSGSIZE;
10547 }
10548
10549 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10550 {
10551         struct nlattr **attrbuf;
10552         struct survey_info survey;
10553         struct cfg80211_registered_device *rdev;
10554         struct wireless_dev *wdev;
10555         int survey_idx = cb->args[2];
10556         int res;
10557         bool radio_stats;
10558
10559         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10560         if (!attrbuf)
10561                 return -ENOMEM;
10562
10563         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10564         if (res) {
10565                 kfree(attrbuf);
10566                 return res;
10567         }
10568         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10569         __acquire(&rdev->wiphy.mtx);
10570
10571         /* prepare_wdev_dump parsed the attributes */
10572         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10573
10574         if (!wdev->netdev) {
10575                 res = -EINVAL;
10576                 goto out_err;
10577         }
10578
10579         if (!rdev->ops->dump_survey) {
10580                 res = -EOPNOTSUPP;
10581                 goto out_err;
10582         }
10583
10584         while (1) {
10585                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10586                 if (res == -ENOENT)
10587                         break;
10588                 if (res)
10589                         goto out_err;
10590
10591                 /* don't send disabled channels, but do send non-channel data */
10592                 if (survey.channel &&
10593                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10594                         survey_idx++;
10595                         continue;
10596                 }
10597
10598                 if (nl80211_send_survey(skb,
10599                                 NETLINK_CB(cb->skb).portid,
10600                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10601                                 wdev->netdev, radio_stats, &survey) < 0)
10602                         goto out;
10603                 survey_idx++;
10604         }
10605
10606  out:
10607         cb->args[2] = survey_idx;
10608         res = skb->len;
10609  out_err:
10610         kfree(attrbuf);
10611         wiphy_unlock(&rdev->wiphy);
10612         return res;
10613 }
10614
10615 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10616 {
10617         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10618                                   NL80211_WPA_VERSION_2 |
10619                                   NL80211_WPA_VERSION_3));
10620 }
10621
10622 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10623 {
10624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10625         struct net_device *dev = info->user_ptr[1];
10626         struct ieee80211_channel *chan;
10627         const u8 *bssid, *ssid;
10628         int err, ssid_len;
10629         enum nl80211_auth_type auth_type;
10630         struct key_parse key;
10631         bool local_state_change;
10632         struct cfg80211_auth_request req = {};
10633         u32 freq;
10634
10635         if (!info->attrs[NL80211_ATTR_MAC])
10636                 return -EINVAL;
10637
10638         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10639                 return -EINVAL;
10640
10641         if (!info->attrs[NL80211_ATTR_SSID])
10642                 return -EINVAL;
10643
10644         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10645                 return -EINVAL;
10646
10647         err = nl80211_parse_key(info, &key);
10648         if (err)
10649                 return err;
10650
10651         if (key.idx >= 0) {
10652                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10653                         return -EINVAL;
10654                 if (!key.p.key || !key.p.key_len)
10655                         return -EINVAL;
10656                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10657                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10658                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10659                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10660                         return -EINVAL;
10661                 if (key.idx > 3)
10662                         return -EINVAL;
10663         } else {
10664                 key.p.key_len = 0;
10665                 key.p.key = NULL;
10666         }
10667
10668         if (key.idx >= 0) {
10669                 int i;
10670                 bool ok = false;
10671
10672                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10673                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10674                                 ok = true;
10675                                 break;
10676                         }
10677                 }
10678                 if (!ok)
10679                         return -EINVAL;
10680         }
10681
10682         if (!rdev->ops->auth)
10683                 return -EOPNOTSUPP;
10684
10685         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10686             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10687                 return -EOPNOTSUPP;
10688
10689         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10690         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10691         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10692                 freq +=
10693                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10694
10695         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10696         if (!chan)
10697                 return -EINVAL;
10698
10699         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10700         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10701
10702         if (info->attrs[NL80211_ATTR_IE]) {
10703                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10704                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10705         }
10706
10707         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10708         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10709                 return -EINVAL;
10710
10711         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10712              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10713              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10714              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10715             !info->attrs[NL80211_ATTR_AUTH_DATA])
10716                 return -EINVAL;
10717
10718         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10719                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10720                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10721                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10722                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10723                         return -EINVAL;
10724                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10725                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10726         }
10727
10728         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10729
10730         /*
10731          * Since we no longer track auth state, ignore
10732          * requests to only change local state.
10733          */
10734         if (local_state_change)
10735                 return 0;
10736
10737         req.auth_type = auth_type;
10738         req.key = key.p.key;
10739         req.key_len = key.p.key_len;
10740         req.key_idx = key.idx;
10741         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10742         if (req.link_id >= 0) {
10743                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10744                         return -EINVAL;
10745                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10746                         return -EINVAL;
10747                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10748                 if (!is_valid_ether_addr(req.ap_mld_addr))
10749                         return -EINVAL;
10750         }
10751
10752         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10753                                    IEEE80211_BSS_TYPE_ESS,
10754                                    IEEE80211_PRIVACY_ANY);
10755         if (!req.bss)
10756                 return -ENOENT;
10757
10758         err = cfg80211_mlme_auth(rdev, dev, &req);
10759
10760         cfg80211_put_bss(&rdev->wiphy, req.bss);
10761
10762         return err;
10763 }
10764
10765 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10766                                      struct genl_info *info)
10767 {
10768         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10769                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10770                 return -EINVAL;
10771         }
10772
10773         if (!rdev->ops->tx_control_port ||
10774             !wiphy_ext_feature_isset(&rdev->wiphy,
10775                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10776                 return -EOPNOTSUPP;
10777
10778         return 0;
10779 }
10780
10781 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10782                                    struct genl_info *info,
10783                                    struct cfg80211_crypto_settings *settings,
10784                                    int cipher_limit)
10785 {
10786         memset(settings, 0, sizeof(*settings));
10787
10788         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10789
10790         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10791                 u16 proto;
10792
10793                 proto = nla_get_u16(
10794                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10795                 settings->control_port_ethertype = cpu_to_be16(proto);
10796                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10797                     proto != ETH_P_PAE)
10798                         return -EINVAL;
10799                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10800                         settings->control_port_no_encrypt = true;
10801         } else
10802                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10803
10804         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10805                 int r = validate_pae_over_nl80211(rdev, info);
10806
10807                 if (r < 0)
10808                         return r;
10809
10810                 settings->control_port_over_nl80211 = true;
10811
10812                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10813                         settings->control_port_no_preauth = true;
10814         }
10815
10816         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10817                 void *data;
10818                 int len, i;
10819
10820                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10821                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10822                 settings->n_ciphers_pairwise = len / sizeof(u32);
10823
10824                 if (len % sizeof(u32))
10825                         return -EINVAL;
10826
10827                 if (settings->n_ciphers_pairwise > cipher_limit)
10828                         return -EINVAL;
10829
10830                 memcpy(settings->ciphers_pairwise, data, len);
10831
10832                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10833                         if (!cfg80211_supported_cipher_suite(
10834                                         &rdev->wiphy,
10835                                         settings->ciphers_pairwise[i]))
10836                                 return -EINVAL;
10837         }
10838
10839         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10840                 settings->cipher_group =
10841                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10842                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10843                                                      settings->cipher_group))
10844                         return -EINVAL;
10845         }
10846
10847         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10848                 settings->wpa_versions =
10849                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10850                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10851                         return -EINVAL;
10852         }
10853
10854         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10855                 void *data;
10856                 int len;
10857
10858                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10859                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10860                 settings->n_akm_suites = len / sizeof(u32);
10861
10862                 if (len % sizeof(u32))
10863                         return -EINVAL;
10864
10865                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10866                         return -EINVAL;
10867
10868                 memcpy(settings->akm_suites, data, len);
10869         }
10870
10871         if (info->attrs[NL80211_ATTR_PMK]) {
10872                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10873                         return -EINVAL;
10874                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10875                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10876                     !wiphy_ext_feature_isset(&rdev->wiphy,
10877                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10878                         return -EINVAL;
10879                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10880         }
10881
10882         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10883                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10884                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10885                     !wiphy_ext_feature_isset(&rdev->wiphy,
10886                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10887                         return -EINVAL;
10888                 settings->sae_pwd =
10889                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10890                 settings->sae_pwd_len =
10891                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10892         }
10893
10894         if (info->attrs[NL80211_ATTR_SAE_PWE])
10895                 settings->sae_pwe =
10896                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10897         else
10898                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10899
10900         return 0;
10901 }
10902
10903 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10904                                               const u8 *ssid, int ssid_len,
10905                                               struct nlattr **attrs)
10906 {
10907         struct ieee80211_channel *chan;
10908         struct cfg80211_bss *bss;
10909         const u8 *bssid;
10910         u32 freq;
10911
10912         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10913                 return ERR_PTR(-EINVAL);
10914
10915         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10916
10917         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10918         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10919                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10920
10921         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10922         if (!chan)
10923                 return ERR_PTR(-EINVAL);
10924
10925         bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10926                                ssid, ssid_len,
10927                                IEEE80211_BSS_TYPE_ESS,
10928                                IEEE80211_PRIVACY_ANY);
10929         if (!bss)
10930                 return ERR_PTR(-ENOENT);
10931
10932         return bss;
10933 }
10934
10935 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10936 {
10937         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10938         struct net_device *dev = info->user_ptr[1];
10939         struct cfg80211_assoc_request req = {};
10940         struct nlattr **attrs = NULL;
10941         const u8 *ap_addr, *ssid;
10942         unsigned int link_id;
10943         int err, ssid_len;
10944
10945         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10946             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10947                 return -EPERM;
10948
10949         if (!info->attrs[NL80211_ATTR_SSID])
10950                 return -EINVAL;
10951
10952         if (!rdev->ops->assoc)
10953                 return -EOPNOTSUPP;
10954
10955         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10956             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10957                 return -EOPNOTSUPP;
10958
10959         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10960         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10961
10962         if (info->attrs[NL80211_ATTR_IE]) {
10963                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10964                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10965
10966                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10967                                            req.ie, req.ie_len)) {
10968                         NL_SET_ERR_MSG_ATTR(info->extack,
10969                                             info->attrs[NL80211_ATTR_IE],
10970                                             "non-inheritance makes no sense");
10971                         return -EINVAL;
10972                 }
10973         }
10974
10975         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10976                 enum nl80211_mfp mfp =
10977                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10978                 if (mfp == NL80211_MFP_REQUIRED)
10979                         req.use_mfp = true;
10980                 else if (mfp != NL80211_MFP_NO)
10981                         return -EINVAL;
10982         }
10983
10984         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10985                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10986
10987         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10988                 req.flags |= ASSOC_REQ_DISABLE_HT;
10989
10990         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10991                 memcpy(&req.ht_capa_mask,
10992                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10993                        sizeof(req.ht_capa_mask));
10994
10995         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10996                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10997                         return -EINVAL;
10998                 memcpy(&req.ht_capa,
10999                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11000                        sizeof(req.ht_capa));
11001         }
11002
11003         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11004                 req.flags |= ASSOC_REQ_DISABLE_VHT;
11005
11006         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11007                 req.flags |= ASSOC_REQ_DISABLE_HE;
11008
11009         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11010                 req.flags |= ASSOC_REQ_DISABLE_EHT;
11011
11012         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11013                 memcpy(&req.vht_capa_mask,
11014                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11015                        sizeof(req.vht_capa_mask));
11016
11017         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11018                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11019                         return -EINVAL;
11020                 memcpy(&req.vht_capa,
11021                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11022                        sizeof(req.vht_capa));
11023         }
11024
11025         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11026                 if (!((rdev->wiphy.features &
11027                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11028                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11029                     !wiphy_ext_feature_isset(&rdev->wiphy,
11030                                              NL80211_EXT_FEATURE_RRM))
11031                         return -EINVAL;
11032                 req.flags |= ASSOC_REQ_USE_RRM;
11033         }
11034
11035         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11036                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11037                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11038                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11039                         return -EINVAL;
11040                 req.fils_nonces =
11041                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11042         }
11043
11044         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11045                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11046                         return -EINVAL;
11047                 memcpy(&req.s1g_capa_mask,
11048                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11049                        sizeof(req.s1g_capa_mask));
11050         }
11051
11052         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11053                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11054                         return -EINVAL;
11055                 memcpy(&req.s1g_capa,
11056                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11057                        sizeof(req.s1g_capa));
11058         }
11059
11060         req.link_id = nl80211_link_id_or_invalid(info->attrs);
11061
11062         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11063                 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11064                 struct nlattr *link;
11065                 int rem = 0;
11066
11067                 if (req.link_id < 0)
11068                         return -EINVAL;
11069
11070                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11071                         return -EINVAL;
11072
11073                 if (info->attrs[NL80211_ATTR_MAC] ||
11074                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11075                     !info->attrs[NL80211_ATTR_MLD_ADDR])
11076                         return -EINVAL;
11077
11078                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11079                 ap_addr = req.ap_mld_addr;
11080
11081                 attrs = kzalloc(attrsize, GFP_KERNEL);
11082                 if (!attrs)
11083                         return -ENOMEM;
11084
11085                 nla_for_each_nested(link,
11086                                     info->attrs[NL80211_ATTR_MLO_LINKS],
11087                                     rem) {
11088                         memset(attrs, 0, attrsize);
11089
11090                         nla_parse_nested(attrs, NL80211_ATTR_MAX,
11091                                          link, NULL, NULL);
11092
11093                         if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11094                                 err = -EINVAL;
11095                                 NL_SET_BAD_ATTR(info->extack, link);
11096                                 goto free;
11097                         }
11098
11099                         link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11100                         /* cannot use the same link ID again */
11101                         if (req.links[link_id].bss) {
11102                                 err = -EINVAL;
11103                                 NL_SET_BAD_ATTR(info->extack, link);
11104                                 goto free;
11105                         }
11106                         req.links[link_id].bss =
11107                                 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11108                         if (IS_ERR(req.links[link_id].bss)) {
11109                                 err = PTR_ERR(req.links[link_id].bss);
11110                                 req.links[link_id].bss = NULL;
11111                                 NL_SET_ERR_MSG_ATTR(info->extack,
11112                                                     link, "Error fetching BSS for link");
11113                                 goto free;
11114                         }
11115
11116                         if (attrs[NL80211_ATTR_IE]) {
11117                                 req.links[link_id].elems =
11118                                         nla_data(attrs[NL80211_ATTR_IE]);
11119                                 req.links[link_id].elems_len =
11120                                         nla_len(attrs[NL80211_ATTR_IE]);
11121
11122                                 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11123                                                        req.links[link_id].elems,
11124                                                        req.links[link_id].elems_len)) {
11125                                         NL_SET_ERR_MSG_ATTR(info->extack,
11126                                                             attrs[NL80211_ATTR_IE],
11127                                                             "cannot deal with fragmentation");
11128                                         err = -EINVAL;
11129                                         goto free;
11130                                 }
11131
11132                                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11133                                                            req.links[link_id].elems,
11134                                                            req.links[link_id].elems_len)) {
11135                                         NL_SET_ERR_MSG_ATTR(info->extack,
11136                                                             attrs[NL80211_ATTR_IE],
11137                                                             "cannot deal with non-inheritance");
11138                                         err = -EINVAL;
11139                                         goto free;
11140                                 }
11141                         }
11142
11143                         req.links[link_id].disabled =
11144                                 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11145                 }
11146
11147                 if (!req.links[req.link_id].bss) {
11148                         err = -EINVAL;
11149                         goto free;
11150                 }
11151
11152                 if (req.links[req.link_id].elems_len) {
11153                         GENL_SET_ERR_MSG(info,
11154                                          "cannot have per-link elems on assoc link");
11155                         err = -EINVAL;
11156                         goto free;
11157                 }
11158
11159                 if (req.links[req.link_id].disabled) {
11160                         GENL_SET_ERR_MSG(info,
11161                                          "cannot have assoc link disabled");
11162                         err = -EINVAL;
11163                         goto free;
11164                 }
11165
11166                 kfree(attrs);
11167                 attrs = NULL;
11168         } else {
11169                 if (req.link_id >= 0)
11170                         return -EINVAL;
11171
11172                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11173                 if (IS_ERR(req.bss))
11174                         return PTR_ERR(req.bss);
11175                 ap_addr = req.bss->bssid;
11176         }
11177
11178         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11179         if (!err) {
11180                 struct nlattr *link;
11181                 int rem = 0;
11182
11183                 err = cfg80211_mlme_assoc(rdev, dev, &req);
11184
11185                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11186                         dev->ieee80211_ptr->conn_owner_nlportid =
11187                                 info->snd_portid;
11188                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11189                                ap_addr, ETH_ALEN);
11190                 }
11191
11192                 /* Report error from first problematic link */
11193                 if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11194                         nla_for_each_nested(link,
11195                                             info->attrs[NL80211_ATTR_MLO_LINKS],
11196                                             rem) {
11197                                 struct nlattr *link_id_attr =
11198                                         nla_find_nested(link, NL80211_ATTR_MLO_LINK_ID);
11199
11200                                 if (!link_id_attr)
11201                                         continue;
11202
11203                                 link_id = nla_get_u8(link_id_attr);
11204
11205                                 if (link_id == req.link_id)
11206                                         continue;
11207
11208                                 if (!req.links[link_id].error ||
11209                                     WARN_ON(req.links[link_id].error > 0))
11210                                         continue;
11211
11212                                 WARN_ON(err >= 0);
11213
11214                                 NL_SET_BAD_ATTR(info->extack, link);
11215                                 err = req.links[link_id].error;
11216                                 break;
11217                         }
11218                 }
11219         }
11220
11221 free:
11222         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11223                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11224         cfg80211_put_bss(&rdev->wiphy, req.bss);
11225         kfree(attrs);
11226
11227         return err;
11228 }
11229
11230 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11231 {
11232         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11233         struct net_device *dev = info->user_ptr[1];
11234         const u8 *ie = NULL, *bssid;
11235         int ie_len = 0;
11236         u16 reason_code;
11237         bool local_state_change;
11238
11239         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11240             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11241                 return -EPERM;
11242
11243         if (!info->attrs[NL80211_ATTR_MAC])
11244                 return -EINVAL;
11245
11246         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11247                 return -EINVAL;
11248
11249         if (!rdev->ops->deauth)
11250                 return -EOPNOTSUPP;
11251
11252         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11253             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11254                 return -EOPNOTSUPP;
11255
11256         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11257
11258         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11259         if (reason_code == 0) {
11260                 /* Reason Code 0 is reserved */
11261                 return -EINVAL;
11262         }
11263
11264         if (info->attrs[NL80211_ATTR_IE]) {
11265                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11266                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11267         }
11268
11269         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11270
11271         return cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11272                                     local_state_change);
11273 }
11274
11275 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11276 {
11277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11278         struct net_device *dev = info->user_ptr[1];
11279         const u8 *ie = NULL, *bssid;
11280         int ie_len = 0;
11281         u16 reason_code;
11282         bool local_state_change;
11283
11284         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11285             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11286                 return -EPERM;
11287
11288         if (!info->attrs[NL80211_ATTR_MAC])
11289                 return -EINVAL;
11290
11291         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11292                 return -EINVAL;
11293
11294         if (!rdev->ops->disassoc)
11295                 return -EOPNOTSUPP;
11296
11297         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11298             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11299                 return -EOPNOTSUPP;
11300
11301         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11302
11303         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11304         if (reason_code == 0) {
11305                 /* Reason Code 0 is reserved */
11306                 return -EINVAL;
11307         }
11308
11309         if (info->attrs[NL80211_ATTR_IE]) {
11310                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11311                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11312         }
11313
11314         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11315
11316         return cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11317                                       local_state_change);
11318 }
11319
11320 static bool
11321 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11322                          int mcast_rate[NUM_NL80211_BANDS],
11323                          int rateval)
11324 {
11325         struct wiphy *wiphy = &rdev->wiphy;
11326         bool found = false;
11327         int band, i;
11328
11329         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11330                 struct ieee80211_supported_band *sband;
11331
11332                 sband = wiphy->bands[band];
11333                 if (!sband)
11334                         continue;
11335
11336                 for (i = 0; i < sband->n_bitrates; i++) {
11337                         if (sband->bitrates[i].bitrate == rateval) {
11338                                 mcast_rate[band] = i + 1;
11339                                 found = true;
11340                                 break;
11341                         }
11342                 }
11343         }
11344
11345         return found;
11346 }
11347
11348 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11349 {
11350         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11351         struct net_device *dev = info->user_ptr[1];
11352         struct cfg80211_ibss_params ibss;
11353         struct wiphy *wiphy;
11354         struct cfg80211_cached_keys *connkeys = NULL;
11355         int err;
11356
11357         memset(&ibss, 0, sizeof(ibss));
11358
11359         if (!info->attrs[NL80211_ATTR_SSID] ||
11360             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11361                 return -EINVAL;
11362
11363         ibss.beacon_interval = 100;
11364
11365         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11366                 ibss.beacon_interval =
11367                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11368
11369         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11370                                            ibss.beacon_interval);
11371         if (err)
11372                 return err;
11373
11374         if (!rdev->ops->join_ibss)
11375                 return -EOPNOTSUPP;
11376
11377         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11378                 return -EOPNOTSUPP;
11379
11380         wiphy = &rdev->wiphy;
11381
11382         if (info->attrs[NL80211_ATTR_MAC]) {
11383                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11384
11385                 if (!is_valid_ether_addr(ibss.bssid))
11386                         return -EINVAL;
11387         }
11388         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11389         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11390
11391         if (info->attrs[NL80211_ATTR_IE]) {
11392                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11393                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11394         }
11395
11396         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11397         if (err)
11398                 return err;
11399
11400         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11401                                      NL80211_IFTYPE_ADHOC))
11402                 return -EINVAL;
11403
11404         switch (ibss.chandef.width) {
11405         case NL80211_CHAN_WIDTH_5:
11406         case NL80211_CHAN_WIDTH_10:
11407         case NL80211_CHAN_WIDTH_20_NOHT:
11408                 break;
11409         case NL80211_CHAN_WIDTH_20:
11410         case NL80211_CHAN_WIDTH_40:
11411                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11412                         return -EINVAL;
11413                 break;
11414         case NL80211_CHAN_WIDTH_80:
11415         case NL80211_CHAN_WIDTH_80P80:
11416         case NL80211_CHAN_WIDTH_160:
11417                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11418                         return -EINVAL;
11419                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11420                                              NL80211_EXT_FEATURE_VHT_IBSS))
11421                         return -EINVAL;
11422                 break;
11423         case NL80211_CHAN_WIDTH_320:
11424                 return -EINVAL;
11425         default:
11426                 return -EINVAL;
11427         }
11428
11429         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11430         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11431
11432         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11433                 u8 *rates =
11434                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11435                 int n_rates =
11436                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11437                 struct ieee80211_supported_band *sband =
11438                         wiphy->bands[ibss.chandef.chan->band];
11439
11440                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11441                                              &ibss.basic_rates);
11442                 if (err)
11443                         return err;
11444         }
11445
11446         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11447                 memcpy(&ibss.ht_capa_mask,
11448                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11449                        sizeof(ibss.ht_capa_mask));
11450
11451         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11452                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11453                         return -EINVAL;
11454                 memcpy(&ibss.ht_capa,
11455                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11456                        sizeof(ibss.ht_capa));
11457         }
11458
11459         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11460             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11461                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11462                 return -EINVAL;
11463
11464         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11465                 bool no_ht = false;
11466
11467                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11468                 if (IS_ERR(connkeys))
11469                         return PTR_ERR(connkeys);
11470
11471                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11472                     no_ht) {
11473                         kfree_sensitive(connkeys);
11474                         return -EINVAL;
11475                 }
11476         }
11477
11478         ibss.control_port =
11479                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11480
11481         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11482                 int r = validate_pae_over_nl80211(rdev, info);
11483
11484                 if (r < 0) {
11485                         kfree_sensitive(connkeys);
11486                         return r;
11487                 }
11488
11489                 ibss.control_port_over_nl80211 = true;
11490         }
11491
11492         ibss.userspace_handles_dfs =
11493                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11494
11495         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11496         if (err)
11497                 kfree_sensitive(connkeys);
11498         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11499                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11500
11501         return err;
11502 }
11503
11504 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11505 {
11506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11507         struct net_device *dev = info->user_ptr[1];
11508
11509         if (!rdev->ops->leave_ibss)
11510                 return -EOPNOTSUPP;
11511
11512         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11513                 return -EOPNOTSUPP;
11514
11515         return cfg80211_leave_ibss(rdev, dev, false);
11516 }
11517
11518 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11519 {
11520         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11521         struct net_device *dev = info->user_ptr[1];
11522         int mcast_rate[NUM_NL80211_BANDS];
11523         u32 nla_rate;
11524
11525         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11526             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11527             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11528                 return -EOPNOTSUPP;
11529
11530         if (!rdev->ops->set_mcast_rate)
11531                 return -EOPNOTSUPP;
11532
11533         memset(mcast_rate, 0, sizeof(mcast_rate));
11534
11535         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11536                 return -EINVAL;
11537
11538         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11539         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11540                 return -EINVAL;
11541
11542         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11543 }
11544
11545 static struct sk_buff *
11546 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11547                             struct wireless_dev *wdev, int approxlen,
11548                             u32 portid, u32 seq, enum nl80211_commands cmd,
11549                             enum nl80211_attrs attr,
11550                             const struct nl80211_vendor_cmd_info *info,
11551                             gfp_t gfp)
11552 {
11553         struct sk_buff *skb;
11554         void *hdr;
11555         struct nlattr *data;
11556
11557         skb = nlmsg_new(approxlen + 100, gfp);
11558         if (!skb)
11559                 return NULL;
11560
11561         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11562         if (!hdr) {
11563                 kfree_skb(skb);
11564                 return NULL;
11565         }
11566
11567         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11568                 goto nla_put_failure;
11569
11570         if (info) {
11571                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11572                                 info->vendor_id))
11573                         goto nla_put_failure;
11574                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11575                                 info->subcmd))
11576                         goto nla_put_failure;
11577         }
11578
11579         if (wdev) {
11580                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11581                                       wdev_id(wdev), NL80211_ATTR_PAD))
11582                         goto nla_put_failure;
11583                 if (wdev->netdev &&
11584                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11585                                 wdev->netdev->ifindex))
11586                         goto nla_put_failure;
11587         }
11588
11589         data = nla_nest_start_noflag(skb, attr);
11590         if (!data)
11591                 goto nla_put_failure;
11592
11593         ((void **)skb->cb)[0] = rdev;
11594         ((void **)skb->cb)[1] = hdr;
11595         ((void **)skb->cb)[2] = data;
11596
11597         return skb;
11598
11599  nla_put_failure:
11600         kfree_skb(skb);
11601         return NULL;
11602 }
11603
11604 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11605                                            struct wireless_dev *wdev,
11606                                            enum nl80211_commands cmd,
11607                                            enum nl80211_attrs attr,
11608                                            unsigned int portid,
11609                                            int vendor_event_idx,
11610                                            int approxlen, gfp_t gfp)
11611 {
11612         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11613         const struct nl80211_vendor_cmd_info *info;
11614
11615         switch (cmd) {
11616         case NL80211_CMD_TESTMODE:
11617                 if (WARN_ON(vendor_event_idx != -1))
11618                         return NULL;
11619                 info = NULL;
11620                 break;
11621         case NL80211_CMD_VENDOR:
11622                 if (WARN_ON(vendor_event_idx < 0 ||
11623                             vendor_event_idx >= wiphy->n_vendor_events))
11624                         return NULL;
11625                 info = &wiphy->vendor_events[vendor_event_idx];
11626                 break;
11627         default:
11628                 WARN_ON(1);
11629                 return NULL;
11630         }
11631
11632         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11633                                            cmd, attr, info, gfp);
11634 }
11635 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11636
11637 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11638 {
11639         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11640         void *hdr = ((void **)skb->cb)[1];
11641         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11642         struct nlattr *data = ((void **)skb->cb)[2];
11643         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11644
11645         /* clear CB data for netlink core to own from now on */
11646         memset(skb->cb, 0, sizeof(skb->cb));
11647
11648         nla_nest_end(skb, data);
11649         genlmsg_end(skb, hdr);
11650
11651         if (nlhdr->nlmsg_pid) {
11652                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11653                                 nlhdr->nlmsg_pid);
11654         } else {
11655                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11656                         mcgrp = NL80211_MCGRP_VENDOR;
11657
11658                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11659                                         skb, 0, mcgrp, gfp);
11660         }
11661 }
11662 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11663
11664 #ifdef CONFIG_NL80211_TESTMODE
11665 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11666 {
11667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11668         struct wireless_dev *wdev;
11669         int err;
11670
11671         lockdep_assert_held(&rdev->wiphy.mtx);
11672
11673         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11674                                           info->attrs);
11675
11676         if (!rdev->ops->testmode_cmd)
11677                 return -EOPNOTSUPP;
11678
11679         if (IS_ERR(wdev)) {
11680                 err = PTR_ERR(wdev);
11681                 if (err != -EINVAL)
11682                         return err;
11683                 wdev = NULL;
11684         } else if (wdev->wiphy != &rdev->wiphy) {
11685                 return -EINVAL;
11686         }
11687
11688         if (!info->attrs[NL80211_ATTR_TESTDATA])
11689                 return -EINVAL;
11690
11691         rdev->cur_cmd_info = info;
11692         err = rdev_testmode_cmd(rdev, wdev,
11693                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11694                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11695         rdev->cur_cmd_info = NULL;
11696
11697         return err;
11698 }
11699
11700 static int nl80211_testmode_dump(struct sk_buff *skb,
11701                                  struct netlink_callback *cb)
11702 {
11703         struct cfg80211_registered_device *rdev;
11704         struct nlattr **attrbuf = NULL;
11705         int err;
11706         long phy_idx;
11707         void *data = NULL;
11708         int data_len = 0;
11709
11710         rtnl_lock();
11711
11712         if (cb->args[0]) {
11713                 /*
11714                  * 0 is a valid index, but not valid for args[0],
11715                  * so we need to offset by 1.
11716                  */
11717                 phy_idx = cb->args[0] - 1;
11718
11719                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11720                 if (!rdev) {
11721                         err = -ENOENT;
11722                         goto out_err;
11723                 }
11724         } else {
11725                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11726                                   GFP_KERNEL);
11727                 if (!attrbuf) {
11728                         err = -ENOMEM;
11729                         goto out_err;
11730                 }
11731
11732                 err = nlmsg_parse_deprecated(cb->nlh,
11733                                              GENL_HDRLEN + nl80211_fam.hdrsize,
11734                                              attrbuf, nl80211_fam.maxattr,
11735                                              nl80211_policy, NULL);
11736                 if (err)
11737                         goto out_err;
11738
11739                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11740                 if (IS_ERR(rdev)) {
11741                         err = PTR_ERR(rdev);
11742                         goto out_err;
11743                 }
11744                 phy_idx = rdev->wiphy_idx;
11745
11746                 if (attrbuf[NL80211_ATTR_TESTDATA])
11747                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11748         }
11749
11750         if (cb->args[1]) {
11751                 data = nla_data((void *)cb->args[1]);
11752                 data_len = nla_len((void *)cb->args[1]);
11753         }
11754
11755         if (!rdev->ops->testmode_dump) {
11756                 err = -EOPNOTSUPP;
11757                 goto out_err;
11758         }
11759
11760         while (1) {
11761                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11762                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11763                                            NL80211_CMD_TESTMODE);
11764                 struct nlattr *tmdata;
11765
11766                 if (!hdr)
11767                         break;
11768
11769                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11770                         genlmsg_cancel(skb, hdr);
11771                         break;
11772                 }
11773
11774                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11775                 if (!tmdata) {
11776                         genlmsg_cancel(skb, hdr);
11777                         break;
11778                 }
11779                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11780                 nla_nest_end(skb, tmdata);
11781
11782                 if (err == -ENOBUFS || err == -ENOENT) {
11783                         genlmsg_cancel(skb, hdr);
11784                         break;
11785                 } else if (err) {
11786                         genlmsg_cancel(skb, hdr);
11787                         goto out_err;
11788                 }
11789
11790                 genlmsg_end(skb, hdr);
11791         }
11792
11793         err = skb->len;
11794         /* see above */
11795         cb->args[0] = phy_idx + 1;
11796  out_err:
11797         kfree(attrbuf);
11798         rtnl_unlock();
11799         return err;
11800 }
11801 #endif
11802
11803 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11804 {
11805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11806         struct net_device *dev = info->user_ptr[1];
11807         struct cfg80211_connect_params connect;
11808         struct wiphy *wiphy;
11809         struct cfg80211_cached_keys *connkeys = NULL;
11810         u32 freq = 0;
11811         int err;
11812
11813         memset(&connect, 0, sizeof(connect));
11814
11815         if (!info->attrs[NL80211_ATTR_SSID] ||
11816             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11817                 return -EINVAL;
11818
11819         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11820                 connect.auth_type =
11821                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11822                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11823                                              NL80211_CMD_CONNECT))
11824                         return -EINVAL;
11825         } else
11826                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11827
11828         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11829
11830         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11831             !wiphy_ext_feature_isset(&rdev->wiphy,
11832                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11833                 return -EINVAL;
11834         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11835
11836         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11837                                       NL80211_MAX_NR_CIPHER_SUITES);
11838         if (err)
11839                 return err;
11840
11841         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11842             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11843                 return -EOPNOTSUPP;
11844
11845         wiphy = &rdev->wiphy;
11846
11847         connect.bg_scan_period = -1;
11848         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11849                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11850                 connect.bg_scan_period =
11851                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11852         }
11853
11854         if (info->attrs[NL80211_ATTR_MAC])
11855                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11856         else if (info->attrs[NL80211_ATTR_MAC_HINT])
11857                 connect.bssid_hint =
11858                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11859         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11860         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11861
11862         if (info->attrs[NL80211_ATTR_IE]) {
11863                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11864                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11865         }
11866
11867         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11868                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11869                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11870                     !wiphy_ext_feature_isset(&rdev->wiphy,
11871                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
11872                         return -EOPNOTSUPP;
11873         } else {
11874                 connect.mfp = NL80211_MFP_NO;
11875         }
11876
11877         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11878                 connect.prev_bssid =
11879                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11880
11881         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11882                 freq = MHZ_TO_KHZ(nla_get_u32(
11883                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11884         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11885                 freq +=
11886                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11887
11888         if (freq) {
11889                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11890                 if (!connect.channel)
11891                         return -EINVAL;
11892         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11893                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11894                 freq = MHZ_TO_KHZ(freq);
11895                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11896                 if (!connect.channel_hint)
11897                         return -EINVAL;
11898         }
11899
11900         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11901                 connect.edmg.channels =
11902                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11903
11904                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11905                         connect.edmg.bw_config =
11906                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11907         }
11908
11909         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11910                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11911                 if (IS_ERR(connkeys))
11912                         return PTR_ERR(connkeys);
11913         }
11914
11915         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11916                 connect.flags |= ASSOC_REQ_DISABLE_HT;
11917
11918         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11919                 memcpy(&connect.ht_capa_mask,
11920                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11921                        sizeof(connect.ht_capa_mask));
11922
11923         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11924                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11925                         kfree_sensitive(connkeys);
11926                         return -EINVAL;
11927                 }
11928                 memcpy(&connect.ht_capa,
11929                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11930                        sizeof(connect.ht_capa));
11931         }
11932
11933         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11934                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11935
11936         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11937                 connect.flags |= ASSOC_REQ_DISABLE_HE;
11938
11939         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11940                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11941
11942         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11943                 memcpy(&connect.vht_capa_mask,
11944                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11945                        sizeof(connect.vht_capa_mask));
11946
11947         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11948                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11949                         kfree_sensitive(connkeys);
11950                         return -EINVAL;
11951                 }
11952                 memcpy(&connect.vht_capa,
11953                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11954                        sizeof(connect.vht_capa));
11955         }
11956
11957         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11958                 if (!((rdev->wiphy.features &
11959                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11960                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11961                     !wiphy_ext_feature_isset(&rdev->wiphy,
11962                                              NL80211_EXT_FEATURE_RRM)) {
11963                         kfree_sensitive(connkeys);
11964                         return -EINVAL;
11965                 }
11966                 connect.flags |= ASSOC_REQ_USE_RRM;
11967         }
11968
11969         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11970         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11971                 kfree_sensitive(connkeys);
11972                 return -EOPNOTSUPP;
11973         }
11974
11975         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11976                 /* bss selection makes no sense if bssid is set */
11977                 if (connect.bssid) {
11978                         kfree_sensitive(connkeys);
11979                         return -EINVAL;
11980                 }
11981
11982                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11983                                        wiphy, &connect.bss_select);
11984                 if (err) {
11985                         kfree_sensitive(connkeys);
11986                         return err;
11987                 }
11988         }
11989
11990         if (wiphy_ext_feature_isset(&rdev->wiphy,
11991                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11992             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11993             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11994             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11995             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11996                 connect.fils_erp_username =
11997                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11998                 connect.fils_erp_username_len =
11999                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12000                 connect.fils_erp_realm =
12001                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12002                 connect.fils_erp_realm_len =
12003                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12004                 connect.fils_erp_next_seq_num =
12005                         nla_get_u16(
12006                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12007                 connect.fils_erp_rrk =
12008                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12009                 connect.fils_erp_rrk_len =
12010                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12011         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12012                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12013                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12014                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12015                 kfree_sensitive(connkeys);
12016                 return -EINVAL;
12017         }
12018
12019         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12020                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12021                         kfree_sensitive(connkeys);
12022                         GENL_SET_ERR_MSG(info,
12023                                          "external auth requires connection ownership");
12024                         return -EINVAL;
12025                 }
12026                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12027         }
12028
12029         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12030                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12031
12032         err = cfg80211_connect(rdev, dev, &connect, connkeys,
12033                                connect.prev_bssid);
12034         if (err)
12035                 kfree_sensitive(connkeys);
12036
12037         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12038                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12039                 if (connect.bssid)
12040                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
12041                                connect.bssid, ETH_ALEN);
12042                 else
12043                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12044         }
12045
12046         return err;
12047 }
12048
12049 static int nl80211_update_connect_params(struct sk_buff *skb,
12050                                          struct genl_info *info)
12051 {
12052         struct cfg80211_connect_params connect = {};
12053         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12054         struct net_device *dev = info->user_ptr[1];
12055         struct wireless_dev *wdev = dev->ieee80211_ptr;
12056         bool fils_sk_offload;
12057         u32 auth_type;
12058         u32 changed = 0;
12059
12060         if (!rdev->ops->update_connect_params)
12061                 return -EOPNOTSUPP;
12062
12063         if (info->attrs[NL80211_ATTR_IE]) {
12064                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12065                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12066                 changed |= UPDATE_ASSOC_IES;
12067         }
12068
12069         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12070                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12071
12072         /*
12073          * when driver supports fils-sk offload all attributes must be
12074          * provided. So the else covers "fils-sk-not-all" and
12075          * "no-fils-sk-any".
12076          */
12077         if (fils_sk_offload &&
12078             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12079             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12080             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12081             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12082                 connect.fils_erp_username =
12083                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12084                 connect.fils_erp_username_len =
12085                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12086                 connect.fils_erp_realm =
12087                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12088                 connect.fils_erp_realm_len =
12089                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12090                 connect.fils_erp_next_seq_num =
12091                         nla_get_u16(
12092                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12093                 connect.fils_erp_rrk =
12094                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12095                 connect.fils_erp_rrk_len =
12096                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12097                 changed |= UPDATE_FILS_ERP_INFO;
12098         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12099                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12100                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12101                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12102                 return -EINVAL;
12103         }
12104
12105         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12106                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12107                 if (!nl80211_valid_auth_type(rdev, auth_type,
12108                                              NL80211_CMD_CONNECT))
12109                         return -EINVAL;
12110
12111                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12112                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12113                         return -EINVAL;
12114
12115                 connect.auth_type = auth_type;
12116                 changed |= UPDATE_AUTH_TYPE;
12117         }
12118
12119         if (!wdev->connected)
12120                 return -ENOLINK;
12121
12122         return rdev_update_connect_params(rdev, dev, &connect, changed);
12123 }
12124
12125 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12126 {
12127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12128         struct net_device *dev = info->user_ptr[1];
12129         u16 reason;
12130
12131         if (dev->ieee80211_ptr->conn_owner_nlportid &&
12132             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12133                 return -EPERM;
12134
12135         if (!info->attrs[NL80211_ATTR_REASON_CODE])
12136                 reason = WLAN_REASON_DEAUTH_LEAVING;
12137         else
12138                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12139
12140         if (reason == 0)
12141                 return -EINVAL;
12142
12143         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12144             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12145                 return -EOPNOTSUPP;
12146
12147         return cfg80211_disconnect(rdev, dev, reason, true);
12148 }
12149
12150 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12151 {
12152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12153         struct net *net;
12154         int err;
12155
12156         if (info->attrs[NL80211_ATTR_PID]) {
12157                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12158
12159                 net = get_net_ns_by_pid(pid);
12160         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12161                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12162
12163                 net = get_net_ns_by_fd(fd);
12164         } else {
12165                 return -EINVAL;
12166         }
12167
12168         if (IS_ERR(net))
12169                 return PTR_ERR(net);
12170
12171         err = 0;
12172
12173         /* check if anything to do */
12174         if (!net_eq(wiphy_net(&rdev->wiphy), net))
12175                 err = cfg80211_switch_netns(rdev, net);
12176
12177         put_net(net);
12178         return err;
12179 }
12180
12181 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12182 {
12183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12184         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12185                         struct cfg80211_pmksa *pmksa) = NULL;
12186         struct net_device *dev = info->user_ptr[1];
12187         struct cfg80211_pmksa pmksa;
12188
12189         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12190
12191         if (!info->attrs[NL80211_ATTR_PMKID])
12192                 return -EINVAL;
12193
12194         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12195
12196         if (info->attrs[NL80211_ATTR_MAC]) {
12197                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12198         } else if (info->attrs[NL80211_ATTR_SSID] &&
12199                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12200                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12201                     info->attrs[NL80211_ATTR_PMK])) {
12202                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12203                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12204                 pmksa.cache_id =
12205                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12206         } else {
12207                 return -EINVAL;
12208         }
12209         if (info->attrs[NL80211_ATTR_PMK]) {
12210                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12211                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12212         }
12213
12214         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12215                 pmksa.pmk_lifetime =
12216                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12217
12218         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12219                 pmksa.pmk_reauth_threshold =
12220                         nla_get_u8(
12221                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12222
12223         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12224             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12225             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12226               wiphy_ext_feature_isset(&rdev->wiphy,
12227                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12228                 return -EOPNOTSUPP;
12229
12230         switch (info->genlhdr->cmd) {
12231         case NL80211_CMD_SET_PMKSA:
12232                 rdev_ops = rdev->ops->set_pmksa;
12233                 break;
12234         case NL80211_CMD_DEL_PMKSA:
12235                 rdev_ops = rdev->ops->del_pmksa;
12236                 break;
12237         default:
12238                 WARN_ON(1);
12239                 break;
12240         }
12241
12242         if (!rdev_ops)
12243                 return -EOPNOTSUPP;
12244
12245         return rdev_ops(&rdev->wiphy, dev, &pmksa);
12246 }
12247
12248 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12249 {
12250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12251         struct net_device *dev = info->user_ptr[1];
12252
12253         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12254             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12255                 return -EOPNOTSUPP;
12256
12257         if (!rdev->ops->flush_pmksa)
12258                 return -EOPNOTSUPP;
12259
12260         return rdev_flush_pmksa(rdev, dev);
12261 }
12262
12263 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12264 {
12265         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12266         struct net_device *dev = info->user_ptr[1];
12267         u8 action_code, dialog_token;
12268         u32 peer_capability = 0;
12269         u16 status_code;
12270         u8 *peer;
12271         int link_id;
12272         bool initiator;
12273
12274         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12275             !rdev->ops->tdls_mgmt)
12276                 return -EOPNOTSUPP;
12277
12278         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12279             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12280             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12281             !info->attrs[NL80211_ATTR_IE] ||
12282             !info->attrs[NL80211_ATTR_MAC])
12283                 return -EINVAL;
12284
12285         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12286         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12287         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12288         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12289         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12290         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12291                 peer_capability =
12292                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12293         link_id = nl80211_link_id_or_invalid(info->attrs);
12294
12295         return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12296                               dialog_token, status_code, peer_capability,
12297                               initiator,
12298                               nla_data(info->attrs[NL80211_ATTR_IE]),
12299                               nla_len(info->attrs[NL80211_ATTR_IE]));
12300 }
12301
12302 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12303 {
12304         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12305         struct net_device *dev = info->user_ptr[1];
12306         enum nl80211_tdls_operation operation;
12307         u8 *peer;
12308
12309         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12310             !rdev->ops->tdls_oper)
12311                 return -EOPNOTSUPP;
12312
12313         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12314             !info->attrs[NL80211_ATTR_MAC])
12315                 return -EINVAL;
12316
12317         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12318         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12319
12320         return rdev_tdls_oper(rdev, dev, peer, operation);
12321 }
12322
12323 static int nl80211_remain_on_channel(struct sk_buff *skb,
12324                                      struct genl_info *info)
12325 {
12326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12327         unsigned int link_id = nl80211_link_id(info->attrs);
12328         struct wireless_dev *wdev = info->user_ptr[1];
12329         struct cfg80211_chan_def chandef;
12330         struct sk_buff *msg;
12331         void *hdr;
12332         u64 cookie;
12333         u32 duration;
12334         int err;
12335
12336         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12337             !info->attrs[NL80211_ATTR_DURATION])
12338                 return -EINVAL;
12339
12340         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12341
12342         if (!rdev->ops->remain_on_channel ||
12343             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12344                 return -EOPNOTSUPP;
12345
12346         /*
12347          * We should be on that channel for at least a minimum amount of
12348          * time (10ms) but no longer than the driver supports.
12349          */
12350         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12351             duration > rdev->wiphy.max_remain_on_channel_duration)
12352                 return -EINVAL;
12353
12354         err = nl80211_parse_chandef(rdev, info, &chandef);
12355         if (err)
12356                 return err;
12357
12358         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12359                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12360
12361                 oper_chandef = wdev_chandef(wdev, link_id);
12362
12363                 if (WARN_ON(!oper_chandef)) {
12364                         /* cannot happen since we must beacon to get here */
12365                         WARN_ON(1);
12366                         return -EBUSY;
12367                 }
12368
12369                 /* note: returns first one if identical chandefs */
12370                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12371                                                              oper_chandef);
12372
12373                 if (compat_chandef != &chandef)
12374                         return -EBUSY;
12375         }
12376
12377         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12378         if (!msg)
12379                 return -ENOMEM;
12380
12381         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12382                              NL80211_CMD_REMAIN_ON_CHANNEL);
12383         if (!hdr) {
12384                 err = -ENOBUFS;
12385                 goto free_msg;
12386         }
12387
12388         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12389                                      duration, &cookie);
12390
12391         if (err)
12392                 goto free_msg;
12393
12394         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12395                               NL80211_ATTR_PAD))
12396                 goto nla_put_failure;
12397
12398         genlmsg_end(msg, hdr);
12399
12400         return genlmsg_reply(msg, info);
12401
12402  nla_put_failure:
12403         err = -ENOBUFS;
12404  free_msg:
12405         nlmsg_free(msg);
12406         return err;
12407 }
12408
12409 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12410                                             struct genl_info *info)
12411 {
12412         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12413         struct wireless_dev *wdev = info->user_ptr[1];
12414         u64 cookie;
12415
12416         if (!info->attrs[NL80211_ATTR_COOKIE])
12417                 return -EINVAL;
12418
12419         if (!rdev->ops->cancel_remain_on_channel)
12420                 return -EOPNOTSUPP;
12421
12422         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12423
12424         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12425 }
12426
12427 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12428                                        struct genl_info *info)
12429 {
12430         struct cfg80211_bitrate_mask mask;
12431         unsigned int link_id = nl80211_link_id(info->attrs);
12432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12433         struct net_device *dev = info->user_ptr[1];
12434         int err;
12435
12436         if (!rdev->ops->set_bitrate_mask)
12437                 return -EOPNOTSUPP;
12438
12439         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12440                                             NL80211_ATTR_TX_RATES, &mask,
12441                                             dev, true, link_id);
12442         if (err)
12443                 return err;
12444
12445         return rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12446 }
12447
12448 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12449 {
12450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12451         struct wireless_dev *wdev = info->user_ptr[1];
12452         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12453
12454         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12455                 return -EINVAL;
12456
12457         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12458                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12459
12460         switch (wdev->iftype) {
12461         case NL80211_IFTYPE_STATION:
12462         case NL80211_IFTYPE_ADHOC:
12463         case NL80211_IFTYPE_P2P_CLIENT:
12464         case NL80211_IFTYPE_AP:
12465         case NL80211_IFTYPE_AP_VLAN:
12466         case NL80211_IFTYPE_MESH_POINT:
12467         case NL80211_IFTYPE_P2P_GO:
12468         case NL80211_IFTYPE_P2P_DEVICE:
12469                 break;
12470         case NL80211_IFTYPE_NAN:
12471                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12472                                              NL80211_EXT_FEATURE_SECURE_NAN))
12473                         return -EOPNOTSUPP;
12474                 break;
12475         default:
12476                 return -EOPNOTSUPP;
12477         }
12478
12479         /* not much point in registering if we can't reply */
12480         if (!rdev->ops->mgmt_tx)
12481                 return -EOPNOTSUPP;
12482
12483         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12484             !wiphy_ext_feature_isset(&rdev->wiphy,
12485                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12486                 GENL_SET_ERR_MSG(info,
12487                                  "multicast RX registrations are not supported");
12488                 return -EOPNOTSUPP;
12489         }
12490
12491         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12492                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12493                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12494                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12495                                            info->extack);
12496 }
12497
12498 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12499 {
12500         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12501         struct wireless_dev *wdev = info->user_ptr[1];
12502         struct cfg80211_chan_def chandef;
12503         int err;
12504         void *hdr = NULL;
12505         u64 cookie;
12506         struct sk_buff *msg = NULL;
12507         struct cfg80211_mgmt_tx_params params = {
12508                 .dont_wait_for_ack =
12509                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12510         };
12511
12512         if (!info->attrs[NL80211_ATTR_FRAME])
12513                 return -EINVAL;
12514
12515         if (!rdev->ops->mgmt_tx)
12516                 return -EOPNOTSUPP;
12517
12518         switch (wdev->iftype) {
12519         case NL80211_IFTYPE_P2P_DEVICE:
12520                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12521                         return -EINVAL;
12522                 break;
12523         case NL80211_IFTYPE_STATION:
12524         case NL80211_IFTYPE_ADHOC:
12525         case NL80211_IFTYPE_P2P_CLIENT:
12526         case NL80211_IFTYPE_AP:
12527         case NL80211_IFTYPE_AP_VLAN:
12528         case NL80211_IFTYPE_MESH_POINT:
12529         case NL80211_IFTYPE_P2P_GO:
12530                 break;
12531         case NL80211_IFTYPE_NAN:
12532                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12533                                              NL80211_EXT_FEATURE_SECURE_NAN))
12534                         return -EOPNOTSUPP;
12535                 break;
12536         default:
12537                 return -EOPNOTSUPP;
12538         }
12539
12540         if (info->attrs[NL80211_ATTR_DURATION]) {
12541                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12542                         return -EINVAL;
12543                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12544
12545                 /*
12546                  * We should wait on the channel for at least a minimum amount
12547                  * of time (10ms) but no longer than the driver supports.
12548                  */
12549                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12550                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12551                         return -EINVAL;
12552         }
12553
12554         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12555
12556         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12557                 return -EINVAL;
12558
12559         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12560
12561         /* get the channel if any has been specified, otherwise pass NULL to
12562          * the driver. The latter will use the current one
12563          */
12564         chandef.chan = NULL;
12565         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12566                 err = nl80211_parse_chandef(rdev, info, &chandef);
12567                 if (err)
12568                         return err;
12569         }
12570
12571         if (!chandef.chan && params.offchan)
12572                 return -EINVAL;
12573
12574         if (params.offchan &&
12575             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan))
12576                 return -EBUSY;
12577
12578         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12579         /*
12580          * This now races due to the unlock, but we cannot check
12581          * the valid links for the _station_ anyway, so that's up
12582          * to the driver.
12583          */
12584         if (params.link_id >= 0 &&
12585             !(wdev->valid_links & BIT(params.link_id)))
12586                 return -EINVAL;
12587
12588         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12589         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12590
12591         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12592                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12593                 int i;
12594
12595                 if (len % sizeof(u16))
12596                         return -EINVAL;
12597
12598                 params.n_csa_offsets = len / sizeof(u16);
12599                 params.csa_offsets =
12600                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12601
12602                 /* check that all the offsets fit the frame */
12603                 for (i = 0; i < params.n_csa_offsets; i++) {
12604                         if (params.csa_offsets[i] >= params.len)
12605                                 return -EINVAL;
12606                 }
12607         }
12608
12609         if (!params.dont_wait_for_ack) {
12610                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12611                 if (!msg)
12612                         return -ENOMEM;
12613
12614                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12615                                      NL80211_CMD_FRAME);
12616                 if (!hdr) {
12617                         err = -ENOBUFS;
12618                         goto free_msg;
12619                 }
12620         }
12621
12622         params.chan = chandef.chan;
12623         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12624         if (err)
12625                 goto free_msg;
12626
12627         if (msg) {
12628                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12629                                       NL80211_ATTR_PAD))
12630                         goto nla_put_failure;
12631
12632                 genlmsg_end(msg, hdr);
12633                 return genlmsg_reply(msg, info);
12634         }
12635
12636         return 0;
12637
12638  nla_put_failure:
12639         err = -ENOBUFS;
12640  free_msg:
12641         nlmsg_free(msg);
12642         return err;
12643 }
12644
12645 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12646 {
12647         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12648         struct wireless_dev *wdev = info->user_ptr[1];
12649         u64 cookie;
12650
12651         if (!info->attrs[NL80211_ATTR_COOKIE])
12652                 return -EINVAL;
12653
12654         if (!rdev->ops->mgmt_tx_cancel_wait)
12655                 return -EOPNOTSUPP;
12656
12657         switch (wdev->iftype) {
12658         case NL80211_IFTYPE_STATION:
12659         case NL80211_IFTYPE_ADHOC:
12660         case NL80211_IFTYPE_P2P_CLIENT:
12661         case NL80211_IFTYPE_AP:
12662         case NL80211_IFTYPE_AP_VLAN:
12663         case NL80211_IFTYPE_P2P_GO:
12664         case NL80211_IFTYPE_P2P_DEVICE:
12665                 break;
12666         case NL80211_IFTYPE_NAN:
12667                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12668                                              NL80211_EXT_FEATURE_SECURE_NAN))
12669                         return -EOPNOTSUPP;
12670                 break;
12671         default:
12672                 return -EOPNOTSUPP;
12673         }
12674
12675         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12676
12677         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12678 }
12679
12680 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12681 {
12682         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12683         struct wireless_dev *wdev;
12684         struct net_device *dev = info->user_ptr[1];
12685         u8 ps_state;
12686         bool state;
12687         int err;
12688
12689         if (!info->attrs[NL80211_ATTR_PS_STATE])
12690                 return -EINVAL;
12691
12692         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12693
12694         wdev = dev->ieee80211_ptr;
12695
12696         if (!rdev->ops->set_power_mgmt)
12697                 return -EOPNOTSUPP;
12698
12699         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12700
12701         if (state == wdev->ps)
12702                 return 0;
12703
12704         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12705         if (!err)
12706                 wdev->ps = state;
12707         return err;
12708 }
12709
12710 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12711 {
12712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12713         enum nl80211_ps_state ps_state;
12714         struct wireless_dev *wdev;
12715         struct net_device *dev = info->user_ptr[1];
12716         struct sk_buff *msg;
12717         void *hdr;
12718         int err;
12719
12720         wdev = dev->ieee80211_ptr;
12721
12722         if (!rdev->ops->set_power_mgmt)
12723                 return -EOPNOTSUPP;
12724
12725         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12726         if (!msg)
12727                 return -ENOMEM;
12728
12729         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12730                              NL80211_CMD_GET_POWER_SAVE);
12731         if (!hdr) {
12732                 err = -ENOBUFS;
12733                 goto free_msg;
12734         }
12735
12736         if (wdev->ps)
12737                 ps_state = NL80211_PS_ENABLED;
12738         else
12739                 ps_state = NL80211_PS_DISABLED;
12740
12741         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12742                 goto nla_put_failure;
12743
12744         genlmsg_end(msg, hdr);
12745         return genlmsg_reply(msg, info);
12746
12747  nla_put_failure:
12748         err = -ENOBUFS;
12749  free_msg:
12750         nlmsg_free(msg);
12751         return err;
12752 }
12753
12754 static const struct nla_policy
12755 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12756         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12757         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12758         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12759         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12760         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12761         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12762         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12763 };
12764
12765 static int nl80211_set_cqm_txe(struct genl_info *info,
12766                                u32 rate, u32 pkts, u32 intvl)
12767 {
12768         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12769         struct net_device *dev = info->user_ptr[1];
12770         struct wireless_dev *wdev = dev->ieee80211_ptr;
12771
12772         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12773                 return -EINVAL;
12774
12775         if (!rdev->ops->set_cqm_txe_config)
12776                 return -EOPNOTSUPP;
12777
12778         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12779             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12780                 return -EOPNOTSUPP;
12781
12782         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12783 }
12784
12785 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12786                                     struct net_device *dev,
12787                                     struct cfg80211_cqm_config *cqm_config)
12788 {
12789         struct wireless_dev *wdev = dev->ieee80211_ptr;
12790         s32 last, low, high;
12791         u32 hyst;
12792         int i, n, low_index;
12793         int err;
12794
12795         /*
12796          * Obtain current RSSI value if possible, if not and no RSSI threshold
12797          * event has been received yet, we should receive an event after a
12798          * connection is established and enough beacons received to calculate
12799          * the average.
12800          */
12801         if (!cqm_config->last_rssi_event_value &&
12802             wdev->links[0].client.current_bss &&
12803             rdev->ops->get_station) {
12804                 struct station_info sinfo = {};
12805                 u8 *mac_addr;
12806
12807                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12808
12809                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12810                 if (err)
12811                         return err;
12812
12813                 cfg80211_sinfo_release_content(&sinfo);
12814                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12815                         cqm_config->last_rssi_event_value =
12816                                 (s8) sinfo.rx_beacon_signal_avg;
12817         }
12818
12819         last = cqm_config->last_rssi_event_value;
12820         hyst = cqm_config->rssi_hyst;
12821         n = cqm_config->n_rssi_thresholds;
12822
12823         for (i = 0; i < n; i++) {
12824                 i = array_index_nospec(i, n);
12825                 if (last < cqm_config->rssi_thresholds[i])
12826                         break;
12827         }
12828
12829         low_index = i - 1;
12830         if (low_index >= 0) {
12831                 low_index = array_index_nospec(low_index, n);
12832                 low = cqm_config->rssi_thresholds[low_index] - hyst;
12833         } else {
12834                 low = S32_MIN;
12835         }
12836         if (i < n) {
12837                 i = array_index_nospec(i, n);
12838                 high = cqm_config->rssi_thresholds[i] + hyst - 1;
12839         } else {
12840                 high = S32_MAX;
12841         }
12842
12843         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12844 }
12845
12846 static int nl80211_set_cqm_rssi(struct genl_info *info,
12847                                 const s32 *thresholds, int n_thresholds,
12848                                 u32 hysteresis)
12849 {
12850         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12851         struct cfg80211_cqm_config *cqm_config = NULL, *old;
12852         struct net_device *dev = info->user_ptr[1];
12853         struct wireless_dev *wdev = dev->ieee80211_ptr;
12854         s32 prev = S32_MIN;
12855         int i, err;
12856
12857         /* Check all values negative and sorted */
12858         for (i = 0; i < n_thresholds; i++) {
12859                 if (thresholds[i] > 0 || thresholds[i] <= prev)
12860                         return -EINVAL;
12861
12862                 prev = thresholds[i];
12863         }
12864
12865         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12866             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12867                 return -EOPNOTSUPP;
12868
12869         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12870                 n_thresholds = 0;
12871
12872         old = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
12873
12874         /* if already disabled just succeed */
12875         if (!n_thresholds && !old)
12876                 return 0;
12877
12878         if (n_thresholds > 1) {
12879                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12880                                              NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
12881                     !rdev->ops->set_cqm_rssi_range_config)
12882                         return -EOPNOTSUPP;
12883         } else {
12884                 if (!rdev->ops->set_cqm_rssi_config)
12885                         return -EOPNOTSUPP;
12886         }
12887
12888         if (n_thresholds) {
12889                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12890                                                  n_thresholds),
12891                                      GFP_KERNEL);
12892                 if (!cqm_config)
12893                         return -ENOMEM;
12894
12895                 cqm_config->rssi_hyst = hysteresis;
12896                 cqm_config->n_rssi_thresholds = n_thresholds;
12897                 memcpy(cqm_config->rssi_thresholds, thresholds,
12898                        flex_array_size(cqm_config, rssi_thresholds,
12899                                        n_thresholds));
12900                 cqm_config->use_range_api = n_thresholds > 1 ||
12901                                             !rdev->ops->set_cqm_rssi_config;
12902
12903                 rcu_assign_pointer(wdev->cqm_config, cqm_config);
12904
12905                 if (cqm_config->use_range_api)
12906                         err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
12907                 else
12908                         err = rdev_set_cqm_rssi_config(rdev, dev,
12909                                                        thresholds[0],
12910                                                        hysteresis);
12911         } else {
12912                 RCU_INIT_POINTER(wdev->cqm_config, NULL);
12913                 /* if enabled as range also disable via range */
12914                 if (old->use_range_api)
12915                         err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12916                 else
12917                         err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12918         }
12919
12920         if (err) {
12921                 rcu_assign_pointer(wdev->cqm_config, old);
12922                 kfree_rcu(cqm_config, rcu_head);
12923         } else {
12924                 kfree_rcu(old, rcu_head);
12925         }
12926
12927         return err;
12928 }
12929
12930 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12931 {
12932         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12933         struct nlattr *cqm;
12934         int err;
12935
12936         cqm = info->attrs[NL80211_ATTR_CQM];
12937         if (!cqm)
12938                 return -EINVAL;
12939
12940         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12941                                           nl80211_attr_cqm_policy,
12942                                           info->extack);
12943         if (err)
12944                 return err;
12945
12946         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12947             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12948                 const s32 *thresholds =
12949                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12950                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12951                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12952
12953                 if (len % 4)
12954                         return -EINVAL;
12955
12956                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12957                                             hysteresis);
12958         }
12959
12960         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12961             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12962             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12963                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12964                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12965                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12966
12967                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12968         }
12969
12970         return -EINVAL;
12971 }
12972
12973 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12974 {
12975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12976         struct net_device *dev = info->user_ptr[1];
12977         struct ocb_setup setup = {};
12978         int err;
12979
12980         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12981         if (err)
12982                 return err;
12983
12984         return cfg80211_join_ocb(rdev, dev, &setup);
12985 }
12986
12987 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12988 {
12989         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12990         struct net_device *dev = info->user_ptr[1];
12991
12992         return cfg80211_leave_ocb(rdev, dev);
12993 }
12994
12995 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12996 {
12997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12998         struct net_device *dev = info->user_ptr[1];
12999         struct mesh_config cfg;
13000         struct mesh_setup setup;
13001         int err;
13002
13003         /* start with default */
13004         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13005         memcpy(&setup, &default_mesh_setup, sizeof(setup));
13006
13007         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13008                 /* and parse parameters if given */
13009                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13010                 if (err)
13011                         return err;
13012         }
13013
13014         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13015             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13016                 return -EINVAL;
13017
13018         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13019         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13020
13021         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13022             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13023                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13024                         return -EINVAL;
13025
13026         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13027                 setup.beacon_interval =
13028                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13029
13030                 err = cfg80211_validate_beacon_int(rdev,
13031                                                    NL80211_IFTYPE_MESH_POINT,
13032                                                    setup.beacon_interval);
13033                 if (err)
13034                         return err;
13035         }
13036
13037         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13038                 setup.dtim_period =
13039                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13040                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13041                         return -EINVAL;
13042         }
13043
13044         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13045                 /* parse additional setup parameters if given */
13046                 err = nl80211_parse_mesh_setup(info, &setup);
13047                 if (err)
13048                         return err;
13049         }
13050
13051         if (setup.user_mpm)
13052                 cfg.auto_open_plinks = false;
13053
13054         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13055                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13056                 if (err)
13057                         return err;
13058         } else {
13059                 /* __cfg80211_join_mesh() will sort it out */
13060                 setup.chandef.chan = NULL;
13061         }
13062
13063         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13064                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13065                 int n_rates =
13066                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13067                 struct ieee80211_supported_band *sband;
13068
13069                 if (!setup.chandef.chan)
13070                         return -EINVAL;
13071
13072                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13073
13074                 err = ieee80211_get_ratemask(sband, rates, n_rates,
13075                                              &setup.basic_rates);
13076                 if (err)
13077                         return err;
13078         }
13079
13080         if (info->attrs[NL80211_ATTR_TX_RATES]) {
13081                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13082                                                     NL80211_ATTR_TX_RATES,
13083                                                     &setup.beacon_rate,
13084                                                     dev, false, 0);
13085                 if (err)
13086                         return err;
13087
13088                 if (!setup.chandef.chan)
13089                         return -EINVAL;
13090
13091                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13092                                               &setup.beacon_rate);
13093                 if (err)
13094                         return err;
13095         }
13096
13097         setup.userspace_handles_dfs =
13098                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13099
13100         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13101                 int r = validate_pae_over_nl80211(rdev, info);
13102
13103                 if (r < 0)
13104                         return r;
13105
13106                 setup.control_port_over_nl80211 = true;
13107         }
13108
13109         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13110         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13111                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13112
13113         return err;
13114 }
13115
13116 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13117 {
13118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13119         struct net_device *dev = info->user_ptr[1];
13120
13121         return cfg80211_leave_mesh(rdev, dev);
13122 }
13123
13124 #ifdef CONFIG_PM
13125 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13126                                         struct cfg80211_registered_device *rdev)
13127 {
13128         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13129         struct nlattr *nl_pats, *nl_pat;
13130         int i, pat_len;
13131
13132         if (!wowlan->n_patterns)
13133                 return 0;
13134
13135         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13136         if (!nl_pats)
13137                 return -ENOBUFS;
13138
13139         for (i = 0; i < wowlan->n_patterns; i++) {
13140                 nl_pat = nla_nest_start_noflag(msg, i + 1);
13141                 if (!nl_pat)
13142                         return -ENOBUFS;
13143                 pat_len = wowlan->patterns[i].pattern_len;
13144                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13145                             wowlan->patterns[i].mask) ||
13146                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13147                             wowlan->patterns[i].pattern) ||
13148                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13149                                 wowlan->patterns[i].pkt_offset))
13150                         return -ENOBUFS;
13151                 nla_nest_end(msg, nl_pat);
13152         }
13153         nla_nest_end(msg, nl_pats);
13154
13155         return 0;
13156 }
13157
13158 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13159                                    struct cfg80211_wowlan_tcp *tcp)
13160 {
13161         struct nlattr *nl_tcp;
13162
13163         if (!tcp)
13164                 return 0;
13165
13166         nl_tcp = nla_nest_start_noflag(msg,
13167                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13168         if (!nl_tcp)
13169                 return -ENOBUFS;
13170
13171         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13172             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13173             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13174             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13175             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13176             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13177                     tcp->payload_len, tcp->payload) ||
13178             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13179                         tcp->data_interval) ||
13180             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13181                     tcp->wake_len, tcp->wake_data) ||
13182             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13183                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13184                 return -ENOBUFS;
13185
13186         if (tcp->payload_seq.len &&
13187             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13188                     sizeof(tcp->payload_seq), &tcp->payload_seq))
13189                 return -ENOBUFS;
13190
13191         if (tcp->payload_tok.len &&
13192             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13193                     sizeof(tcp->payload_tok) + tcp->tokens_size,
13194                     &tcp->payload_tok))
13195                 return -ENOBUFS;
13196
13197         nla_nest_end(msg, nl_tcp);
13198
13199         return 0;
13200 }
13201
13202 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13203                                   struct cfg80211_sched_scan_request *req)
13204 {
13205         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13206         int i;
13207
13208         if (!req)
13209                 return 0;
13210
13211         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13212         if (!nd)
13213                 return -ENOBUFS;
13214
13215         if (req->n_scan_plans == 1 &&
13216             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13217                         req->scan_plans[0].interval * 1000))
13218                 return -ENOBUFS;
13219
13220         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13221                 return -ENOBUFS;
13222
13223         if (req->relative_rssi_set) {
13224                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13225
13226                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13227                                req->relative_rssi))
13228                         return -ENOBUFS;
13229
13230                 rssi_adjust.band = req->rssi_adjust.band;
13231                 rssi_adjust.delta = req->rssi_adjust.delta;
13232                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13233                             sizeof(rssi_adjust), &rssi_adjust))
13234                         return -ENOBUFS;
13235         }
13236
13237         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13238         if (!freqs)
13239                 return -ENOBUFS;
13240
13241         for (i = 0; i < req->n_channels; i++) {
13242                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13243                         return -ENOBUFS;
13244         }
13245
13246         nla_nest_end(msg, freqs);
13247
13248         if (req->n_match_sets) {
13249                 matches = nla_nest_start_noflag(msg,
13250                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13251                 if (!matches)
13252                         return -ENOBUFS;
13253
13254                 for (i = 0; i < req->n_match_sets; i++) {
13255                         match = nla_nest_start_noflag(msg, i);
13256                         if (!match)
13257                                 return -ENOBUFS;
13258
13259                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13260                                     req->match_sets[i].ssid.ssid_len,
13261                                     req->match_sets[i].ssid.ssid))
13262                                 return -ENOBUFS;
13263                         nla_nest_end(msg, match);
13264                 }
13265                 nla_nest_end(msg, matches);
13266         }
13267
13268         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13269         if (!scan_plans)
13270                 return -ENOBUFS;
13271
13272         for (i = 0; i < req->n_scan_plans; i++) {
13273                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13274                 if (!scan_plan)
13275                         return -ENOBUFS;
13276
13277                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13278                                 req->scan_plans[i].interval) ||
13279                     (req->scan_plans[i].iterations &&
13280                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13281                                  req->scan_plans[i].iterations)))
13282                         return -ENOBUFS;
13283                 nla_nest_end(msg, scan_plan);
13284         }
13285         nla_nest_end(msg, scan_plans);
13286
13287         nla_nest_end(msg, nd);
13288
13289         return 0;
13290 }
13291
13292 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13293 {
13294         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13295         struct sk_buff *msg;
13296         void *hdr;
13297         u32 size = NLMSG_DEFAULT_SIZE;
13298
13299         if (!rdev->wiphy.wowlan)
13300                 return -EOPNOTSUPP;
13301
13302         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13303                 /* adjust size to have room for all the data */
13304                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13305                         rdev->wiphy.wowlan_config->tcp->payload_len +
13306                         rdev->wiphy.wowlan_config->tcp->wake_len +
13307                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13308         }
13309
13310         msg = nlmsg_new(size, GFP_KERNEL);
13311         if (!msg)
13312                 return -ENOMEM;
13313
13314         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13315                              NL80211_CMD_GET_WOWLAN);
13316         if (!hdr)
13317                 goto nla_put_failure;
13318
13319         if (rdev->wiphy.wowlan_config) {
13320                 struct nlattr *nl_wowlan;
13321
13322                 nl_wowlan = nla_nest_start_noflag(msg,
13323                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13324                 if (!nl_wowlan)
13325                         goto nla_put_failure;
13326
13327                 if ((rdev->wiphy.wowlan_config->any &&
13328                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13329                     (rdev->wiphy.wowlan_config->disconnect &&
13330                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13331                     (rdev->wiphy.wowlan_config->magic_pkt &&
13332                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13333                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13334                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13335                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13336                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13337                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13338                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13339                     (rdev->wiphy.wowlan_config->rfkill_release &&
13340                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13341                         goto nla_put_failure;
13342
13343                 if (nl80211_send_wowlan_patterns(msg, rdev))
13344                         goto nla_put_failure;
13345
13346                 if (nl80211_send_wowlan_tcp(msg,
13347                                             rdev->wiphy.wowlan_config->tcp))
13348                         goto nla_put_failure;
13349
13350                 if (nl80211_send_wowlan_nd(
13351                             msg,
13352                             rdev->wiphy.wowlan_config->nd_config))
13353                         goto nla_put_failure;
13354
13355                 nla_nest_end(msg, nl_wowlan);
13356         }
13357
13358         genlmsg_end(msg, hdr);
13359         return genlmsg_reply(msg, info);
13360
13361 nla_put_failure:
13362         nlmsg_free(msg);
13363         return -ENOBUFS;
13364 }
13365
13366 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13367                                     struct nlattr *attr,
13368                                     struct cfg80211_wowlan *trig)
13369 {
13370         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13371         struct cfg80211_wowlan_tcp *cfg;
13372         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13373         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13374         u32 size;
13375         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13376         int err, port;
13377
13378         if (!rdev->wiphy.wowlan->tcp)
13379                 return -EINVAL;
13380
13381         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13382                                           nl80211_wowlan_tcp_policy, NULL);
13383         if (err)
13384                 return err;
13385
13386         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13387             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13388             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13389             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13390             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13391             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13392             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13393             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13394                 return -EINVAL;
13395
13396         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13397         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13398                 return -EINVAL;
13399
13400         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13401                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13402             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13403                 return -EINVAL;
13404
13405         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13406         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13407                 return -EINVAL;
13408
13409         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13410         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13411                 return -EINVAL;
13412
13413         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13414                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13415
13416                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13417                 tokens_size = tokln - sizeof(*tok);
13418
13419                 if (!tok->len || tokens_size % tok->len)
13420                         return -EINVAL;
13421                 if (!rdev->wiphy.wowlan->tcp->tok)
13422                         return -EINVAL;
13423                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13424                         return -EINVAL;
13425                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13426                         return -EINVAL;
13427                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13428                         return -EINVAL;
13429                 if (tok->offset + tok->len > data_size)
13430                         return -EINVAL;
13431         }
13432
13433         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13434                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13435                 if (!rdev->wiphy.wowlan->tcp->seq)
13436                         return -EINVAL;
13437                 if (seq->len == 0 || seq->len > 4)
13438                         return -EINVAL;
13439                 if (seq->len + seq->offset > data_size)
13440                         return -EINVAL;
13441         }
13442
13443         size = sizeof(*cfg);
13444         size += data_size;
13445         size += wake_size + wake_mask_size;
13446         size += tokens_size;
13447
13448         cfg = kzalloc(size, GFP_KERNEL);
13449         if (!cfg)
13450                 return -ENOMEM;
13451         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13452         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13453         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13454                ETH_ALEN);
13455         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13456                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13457         else
13458                 port = 0;
13459 #ifdef CONFIG_INET
13460         /* allocate a socket and port for it and use it */
13461         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13462                             IPPROTO_TCP, &cfg->sock, 1);
13463         if (err) {
13464                 kfree(cfg);
13465                 return err;
13466         }
13467         if (inet_csk_get_port(cfg->sock->sk, port)) {
13468                 sock_release(cfg->sock);
13469                 kfree(cfg);
13470                 return -EADDRINUSE;
13471         }
13472         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13473 #else
13474         if (!port) {
13475                 kfree(cfg);
13476                 return -EINVAL;
13477         }
13478         cfg->src_port = port;
13479 #endif
13480
13481         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13482         cfg->payload_len = data_size;
13483         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13484         memcpy((void *)cfg->payload,
13485                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13486                data_size);
13487         if (seq)
13488                 cfg->payload_seq = *seq;
13489         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13490         cfg->wake_len = wake_size;
13491         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13492         memcpy((void *)cfg->wake_data,
13493                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13494                wake_size);
13495         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13496                          data_size + wake_size;
13497         memcpy((void *)cfg->wake_mask,
13498                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13499                wake_mask_size);
13500         if (tok) {
13501                 cfg->tokens_size = tokens_size;
13502                 cfg->payload_tok = *tok;
13503                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13504                        tokens_size);
13505         }
13506
13507         trig->tcp = cfg;
13508
13509         return 0;
13510 }
13511
13512 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13513                                    const struct wiphy_wowlan_support *wowlan,
13514                                    struct nlattr *attr,
13515                                    struct cfg80211_wowlan *trig)
13516 {
13517         struct nlattr **tb;
13518         int err;
13519
13520         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13521         if (!tb)
13522                 return -ENOMEM;
13523
13524         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13525                 err = -EOPNOTSUPP;
13526                 goto out;
13527         }
13528
13529         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13530                                           nl80211_policy, NULL);
13531         if (err)
13532                 goto out;
13533
13534         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13535                                                    wowlan->max_nd_match_sets);
13536         err = PTR_ERR_OR_ZERO(trig->nd_config);
13537         if (err)
13538                 trig->nd_config = NULL;
13539
13540 out:
13541         kfree(tb);
13542         return err;
13543 }
13544
13545 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13546 {
13547         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13548         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13549         struct cfg80211_wowlan new_triggers = {};
13550         struct cfg80211_wowlan *ntrig;
13551         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13552         int err, i;
13553         bool prev_enabled = rdev->wiphy.wowlan_config;
13554         bool regular = false;
13555
13556         if (!wowlan)
13557                 return -EOPNOTSUPP;
13558
13559         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13560                 cfg80211_rdev_free_wowlan(rdev);
13561                 rdev->wiphy.wowlan_config = NULL;
13562                 goto set_wakeup;
13563         }
13564
13565         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13566                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13567                                           nl80211_wowlan_policy, info->extack);
13568         if (err)
13569                 return err;
13570
13571         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13572                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13573                         return -EINVAL;
13574                 new_triggers.any = true;
13575         }
13576
13577         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13578                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13579                         return -EINVAL;
13580                 new_triggers.disconnect = true;
13581                 regular = true;
13582         }
13583
13584         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13585                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13586                         return -EINVAL;
13587                 new_triggers.magic_pkt = true;
13588                 regular = true;
13589         }
13590
13591         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13592                 return -EINVAL;
13593
13594         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13595                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13596                         return -EINVAL;
13597                 new_triggers.gtk_rekey_failure = true;
13598                 regular = true;
13599         }
13600
13601         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13602                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13603                         return -EINVAL;
13604                 new_triggers.eap_identity_req = true;
13605                 regular = true;
13606         }
13607
13608         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13609                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13610                         return -EINVAL;
13611                 new_triggers.four_way_handshake = true;
13612                 regular = true;
13613         }
13614
13615         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13616                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13617                         return -EINVAL;
13618                 new_triggers.rfkill_release = true;
13619                 regular = true;
13620         }
13621
13622         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13623                 struct nlattr *pat;
13624                 int n_patterns = 0;
13625                 int rem, pat_len, mask_len, pkt_offset;
13626                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13627
13628                 regular = true;
13629
13630                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13631                                     rem)
13632                         n_patterns++;
13633                 if (n_patterns > wowlan->n_patterns)
13634                         return -EINVAL;
13635
13636                 new_triggers.patterns = kcalloc(n_patterns,
13637                                                 sizeof(new_triggers.patterns[0]),
13638                                                 GFP_KERNEL);
13639                 if (!new_triggers.patterns)
13640                         return -ENOMEM;
13641
13642                 new_triggers.n_patterns = n_patterns;
13643                 i = 0;
13644
13645                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13646                                     rem) {
13647                         u8 *mask_pat;
13648
13649                         err = nla_parse_nested_deprecated(pat_tb,
13650                                                           MAX_NL80211_PKTPAT,
13651                                                           pat,
13652                                                           nl80211_packet_pattern_policy,
13653                                                           info->extack);
13654                         if (err)
13655                                 goto error;
13656
13657                         err = -EINVAL;
13658                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13659                             !pat_tb[NL80211_PKTPAT_PATTERN])
13660                                 goto error;
13661                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13662                         mask_len = DIV_ROUND_UP(pat_len, 8);
13663                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13664                                 goto error;
13665                         if (pat_len > wowlan->pattern_max_len ||
13666                             pat_len < wowlan->pattern_min_len)
13667                                 goto error;
13668
13669                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
13670                                 pkt_offset = 0;
13671                         else
13672                                 pkt_offset = nla_get_u32(
13673                                         pat_tb[NL80211_PKTPAT_OFFSET]);
13674                         if (pkt_offset > wowlan->max_pkt_offset)
13675                                 goto error;
13676                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13677
13678                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13679                         if (!mask_pat) {
13680                                 err = -ENOMEM;
13681                                 goto error;
13682                         }
13683                         new_triggers.patterns[i].mask = mask_pat;
13684                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13685                                mask_len);
13686                         mask_pat += mask_len;
13687                         new_triggers.patterns[i].pattern = mask_pat;
13688                         new_triggers.patterns[i].pattern_len = pat_len;
13689                         memcpy(mask_pat,
13690                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13691                                pat_len);
13692                         i++;
13693                 }
13694         }
13695
13696         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13697                 regular = true;
13698                 err = nl80211_parse_wowlan_tcp(
13699                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13700                         &new_triggers);
13701                 if (err)
13702                         goto error;
13703         }
13704
13705         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13706                 regular = true;
13707                 err = nl80211_parse_wowlan_nd(
13708                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13709                         &new_triggers);
13710                 if (err)
13711                         goto error;
13712         }
13713
13714         /* The 'any' trigger means the device continues operating more or less
13715          * as in its normal operation mode and wakes up the host on most of the
13716          * normal interrupts (like packet RX, ...)
13717          * It therefore makes little sense to combine with the more constrained
13718          * wakeup trigger modes.
13719          */
13720         if (new_triggers.any && regular) {
13721                 err = -EINVAL;
13722                 goto error;
13723         }
13724
13725         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13726         if (!ntrig) {
13727                 err = -ENOMEM;
13728                 goto error;
13729         }
13730         cfg80211_rdev_free_wowlan(rdev);
13731         rdev->wiphy.wowlan_config = ntrig;
13732
13733  set_wakeup:
13734         if (rdev->ops->set_wakeup &&
13735             prev_enabled != !!rdev->wiphy.wowlan_config)
13736                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13737
13738         return 0;
13739  error:
13740         for (i = 0; i < new_triggers.n_patterns; i++)
13741                 kfree(new_triggers.patterns[i].mask);
13742         kfree(new_triggers.patterns);
13743         if (new_triggers.tcp && new_triggers.tcp->sock)
13744                 sock_release(new_triggers.tcp->sock);
13745         kfree(new_triggers.tcp);
13746         kfree(new_triggers.nd_config);
13747         return err;
13748 }
13749 #endif
13750
13751 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13752                                        struct cfg80211_registered_device *rdev)
13753 {
13754         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13755         int i, j, pat_len;
13756         struct cfg80211_coalesce_rules *rule;
13757
13758         if (!rdev->coalesce->n_rules)
13759                 return 0;
13760
13761         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13762         if (!nl_rules)
13763                 return -ENOBUFS;
13764
13765         for (i = 0; i < rdev->coalesce->n_rules; i++) {
13766                 nl_rule = nla_nest_start_noflag(msg, i + 1);
13767                 if (!nl_rule)
13768                         return -ENOBUFS;
13769
13770                 rule = &rdev->coalesce->rules[i];
13771                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13772                                 rule->delay))
13773                         return -ENOBUFS;
13774
13775                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13776                                 rule->condition))
13777                         return -ENOBUFS;
13778
13779                 nl_pats = nla_nest_start_noflag(msg,
13780                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13781                 if (!nl_pats)
13782                         return -ENOBUFS;
13783
13784                 for (j = 0; j < rule->n_patterns; j++) {
13785                         nl_pat = nla_nest_start_noflag(msg, j + 1);
13786                         if (!nl_pat)
13787                                 return -ENOBUFS;
13788                         pat_len = rule->patterns[j].pattern_len;
13789                         if (nla_put(msg, NL80211_PKTPAT_MASK,
13790                                     DIV_ROUND_UP(pat_len, 8),
13791                                     rule->patterns[j].mask) ||
13792                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13793                                     rule->patterns[j].pattern) ||
13794                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13795                                         rule->patterns[j].pkt_offset))
13796                                 return -ENOBUFS;
13797                         nla_nest_end(msg, nl_pat);
13798                 }
13799                 nla_nest_end(msg, nl_pats);
13800                 nla_nest_end(msg, nl_rule);
13801         }
13802         nla_nest_end(msg, nl_rules);
13803
13804         return 0;
13805 }
13806
13807 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13808 {
13809         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13810         struct sk_buff *msg;
13811         void *hdr;
13812
13813         if (!rdev->wiphy.coalesce)
13814                 return -EOPNOTSUPP;
13815
13816         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13817         if (!msg)
13818                 return -ENOMEM;
13819
13820         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13821                              NL80211_CMD_GET_COALESCE);
13822         if (!hdr)
13823                 goto nla_put_failure;
13824
13825         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13826                 goto nla_put_failure;
13827
13828         genlmsg_end(msg, hdr);
13829         return genlmsg_reply(msg, info);
13830
13831 nla_put_failure:
13832         nlmsg_free(msg);
13833         return -ENOBUFS;
13834 }
13835
13836 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13837 {
13838         struct cfg80211_coalesce *coalesce = rdev->coalesce;
13839         int i, j;
13840         struct cfg80211_coalesce_rules *rule;
13841
13842         if (!coalesce)
13843                 return;
13844
13845         for (i = 0; i < coalesce->n_rules; i++) {
13846                 rule = &coalesce->rules[i];
13847                 for (j = 0; j < rule->n_patterns; j++)
13848                         kfree(rule->patterns[j].mask);
13849                 kfree(rule->patterns);
13850         }
13851         kfree(coalesce->rules);
13852         kfree(coalesce);
13853         rdev->coalesce = NULL;
13854 }
13855
13856 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13857                                        struct nlattr *rule,
13858                                        struct cfg80211_coalesce_rules *new_rule)
13859 {
13860         int err, i;
13861         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13862         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13863         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13864         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13865
13866         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13867                                           rule, nl80211_coalesce_policy, NULL);
13868         if (err)
13869                 return err;
13870
13871         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13872                 new_rule->delay =
13873                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13874         if (new_rule->delay > coalesce->max_delay)
13875                 return -EINVAL;
13876
13877         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13878                 new_rule->condition =
13879                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13880
13881         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13882                 return -EINVAL;
13883
13884         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13885                             rem)
13886                 n_patterns++;
13887         if (n_patterns > coalesce->n_patterns)
13888                 return -EINVAL;
13889
13890         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13891                                      GFP_KERNEL);
13892         if (!new_rule->patterns)
13893                 return -ENOMEM;
13894
13895         new_rule->n_patterns = n_patterns;
13896         i = 0;
13897
13898         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13899                             rem) {
13900                 u8 *mask_pat;
13901
13902                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13903                                                   pat,
13904                                                   nl80211_packet_pattern_policy,
13905                                                   NULL);
13906                 if (err)
13907                         return err;
13908
13909                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13910                     !pat_tb[NL80211_PKTPAT_PATTERN])
13911                         return -EINVAL;
13912                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13913                 mask_len = DIV_ROUND_UP(pat_len, 8);
13914                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13915                         return -EINVAL;
13916                 if (pat_len > coalesce->pattern_max_len ||
13917                     pat_len < coalesce->pattern_min_len)
13918                         return -EINVAL;
13919
13920                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13921                         pkt_offset = 0;
13922                 else
13923                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13924                 if (pkt_offset > coalesce->max_pkt_offset)
13925                         return -EINVAL;
13926                 new_rule->patterns[i].pkt_offset = pkt_offset;
13927
13928                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13929                 if (!mask_pat)
13930                         return -ENOMEM;
13931
13932                 new_rule->patterns[i].mask = mask_pat;
13933                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13934                        mask_len);
13935
13936                 mask_pat += mask_len;
13937                 new_rule->patterns[i].pattern = mask_pat;
13938                 new_rule->patterns[i].pattern_len = pat_len;
13939                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13940                        pat_len);
13941                 i++;
13942         }
13943
13944         return 0;
13945 }
13946
13947 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13948 {
13949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13950         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13951         struct cfg80211_coalesce new_coalesce = {};
13952         struct cfg80211_coalesce *n_coalesce;
13953         int err, rem_rule, n_rules = 0, i, j;
13954         struct nlattr *rule;
13955         struct cfg80211_coalesce_rules *tmp_rule;
13956
13957         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13958                 return -EOPNOTSUPP;
13959
13960         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13961                 cfg80211_rdev_free_coalesce(rdev);
13962                 rdev_set_coalesce(rdev, NULL);
13963                 return 0;
13964         }
13965
13966         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13967                             rem_rule)
13968                 n_rules++;
13969         if (n_rules > coalesce->n_rules)
13970                 return -EINVAL;
13971
13972         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13973                                      GFP_KERNEL);
13974         if (!new_coalesce.rules)
13975                 return -ENOMEM;
13976
13977         new_coalesce.n_rules = n_rules;
13978         i = 0;
13979
13980         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13981                             rem_rule) {
13982                 err = nl80211_parse_coalesce_rule(rdev, rule,
13983                                                   &new_coalesce.rules[i]);
13984                 if (err)
13985                         goto error;
13986
13987                 i++;
13988         }
13989
13990         err = rdev_set_coalesce(rdev, &new_coalesce);
13991         if (err)
13992                 goto error;
13993
13994         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13995         if (!n_coalesce) {
13996                 err = -ENOMEM;
13997                 goto error;
13998         }
13999         cfg80211_rdev_free_coalesce(rdev);
14000         rdev->coalesce = n_coalesce;
14001
14002         return 0;
14003 error:
14004         for (i = 0; i < new_coalesce.n_rules; i++) {
14005                 tmp_rule = &new_coalesce.rules[i];
14006                 for (j = 0; j < tmp_rule->n_patterns; j++)
14007                         kfree(tmp_rule->patterns[j].mask);
14008                 kfree(tmp_rule->patterns);
14009         }
14010         kfree(new_coalesce.rules);
14011
14012         return err;
14013 }
14014
14015 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14016 {
14017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14018         struct net_device *dev = info->user_ptr[1];
14019         struct wireless_dev *wdev = dev->ieee80211_ptr;
14020         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14021         struct cfg80211_gtk_rekey_data rekey_data = {};
14022         int err;
14023
14024         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14025                 return -EINVAL;
14026
14027         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14028                                           info->attrs[NL80211_ATTR_REKEY_DATA],
14029                                           nl80211_rekey_policy, info->extack);
14030         if (err)
14031                 return err;
14032
14033         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14034             !tb[NL80211_REKEY_DATA_KCK])
14035                 return -EINVAL;
14036         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14037             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14038               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14039                 return -ERANGE;
14040         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14041             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14042               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14043              !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14044                nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14045                 return -ERANGE;
14046
14047         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14048         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14049         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14050         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14051         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14052         if (tb[NL80211_REKEY_DATA_AKM])
14053                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14054
14055         if (!wdev->connected)
14056                 return -ENOTCONN;
14057
14058         if (!rdev->ops->set_rekey_data)
14059                 return -EOPNOTSUPP;
14060
14061         return rdev_set_rekey_data(rdev, dev, &rekey_data);
14062 }
14063
14064 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14065                                              struct genl_info *info)
14066 {
14067         struct net_device *dev = info->user_ptr[1];
14068         struct wireless_dev *wdev = dev->ieee80211_ptr;
14069
14070         if (wdev->iftype != NL80211_IFTYPE_AP &&
14071             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14072                 return -EINVAL;
14073
14074         if (wdev->ap_unexpected_nlportid)
14075                 return -EBUSY;
14076
14077         wdev->ap_unexpected_nlportid = info->snd_portid;
14078         return 0;
14079 }
14080
14081 static int nl80211_probe_client(struct sk_buff *skb,
14082                                 struct genl_info *info)
14083 {
14084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14085         struct net_device *dev = info->user_ptr[1];
14086         struct wireless_dev *wdev = dev->ieee80211_ptr;
14087         struct sk_buff *msg;
14088         void *hdr;
14089         const u8 *addr;
14090         u64 cookie;
14091         int err;
14092
14093         if (wdev->iftype != NL80211_IFTYPE_AP &&
14094             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14095                 return -EOPNOTSUPP;
14096
14097         if (!info->attrs[NL80211_ATTR_MAC])
14098                 return -EINVAL;
14099
14100         if (!rdev->ops->probe_client)
14101                 return -EOPNOTSUPP;
14102
14103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14104         if (!msg)
14105                 return -ENOMEM;
14106
14107         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14108                              NL80211_CMD_PROBE_CLIENT);
14109         if (!hdr) {
14110                 err = -ENOBUFS;
14111                 goto free_msg;
14112         }
14113
14114         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14115
14116         err = rdev_probe_client(rdev, dev, addr, &cookie);
14117         if (err)
14118                 goto free_msg;
14119
14120         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14121                               NL80211_ATTR_PAD))
14122                 goto nla_put_failure;
14123
14124         genlmsg_end(msg, hdr);
14125
14126         return genlmsg_reply(msg, info);
14127
14128  nla_put_failure:
14129         err = -ENOBUFS;
14130  free_msg:
14131         nlmsg_free(msg);
14132         return err;
14133 }
14134
14135 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14136 {
14137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14138         struct cfg80211_beacon_registration *reg, *nreg;
14139         int rv;
14140
14141         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14142                 return -EOPNOTSUPP;
14143
14144         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14145         if (!nreg)
14146                 return -ENOMEM;
14147
14148         /* First, check if already registered. */
14149         spin_lock_bh(&rdev->beacon_registrations_lock);
14150         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14151                 if (reg->nlportid == info->snd_portid) {
14152                         rv = -EALREADY;
14153                         goto out_err;
14154                 }
14155         }
14156         /* Add it to the list */
14157         nreg->nlportid = info->snd_portid;
14158         list_add(&nreg->list, &rdev->beacon_registrations);
14159
14160         spin_unlock_bh(&rdev->beacon_registrations_lock);
14161
14162         return 0;
14163 out_err:
14164         spin_unlock_bh(&rdev->beacon_registrations_lock);
14165         kfree(nreg);
14166         return rv;
14167 }
14168
14169 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14170 {
14171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14172         struct wireless_dev *wdev = info->user_ptr[1];
14173         int err;
14174
14175         if (!rdev->ops->start_p2p_device)
14176                 return -EOPNOTSUPP;
14177
14178         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14179                 return -EOPNOTSUPP;
14180
14181         if (wdev_running(wdev))
14182                 return 0;
14183
14184         if (rfkill_blocked(rdev->wiphy.rfkill))
14185                 return -ERFKILL;
14186
14187         err = rdev_start_p2p_device(rdev, wdev);
14188         if (err)
14189                 return err;
14190
14191         wdev->is_running = true;
14192         rdev->opencount++;
14193
14194         return 0;
14195 }
14196
14197 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14198 {
14199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14200         struct wireless_dev *wdev = info->user_ptr[1];
14201
14202         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14203                 return -EOPNOTSUPP;
14204
14205         if (!rdev->ops->stop_p2p_device)
14206                 return -EOPNOTSUPP;
14207
14208         cfg80211_stop_p2p_device(rdev, wdev);
14209
14210         return 0;
14211 }
14212
14213 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14214 {
14215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14216         struct wireless_dev *wdev = info->user_ptr[1];
14217         struct cfg80211_nan_conf conf = {};
14218         int err;
14219
14220         if (wdev->iftype != NL80211_IFTYPE_NAN)
14221                 return -EOPNOTSUPP;
14222
14223         if (wdev_running(wdev))
14224                 return -EEXIST;
14225
14226         if (rfkill_blocked(rdev->wiphy.rfkill))
14227                 return -ERFKILL;
14228
14229         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14230                 return -EINVAL;
14231
14232         conf.master_pref =
14233                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14234
14235         if (info->attrs[NL80211_ATTR_BANDS]) {
14236                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14237
14238                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14239                         return -EOPNOTSUPP;
14240
14241                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14242                         return -EINVAL;
14243
14244                 conf.bands = bands;
14245         }
14246
14247         err = rdev_start_nan(rdev, wdev, &conf);
14248         if (err)
14249                 return err;
14250
14251         wdev->is_running = true;
14252         rdev->opencount++;
14253
14254         return 0;
14255 }
14256
14257 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14258 {
14259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14260         struct wireless_dev *wdev = info->user_ptr[1];
14261
14262         if (wdev->iftype != NL80211_IFTYPE_NAN)
14263                 return -EOPNOTSUPP;
14264
14265         cfg80211_stop_nan(rdev, wdev);
14266
14267         return 0;
14268 }
14269
14270 static int validate_nan_filter(struct nlattr *filter_attr)
14271 {
14272         struct nlattr *attr;
14273         int len = 0, n_entries = 0, rem;
14274
14275         nla_for_each_nested(attr, filter_attr, rem) {
14276                 len += nla_len(attr);
14277                 n_entries++;
14278         }
14279
14280         if (len >= U8_MAX)
14281                 return -EINVAL;
14282
14283         return n_entries;
14284 }
14285
14286 static int handle_nan_filter(struct nlattr *attr_filter,
14287                              struct cfg80211_nan_func *func,
14288                              bool tx)
14289 {
14290         struct nlattr *attr;
14291         int n_entries, rem, i;
14292         struct cfg80211_nan_func_filter *filter;
14293
14294         n_entries = validate_nan_filter(attr_filter);
14295         if (n_entries < 0)
14296                 return n_entries;
14297
14298         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14299
14300         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14301         if (!filter)
14302                 return -ENOMEM;
14303
14304         i = 0;
14305         nla_for_each_nested(attr, attr_filter, rem) {
14306                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14307                 if (!filter[i].filter)
14308                         goto err;
14309
14310                 filter[i].len = nla_len(attr);
14311                 i++;
14312         }
14313         if (tx) {
14314                 func->num_tx_filters = n_entries;
14315                 func->tx_filters = filter;
14316         } else {
14317                 func->num_rx_filters = n_entries;
14318                 func->rx_filters = filter;
14319         }
14320
14321         return 0;
14322
14323 err:
14324         i = 0;
14325         nla_for_each_nested(attr, attr_filter, rem) {
14326                 kfree(filter[i].filter);
14327                 i++;
14328         }
14329         kfree(filter);
14330         return -ENOMEM;
14331 }
14332
14333 static int nl80211_nan_add_func(struct sk_buff *skb,
14334                                 struct genl_info *info)
14335 {
14336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14337         struct wireless_dev *wdev = info->user_ptr[1];
14338         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14339         struct cfg80211_nan_func *func;
14340         struct sk_buff *msg = NULL;
14341         void *hdr = NULL;
14342         int err = 0;
14343
14344         if (wdev->iftype != NL80211_IFTYPE_NAN)
14345                 return -EOPNOTSUPP;
14346
14347         if (!wdev_running(wdev))
14348                 return -ENOTCONN;
14349
14350         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14351                 return -EINVAL;
14352
14353         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14354                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14355                                           nl80211_nan_func_policy,
14356                                           info->extack);
14357         if (err)
14358                 return err;
14359
14360         func = kzalloc(sizeof(*func), GFP_KERNEL);
14361         if (!func)
14362                 return -ENOMEM;
14363
14364         func->cookie = cfg80211_assign_cookie(rdev);
14365
14366         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14367                 err = -EINVAL;
14368                 goto out;
14369         }
14370
14371
14372         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14373
14374         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14375                 err = -EINVAL;
14376                 goto out;
14377         }
14378
14379         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14380                sizeof(func->service_id));
14381
14382         func->close_range =
14383                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14384
14385         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14386                 func->serv_spec_info_len =
14387                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14388                 func->serv_spec_info =
14389                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14390                                 func->serv_spec_info_len,
14391                                 GFP_KERNEL);
14392                 if (!func->serv_spec_info) {
14393                         err = -ENOMEM;
14394                         goto out;
14395                 }
14396         }
14397
14398         if (tb[NL80211_NAN_FUNC_TTL])
14399                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14400
14401         switch (func->type) {
14402         case NL80211_NAN_FUNC_PUBLISH:
14403                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14404                         err = -EINVAL;
14405                         goto out;
14406                 }
14407
14408                 func->publish_type =
14409                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14410                 func->publish_bcast =
14411                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14412
14413                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14414                         func->publish_bcast) {
14415                         err = -EINVAL;
14416                         goto out;
14417                 }
14418                 break;
14419         case NL80211_NAN_FUNC_SUBSCRIBE:
14420                 func->subscribe_active =
14421                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14422                 break;
14423         case NL80211_NAN_FUNC_FOLLOW_UP:
14424                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14425                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14426                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14427                         err = -EINVAL;
14428                         goto out;
14429                 }
14430
14431                 func->followup_id =
14432                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14433                 func->followup_reqid =
14434                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14435                 memcpy(func->followup_dest.addr,
14436                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14437                        sizeof(func->followup_dest.addr));
14438                 if (func->ttl) {
14439                         err = -EINVAL;
14440                         goto out;
14441                 }
14442                 break;
14443         default:
14444                 err = -EINVAL;
14445                 goto out;
14446         }
14447
14448         if (tb[NL80211_NAN_FUNC_SRF]) {
14449                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14450
14451                 err = nla_parse_nested_deprecated(srf_tb,
14452                                                   NL80211_NAN_SRF_ATTR_MAX,
14453                                                   tb[NL80211_NAN_FUNC_SRF],
14454                                                   nl80211_nan_srf_policy,
14455                                                   info->extack);
14456                 if (err)
14457                         goto out;
14458
14459                 func->srf_include =
14460                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14461
14462                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14463                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14464                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14465                                 err = -EINVAL;
14466                                 goto out;
14467                         }
14468
14469                         func->srf_bf_len =
14470                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14471                         func->srf_bf =
14472                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14473                                         func->srf_bf_len, GFP_KERNEL);
14474                         if (!func->srf_bf) {
14475                                 err = -ENOMEM;
14476                                 goto out;
14477                         }
14478
14479                         func->srf_bf_idx =
14480                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14481                 } else {
14482                         struct nlattr *attr, *mac_attr =
14483                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14484                         int n_entries, rem, i = 0;
14485
14486                         if (!mac_attr) {
14487                                 err = -EINVAL;
14488                                 goto out;
14489                         }
14490
14491                         n_entries = validate_acl_mac_addrs(mac_attr);
14492                         if (n_entries <= 0) {
14493                                 err = -EINVAL;
14494                                 goto out;
14495                         }
14496
14497                         func->srf_num_macs = n_entries;
14498                         func->srf_macs =
14499                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14500                                         GFP_KERNEL);
14501                         if (!func->srf_macs) {
14502                                 err = -ENOMEM;
14503                                 goto out;
14504                         }
14505
14506                         nla_for_each_nested(attr, mac_attr, rem)
14507                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14508                                        sizeof(*func->srf_macs));
14509                 }
14510         }
14511
14512         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14513                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14514                                         func, true);
14515                 if (err)
14516                         goto out;
14517         }
14518
14519         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14520                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14521                                         func, false);
14522                 if (err)
14523                         goto out;
14524         }
14525
14526         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14527         if (!msg) {
14528                 err = -ENOMEM;
14529                 goto out;
14530         }
14531
14532         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14533                              NL80211_CMD_ADD_NAN_FUNCTION);
14534         /* This can't really happen - we just allocated 4KB */
14535         if (WARN_ON(!hdr)) {
14536                 err = -ENOMEM;
14537                 goto out;
14538         }
14539
14540         err = rdev_add_nan_func(rdev, wdev, func);
14541 out:
14542         if (err < 0) {
14543                 cfg80211_free_nan_func(func);
14544                 nlmsg_free(msg);
14545                 return err;
14546         }
14547
14548         /* propagate the instance id and cookie to userspace  */
14549         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14550                               NL80211_ATTR_PAD))
14551                 goto nla_put_failure;
14552
14553         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14554         if (!func_attr)
14555                 goto nla_put_failure;
14556
14557         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14558                        func->instance_id))
14559                 goto nla_put_failure;
14560
14561         nla_nest_end(msg, func_attr);
14562
14563         genlmsg_end(msg, hdr);
14564         return genlmsg_reply(msg, info);
14565
14566 nla_put_failure:
14567         nlmsg_free(msg);
14568         return -ENOBUFS;
14569 }
14570
14571 static int nl80211_nan_del_func(struct sk_buff *skb,
14572                                struct genl_info *info)
14573 {
14574         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14575         struct wireless_dev *wdev = info->user_ptr[1];
14576         u64 cookie;
14577
14578         if (wdev->iftype != NL80211_IFTYPE_NAN)
14579                 return -EOPNOTSUPP;
14580
14581         if (!wdev_running(wdev))
14582                 return -ENOTCONN;
14583
14584         if (!info->attrs[NL80211_ATTR_COOKIE])
14585                 return -EINVAL;
14586
14587         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14588
14589         rdev_del_nan_func(rdev, wdev, cookie);
14590
14591         return 0;
14592 }
14593
14594 static int nl80211_nan_change_config(struct sk_buff *skb,
14595                                      struct genl_info *info)
14596 {
14597         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14598         struct wireless_dev *wdev = info->user_ptr[1];
14599         struct cfg80211_nan_conf conf = {};
14600         u32 changed = 0;
14601
14602         if (wdev->iftype != NL80211_IFTYPE_NAN)
14603                 return -EOPNOTSUPP;
14604
14605         if (!wdev_running(wdev))
14606                 return -ENOTCONN;
14607
14608         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14609                 conf.master_pref =
14610                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14611                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14612                         return -EINVAL;
14613
14614                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14615         }
14616
14617         if (info->attrs[NL80211_ATTR_BANDS]) {
14618                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14619
14620                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14621                         return -EOPNOTSUPP;
14622
14623                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14624                         return -EINVAL;
14625
14626                 conf.bands = bands;
14627                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14628         }
14629
14630         if (!changed)
14631                 return -EINVAL;
14632
14633         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14634 }
14635
14636 void cfg80211_nan_match(struct wireless_dev *wdev,
14637                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14638 {
14639         struct wiphy *wiphy = wdev->wiphy;
14640         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14641         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14642         struct sk_buff *msg;
14643         void *hdr;
14644
14645         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14646                 return;
14647
14648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14649         if (!msg)
14650                 return;
14651
14652         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14653         if (!hdr) {
14654                 nlmsg_free(msg);
14655                 return;
14656         }
14657
14658         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14659             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14660                                          wdev->netdev->ifindex)) ||
14661             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14662                               NL80211_ATTR_PAD))
14663                 goto nla_put_failure;
14664
14665         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14666                               NL80211_ATTR_PAD) ||
14667             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14668                 goto nla_put_failure;
14669
14670         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14671         if (!match_attr)
14672                 goto nla_put_failure;
14673
14674         local_func_attr = nla_nest_start_noflag(msg,
14675                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14676         if (!local_func_attr)
14677                 goto nla_put_failure;
14678
14679         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14680                 goto nla_put_failure;
14681
14682         nla_nest_end(msg, local_func_attr);
14683
14684         peer_func_attr = nla_nest_start_noflag(msg,
14685                                                NL80211_NAN_MATCH_FUNC_PEER);
14686         if (!peer_func_attr)
14687                 goto nla_put_failure;
14688
14689         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14690             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14691                 goto nla_put_failure;
14692
14693         if (match->info && match->info_len &&
14694             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14695                     match->info))
14696                 goto nla_put_failure;
14697
14698         nla_nest_end(msg, peer_func_attr);
14699         nla_nest_end(msg, match_attr);
14700         genlmsg_end(msg, hdr);
14701
14702         if (!wdev->owner_nlportid)
14703                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14704                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14705         else
14706                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14707                                 wdev->owner_nlportid);
14708
14709         return;
14710
14711 nla_put_failure:
14712         nlmsg_free(msg);
14713 }
14714 EXPORT_SYMBOL(cfg80211_nan_match);
14715
14716 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14717                                   u8 inst_id,
14718                                   enum nl80211_nan_func_term_reason reason,
14719                                   u64 cookie, gfp_t gfp)
14720 {
14721         struct wiphy *wiphy = wdev->wiphy;
14722         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14723         struct sk_buff *msg;
14724         struct nlattr *func_attr;
14725         void *hdr;
14726
14727         if (WARN_ON(!inst_id))
14728                 return;
14729
14730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14731         if (!msg)
14732                 return;
14733
14734         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14735         if (!hdr) {
14736                 nlmsg_free(msg);
14737                 return;
14738         }
14739
14740         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14741             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14742                                          wdev->netdev->ifindex)) ||
14743             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14744                               NL80211_ATTR_PAD))
14745                 goto nla_put_failure;
14746
14747         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14748                               NL80211_ATTR_PAD))
14749                 goto nla_put_failure;
14750
14751         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14752         if (!func_attr)
14753                 goto nla_put_failure;
14754
14755         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14756             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14757                 goto nla_put_failure;
14758
14759         nla_nest_end(msg, func_attr);
14760         genlmsg_end(msg, hdr);
14761
14762         if (!wdev->owner_nlportid)
14763                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14764                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14765         else
14766                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14767                                 wdev->owner_nlportid);
14768
14769         return;
14770
14771 nla_put_failure:
14772         nlmsg_free(msg);
14773 }
14774 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14775
14776 static int nl80211_get_protocol_features(struct sk_buff *skb,
14777                                          struct genl_info *info)
14778 {
14779         void *hdr;
14780         struct sk_buff *msg;
14781
14782         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14783         if (!msg)
14784                 return -ENOMEM;
14785
14786         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14787                              NL80211_CMD_GET_PROTOCOL_FEATURES);
14788         if (!hdr)
14789                 goto nla_put_failure;
14790
14791         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14792                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14793                 goto nla_put_failure;
14794
14795         genlmsg_end(msg, hdr);
14796         return genlmsg_reply(msg, info);
14797
14798  nla_put_failure:
14799         kfree_skb(msg);
14800         return -ENOBUFS;
14801 }
14802
14803 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14804 {
14805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14806         struct cfg80211_update_ft_ies_params ft_params;
14807         struct net_device *dev = info->user_ptr[1];
14808
14809         if (!rdev->ops->update_ft_ies)
14810                 return -EOPNOTSUPP;
14811
14812         if (!info->attrs[NL80211_ATTR_MDID] ||
14813             !info->attrs[NL80211_ATTR_IE])
14814                 return -EINVAL;
14815
14816         memset(&ft_params, 0, sizeof(ft_params));
14817         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14818         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14819         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14820
14821         return rdev_update_ft_ies(rdev, dev, &ft_params);
14822 }
14823
14824 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14825                                        struct genl_info *info)
14826 {
14827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14828         struct wireless_dev *wdev = info->user_ptr[1];
14829         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14830         u16 duration;
14831         int ret;
14832
14833         if (!rdev->ops->crit_proto_start)
14834                 return -EOPNOTSUPP;
14835
14836         if (WARN_ON(!rdev->ops->crit_proto_stop))
14837                 return -EINVAL;
14838
14839         if (rdev->crit_proto_nlportid)
14840                 return -EBUSY;
14841
14842         /* determine protocol if provided */
14843         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14844                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14845
14846         if (proto >= NUM_NL80211_CRIT_PROTO)
14847                 return -EINVAL;
14848
14849         /* timeout must be provided */
14850         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14851                 return -EINVAL;
14852
14853         duration =
14854                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14855
14856         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14857         if (!ret)
14858                 rdev->crit_proto_nlportid = info->snd_portid;
14859
14860         return ret;
14861 }
14862
14863 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14864                                       struct genl_info *info)
14865 {
14866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14867         struct wireless_dev *wdev = info->user_ptr[1];
14868
14869         if (!rdev->ops->crit_proto_stop)
14870                 return -EOPNOTSUPP;
14871
14872         if (rdev->crit_proto_nlportid) {
14873                 rdev->crit_proto_nlportid = 0;
14874                 rdev_crit_proto_stop(rdev, wdev);
14875         }
14876         return 0;
14877 }
14878
14879 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14880                                        struct nlattr *attr,
14881                                        struct netlink_ext_ack *extack)
14882 {
14883         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14884                 if (attr->nla_type & NLA_F_NESTED) {
14885                         NL_SET_ERR_MSG_ATTR(extack, attr,
14886                                             "unexpected nested data");
14887                         return -EINVAL;
14888                 }
14889
14890                 return 0;
14891         }
14892
14893         if (!(attr->nla_type & NLA_F_NESTED)) {
14894                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14895                 return -EINVAL;
14896         }
14897
14898         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14899 }
14900
14901 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14902 {
14903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14904         struct wireless_dev *wdev =
14905                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14906                                            info->attrs);
14907         int i, err;
14908         u32 vid, subcmd;
14909
14910         if (!rdev->wiphy.vendor_commands)
14911                 return -EOPNOTSUPP;
14912
14913         if (IS_ERR(wdev)) {
14914                 err = PTR_ERR(wdev);
14915                 if (err != -EINVAL)
14916                         return err;
14917                 wdev = NULL;
14918         } else if (wdev->wiphy != &rdev->wiphy) {
14919                 return -EINVAL;
14920         }
14921
14922         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14923             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14924                 return -EINVAL;
14925
14926         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14927         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14928         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14929                 const struct wiphy_vendor_command *vcmd;
14930                 void *data = NULL;
14931                 int len = 0;
14932
14933                 vcmd = &rdev->wiphy.vendor_commands[i];
14934
14935                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14936                         continue;
14937
14938                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14939                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14940                         if (!wdev)
14941                                 return -EINVAL;
14942                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14943                             !wdev->netdev)
14944                                 return -EINVAL;
14945
14946                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14947                                 if (!wdev_running(wdev))
14948                                         return -ENETDOWN;
14949                         }
14950                 } else {
14951                         wdev = NULL;
14952                 }
14953
14954                 if (!vcmd->doit)
14955                         return -EOPNOTSUPP;
14956
14957                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14958                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14959                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14960
14961                         err = nl80211_vendor_check_policy(vcmd,
14962                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
14963                                         info->extack);
14964                         if (err)
14965                                 return err;
14966                 }
14967
14968                 rdev->cur_cmd_info = info;
14969                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14970                 rdev->cur_cmd_info = NULL;
14971                 return err;
14972         }
14973
14974         return -EOPNOTSUPP;
14975 }
14976
14977 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14978                                        struct netlink_callback *cb,
14979                                        struct cfg80211_registered_device **rdev,
14980                                        struct wireless_dev **wdev)
14981 {
14982         struct nlattr **attrbuf;
14983         u32 vid, subcmd;
14984         unsigned int i;
14985         int vcmd_idx = -1;
14986         int err;
14987         void *data = NULL;
14988         unsigned int data_len = 0;
14989
14990         if (cb->args[0]) {
14991                 /* subtract the 1 again here */
14992                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14993                 struct wireless_dev *tmp;
14994
14995                 if (!wiphy)
14996                         return -ENODEV;
14997                 *rdev = wiphy_to_rdev(wiphy);
14998                 *wdev = NULL;
14999
15000                 if (cb->args[1]) {
15001                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15002                                 if (tmp->identifier == cb->args[1] - 1) {
15003                                         *wdev = tmp;
15004                                         break;
15005                                 }
15006                         }
15007                 }
15008
15009                 /* keep rtnl locked in successful case */
15010                 return 0;
15011         }
15012
15013         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15014         if (!attrbuf)
15015                 return -ENOMEM;
15016
15017         err = nlmsg_parse_deprecated(cb->nlh,
15018                                      GENL_HDRLEN + nl80211_fam.hdrsize,
15019                                      attrbuf, nl80211_fam.maxattr,
15020                                      nl80211_policy, NULL);
15021         if (err)
15022                 goto out;
15023
15024         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15025             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15026                 err = -EINVAL;
15027                 goto out;
15028         }
15029
15030         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15031         if (IS_ERR(*wdev))
15032                 *wdev = NULL;
15033
15034         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15035         if (IS_ERR(*rdev)) {
15036                 err = PTR_ERR(*rdev);
15037                 goto out;
15038         }
15039
15040         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15041         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15042
15043         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15044                 const struct wiphy_vendor_command *vcmd;
15045
15046                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15047
15048                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15049                         continue;
15050
15051                 if (!vcmd->dumpit) {
15052                         err = -EOPNOTSUPP;
15053                         goto out;
15054                 }
15055
15056                 vcmd_idx = i;
15057                 break;
15058         }
15059
15060         if (vcmd_idx < 0) {
15061                 err = -EOPNOTSUPP;
15062                 goto out;
15063         }
15064
15065         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15066                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15067                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15068
15069                 err = nl80211_vendor_check_policy(
15070                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15071                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
15072                                 cb->extack);
15073                 if (err)
15074                         goto out;
15075         }
15076
15077         /* 0 is the first index - add 1 to parse only once */
15078         cb->args[0] = (*rdev)->wiphy_idx + 1;
15079         /* add 1 to know if it was NULL */
15080         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15081         cb->args[2] = vcmd_idx;
15082         cb->args[3] = (unsigned long)data;
15083         cb->args[4] = data_len;
15084
15085         /* keep rtnl locked in successful case */
15086         err = 0;
15087 out:
15088         kfree(attrbuf);
15089         return err;
15090 }
15091
15092 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15093                                    struct netlink_callback *cb)
15094 {
15095         struct cfg80211_registered_device *rdev;
15096         struct wireless_dev *wdev;
15097         unsigned int vcmd_idx;
15098         const struct wiphy_vendor_command *vcmd;
15099         void *data;
15100         int data_len;
15101         int err;
15102         struct nlattr *vendor_data;
15103
15104         rtnl_lock();
15105         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15106         if (err)
15107                 goto out;
15108
15109         vcmd_idx = cb->args[2];
15110         data = (void *)cb->args[3];
15111         data_len = cb->args[4];
15112         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15113
15114         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15115                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15116                 if (!wdev) {
15117                         err = -EINVAL;
15118                         goto out;
15119                 }
15120                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15121                     !wdev->netdev) {
15122                         err = -EINVAL;
15123                         goto out;
15124                 }
15125
15126                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15127                         if (!wdev_running(wdev)) {
15128                                 err = -ENETDOWN;
15129                                 goto out;
15130                         }
15131                 }
15132         }
15133
15134         while (1) {
15135                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15136                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
15137                                            NL80211_CMD_VENDOR);
15138                 if (!hdr)
15139                         break;
15140
15141                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15142                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15143                                                wdev_id(wdev),
15144                                                NL80211_ATTR_PAD))) {
15145                         genlmsg_cancel(skb, hdr);
15146                         break;
15147                 }
15148
15149                 vendor_data = nla_nest_start_noflag(skb,
15150                                                     NL80211_ATTR_VENDOR_DATA);
15151                 if (!vendor_data) {
15152                         genlmsg_cancel(skb, hdr);
15153                         break;
15154                 }
15155
15156                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15157                                    (unsigned long *)&cb->args[5]);
15158                 nla_nest_end(skb, vendor_data);
15159
15160                 if (err == -ENOBUFS || err == -ENOENT) {
15161                         genlmsg_cancel(skb, hdr);
15162                         break;
15163                 } else if (err <= 0) {
15164                         genlmsg_cancel(skb, hdr);
15165                         goto out;
15166                 }
15167
15168                 genlmsg_end(skb, hdr);
15169         }
15170
15171         err = skb->len;
15172  out:
15173         rtnl_unlock();
15174         return err;
15175 }
15176
15177 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15178                                            enum nl80211_commands cmd,
15179                                            enum nl80211_attrs attr,
15180                                            int approxlen)
15181 {
15182         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15183
15184         if (WARN_ON(!rdev->cur_cmd_info))
15185                 return NULL;
15186
15187         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15188                                            rdev->cur_cmd_info->snd_portid,
15189                                            rdev->cur_cmd_info->snd_seq,
15190                                            cmd, attr, NULL, GFP_KERNEL);
15191 }
15192 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15193
15194 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15195 {
15196         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15197         void *hdr = ((void **)skb->cb)[1];
15198         struct nlattr *data = ((void **)skb->cb)[2];
15199
15200         /* clear CB data for netlink core to own from now on */
15201         memset(skb->cb, 0, sizeof(skb->cb));
15202
15203         if (WARN_ON(!rdev->cur_cmd_info)) {
15204                 kfree_skb(skb);
15205                 return -EINVAL;
15206         }
15207
15208         nla_nest_end(skb, data);
15209         genlmsg_end(skb, hdr);
15210         return genlmsg_reply(skb, rdev->cur_cmd_info);
15211 }
15212 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15213
15214 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15215 {
15216         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15217
15218         if (WARN_ON(!rdev->cur_cmd_info))
15219                 return 0;
15220
15221         return rdev->cur_cmd_info->snd_portid;
15222 }
15223 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15224
15225 static int nl80211_set_qos_map(struct sk_buff *skb,
15226                                struct genl_info *info)
15227 {
15228         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15229         struct cfg80211_qos_map *qos_map = NULL;
15230         struct net_device *dev = info->user_ptr[1];
15231         u8 *pos, len, num_des, des_len, des;
15232         int ret;
15233
15234         if (!rdev->ops->set_qos_map)
15235                 return -EOPNOTSUPP;
15236
15237         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15238                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15239                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15240
15241                 if (len % 2)
15242                         return -EINVAL;
15243
15244                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15245                 if (!qos_map)
15246                         return -ENOMEM;
15247
15248                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15249                 if (num_des) {
15250                         des_len = num_des *
15251                                 sizeof(struct cfg80211_dscp_exception);
15252                         memcpy(qos_map->dscp_exception, pos, des_len);
15253                         qos_map->num_des = num_des;
15254                         for (des = 0; des < num_des; des++) {
15255                                 if (qos_map->dscp_exception[des].up > 7) {
15256                                         kfree(qos_map);
15257                                         return -EINVAL;
15258                                 }
15259                         }
15260                         pos += des_len;
15261                 }
15262                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15263         }
15264
15265         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15266         if (!ret)
15267                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15268
15269         kfree(qos_map);
15270         return ret;
15271 }
15272
15273 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15274 {
15275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15276         struct net_device *dev = info->user_ptr[1];
15277         struct wireless_dev *wdev = dev->ieee80211_ptr;
15278         const u8 *peer;
15279         u8 tsid, up;
15280         u16 admitted_time = 0;
15281
15282         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15283                 return -EOPNOTSUPP;
15284
15285         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15286             !info->attrs[NL80211_ATTR_USER_PRIO])
15287                 return -EINVAL;
15288
15289         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15290         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15291
15292         /* WMM uses TIDs 0-7 even for TSPEC */
15293         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15294                 /* TODO: handle 802.11 TSPEC/admission control
15295                  * need more attributes for that (e.g. BA session requirement);
15296                  * change the WMM adminssion test above to allow both then
15297                  */
15298                 return -EINVAL;
15299         }
15300
15301         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15302
15303         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15304                 admitted_time =
15305                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15306                 if (!admitted_time)
15307                         return -EINVAL;
15308         }
15309
15310         switch (wdev->iftype) {
15311         case NL80211_IFTYPE_STATION:
15312         case NL80211_IFTYPE_P2P_CLIENT:
15313                 if (wdev->connected)
15314                         break;
15315                 return -ENOTCONN;
15316         default:
15317                 return -EOPNOTSUPP;
15318         }
15319
15320         return rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15321 }
15322
15323 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15324 {
15325         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15326         struct net_device *dev = info->user_ptr[1];
15327         const u8 *peer;
15328         u8 tsid;
15329
15330         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15331                 return -EINVAL;
15332
15333         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15334         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15335
15336         return rdev_del_tx_ts(rdev, dev, tsid, peer);
15337 }
15338
15339 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15340                                        struct genl_info *info)
15341 {
15342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15343         struct net_device *dev = info->user_ptr[1];
15344         struct wireless_dev *wdev = dev->ieee80211_ptr;
15345         struct cfg80211_chan_def chandef = {};
15346         const u8 *addr;
15347         u8 oper_class;
15348         int err;
15349
15350         if (!rdev->ops->tdls_channel_switch ||
15351             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15352                 return -EOPNOTSUPP;
15353
15354         switch (dev->ieee80211_ptr->iftype) {
15355         case NL80211_IFTYPE_STATION:
15356         case NL80211_IFTYPE_P2P_CLIENT:
15357                 break;
15358         default:
15359                 return -EOPNOTSUPP;
15360         }
15361
15362         if (!info->attrs[NL80211_ATTR_MAC] ||
15363             !info->attrs[NL80211_ATTR_OPER_CLASS])
15364                 return -EINVAL;
15365
15366         err = nl80211_parse_chandef(rdev, info, &chandef);
15367         if (err)
15368                 return err;
15369
15370         /*
15371          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15372          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15373          * specification is not defined for them.
15374          */
15375         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15376             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15377             chandef.width != NL80211_CHAN_WIDTH_20)
15378                 return -EINVAL;
15379
15380         /* we will be active on the TDLS link */
15381         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15382                                            wdev->iftype))
15383                 return -EINVAL;
15384
15385         /* don't allow switching to DFS channels */
15386         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15387                 return -EINVAL;
15388
15389         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15390         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15391
15392         return rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15393 }
15394
15395 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15396                                               struct genl_info *info)
15397 {
15398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15399         struct net_device *dev = info->user_ptr[1];
15400         const u8 *addr;
15401
15402         if (!rdev->ops->tdls_channel_switch ||
15403             !rdev->ops->tdls_cancel_channel_switch ||
15404             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15405                 return -EOPNOTSUPP;
15406
15407         switch (dev->ieee80211_ptr->iftype) {
15408         case NL80211_IFTYPE_STATION:
15409         case NL80211_IFTYPE_P2P_CLIENT:
15410                 break;
15411         default:
15412                 return -EOPNOTSUPP;
15413         }
15414
15415         if (!info->attrs[NL80211_ATTR_MAC])
15416                 return -EINVAL;
15417
15418         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15419
15420         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15421
15422         return 0;
15423 }
15424
15425 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15426                                             struct genl_info *info)
15427 {
15428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15429         struct net_device *dev = info->user_ptr[1];
15430         struct wireless_dev *wdev = dev->ieee80211_ptr;
15431         const struct nlattr *nla;
15432         bool enabled;
15433
15434         if (!rdev->ops->set_multicast_to_unicast)
15435                 return -EOPNOTSUPP;
15436
15437         if (wdev->iftype != NL80211_IFTYPE_AP &&
15438             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15439                 return -EOPNOTSUPP;
15440
15441         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15442         enabled = nla_get_flag(nla);
15443
15444         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15445 }
15446
15447 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15448 {
15449         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15450         struct net_device *dev = info->user_ptr[1];
15451         struct wireless_dev *wdev = dev->ieee80211_ptr;
15452         struct cfg80211_pmk_conf pmk_conf = {};
15453
15454         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15455             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15456                 return -EOPNOTSUPP;
15457
15458         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15459                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15460                 return -EOPNOTSUPP;
15461
15462         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15463                 return -EINVAL;
15464
15465         if (!wdev->connected)
15466                 return -ENOTCONN;
15467
15468         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15469         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN))
15470                 return -EINVAL;
15471
15472         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15473         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15474         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15475             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192)
15476                 return -EINVAL;
15477
15478         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15479                 pmk_conf.pmk_r0_name =
15480                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15481
15482         return rdev_set_pmk(rdev, dev, &pmk_conf);
15483 }
15484
15485 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15486 {
15487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15488         struct net_device *dev = info->user_ptr[1];
15489         struct wireless_dev *wdev = dev->ieee80211_ptr;
15490         const u8 *aa;
15491
15492         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15493             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15494                 return -EOPNOTSUPP;
15495
15496         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15497                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15498                 return -EOPNOTSUPP;
15499
15500         if (!info->attrs[NL80211_ATTR_MAC])
15501                 return -EINVAL;
15502
15503         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15504         return rdev_del_pmk(rdev, dev, aa);
15505 }
15506
15507 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15508 {
15509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15510         struct net_device *dev = info->user_ptr[1];
15511         struct cfg80211_external_auth_params params;
15512
15513         if (!rdev->ops->external_auth)
15514                 return -EOPNOTSUPP;
15515
15516         if (!info->attrs[NL80211_ATTR_SSID] &&
15517             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15518             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15519                 return -EINVAL;
15520
15521         if (!info->attrs[NL80211_ATTR_BSSID])
15522                 return -EINVAL;
15523
15524         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15525                 return -EINVAL;
15526
15527         memset(&params, 0, sizeof(params));
15528
15529         if (info->attrs[NL80211_ATTR_SSID]) {
15530                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15531                 if (params.ssid.ssid_len == 0)
15532                         return -EINVAL;
15533                 memcpy(params.ssid.ssid,
15534                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15535                        params.ssid.ssid_len);
15536         }
15537
15538         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15539                ETH_ALEN);
15540
15541         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15542
15543         if (info->attrs[NL80211_ATTR_PMKID])
15544                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15545
15546         return rdev_external_auth(rdev, dev, &params);
15547 }
15548
15549 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15550 {
15551         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15553         struct net_device *dev = info->user_ptr[1];
15554         struct wireless_dev *wdev = dev->ieee80211_ptr;
15555         const u8 *buf;
15556         size_t len;
15557         u8 *dest;
15558         u16 proto;
15559         bool noencrypt;
15560         u64 cookie = 0;
15561         int link_id;
15562         int err;
15563
15564         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15565                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15566                 return -EOPNOTSUPP;
15567
15568         if (!rdev->ops->tx_control_port)
15569                 return -EOPNOTSUPP;
15570
15571         if (!info->attrs[NL80211_ATTR_FRAME] ||
15572             !info->attrs[NL80211_ATTR_MAC] ||
15573             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15574                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15575                 return -EINVAL;
15576         }
15577
15578         switch (wdev->iftype) {
15579         case NL80211_IFTYPE_AP:
15580         case NL80211_IFTYPE_P2P_GO:
15581         case NL80211_IFTYPE_MESH_POINT:
15582                 break;
15583         case NL80211_IFTYPE_ADHOC:
15584                 if (wdev->u.ibss.current_bss)
15585                         break;
15586                 return -ENOTCONN;
15587         case NL80211_IFTYPE_STATION:
15588         case NL80211_IFTYPE_P2P_CLIENT:
15589                 if (wdev->connected)
15590                         break;
15591                 return -ENOTCONN;
15592         default:
15593                 return -EOPNOTSUPP;
15594         }
15595
15596         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15597         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15598         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15599         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15600         noencrypt =
15601                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15602
15603         link_id = nl80211_link_id_or_invalid(info->attrs);
15604
15605         err = rdev_tx_control_port(rdev, dev, buf, len,
15606                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15607                                    dont_wait_for_ack ? NULL : &cookie);
15608         if (!err && !dont_wait_for_ack)
15609                 nl_set_extack_cookie_u64(info->extack, cookie);
15610         return err;
15611 }
15612
15613 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15614                                            struct genl_info *info)
15615 {
15616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15617         struct net_device *dev = info->user_ptr[1];
15618         struct wireless_dev *wdev = dev->ieee80211_ptr;
15619         struct cfg80211_ftm_responder_stats ftm_stats = {};
15620         unsigned int link_id = nl80211_link_id(info->attrs);
15621         struct sk_buff *msg;
15622         void *hdr;
15623         struct nlattr *ftm_stats_attr;
15624         int err;
15625
15626         if (wdev->iftype != NL80211_IFTYPE_AP ||
15627             !wdev->links[link_id].ap.beacon_interval)
15628                 return -EOPNOTSUPP;
15629
15630         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15631         if (err)
15632                 return err;
15633
15634         if (!ftm_stats.filled)
15635                 return -ENODATA;
15636
15637         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15638         if (!msg)
15639                 return -ENOMEM;
15640
15641         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15642                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15643         if (!hdr)
15644                 goto nla_put_failure;
15645
15646         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15647                 goto nla_put_failure;
15648
15649         ftm_stats_attr = nla_nest_start_noflag(msg,
15650                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15651         if (!ftm_stats_attr)
15652                 goto nla_put_failure;
15653
15654 #define SET_FTM(field, name, type)                                       \
15655         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15656             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15657                              ftm_stats.field))                           \
15658                 goto nla_put_failure; } while (0)
15659 #define SET_FTM_U64(field, name)                                         \
15660         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15661             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15662                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15663                 goto nla_put_failure; } while (0)
15664
15665         SET_FTM(success_num, SUCCESS_NUM, u32);
15666         SET_FTM(partial_num, PARTIAL_NUM, u32);
15667         SET_FTM(failed_num, FAILED_NUM, u32);
15668         SET_FTM(asap_num, ASAP_NUM, u32);
15669         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15670         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15671         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15672         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15673         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15674 #undef SET_FTM
15675
15676         nla_nest_end(msg, ftm_stats_attr);
15677
15678         genlmsg_end(msg, hdr);
15679         return genlmsg_reply(msg, info);
15680
15681 nla_put_failure:
15682         nlmsg_free(msg);
15683         return -ENOBUFS;
15684 }
15685
15686 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15687 {
15688         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15689         struct cfg80211_update_owe_info owe_info;
15690         struct net_device *dev = info->user_ptr[1];
15691
15692         if (!rdev->ops->update_owe_info)
15693                 return -EOPNOTSUPP;
15694
15695         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15696             !info->attrs[NL80211_ATTR_MAC])
15697                 return -EINVAL;
15698
15699         memset(&owe_info, 0, sizeof(owe_info));
15700         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15701         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15702
15703         if (info->attrs[NL80211_ATTR_IE]) {
15704                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15705                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15706         }
15707
15708         return rdev_update_owe_info(rdev, dev, &owe_info);
15709 }
15710
15711 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15712 {
15713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15714         struct net_device *dev = info->user_ptr[1];
15715         struct wireless_dev *wdev = dev->ieee80211_ptr;
15716         struct station_info sinfo = {};
15717         const u8 *buf;
15718         size_t len;
15719         u8 *dest;
15720         int err;
15721
15722         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15723                 return -EOPNOTSUPP;
15724
15725         if (!info->attrs[NL80211_ATTR_MAC] ||
15726             !info->attrs[NL80211_ATTR_FRAME]) {
15727                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15728                 return -EINVAL;
15729         }
15730
15731         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15732                 return -EOPNOTSUPP;
15733
15734         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15735         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15736         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15737
15738         if (len < sizeof(struct ethhdr))
15739                 return -EINVAL;
15740
15741         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15742             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15743                 return -EINVAL;
15744
15745         err = rdev_get_station(rdev, dev, dest, &sinfo);
15746         if (err)
15747                 return err;
15748
15749         cfg80211_sinfo_release_content(&sinfo);
15750
15751         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15752 }
15753
15754 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15755                           struct nlattr *attrs[], struct net_device *dev,
15756                           struct cfg80211_tid_cfg *tid_conf,
15757                           struct genl_info *info, const u8 *peer,
15758                           unsigned int link_id)
15759 {
15760         struct netlink_ext_ack *extack = info->extack;
15761         u64 mask;
15762         int err;
15763
15764         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15765                 return -EINVAL;
15766
15767         tid_conf->config_override =
15768                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15769         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15770
15771         if (tid_conf->config_override) {
15772                 if (rdev->ops->reset_tid_config) {
15773                         err = rdev_reset_tid_config(rdev, dev, peer,
15774                                                     tid_conf->tids);
15775                         if (err)
15776                                 return err;
15777                 } else {
15778                         return -EINVAL;
15779                 }
15780         }
15781
15782         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15783                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15784                 tid_conf->noack =
15785                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15786         }
15787
15788         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15789                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15790                 tid_conf->retry_short =
15791                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15792
15793                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15794                         return -EINVAL;
15795         }
15796
15797         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15798                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15799                 tid_conf->retry_long =
15800                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15801
15802                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15803                         return -EINVAL;
15804         }
15805
15806         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15807                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15808                 tid_conf->ampdu =
15809                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15810         }
15811
15812         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15813                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15814                 tid_conf->rtscts =
15815                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15816         }
15817
15818         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15819                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15820                 tid_conf->amsdu =
15821                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15822         }
15823
15824         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15825                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15826
15827                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15828
15829                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15830                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15831                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15832                                                     &tid_conf->txrate_mask, dev,
15833                                                     true, link_id);
15834                         if (err)
15835                                 return err;
15836
15837                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15838                 }
15839                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15840         }
15841
15842         if (peer)
15843                 mask = rdev->wiphy.tid_config_support.peer;
15844         else
15845                 mask = rdev->wiphy.tid_config_support.vif;
15846
15847         if (tid_conf->mask & ~mask) {
15848                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15849                 return -ENOTSUPP;
15850         }
15851
15852         return 0;
15853 }
15854
15855 static int nl80211_set_tid_config(struct sk_buff *skb,
15856                                   struct genl_info *info)
15857 {
15858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15859         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15860         unsigned int link_id = nl80211_link_id(info->attrs);
15861         struct net_device *dev = info->user_ptr[1];
15862         struct cfg80211_tid_config *tid_config;
15863         struct nlattr *tid;
15864         int conf_idx = 0, rem_conf;
15865         int ret = -EINVAL;
15866         u32 num_conf = 0;
15867
15868         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15869                 return -EINVAL;
15870
15871         if (!rdev->ops->set_tid_config)
15872                 return -EOPNOTSUPP;
15873
15874         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15875                             rem_conf)
15876                 num_conf++;
15877
15878         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15879                              GFP_KERNEL);
15880         if (!tid_config)
15881                 return -ENOMEM;
15882
15883         tid_config->n_tid_conf = num_conf;
15884
15885         if (info->attrs[NL80211_ATTR_MAC])
15886                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15887
15888         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15889                             rem_conf) {
15890                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15891                                        tid, NULL, NULL);
15892
15893                 if (ret)
15894                         goto bad_tid_conf;
15895
15896                 ret = parse_tid_conf(rdev, attrs, dev,
15897                                      &tid_config->tid_conf[conf_idx],
15898                                      info, tid_config->peer, link_id);
15899                 if (ret)
15900                         goto bad_tid_conf;
15901
15902                 conf_idx++;
15903         }
15904
15905         ret = rdev_set_tid_config(rdev, dev, tid_config);
15906
15907 bad_tid_conf:
15908         kfree(tid_config);
15909         return ret;
15910 }
15911
15912 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15913 {
15914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15915         struct cfg80211_color_change_settings params = {};
15916         struct net_device *dev = info->user_ptr[1];
15917         struct wireless_dev *wdev = dev->ieee80211_ptr;
15918         struct nlattr **tb;
15919         u16 offset;
15920         int err;
15921
15922         if (!rdev->ops->color_change)
15923                 return -EOPNOTSUPP;
15924
15925         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15926                                      NL80211_EXT_FEATURE_BSS_COLOR))
15927                 return -EOPNOTSUPP;
15928
15929         if (wdev->iftype != NL80211_IFTYPE_AP)
15930                 return -EOPNOTSUPP;
15931
15932         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15933             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15934             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15935                 return -EINVAL;
15936
15937         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15938         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15939
15940         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
15941                                    info->extack);
15942         if (err)
15943                 return err;
15944
15945         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15946         if (!tb)
15947                 return -ENOMEM;
15948
15949         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15950                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15951                                nl80211_policy, info->extack);
15952         if (err)
15953                 goto out;
15954
15955         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
15956                                    info->extack);
15957         if (err)
15958                 goto out;
15959
15960         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15961                 err = -EINVAL;
15962                 goto out;
15963         }
15964
15965         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15966                 err = -EINVAL;
15967                 goto out;
15968         }
15969
15970         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15971         if (offset >= params.beacon_color_change.tail_len) {
15972                 err = -EINVAL;
15973                 goto out;
15974         }
15975
15976         if (params.beacon_color_change.tail[offset] != params.count) {
15977                 err = -EINVAL;
15978                 goto out;
15979         }
15980
15981         params.counter_offset_beacon = offset;
15982
15983         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
15984                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
15985                     sizeof(u16)) {
15986                         err = -EINVAL;
15987                         goto out;
15988                 }
15989
15990                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
15991                 if (offset >= params.beacon_color_change.probe_resp_len) {
15992                         err = -EINVAL;
15993                         goto out;
15994                 }
15995
15996                 if (params.beacon_color_change.probe_resp[offset] !=
15997                     params.count) {
15998                         err = -EINVAL;
15999                         goto out;
16000                 }
16001
16002                 params.counter_offset_presp = offset;
16003         }
16004
16005         err = rdev_color_change(rdev, dev, &params);
16006
16007 out:
16008         kfree(params.beacon_next.mbssid_ies);
16009         kfree(params.beacon_color_change.mbssid_ies);
16010         kfree(params.beacon_next.rnr_ies);
16011         kfree(params.beacon_color_change.rnr_ies);
16012         kfree(tb);
16013         return err;
16014 }
16015
16016 static int nl80211_set_fils_aad(struct sk_buff *skb,
16017                                 struct genl_info *info)
16018 {
16019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16020         struct net_device *dev = info->user_ptr[1];
16021         struct cfg80211_fils_aad fils_aad = {};
16022         u8 *nonces;
16023
16024         if (!info->attrs[NL80211_ATTR_MAC] ||
16025             !info->attrs[NL80211_ATTR_FILS_KEK] ||
16026             !info->attrs[NL80211_ATTR_FILS_NONCES])
16027                 return -EINVAL;
16028
16029         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16030         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16031         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16032         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16033         fils_aad.snonce = nonces;
16034         fils_aad.anonce = nonces + FILS_NONCE_LEN;
16035
16036         return rdev_set_fils_aad(rdev, dev, &fils_aad);
16037 }
16038
16039 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16040 {
16041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16042         unsigned int link_id = nl80211_link_id(info->attrs);
16043         struct net_device *dev = info->user_ptr[1];
16044         struct wireless_dev *wdev = dev->ieee80211_ptr;
16045         int ret;
16046
16047         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16048                 return -EINVAL;
16049
16050         switch (wdev->iftype) {
16051         case NL80211_IFTYPE_AP:
16052                 break;
16053         default:
16054                 return -EINVAL;
16055         }
16056
16057         if (!info->attrs[NL80211_ATTR_MAC] ||
16058             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16059                 return -EINVAL;
16060
16061         wdev->valid_links |= BIT(link_id);
16062         ether_addr_copy(wdev->links[link_id].addr,
16063                         nla_data(info->attrs[NL80211_ATTR_MAC]));
16064
16065         ret = rdev_add_intf_link(rdev, wdev, link_id);
16066         if (ret) {
16067                 wdev->valid_links &= ~BIT(link_id);
16068                 eth_zero_addr(wdev->links[link_id].addr);
16069         }
16070
16071         return ret;
16072 }
16073
16074 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16075 {
16076         unsigned int link_id = nl80211_link_id(info->attrs);
16077         struct net_device *dev = info->user_ptr[1];
16078         struct wireless_dev *wdev = dev->ieee80211_ptr;
16079
16080         /* cannot remove if there's no link */
16081         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16082                 return -EINVAL;
16083
16084         switch (wdev->iftype) {
16085         case NL80211_IFTYPE_AP:
16086                 break;
16087         default:
16088                 return -EINVAL;
16089         }
16090
16091         cfg80211_remove_link(wdev, link_id);
16092
16093         return 0;
16094 }
16095
16096 static int
16097 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16098                              bool add)
16099 {
16100         struct link_station_parameters params = {};
16101         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16102         struct net_device *dev = info->user_ptr[1];
16103         int err;
16104
16105         if ((add && !rdev->ops->add_link_station) ||
16106             (!add && !rdev->ops->mod_link_station))
16107                 return -EOPNOTSUPP;
16108
16109         if (add && !info->attrs[NL80211_ATTR_MAC])
16110                 return -EINVAL;
16111
16112         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16113                 return -EINVAL;
16114
16115         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16116                 return -EINVAL;
16117
16118         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16119
16120         if (info->attrs[NL80211_ATTR_MAC]) {
16121                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16122                 if (!is_valid_ether_addr(params.link_mac))
16123                         return -EINVAL;
16124         }
16125
16126         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16127                 return -EINVAL;
16128
16129         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16130
16131         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16132                 params.supported_rates =
16133                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16134                 params.supported_rates_len =
16135                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16136         }
16137
16138         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16139                 params.ht_capa =
16140                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16141
16142         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16143                 params.vht_capa =
16144                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16145
16146         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16147                 params.he_capa =
16148                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16149                 params.he_capa_len =
16150                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16151
16152                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16153                         params.eht_capa =
16154                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16155                         params.eht_capa_len =
16156                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16157
16158                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16159                                                         (const u8 *)params.eht_capa,
16160                                                         params.eht_capa_len,
16161                                                         false))
16162                                 return -EINVAL;
16163                 }
16164         }
16165
16166         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16167                 params.he_6ghz_capa =
16168                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16169
16170         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16171                 params.opmode_notif_used = true;
16172                 params.opmode_notif =
16173                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16174         }
16175
16176         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16177                                                 &params.txpwr_set);
16178         if (err)
16179                 return err;
16180
16181         if (add)
16182                 return rdev_add_link_station(rdev, dev, &params);
16183
16184         return rdev_mod_link_station(rdev, dev, &params);
16185 }
16186
16187 static int
16188 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16189 {
16190         return nl80211_add_mod_link_station(skb, info, true);
16191 }
16192
16193 static int
16194 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16195 {
16196         return nl80211_add_mod_link_station(skb, info, false);
16197 }
16198
16199 static int
16200 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16201 {
16202         struct link_station_del_parameters params = {};
16203         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16204         struct net_device *dev = info->user_ptr[1];
16205
16206         if (!rdev->ops->del_link_station)
16207                 return -EOPNOTSUPP;
16208
16209         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16210             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16211                 return -EINVAL;
16212
16213         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16214         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16215
16216         return rdev_del_link_station(rdev, dev, &params);
16217 }
16218
16219 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16220                                     struct genl_info *info)
16221 {
16222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16223         struct net_device *dev = info->user_ptr[1];
16224         struct cfg80211_set_hw_timestamp hwts = {};
16225
16226         if (!rdev->wiphy.hw_timestamp_max_peers)
16227                 return -EOPNOTSUPP;
16228
16229         if (!info->attrs[NL80211_ATTR_MAC] &&
16230             rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16231                 return -EOPNOTSUPP;
16232
16233         if (info->attrs[NL80211_ATTR_MAC])
16234                 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16235
16236         hwts.enable =
16237                 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16238
16239         return rdev_set_hw_timestamp(rdev, dev, &hwts);
16240 }
16241
16242 #define NL80211_FLAG_NEED_WIPHY         0x01
16243 #define NL80211_FLAG_NEED_NETDEV        0x02
16244 #define NL80211_FLAG_NEED_RTNL          0x04
16245 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16246 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16247                                          NL80211_FLAG_CHECK_NETDEV_UP)
16248 #define NL80211_FLAG_NEED_WDEV          0x10
16249 /* If a netdev is associated, it must be UP, P2P must be started */
16250 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16251                                          NL80211_FLAG_CHECK_NETDEV_UP)
16252 #define NL80211_FLAG_CLEAR_SKB          0x20
16253 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16254 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16255 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16256
16257 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16258         SELECTOR(__sel, NONE, 0) /* must be first */    \
16259         SELECTOR(__sel, WIPHY,                          \
16260                  NL80211_FLAG_NEED_WIPHY)               \
16261         SELECTOR(__sel, WDEV,                           \
16262                  NL80211_FLAG_NEED_WDEV)                \
16263         SELECTOR(__sel, NETDEV,                         \
16264                  NL80211_FLAG_NEED_NETDEV)              \
16265         SELECTOR(__sel, NETDEV_LINK,                    \
16266                  NL80211_FLAG_NEED_NETDEV |             \
16267                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16268         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16269                  NL80211_FLAG_NEED_NETDEV |             \
16270                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16271         SELECTOR(__sel, WIPHY_RTNL,                     \
16272                  NL80211_FLAG_NEED_WIPHY |              \
16273                  NL80211_FLAG_NEED_RTNL)                \
16274         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16275                  NL80211_FLAG_NEED_WIPHY |              \
16276                  NL80211_FLAG_NEED_RTNL |               \
16277                  NL80211_FLAG_NO_WIPHY_MTX)             \
16278         SELECTOR(__sel, WDEV_RTNL,                      \
16279                  NL80211_FLAG_NEED_WDEV |               \
16280                  NL80211_FLAG_NEED_RTNL)                \
16281         SELECTOR(__sel, NETDEV_RTNL,                    \
16282                  NL80211_FLAG_NEED_NETDEV |             \
16283                  NL80211_FLAG_NEED_RTNL)                \
16284         SELECTOR(__sel, NETDEV_UP,                      \
16285                  NL80211_FLAG_NEED_NETDEV_UP)           \
16286         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16287                  NL80211_FLAG_NEED_NETDEV_UP |          \
16288                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16289         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16290                  NL80211_FLAG_NEED_NETDEV_UP |          \
16291                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16292         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16293                  NL80211_FLAG_NEED_NETDEV_UP |          \
16294                  NL80211_FLAG_CLEAR_SKB |               \
16295                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16296         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16297                  NL80211_FLAG_NEED_NETDEV_UP |          \
16298                  NL80211_FLAG_NO_WIPHY_MTX)             \
16299         SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,          \
16300                  NL80211_FLAG_NEED_NETDEV_UP |          \
16301                  NL80211_FLAG_NO_WIPHY_MTX |            \
16302                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16303         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16304                  NL80211_FLAG_NEED_NETDEV_UP |          \
16305                  NL80211_FLAG_CLEAR_SKB)                \
16306         SELECTOR(__sel, WDEV_UP,                        \
16307                  NL80211_FLAG_NEED_WDEV_UP)             \
16308         SELECTOR(__sel, WDEV_UP_LINK,                   \
16309                  NL80211_FLAG_NEED_WDEV_UP |            \
16310                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16311         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16312                  NL80211_FLAG_NEED_WDEV_UP |            \
16313                  NL80211_FLAG_NEED_RTNL)                \
16314         SELECTOR(__sel, WIPHY_CLEAR,                    \
16315                  NL80211_FLAG_NEED_WIPHY |              \
16316                  NL80211_FLAG_CLEAR_SKB)
16317
16318 enum nl80211_internal_flags_selector {
16319 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16320         INTERNAL_FLAG_SELECTORS(_)
16321 #undef SELECTOR
16322 };
16323
16324 static u32 nl80211_internal_flags[] = {
16325 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16326         INTERNAL_FLAG_SELECTORS(_)
16327 #undef SELECTOR
16328 };
16329
16330 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16331                             struct sk_buff *skb,
16332                             struct genl_info *info)
16333 {
16334         struct cfg80211_registered_device *rdev = NULL;
16335         struct wireless_dev *wdev = NULL;
16336         struct net_device *dev = NULL;
16337         u32 internal_flags;
16338         int err;
16339
16340         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16341                 return -EINVAL;
16342
16343         internal_flags = nl80211_internal_flags[ops->internal_flags];
16344
16345         rtnl_lock();
16346         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16347                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16348                 if (IS_ERR(rdev)) {
16349                         err = PTR_ERR(rdev);
16350                         goto out_unlock;
16351                 }
16352                 info->user_ptr[0] = rdev;
16353         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16354                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16355                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16356                                                   info->attrs);
16357                 if (IS_ERR(wdev)) {
16358                         err = PTR_ERR(wdev);
16359                         goto out_unlock;
16360                 }
16361
16362                 dev = wdev->netdev;
16363                 dev_hold(dev);
16364                 rdev = wiphy_to_rdev(wdev->wiphy);
16365
16366                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16367                         if (!dev) {
16368                                 err = -EINVAL;
16369                                 goto out_unlock;
16370                         }
16371
16372                         info->user_ptr[1] = dev;
16373                 } else {
16374                         info->user_ptr[1] = wdev;
16375                 }
16376
16377                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16378                     !wdev_running(wdev)) {
16379                         err = -ENETDOWN;
16380                         goto out_unlock;
16381                 }
16382
16383                 info->user_ptr[0] = rdev;
16384         }
16385
16386         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16387                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16388
16389                 if (!wdev) {
16390                         err = -EINVAL;
16391                         goto out_unlock;
16392                 }
16393
16394                 /* MLO -> require valid link ID */
16395                 if (wdev->valid_links &&
16396                     (!link_id ||
16397                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16398                         err = -EINVAL;
16399                         goto out_unlock;
16400                 }
16401
16402                 /* non-MLO -> no link ID attribute accepted */
16403                 if (!wdev->valid_links && link_id) {
16404                         err = -EINVAL;
16405                         goto out_unlock;
16406                 }
16407         }
16408
16409         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16410                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16411                     (wdev && wdev->valid_links)) {
16412                         err = -EINVAL;
16413                         goto out_unlock;
16414                 }
16415         }
16416
16417         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16418                 wiphy_lock(&rdev->wiphy);
16419                 /* we keep the mutex locked until post_doit */
16420                 __release(&rdev->wiphy.mtx);
16421         }
16422         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16423                 rtnl_unlock();
16424
16425         return 0;
16426 out_unlock:
16427         rtnl_unlock();
16428         dev_put(dev);
16429         return err;
16430 }
16431
16432 static void nl80211_post_doit(const struct genl_split_ops *ops,
16433                               struct sk_buff *skb,
16434                               struct genl_info *info)
16435 {
16436         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16437
16438         if (info->user_ptr[1]) {
16439                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16440                         struct wireless_dev *wdev = info->user_ptr[1];
16441
16442                         dev_put(wdev->netdev);
16443                 } else {
16444                         dev_put(info->user_ptr[1]);
16445                 }
16446         }
16447
16448         if (info->user_ptr[0] &&
16449             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16450                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16451
16452                 /* we kept the mutex locked since pre_doit */
16453                 __acquire(&rdev->wiphy.mtx);
16454                 wiphy_unlock(&rdev->wiphy);
16455         }
16456
16457         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16458                 rtnl_unlock();
16459
16460         /* If needed, clear the netlink message payload from the SKB
16461          * as it might contain key data that shouldn't stick around on
16462          * the heap after the SKB is freed. The netlink message header
16463          * is still needed for further processing, so leave it intact.
16464          */
16465         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16466                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16467
16468                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16469         }
16470 }
16471
16472 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16473                                      struct cfg80211_sar_specs *sar_specs,
16474                                      struct nlattr *spec[], int index)
16475 {
16476         u32 range_index, i;
16477
16478         if (!sar_specs || !spec)
16479                 return -EINVAL;
16480
16481         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16482             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16483                 return -EINVAL;
16484
16485         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16486
16487         /* check if range_index exceeds num_freq_ranges */
16488         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16489                 return -EINVAL;
16490
16491         /* check if range_index duplicates */
16492         for (i = 0; i < index; i++) {
16493                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16494                         return -EINVAL;
16495         }
16496
16497         sar_specs->sub_specs[index].power =
16498                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16499
16500         sar_specs->sub_specs[index].freq_range_index = range_index;
16501
16502         return 0;
16503 }
16504
16505 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16506 {
16507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16508         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16509         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16510         struct cfg80211_sar_specs *sar_spec;
16511         enum nl80211_sar_type type;
16512         struct nlattr *spec_list;
16513         u32 specs;
16514         int rem, err;
16515
16516         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16517                 return -EOPNOTSUPP;
16518
16519         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16520                 return -EINVAL;
16521
16522         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16523                          info->attrs[NL80211_ATTR_SAR_SPEC],
16524                          NULL, NULL);
16525
16526         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16527                 return -EINVAL;
16528
16529         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16530         if (type != rdev->wiphy.sar_capa->type)
16531                 return -EINVAL;
16532
16533         specs = 0;
16534         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16535                 specs++;
16536
16537         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16538                 return -EINVAL;
16539
16540         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16541         if (!sar_spec)
16542                 return -ENOMEM;
16543
16544         sar_spec->type = type;
16545         specs = 0;
16546         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16547                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16548                                  spec_list, NULL, NULL);
16549
16550                 switch (type) {
16551                 case NL80211_SAR_TYPE_POWER:
16552                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16553                                                       spec, specs)) {
16554                                 err = -EINVAL;
16555                                 goto error;
16556                         }
16557                         break;
16558                 default:
16559                         err = -EINVAL;
16560                         goto error;
16561                 }
16562                 specs++;
16563         }
16564
16565         sar_spec->num_sub_specs = specs;
16566
16567         rdev->cur_cmd_info = info;
16568         err = rdev_set_sar_specs(rdev, sar_spec);
16569         rdev->cur_cmd_info = NULL;
16570 error:
16571         kfree(sar_spec);
16572         return err;
16573 }
16574
16575 #define SELECTOR(__sel, name, value) \
16576         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16577 int __missing_selector(void);
16578 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16579
16580 static const struct genl_ops nl80211_ops[] = {
16581         {
16582                 .cmd = NL80211_CMD_GET_WIPHY,
16583                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16584                 .doit = nl80211_get_wiphy,
16585                 .dumpit = nl80211_dump_wiphy,
16586                 .done = nl80211_dump_wiphy_done,
16587                 /* can be retrieved by unprivileged users */
16588                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16589         },
16590 };
16591
16592 static const struct genl_small_ops nl80211_small_ops[] = {
16593         {
16594                 .cmd = NL80211_CMD_SET_WIPHY,
16595                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16596                 .doit = nl80211_set_wiphy,
16597                 .flags = GENL_UNS_ADMIN_PERM,
16598         },
16599         {
16600                 .cmd = NL80211_CMD_GET_INTERFACE,
16601                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16602                 .doit = nl80211_get_interface,
16603                 .dumpit = nl80211_dump_interface,
16604                 /* can be retrieved by unprivileged users */
16605                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16606         },
16607         {
16608                 .cmd = NL80211_CMD_SET_INTERFACE,
16609                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16610                 .doit = nl80211_set_interface,
16611                 .flags = GENL_UNS_ADMIN_PERM,
16612                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16613                                          NL80211_FLAG_NEED_RTNL),
16614         },
16615         {
16616                 .cmd = NL80211_CMD_NEW_INTERFACE,
16617                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16618                 .doit = nl80211_new_interface,
16619                 .flags = GENL_UNS_ADMIN_PERM,
16620                 .internal_flags =
16621                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
16622                                NL80211_FLAG_NEED_RTNL |
16623                                /* we take the wiphy mutex later ourselves */
16624                                NL80211_FLAG_NO_WIPHY_MTX),
16625         },
16626         {
16627                 .cmd = NL80211_CMD_DEL_INTERFACE,
16628                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16629                 .doit = nl80211_del_interface,
16630                 .flags = GENL_UNS_ADMIN_PERM,
16631                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16632                                          NL80211_FLAG_NEED_RTNL),
16633         },
16634         {
16635                 .cmd = NL80211_CMD_GET_KEY,
16636                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16637                 .doit = nl80211_get_key,
16638                 .flags = GENL_UNS_ADMIN_PERM,
16639                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16640         },
16641         {
16642                 .cmd = NL80211_CMD_SET_KEY,
16643                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16644                 .doit = nl80211_set_key,
16645                 .flags = GENL_UNS_ADMIN_PERM,
16646                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16647                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16648                                          NL80211_FLAG_CLEAR_SKB),
16649         },
16650         {
16651                 .cmd = NL80211_CMD_NEW_KEY,
16652                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16653                 .doit = nl80211_new_key,
16654                 .flags = GENL_UNS_ADMIN_PERM,
16655                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16656                                          NL80211_FLAG_CLEAR_SKB),
16657         },
16658         {
16659                 .cmd = NL80211_CMD_DEL_KEY,
16660                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16661                 .doit = nl80211_del_key,
16662                 .flags = GENL_UNS_ADMIN_PERM,
16663                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16664         },
16665         {
16666                 .cmd = NL80211_CMD_SET_BEACON,
16667                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16668                 .flags = GENL_UNS_ADMIN_PERM,
16669                 .doit = nl80211_set_beacon,
16670                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16671                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16672         },
16673         {
16674                 .cmd = NL80211_CMD_START_AP,
16675                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16676                 .flags = GENL_UNS_ADMIN_PERM,
16677                 .doit = nl80211_start_ap,
16678                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16679                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16680         },
16681         {
16682                 .cmd = NL80211_CMD_STOP_AP,
16683                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16684                 .flags = GENL_UNS_ADMIN_PERM,
16685                 .doit = nl80211_stop_ap,
16686                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16687                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16688         },
16689         {
16690                 .cmd = NL80211_CMD_GET_STATION,
16691                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16692                 .doit = nl80211_get_station,
16693                 .dumpit = nl80211_dump_station,
16694                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16695         },
16696         {
16697                 .cmd = NL80211_CMD_SET_STATION,
16698                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16699                 .doit = nl80211_set_station,
16700                 .flags = GENL_UNS_ADMIN_PERM,
16701                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16702         },
16703         {
16704                 .cmd = NL80211_CMD_NEW_STATION,
16705                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16706                 .doit = nl80211_new_station,
16707                 .flags = GENL_UNS_ADMIN_PERM,
16708                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16709         },
16710         {
16711                 .cmd = NL80211_CMD_DEL_STATION,
16712                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16713                 .doit = nl80211_del_station,
16714                 .flags = GENL_UNS_ADMIN_PERM,
16715                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16716         },
16717         {
16718                 .cmd = NL80211_CMD_GET_MPATH,
16719                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16720                 .doit = nl80211_get_mpath,
16721                 .dumpit = nl80211_dump_mpath,
16722                 .flags = GENL_UNS_ADMIN_PERM,
16723                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16724         },
16725         {
16726                 .cmd = NL80211_CMD_GET_MPP,
16727                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16728                 .doit = nl80211_get_mpp,
16729                 .dumpit = nl80211_dump_mpp,
16730                 .flags = GENL_UNS_ADMIN_PERM,
16731                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16732         },
16733         {
16734                 .cmd = NL80211_CMD_SET_MPATH,
16735                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16736                 .doit = nl80211_set_mpath,
16737                 .flags = GENL_UNS_ADMIN_PERM,
16738                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16739         },
16740         {
16741                 .cmd = NL80211_CMD_NEW_MPATH,
16742                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16743                 .doit = nl80211_new_mpath,
16744                 .flags = GENL_UNS_ADMIN_PERM,
16745                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16746         },
16747         {
16748                 .cmd = NL80211_CMD_DEL_MPATH,
16749                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16750                 .doit = nl80211_del_mpath,
16751                 .flags = GENL_UNS_ADMIN_PERM,
16752                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16753         },
16754         {
16755                 .cmd = NL80211_CMD_SET_BSS,
16756                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16757                 .doit = nl80211_set_bss,
16758                 .flags = GENL_UNS_ADMIN_PERM,
16759                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16760                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16761         },
16762         {
16763                 .cmd = NL80211_CMD_GET_REG,
16764                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16765                 .doit = nl80211_get_reg_do,
16766                 .dumpit = nl80211_get_reg_dump,
16767                 /* can be retrieved by unprivileged users */
16768         },
16769 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16770         {
16771                 .cmd = NL80211_CMD_SET_REG,
16772                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16773                 .doit = nl80211_set_reg,
16774                 .flags = GENL_ADMIN_PERM,
16775         },
16776 #endif
16777         {
16778                 .cmd = NL80211_CMD_REQ_SET_REG,
16779                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16780                 .doit = nl80211_req_set_reg,
16781                 .flags = GENL_ADMIN_PERM,
16782         },
16783         {
16784                 .cmd = NL80211_CMD_RELOAD_REGDB,
16785                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16786                 .doit = nl80211_reload_regdb,
16787                 .flags = GENL_ADMIN_PERM,
16788         },
16789         {
16790                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16791                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16792                 .doit = nl80211_get_mesh_config,
16793                 /* can be retrieved by unprivileged users */
16794                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16795         },
16796         {
16797                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16798                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16799                 .doit = nl80211_update_mesh_config,
16800                 .flags = GENL_UNS_ADMIN_PERM,
16801                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16802         },
16803         {
16804                 .cmd = NL80211_CMD_TRIGGER_SCAN,
16805                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16806                 .doit = nl80211_trigger_scan,
16807                 .flags = GENL_UNS_ADMIN_PERM,
16808                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16809         },
16810         {
16811                 .cmd = NL80211_CMD_ABORT_SCAN,
16812                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16813                 .doit = nl80211_abort_scan,
16814                 .flags = GENL_UNS_ADMIN_PERM,
16815                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16816         },
16817         {
16818                 .cmd = NL80211_CMD_GET_SCAN,
16819                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16820                 .dumpit = nl80211_dump_scan,
16821         },
16822         {
16823                 .cmd = NL80211_CMD_START_SCHED_SCAN,
16824                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16825                 .doit = nl80211_start_sched_scan,
16826                 .flags = GENL_UNS_ADMIN_PERM,
16827                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16828         },
16829         {
16830                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16831                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16832                 .doit = nl80211_stop_sched_scan,
16833                 .flags = GENL_UNS_ADMIN_PERM,
16834                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16835         },
16836         {
16837                 .cmd = NL80211_CMD_AUTHENTICATE,
16838                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16839                 .doit = nl80211_authenticate,
16840                 .flags = GENL_UNS_ADMIN_PERM,
16841                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16842                                          NL80211_FLAG_CLEAR_SKB),
16843         },
16844         {
16845                 .cmd = NL80211_CMD_ASSOCIATE,
16846                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16847                 .doit = nl80211_associate,
16848                 .flags = GENL_UNS_ADMIN_PERM,
16849                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16850                                          NL80211_FLAG_CLEAR_SKB),
16851         },
16852         {
16853                 .cmd = NL80211_CMD_DEAUTHENTICATE,
16854                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16855                 .doit = nl80211_deauthenticate,
16856                 .flags = GENL_UNS_ADMIN_PERM,
16857                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16858         },
16859         {
16860                 .cmd = NL80211_CMD_DISASSOCIATE,
16861                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16862                 .doit = nl80211_disassociate,
16863                 .flags = GENL_UNS_ADMIN_PERM,
16864                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16865         },
16866         {
16867                 .cmd = NL80211_CMD_JOIN_IBSS,
16868                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16869                 .doit = nl80211_join_ibss,
16870                 .flags = GENL_UNS_ADMIN_PERM,
16871                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16872         },
16873         {
16874                 .cmd = NL80211_CMD_LEAVE_IBSS,
16875                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16876                 .doit = nl80211_leave_ibss,
16877                 .flags = GENL_UNS_ADMIN_PERM,
16878                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16879         },
16880 #ifdef CONFIG_NL80211_TESTMODE
16881         {
16882                 .cmd = NL80211_CMD_TESTMODE,
16883                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16884                 .doit = nl80211_testmode_do,
16885                 .dumpit = nl80211_testmode_dump,
16886                 .flags = GENL_UNS_ADMIN_PERM,
16887                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16888         },
16889 #endif
16890         {
16891                 .cmd = NL80211_CMD_CONNECT,
16892                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16893                 .doit = nl80211_connect,
16894                 .flags = GENL_UNS_ADMIN_PERM,
16895                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16896                                          NL80211_FLAG_CLEAR_SKB),
16897         },
16898         {
16899                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16900                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16901                 .doit = nl80211_update_connect_params,
16902                 .flags = GENL_ADMIN_PERM,
16903                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16904                                          NL80211_FLAG_CLEAR_SKB),
16905         },
16906         {
16907                 .cmd = NL80211_CMD_DISCONNECT,
16908                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16909                 .doit = nl80211_disconnect,
16910                 .flags = GENL_UNS_ADMIN_PERM,
16911                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16912         },
16913         {
16914                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16915                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16916                 .doit = nl80211_wiphy_netns,
16917                 .flags = GENL_UNS_ADMIN_PERM,
16918                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16919                                          NL80211_FLAG_NEED_RTNL |
16920                                          NL80211_FLAG_NO_WIPHY_MTX),
16921         },
16922         {
16923                 .cmd = NL80211_CMD_GET_SURVEY,
16924                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16925                 .dumpit = nl80211_dump_survey,
16926         },
16927         {
16928                 .cmd = NL80211_CMD_SET_PMKSA,
16929                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16930                 .doit = nl80211_setdel_pmksa,
16931                 .flags = GENL_UNS_ADMIN_PERM,
16932                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16933                                          NL80211_FLAG_CLEAR_SKB),
16934         },
16935         {
16936                 .cmd = NL80211_CMD_DEL_PMKSA,
16937                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16938                 .doit = nl80211_setdel_pmksa,
16939                 .flags = GENL_UNS_ADMIN_PERM,
16940                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16941         },
16942         {
16943                 .cmd = NL80211_CMD_FLUSH_PMKSA,
16944                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16945                 .doit = nl80211_flush_pmksa,
16946                 .flags = GENL_UNS_ADMIN_PERM,
16947                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16948         },
16949         {
16950                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16951                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16952                 .doit = nl80211_remain_on_channel,
16953                 .flags = GENL_UNS_ADMIN_PERM,
16954                 /* FIXME: requiring a link ID here is probably not good */
16955                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16956                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16957         },
16958         {
16959                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16960                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16961                 .doit = nl80211_cancel_remain_on_channel,
16962                 .flags = GENL_UNS_ADMIN_PERM,
16963                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16964         },
16965         {
16966                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
16967                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16968                 .doit = nl80211_set_tx_bitrate_mask,
16969                 .flags = GENL_UNS_ADMIN_PERM,
16970                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16971                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16972         },
16973         {
16974                 .cmd = NL80211_CMD_REGISTER_FRAME,
16975                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16976                 .doit = nl80211_register_mgmt,
16977                 .flags = GENL_UNS_ADMIN_PERM,
16978                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16979         },
16980         {
16981                 .cmd = NL80211_CMD_FRAME,
16982                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16983                 .doit = nl80211_tx_mgmt,
16984                 .flags = GENL_UNS_ADMIN_PERM,
16985                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16986         },
16987         {
16988                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
16989                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16990                 .doit = nl80211_tx_mgmt_cancel_wait,
16991                 .flags = GENL_UNS_ADMIN_PERM,
16992                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16993         },
16994         {
16995                 .cmd = NL80211_CMD_SET_POWER_SAVE,
16996                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16997                 .doit = nl80211_set_power_save,
16998                 .flags = GENL_UNS_ADMIN_PERM,
16999                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17000         },
17001         {
17002                 .cmd = NL80211_CMD_GET_POWER_SAVE,
17003                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17004                 .doit = nl80211_get_power_save,
17005                 /* can be retrieved by unprivileged users */
17006                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17007         },
17008         {
17009                 .cmd = NL80211_CMD_SET_CQM,
17010                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17011                 .doit = nl80211_set_cqm,
17012                 .flags = GENL_UNS_ADMIN_PERM,
17013                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17014         },
17015         {
17016                 .cmd = NL80211_CMD_SET_CHANNEL,
17017                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17018                 .doit = nl80211_set_channel,
17019                 .flags = GENL_UNS_ADMIN_PERM,
17020                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17021                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17022         },
17023         {
17024                 .cmd = NL80211_CMD_JOIN_MESH,
17025                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17026                 .doit = nl80211_join_mesh,
17027                 .flags = GENL_UNS_ADMIN_PERM,
17028                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17029         },
17030         {
17031                 .cmd = NL80211_CMD_LEAVE_MESH,
17032                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17033                 .doit = nl80211_leave_mesh,
17034                 .flags = GENL_UNS_ADMIN_PERM,
17035                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17036         },
17037         {
17038                 .cmd = NL80211_CMD_JOIN_OCB,
17039                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17040                 .doit = nl80211_join_ocb,
17041                 .flags = GENL_UNS_ADMIN_PERM,
17042                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17043         },
17044         {
17045                 .cmd = NL80211_CMD_LEAVE_OCB,
17046                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17047                 .doit = nl80211_leave_ocb,
17048                 .flags = GENL_UNS_ADMIN_PERM,
17049                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17050         },
17051 #ifdef CONFIG_PM
17052         {
17053                 .cmd = NL80211_CMD_GET_WOWLAN,
17054                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17055                 .doit = nl80211_get_wowlan,
17056                 /* can be retrieved by unprivileged users */
17057                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17058         },
17059         {
17060                 .cmd = NL80211_CMD_SET_WOWLAN,
17061                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17062                 .doit = nl80211_set_wowlan,
17063                 .flags = GENL_UNS_ADMIN_PERM,
17064                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17065         },
17066 #endif
17067         {
17068                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17069                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17070                 .doit = nl80211_set_rekey_data,
17071                 .flags = GENL_UNS_ADMIN_PERM,
17072                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17073                                          NL80211_FLAG_CLEAR_SKB),
17074         },
17075         {
17076                 .cmd = NL80211_CMD_TDLS_MGMT,
17077                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17078                 .doit = nl80211_tdls_mgmt,
17079                 .flags = GENL_UNS_ADMIN_PERM,
17080                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17081                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17082         },
17083         {
17084                 .cmd = NL80211_CMD_TDLS_OPER,
17085                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17086                 .doit = nl80211_tdls_oper,
17087                 .flags = GENL_UNS_ADMIN_PERM,
17088                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17089         },
17090         {
17091                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17092                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17093                 .doit = nl80211_register_unexpected_frame,
17094                 .flags = GENL_UNS_ADMIN_PERM,
17095                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17096         },
17097         {
17098                 .cmd = NL80211_CMD_PROBE_CLIENT,
17099                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17100                 .doit = nl80211_probe_client,
17101                 .flags = GENL_UNS_ADMIN_PERM,
17102                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17103         },
17104         {
17105                 .cmd = NL80211_CMD_REGISTER_BEACONS,
17106                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17107                 .doit = nl80211_register_beacons,
17108                 .flags = GENL_UNS_ADMIN_PERM,
17109                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17110         },
17111         {
17112                 .cmd = NL80211_CMD_SET_NOACK_MAP,
17113                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17114                 .doit = nl80211_set_noack_map,
17115                 .flags = GENL_UNS_ADMIN_PERM,
17116                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17117         },
17118         {
17119                 .cmd = NL80211_CMD_START_P2P_DEVICE,
17120                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17121                 .doit = nl80211_start_p2p_device,
17122                 .flags = GENL_UNS_ADMIN_PERM,
17123                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17124                                          NL80211_FLAG_NEED_RTNL),
17125         },
17126         {
17127                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17128                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17129                 .doit = nl80211_stop_p2p_device,
17130                 .flags = GENL_UNS_ADMIN_PERM,
17131                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17132                                          NL80211_FLAG_NEED_RTNL),
17133         },
17134         {
17135                 .cmd = NL80211_CMD_START_NAN,
17136                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17137                 .doit = nl80211_start_nan,
17138                 .flags = GENL_ADMIN_PERM,
17139                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17140                                          NL80211_FLAG_NEED_RTNL),
17141         },
17142         {
17143                 .cmd = NL80211_CMD_STOP_NAN,
17144                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17145                 .doit = nl80211_stop_nan,
17146                 .flags = GENL_ADMIN_PERM,
17147                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17148                                          NL80211_FLAG_NEED_RTNL),
17149         },
17150         {
17151                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17152                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17153                 .doit = nl80211_nan_add_func,
17154                 .flags = GENL_ADMIN_PERM,
17155                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17156         },
17157         {
17158                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17159                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17160                 .doit = nl80211_nan_del_func,
17161                 .flags = GENL_ADMIN_PERM,
17162                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17163         },
17164         {
17165                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17166                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17167                 .doit = nl80211_nan_change_config,
17168                 .flags = GENL_ADMIN_PERM,
17169                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17170         },
17171         {
17172                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17173                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17174                 .doit = nl80211_set_mcast_rate,
17175                 .flags = GENL_UNS_ADMIN_PERM,
17176                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17177         },
17178         {
17179                 .cmd = NL80211_CMD_SET_MAC_ACL,
17180                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17181                 .doit = nl80211_set_mac_acl,
17182                 .flags = GENL_UNS_ADMIN_PERM,
17183                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17184                                          NL80211_FLAG_MLO_UNSUPPORTED),
17185         },
17186         {
17187                 .cmd = NL80211_CMD_RADAR_DETECT,
17188                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17189                 .doit = nl80211_start_radar_detection,
17190                 .flags = GENL_UNS_ADMIN_PERM,
17191                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17192                                          NL80211_FLAG_NO_WIPHY_MTX |
17193                                          NL80211_FLAG_MLO_UNSUPPORTED),
17194         },
17195         {
17196                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17197                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17198                 .doit = nl80211_get_protocol_features,
17199         },
17200         {
17201                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17202                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17203                 .doit = nl80211_update_ft_ies,
17204                 .flags = GENL_UNS_ADMIN_PERM,
17205                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17206         },
17207         {
17208                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17209                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17210                 .doit = nl80211_crit_protocol_start,
17211                 .flags = GENL_UNS_ADMIN_PERM,
17212                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17213         },
17214         {
17215                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17216                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17217                 .doit = nl80211_crit_protocol_stop,
17218                 .flags = GENL_UNS_ADMIN_PERM,
17219                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17220         },
17221         {
17222                 .cmd = NL80211_CMD_GET_COALESCE,
17223                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17224                 .doit = nl80211_get_coalesce,
17225                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17226         },
17227         {
17228                 .cmd = NL80211_CMD_SET_COALESCE,
17229                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17230                 .doit = nl80211_set_coalesce,
17231                 .flags = GENL_UNS_ADMIN_PERM,
17232                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17233         },
17234         {
17235                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17236                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17237                 .doit = nl80211_channel_switch,
17238                 .flags = GENL_UNS_ADMIN_PERM,
17239                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17240                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17241         },
17242         {
17243                 .cmd = NL80211_CMD_VENDOR,
17244                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17245                 .doit = nl80211_vendor_cmd,
17246                 .dumpit = nl80211_vendor_cmd_dump,
17247                 .flags = GENL_UNS_ADMIN_PERM,
17248                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17249                                          NL80211_FLAG_CLEAR_SKB),
17250         },
17251         {
17252                 .cmd = NL80211_CMD_SET_QOS_MAP,
17253                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17254                 .doit = nl80211_set_qos_map,
17255                 .flags = GENL_UNS_ADMIN_PERM,
17256                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17257         },
17258         {
17259                 .cmd = NL80211_CMD_ADD_TX_TS,
17260                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17261                 .doit = nl80211_add_tx_ts,
17262                 .flags = GENL_UNS_ADMIN_PERM,
17263                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17264                                          NL80211_FLAG_MLO_UNSUPPORTED),
17265         },
17266         {
17267                 .cmd = NL80211_CMD_DEL_TX_TS,
17268                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17269                 .doit = nl80211_del_tx_ts,
17270                 .flags = GENL_UNS_ADMIN_PERM,
17271                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17272         },
17273         {
17274                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17275                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17276                 .doit = nl80211_tdls_channel_switch,
17277                 .flags = GENL_UNS_ADMIN_PERM,
17278                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17279         },
17280         {
17281                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17282                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17283                 .doit = nl80211_tdls_cancel_channel_switch,
17284                 .flags = GENL_UNS_ADMIN_PERM,
17285                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17286         },
17287         {
17288                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17289                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17290                 .doit = nl80211_set_multicast_to_unicast,
17291                 .flags = GENL_UNS_ADMIN_PERM,
17292                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17293         },
17294         {
17295                 .cmd = NL80211_CMD_SET_PMK,
17296                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17297                 .doit = nl80211_set_pmk,
17298                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17299                                          NL80211_FLAG_CLEAR_SKB),
17300         },
17301         {
17302                 .cmd = NL80211_CMD_DEL_PMK,
17303                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17304                 .doit = nl80211_del_pmk,
17305                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17306         },
17307         {
17308                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17309                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17310                 .doit = nl80211_external_auth,
17311                 .flags = GENL_ADMIN_PERM,
17312                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17313         },
17314         {
17315                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17316                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17317                 .doit = nl80211_tx_control_port,
17318                 .flags = GENL_UNS_ADMIN_PERM,
17319                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17320         },
17321         {
17322                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17323                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17324                 .doit = nl80211_get_ftm_responder_stats,
17325                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17326                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17327         },
17328         {
17329                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17330                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17331                 .doit = nl80211_pmsr_start,
17332                 .flags = GENL_UNS_ADMIN_PERM,
17333                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17334         },
17335         {
17336                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17337                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17338                 .doit = nl80211_notify_radar_detection,
17339                 .flags = GENL_UNS_ADMIN_PERM,
17340                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17341         },
17342         {
17343                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17344                 .doit = nl80211_update_owe_info,
17345                 .flags = GENL_ADMIN_PERM,
17346                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17347         },
17348         {
17349                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17350                 .doit = nl80211_probe_mesh_link,
17351                 .flags = GENL_UNS_ADMIN_PERM,
17352                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17353         },
17354         {
17355                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17356                 .doit = nl80211_set_tid_config,
17357                 .flags = GENL_UNS_ADMIN_PERM,
17358                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17359                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17360         },
17361         {
17362                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17363                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17364                 .doit = nl80211_set_sar_specs,
17365                 .flags = GENL_UNS_ADMIN_PERM,
17366                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17367                                          NL80211_FLAG_NEED_RTNL),
17368         },
17369         {
17370                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17371                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17372                 .doit = nl80211_color_change,
17373                 .flags = GENL_UNS_ADMIN_PERM,
17374                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17375         },
17376         {
17377                 .cmd = NL80211_CMD_SET_FILS_AAD,
17378                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17379                 .doit = nl80211_set_fils_aad,
17380                 .flags = GENL_UNS_ADMIN_PERM,
17381                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17382         },
17383         {
17384                 .cmd = NL80211_CMD_ADD_LINK,
17385                 .doit = nl80211_add_link,
17386                 .flags = GENL_UNS_ADMIN_PERM,
17387                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17388         },
17389         {
17390                 .cmd = NL80211_CMD_REMOVE_LINK,
17391                 .doit = nl80211_remove_link,
17392                 .flags = GENL_UNS_ADMIN_PERM,
17393                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17394                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17395         },
17396         {
17397                 .cmd = NL80211_CMD_ADD_LINK_STA,
17398                 .doit = nl80211_add_link_station,
17399                 .flags = GENL_UNS_ADMIN_PERM,
17400                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17401                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17402         },
17403         {
17404                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17405                 .doit = nl80211_modify_link_station,
17406                 .flags = GENL_UNS_ADMIN_PERM,
17407                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17408                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17409         },
17410         {
17411                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17412                 .doit = nl80211_remove_link_station,
17413                 .flags = GENL_UNS_ADMIN_PERM,
17414                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17415                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17416         },
17417         {
17418                 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17419                 .doit = nl80211_set_hw_timestamp,
17420                 .flags = GENL_UNS_ADMIN_PERM,
17421                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17422         },
17423 };
17424
17425 static struct genl_family nl80211_fam __ro_after_init = {
17426         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17427         .hdrsize = 0,                   /* no private header */
17428         .version = 1,                   /* no particular meaning now */
17429         .maxattr = NL80211_ATTR_MAX,
17430         .policy = nl80211_policy,
17431         .netnsok = true,
17432         .pre_doit = nl80211_pre_doit,
17433         .post_doit = nl80211_post_doit,
17434         .module = THIS_MODULE,
17435         .ops = nl80211_ops,
17436         .n_ops = ARRAY_SIZE(nl80211_ops),
17437         .small_ops = nl80211_small_ops,
17438         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17439         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17440         .mcgrps = nl80211_mcgrps,
17441         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17442         .parallel_ops = true,
17443 };
17444
17445 /* notification functions */
17446
17447 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17448                           enum nl80211_commands cmd)
17449 {
17450         struct sk_buff *msg;
17451         struct nl80211_dump_wiphy_state state = {};
17452
17453         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17454                 cmd != NL80211_CMD_DEL_WIPHY);
17455
17456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17457         if (!msg)
17458                 return;
17459
17460         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17461                 nlmsg_free(msg);
17462                 return;
17463         }
17464
17465         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17466                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17467 }
17468
17469 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17470                                 struct wireless_dev *wdev,
17471                                 enum nl80211_commands cmd)
17472 {
17473         struct sk_buff *msg;
17474
17475         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17476         if (!msg)
17477                 return;
17478
17479         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17480                 nlmsg_free(msg);
17481                 return;
17482         }
17483
17484         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17485                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17486 }
17487
17488 static int nl80211_add_scan_req(struct sk_buff *msg,
17489                                 struct cfg80211_registered_device *rdev)
17490 {
17491         struct cfg80211_scan_request *req = rdev->scan_req;
17492         struct nlattr *nest;
17493         int i;
17494         struct cfg80211_scan_info *info;
17495
17496         if (WARN_ON(!req))
17497                 return 0;
17498
17499         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17500         if (!nest)
17501                 goto nla_put_failure;
17502         for (i = 0; i < req->n_ssids; i++) {
17503                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17504                         goto nla_put_failure;
17505         }
17506         nla_nest_end(msg, nest);
17507
17508         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17509                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17510                 if (!nest)
17511                         goto nla_put_failure;
17512                 for (i = 0; i < req->n_channels; i++) {
17513                         if (nla_put_u32(msg, i,
17514                                    ieee80211_channel_to_khz(req->channels[i])))
17515                                 goto nla_put_failure;
17516                 }
17517                 nla_nest_end(msg, nest);
17518         } else {
17519                 nest = nla_nest_start_noflag(msg,
17520                                              NL80211_ATTR_SCAN_FREQUENCIES);
17521                 if (!nest)
17522                         goto nla_put_failure;
17523                 for (i = 0; i < req->n_channels; i++) {
17524                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17525                                 goto nla_put_failure;
17526                 }
17527                 nla_nest_end(msg, nest);
17528         }
17529
17530         if (req->ie &&
17531             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17532                 goto nla_put_failure;
17533
17534         if (req->flags &&
17535             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17536                 goto nla_put_failure;
17537
17538         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17539                 &rdev->scan_req->info;
17540         if (info->scan_start_tsf &&
17541             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17542                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17543              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17544                      info->tsf_bssid)))
17545                 goto nla_put_failure;
17546
17547         return 0;
17548  nla_put_failure:
17549         return -ENOBUFS;
17550 }
17551
17552 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17553                                  struct cfg80211_registered_device *rdev,
17554                                  struct wireless_dev *wdev,
17555                                  u32 portid, u32 seq, int flags,
17556                                  u32 cmd)
17557 {
17558         void *hdr;
17559
17560         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17561         if (!hdr)
17562                 return -1;
17563
17564         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17565             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17566                                          wdev->netdev->ifindex)) ||
17567             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17568                               NL80211_ATTR_PAD))
17569                 goto nla_put_failure;
17570
17571         /* ignore errors and send incomplete event anyway */
17572         nl80211_add_scan_req(msg, rdev);
17573
17574         genlmsg_end(msg, hdr);
17575         return 0;
17576
17577  nla_put_failure:
17578         genlmsg_cancel(msg, hdr);
17579         return -EMSGSIZE;
17580 }
17581
17582 static int
17583 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17584                             struct cfg80211_sched_scan_request *req, u32 cmd)
17585 {
17586         void *hdr;
17587
17588         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17589         if (!hdr)
17590                 return -1;
17591
17592         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17593                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17594             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17595             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17596                               NL80211_ATTR_PAD))
17597                 goto nla_put_failure;
17598
17599         genlmsg_end(msg, hdr);
17600         return 0;
17601
17602  nla_put_failure:
17603         genlmsg_cancel(msg, hdr);
17604         return -EMSGSIZE;
17605 }
17606
17607 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17608                              struct wireless_dev *wdev)
17609 {
17610         struct sk_buff *msg;
17611
17612         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17613         if (!msg)
17614                 return;
17615
17616         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17617                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
17618                 nlmsg_free(msg);
17619                 return;
17620         }
17621
17622         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17623                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17624 }
17625
17626 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17627                                        struct wireless_dev *wdev, bool aborted)
17628 {
17629         struct sk_buff *msg;
17630
17631         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17632         if (!msg)
17633                 return NULL;
17634
17635         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17636                                   aborted ? NL80211_CMD_SCAN_ABORTED :
17637                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17638                 nlmsg_free(msg);
17639                 return NULL;
17640         }
17641
17642         return msg;
17643 }
17644
17645 /* send message created by nl80211_build_scan_msg() */
17646 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17647                            struct sk_buff *msg)
17648 {
17649         if (!msg)
17650                 return;
17651
17652         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17653                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17654 }
17655
17656 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17657 {
17658         struct sk_buff *msg;
17659
17660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17661         if (!msg)
17662                 return;
17663
17664         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17665                 nlmsg_free(msg);
17666                 return;
17667         }
17668
17669         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17670                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17671 }
17672
17673 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17674                                           struct regulatory_request *request)
17675 {
17676         /* Userspace can always count this one always being set */
17677         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17678                 goto nla_put_failure;
17679
17680         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17681                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17682                                NL80211_REGDOM_TYPE_WORLD))
17683                         goto nla_put_failure;
17684         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17685                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17686                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17687                         goto nla_put_failure;
17688         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17689                    request->intersect) {
17690                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17691                                NL80211_REGDOM_TYPE_INTERSECTION))
17692                         goto nla_put_failure;
17693         } else {
17694                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17695                                NL80211_REGDOM_TYPE_COUNTRY) ||
17696                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17697                                    request->alpha2))
17698                         goto nla_put_failure;
17699         }
17700
17701         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17702                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17703
17704                 if (wiphy &&
17705                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17706                         goto nla_put_failure;
17707
17708                 if (wiphy &&
17709                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17710                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17711                         goto nla_put_failure;
17712         }
17713
17714         return true;
17715
17716 nla_put_failure:
17717         return false;
17718 }
17719
17720 /*
17721  * This can happen on global regulatory changes or device specific settings
17722  * based on custom regulatory domains.
17723  */
17724 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17725                                      struct regulatory_request *request)
17726 {
17727         struct sk_buff *msg;
17728         void *hdr;
17729
17730         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17731         if (!msg)
17732                 return;
17733
17734         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17735         if (!hdr)
17736                 goto nla_put_failure;
17737
17738         if (!nl80211_reg_change_event_fill(msg, request))
17739                 goto nla_put_failure;
17740
17741         genlmsg_end(msg, hdr);
17742
17743         rcu_read_lock();
17744         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17745                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17746         rcu_read_unlock();
17747
17748         return;
17749
17750 nla_put_failure:
17751         nlmsg_free(msg);
17752 }
17753
17754 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17755                                     struct net_device *netdev,
17756                                     const u8 *buf, size_t len,
17757                                     enum nl80211_commands cmd, gfp_t gfp,
17758                                     int uapsd_queues, const u8 *req_ies,
17759                                     size_t req_ies_len, bool reconnect)
17760 {
17761         struct sk_buff *msg;
17762         void *hdr;
17763
17764         msg = nlmsg_new(100 + len + req_ies_len, gfp);
17765         if (!msg)
17766                 return;
17767
17768         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17769         if (!hdr) {
17770                 nlmsg_free(msg);
17771                 return;
17772         }
17773
17774         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17775             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17776             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17777             (req_ies &&
17778              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17779                 goto nla_put_failure;
17780
17781         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17782                 goto nla_put_failure;
17783
17784         if (uapsd_queues >= 0) {
17785                 struct nlattr *nla_wmm =
17786                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17787                 if (!nla_wmm)
17788                         goto nla_put_failure;
17789
17790                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17791                                uapsd_queues))
17792                         goto nla_put_failure;
17793
17794                 nla_nest_end(msg, nla_wmm);
17795         }
17796
17797         genlmsg_end(msg, hdr);
17798
17799         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17800                                 NL80211_MCGRP_MLME, gfp);
17801         return;
17802
17803  nla_put_failure:
17804         nlmsg_free(msg);
17805 }
17806
17807 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17808                           struct net_device *netdev, const u8 *buf,
17809                           size_t len, gfp_t gfp)
17810 {
17811         nl80211_send_mlme_event(rdev, netdev, buf, len,
17812                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17813                                 false);
17814 }
17815
17816 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17817                            struct net_device *netdev,
17818                            struct cfg80211_rx_assoc_resp_data *data)
17819 {
17820         nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17821                                 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17822                                 data->uapsd_queues,
17823                                 data->req_ies, data->req_ies_len, false);
17824 }
17825
17826 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17827                          struct net_device *netdev, const u8 *buf,
17828                          size_t len, bool reconnect, gfp_t gfp)
17829 {
17830         nl80211_send_mlme_event(rdev, netdev, buf, len,
17831                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17832                                 reconnect);
17833 }
17834
17835 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17836                            struct net_device *netdev, const u8 *buf,
17837                            size_t len, bool reconnect, gfp_t gfp)
17838 {
17839         nl80211_send_mlme_event(rdev, netdev, buf, len,
17840                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17841                                 reconnect);
17842 }
17843
17844 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17845                                   size_t len)
17846 {
17847         struct wireless_dev *wdev = dev->ieee80211_ptr;
17848         struct wiphy *wiphy = wdev->wiphy;
17849         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17850         const struct ieee80211_mgmt *mgmt = (void *)buf;
17851         u32 cmd;
17852
17853         if (WARN_ON(len < 2))
17854                 return;
17855
17856         if (ieee80211_is_deauth(mgmt->frame_control)) {
17857                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17858         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17859                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17860         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17861                 if (wdev->unprot_beacon_reported &&
17862                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17863                         return;
17864                 cmd = NL80211_CMD_UNPROT_BEACON;
17865                 wdev->unprot_beacon_reported = jiffies;
17866         } else {
17867                 return;
17868         }
17869
17870         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17871         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17872                                 NULL, 0, false);
17873 }
17874 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17875
17876 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17877                                       struct net_device *netdev, int cmd,
17878                                       const u8 *addr, gfp_t gfp)
17879 {
17880         struct sk_buff *msg;
17881         void *hdr;
17882
17883         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17884         if (!msg)
17885                 return;
17886
17887         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17888         if (!hdr) {
17889                 nlmsg_free(msg);
17890                 return;
17891         }
17892
17893         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17894             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17895             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17896             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17897                 goto nla_put_failure;
17898
17899         genlmsg_end(msg, hdr);
17900
17901         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17902                                 NL80211_MCGRP_MLME, gfp);
17903         return;
17904
17905  nla_put_failure:
17906         nlmsg_free(msg);
17907 }
17908
17909 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17910                                struct net_device *netdev, const u8 *addr,
17911                                gfp_t gfp)
17912 {
17913         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17914                                   addr, gfp);
17915 }
17916
17917 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17918                                 struct net_device *netdev, const u8 *addr,
17919                                 gfp_t gfp)
17920 {
17921         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17922                                   addr, gfp);
17923 }
17924
17925 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17926                                  struct net_device *netdev,
17927                                  struct cfg80211_connect_resp_params *cr,
17928                                  gfp_t gfp)
17929 {
17930         struct sk_buff *msg;
17931         void *hdr;
17932         unsigned int link;
17933         size_t link_info_size = 0;
17934         const u8 *connected_addr = cr->valid_links ?
17935                                    cr->ap_mld_addr : cr->links[0].bssid;
17936
17937         if (cr->valid_links) {
17938                 for_each_valid_link(cr, link) {
17939                         /* Nested attribute header */
17940                         link_info_size += NLA_HDRLEN;
17941                         /* Link ID */
17942                         link_info_size += nla_total_size(sizeof(u8));
17943                         link_info_size += cr->links[link].addr ?
17944                                           nla_total_size(ETH_ALEN) : 0;
17945                         link_info_size += (cr->links[link].bssid ||
17946                                            cr->links[link].bss) ?
17947                                           nla_total_size(ETH_ALEN) : 0;
17948                         link_info_size += nla_total_size(sizeof(u16));
17949                 }
17950         }
17951
17952         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17953                         cr->fils.kek_len + cr->fils.pmk_len +
17954                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
17955                         gfp);
17956         if (!msg)
17957                 return;
17958
17959         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17960         if (!hdr) {
17961                 nlmsg_free(msg);
17962                 return;
17963         }
17964
17965         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17966             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17967             (connected_addr &&
17968              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
17969             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
17970                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
17971                         cr->status) ||
17972             (cr->status < 0 &&
17973              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17974               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
17975                           cr->timeout_reason))) ||
17976             (cr->req_ie &&
17977              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
17978             (cr->resp_ie &&
17979              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
17980                      cr->resp_ie)) ||
17981             (cr->fils.update_erp_next_seq_num &&
17982              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17983                          cr->fils.erp_next_seq_num)) ||
17984             (cr->status == WLAN_STATUS_SUCCESS &&
17985              ((cr->fils.kek &&
17986                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
17987                        cr->fils.kek)) ||
17988               (cr->fils.pmk &&
17989                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
17990               (cr->fils.pmkid &&
17991                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
17992                 goto nla_put_failure;
17993
17994         if (cr->valid_links) {
17995                 int i = 1;
17996                 struct nlattr *nested;
17997
17998                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
17999                 if (!nested)
18000                         goto nla_put_failure;
18001
18002                 for_each_valid_link(cr, link) {
18003                         struct nlattr *nested_mlo_links;
18004                         const u8 *bssid = cr->links[link].bss ?
18005                                           cr->links[link].bss->bssid :
18006                                           cr->links[link].bssid;
18007
18008                         nested_mlo_links = nla_nest_start(msg, i);
18009                         if (!nested_mlo_links)
18010                                 goto nla_put_failure;
18011
18012                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18013                             (bssid &&
18014                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18015                             (cr->links[link].addr &&
18016                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18017                                      cr->links[link].addr)) ||
18018                             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18019                                         cr->links[link].status))
18020                                 goto nla_put_failure;
18021
18022                         nla_nest_end(msg, nested_mlo_links);
18023                         i++;
18024                 }
18025                 nla_nest_end(msg, nested);
18026         }
18027
18028         genlmsg_end(msg, hdr);
18029
18030         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18031                                 NL80211_MCGRP_MLME, gfp);
18032         return;
18033
18034  nla_put_failure:
18035         nlmsg_free(msg);
18036 }
18037
18038 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18039                          struct net_device *netdev,
18040                          struct cfg80211_roam_info *info, gfp_t gfp)
18041 {
18042         struct sk_buff *msg;
18043         void *hdr;
18044         size_t link_info_size = 0;
18045         unsigned int link;
18046         const u8 *connected_addr = info->ap_mld_addr ?
18047                                    info->ap_mld_addr :
18048                                    (info->links[0].bss ?
18049                                     info->links[0].bss->bssid :
18050                                     info->links[0].bssid);
18051
18052         if (info->valid_links) {
18053                 for_each_valid_link(info, link) {
18054                         /* Nested attribute header */
18055                         link_info_size += NLA_HDRLEN;
18056                         /* Link ID */
18057                         link_info_size += nla_total_size(sizeof(u8));
18058                         link_info_size += info->links[link].addr ?
18059                                           nla_total_size(ETH_ALEN) : 0;
18060                         link_info_size += (info->links[link].bssid ||
18061                                            info->links[link].bss) ?
18062                                           nla_total_size(ETH_ALEN) : 0;
18063                 }
18064         }
18065
18066         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18067                         info->fils.kek_len + info->fils.pmk_len +
18068                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18069                         link_info_size, gfp);
18070         if (!msg)
18071                 return;
18072
18073         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18074         if (!hdr) {
18075                 nlmsg_free(msg);
18076                 return;
18077         }
18078
18079         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18080             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18081             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18082             (info->req_ie &&
18083              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18084                      info->req_ie)) ||
18085             (info->resp_ie &&
18086              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18087                      info->resp_ie)) ||
18088             (info->fils.update_erp_next_seq_num &&
18089              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18090                          info->fils.erp_next_seq_num)) ||
18091             (info->fils.kek &&
18092              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18093                      info->fils.kek)) ||
18094             (info->fils.pmk &&
18095              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18096             (info->fils.pmkid &&
18097              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18098                 goto nla_put_failure;
18099
18100         if (info->valid_links) {
18101                 int i = 1;
18102                 struct nlattr *nested;
18103
18104                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18105                 if (!nested)
18106                         goto nla_put_failure;
18107
18108                 for_each_valid_link(info, link) {
18109                         struct nlattr *nested_mlo_links;
18110                         const u8 *bssid = info->links[link].bss ?
18111                                           info->links[link].bss->bssid :
18112                                           info->links[link].bssid;
18113
18114                         nested_mlo_links = nla_nest_start(msg, i);
18115                         if (!nested_mlo_links)
18116                                 goto nla_put_failure;
18117
18118                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18119                             (bssid &&
18120                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18121                             (info->links[link].addr &&
18122                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18123                                      info->links[link].addr)))
18124                                 goto nla_put_failure;
18125
18126                         nla_nest_end(msg, nested_mlo_links);
18127                         i++;
18128                 }
18129                 nla_nest_end(msg, nested);
18130         }
18131
18132         genlmsg_end(msg, hdr);
18133
18134         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18135                                 NL80211_MCGRP_MLME, gfp);
18136         return;
18137
18138  nla_put_failure:
18139         nlmsg_free(msg);
18140 }
18141
18142 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18143                                   struct net_device *netdev, const u8 *peer_addr,
18144                                   const u8 *td_bitmap, u8 td_bitmap_len)
18145 {
18146         struct sk_buff *msg;
18147         void *hdr;
18148
18149         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18150         if (!msg)
18151                 return;
18152
18153         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18154         if (!hdr) {
18155                 nlmsg_free(msg);
18156                 return;
18157         }
18158
18159         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18160             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18161             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer_addr))
18162                 goto nla_put_failure;
18163
18164         if ((td_bitmap_len > 0) && td_bitmap)
18165                 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18166                             td_bitmap_len, td_bitmap))
18167                         goto nla_put_failure;
18168
18169         genlmsg_end(msg, hdr);
18170
18171         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18172                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18173         return;
18174
18175  nla_put_failure:
18176         nlmsg_free(msg);
18177 }
18178
18179 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18180                                struct net_device *netdev, u16 reason,
18181                                const u8 *ie, size_t ie_len, bool from_ap)
18182 {
18183         struct sk_buff *msg;
18184         void *hdr;
18185
18186         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18187         if (!msg)
18188                 return;
18189
18190         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18191         if (!hdr) {
18192                 nlmsg_free(msg);
18193                 return;
18194         }
18195
18196         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18197             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18198             (reason &&
18199              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18200             (from_ap &&
18201              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18202             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18203                 goto nla_put_failure;
18204
18205         genlmsg_end(msg, hdr);
18206
18207         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18208                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18209         return;
18210
18211  nla_put_failure:
18212         nlmsg_free(msg);
18213 }
18214
18215 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18216 {
18217         struct wireless_dev *wdev = dev->ieee80211_ptr;
18218         struct wiphy *wiphy = wdev->wiphy;
18219         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18220         struct sk_buff *msg;
18221         struct nlattr *links;
18222         void *hdr;
18223
18224         lockdep_assert_wiphy(wdev->wiphy);
18225         trace_cfg80211_links_removed(dev, link_mask);
18226
18227         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18228                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18229                 return;
18230
18231         if (WARN_ON(!wdev->valid_links || !link_mask ||
18232                     (wdev->valid_links & link_mask) != link_mask ||
18233                     wdev->valid_links == link_mask))
18234                 return;
18235
18236         cfg80211_wdev_release_link_bsses(wdev, link_mask);
18237         wdev->valid_links &= ~link_mask;
18238
18239         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18240         if (!msg)
18241                 return;
18242
18243         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18244         if (!hdr) {
18245                 nlmsg_free(msg);
18246                 return;
18247         }
18248
18249         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18250             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18251                 goto nla_put_failure;
18252
18253         links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18254         if (!links)
18255                 goto nla_put_failure;
18256
18257         while (link_mask) {
18258                 struct nlattr *link;
18259                 int link_id = __ffs(link_mask);
18260
18261                 link = nla_nest_start(msg, link_id + 1);
18262                 if (!link)
18263                         goto nla_put_failure;
18264
18265                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18266                         goto nla_put_failure;
18267
18268                 nla_nest_end(msg, link);
18269                 link_mask &= ~(1 << link_id);
18270         }
18271
18272         nla_nest_end(msg, links);
18273
18274         genlmsg_end(msg, hdr);
18275
18276         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18277                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18278         return;
18279
18280  nla_put_failure:
18281         nlmsg_free(msg);
18282 }
18283 EXPORT_SYMBOL(cfg80211_links_removed);
18284
18285 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18286                              struct net_device *netdev, const u8 *bssid,
18287                              gfp_t gfp)
18288 {
18289         struct sk_buff *msg;
18290         void *hdr;
18291
18292         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18293         if (!msg)
18294                 return;
18295
18296         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18297         if (!hdr) {
18298                 nlmsg_free(msg);
18299                 return;
18300         }
18301
18302         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18303             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18304             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18305                 goto nla_put_failure;
18306
18307         genlmsg_end(msg, hdr);
18308
18309         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18310                                 NL80211_MCGRP_MLME, gfp);
18311         return;
18312
18313  nla_put_failure:
18314         nlmsg_free(msg);
18315 }
18316
18317 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18318                                         const u8 *ie, u8 ie_len,
18319                                         int sig_dbm, gfp_t gfp)
18320 {
18321         struct wireless_dev *wdev = dev->ieee80211_ptr;
18322         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18323         struct sk_buff *msg;
18324         void *hdr;
18325
18326         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18327                 return;
18328
18329         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18330
18331         msg = nlmsg_new(100 + ie_len, gfp);
18332         if (!msg)
18333                 return;
18334
18335         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18336         if (!hdr) {
18337                 nlmsg_free(msg);
18338                 return;
18339         }
18340
18341         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18342             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18343             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18344             (ie_len && ie &&
18345              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18346             (sig_dbm &&
18347              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18348                 goto nla_put_failure;
18349
18350         genlmsg_end(msg, hdr);
18351
18352         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18353                                 NL80211_MCGRP_MLME, gfp);
18354         return;
18355
18356  nla_put_failure:
18357         nlmsg_free(msg);
18358 }
18359 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18360
18361 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18362                                  struct net_device *netdev, const u8 *addr,
18363                                  enum nl80211_key_type key_type, int key_id,
18364                                  const u8 *tsc, gfp_t gfp)
18365 {
18366         struct sk_buff *msg;
18367         void *hdr;
18368
18369         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18370         if (!msg)
18371                 return;
18372
18373         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18374         if (!hdr) {
18375                 nlmsg_free(msg);
18376                 return;
18377         }
18378
18379         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18380             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18381             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18382             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18383             (key_id != -1 &&
18384              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18385             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18386                 goto nla_put_failure;
18387
18388         genlmsg_end(msg, hdr);
18389
18390         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18391                                 NL80211_MCGRP_MLME, gfp);
18392         return;
18393
18394  nla_put_failure:
18395         nlmsg_free(msg);
18396 }
18397
18398 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18399                                     struct ieee80211_channel *channel_before,
18400                                     struct ieee80211_channel *channel_after)
18401 {
18402         struct sk_buff *msg;
18403         void *hdr;
18404         struct nlattr *nl_freq;
18405
18406         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18407         if (!msg)
18408                 return;
18409
18410         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18411         if (!hdr) {
18412                 nlmsg_free(msg);
18413                 return;
18414         }
18415
18416         /*
18417          * Since we are applying the beacon hint to a wiphy we know its
18418          * wiphy_idx is valid
18419          */
18420         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18421                 goto nla_put_failure;
18422
18423         /* Before */
18424         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18425         if (!nl_freq)
18426                 goto nla_put_failure;
18427
18428         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18429                 goto nla_put_failure;
18430         nla_nest_end(msg, nl_freq);
18431
18432         /* After */
18433         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18434         if (!nl_freq)
18435                 goto nla_put_failure;
18436
18437         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18438                 goto nla_put_failure;
18439         nla_nest_end(msg, nl_freq);
18440
18441         genlmsg_end(msg, hdr);
18442
18443         rcu_read_lock();
18444         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18445                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18446         rcu_read_unlock();
18447
18448         return;
18449
18450 nla_put_failure:
18451         nlmsg_free(msg);
18452 }
18453
18454 static void nl80211_send_remain_on_chan_event(
18455         int cmd, struct cfg80211_registered_device *rdev,
18456         struct wireless_dev *wdev, u64 cookie,
18457         struct ieee80211_channel *chan,
18458         unsigned int duration, gfp_t gfp)
18459 {
18460         struct sk_buff *msg;
18461         void *hdr;
18462
18463         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18464         if (!msg)
18465                 return;
18466
18467         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18468         if (!hdr) {
18469                 nlmsg_free(msg);
18470                 return;
18471         }
18472
18473         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18474             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18475                                          wdev->netdev->ifindex)) ||
18476             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18477                               NL80211_ATTR_PAD) ||
18478             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18479             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18480                         NL80211_CHAN_NO_HT) ||
18481             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18482                               NL80211_ATTR_PAD))
18483                 goto nla_put_failure;
18484
18485         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18486             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18487                 goto nla_put_failure;
18488
18489         genlmsg_end(msg, hdr);
18490
18491         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18492                                 NL80211_MCGRP_MLME, gfp);
18493         return;
18494
18495  nla_put_failure:
18496         nlmsg_free(msg);
18497 }
18498
18499 void cfg80211_assoc_comeback(struct net_device *netdev,
18500                              const u8 *ap_addr, u32 timeout)
18501 {
18502         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18503         struct wiphy *wiphy = wdev->wiphy;
18504         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18505         struct sk_buff *msg;
18506         void *hdr;
18507
18508         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18509
18510         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18511         if (!msg)
18512                 return;
18513
18514         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18515         if (!hdr) {
18516                 nlmsg_free(msg);
18517                 return;
18518         }
18519
18520         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18521             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18522             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18523             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18524                 goto nla_put_failure;
18525
18526         genlmsg_end(msg, hdr);
18527
18528         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18529                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18530         return;
18531
18532  nla_put_failure:
18533         nlmsg_free(msg);
18534 }
18535 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18536
18537 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18538                                struct ieee80211_channel *chan,
18539                                unsigned int duration, gfp_t gfp)
18540 {
18541         struct wiphy *wiphy = wdev->wiphy;
18542         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18543
18544         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18545         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18546                                           rdev, wdev, cookie, chan,
18547                                           duration, gfp);
18548 }
18549 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18550
18551 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18552                                         struct ieee80211_channel *chan,
18553                                         gfp_t gfp)
18554 {
18555         struct wiphy *wiphy = wdev->wiphy;
18556         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18557
18558         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18559         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18560                                           rdev, wdev, cookie, chan, 0, gfp);
18561 }
18562 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18563
18564 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18565                                         struct ieee80211_channel *chan,
18566                                         gfp_t gfp)
18567 {
18568         struct wiphy *wiphy = wdev->wiphy;
18569         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18570
18571         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18572         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18573                                           rdev, wdev, cookie, chan, 0, gfp);
18574 }
18575 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18576
18577 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18578                       struct station_info *sinfo, gfp_t gfp)
18579 {
18580         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18581         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18582         struct sk_buff *msg;
18583
18584         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18585
18586         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18587         if (!msg)
18588                 return;
18589
18590         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18591                                  rdev, dev, mac_addr, sinfo) < 0) {
18592                 nlmsg_free(msg);
18593                 return;
18594         }
18595
18596         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18597                                 NL80211_MCGRP_MLME, gfp);
18598 }
18599 EXPORT_SYMBOL(cfg80211_new_sta);
18600
18601 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18602                             struct station_info *sinfo, gfp_t gfp)
18603 {
18604         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18605         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18606         struct sk_buff *msg;
18607         struct station_info empty_sinfo = {};
18608
18609         if (!sinfo)
18610                 sinfo = &empty_sinfo;
18611
18612         trace_cfg80211_del_sta(dev, mac_addr);
18613
18614         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18615         if (!msg) {
18616                 cfg80211_sinfo_release_content(sinfo);
18617                 return;
18618         }
18619
18620         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18621                                  rdev, dev, mac_addr, sinfo) < 0) {
18622                 nlmsg_free(msg);
18623                 return;
18624         }
18625
18626         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18627                                 NL80211_MCGRP_MLME, gfp);
18628 }
18629 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18630
18631 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18632                           enum nl80211_connect_failed_reason reason,
18633                           gfp_t gfp)
18634 {
18635         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18636         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18637         struct sk_buff *msg;
18638         void *hdr;
18639
18640         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18641         if (!msg)
18642                 return;
18643
18644         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18645         if (!hdr) {
18646                 nlmsg_free(msg);
18647                 return;
18648         }
18649
18650         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18651             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18652             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18653                 goto nla_put_failure;
18654
18655         genlmsg_end(msg, hdr);
18656
18657         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18658                                 NL80211_MCGRP_MLME, gfp);
18659         return;
18660
18661  nla_put_failure:
18662         nlmsg_free(msg);
18663 }
18664 EXPORT_SYMBOL(cfg80211_conn_failed);
18665
18666 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18667                                        const u8 *addr, gfp_t gfp)
18668 {
18669         struct wireless_dev *wdev = dev->ieee80211_ptr;
18670         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18671         struct sk_buff *msg;
18672         void *hdr;
18673         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18674
18675         if (!nlportid)
18676                 return false;
18677
18678         msg = nlmsg_new(100, gfp);
18679         if (!msg)
18680                 return true;
18681
18682         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18683         if (!hdr) {
18684                 nlmsg_free(msg);
18685                 return true;
18686         }
18687
18688         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18689             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18690             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18691                 goto nla_put_failure;
18692
18693         genlmsg_end(msg, hdr);
18694         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18695         return true;
18696
18697  nla_put_failure:
18698         nlmsg_free(msg);
18699         return true;
18700 }
18701
18702 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18703                                 const u8 *addr, gfp_t gfp)
18704 {
18705         struct wireless_dev *wdev = dev->ieee80211_ptr;
18706         bool ret;
18707
18708         trace_cfg80211_rx_spurious_frame(dev, addr);
18709
18710         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18711                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18712                 trace_cfg80211_return_bool(false);
18713                 return false;
18714         }
18715         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18716                                          addr, gfp);
18717         trace_cfg80211_return_bool(ret);
18718         return ret;
18719 }
18720 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18721
18722 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18723                                         const u8 *addr, gfp_t gfp)
18724 {
18725         struct wireless_dev *wdev = dev->ieee80211_ptr;
18726         bool ret;
18727
18728         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18729
18730         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18731                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18732                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18733                 trace_cfg80211_return_bool(false);
18734                 return false;
18735         }
18736         ret = __nl80211_unexpected_frame(dev,
18737                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18738                                          addr, gfp);
18739         trace_cfg80211_return_bool(ret);
18740         return ret;
18741 }
18742 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18743
18744 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18745                       struct wireless_dev *wdev, u32 nlportid,
18746                       struct cfg80211_rx_info *info, gfp_t gfp)
18747 {
18748         struct net_device *netdev = wdev->netdev;
18749         struct sk_buff *msg;
18750         void *hdr;
18751
18752         msg = nlmsg_new(100 + info->len, gfp);
18753         if (!msg)
18754                 return -ENOMEM;
18755
18756         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18757         if (!hdr) {
18758                 nlmsg_free(msg);
18759                 return -ENOMEM;
18760         }
18761
18762         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18763             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18764                                         netdev->ifindex)) ||
18765             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18766                               NL80211_ATTR_PAD) ||
18767             (info->have_link_id &&
18768              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18769             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18770             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18771             (info->sig_dbm &&
18772              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18773             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18774             (info->flags &&
18775              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18776             (info->rx_tstamp && nla_put_u64_64bit(msg,
18777                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
18778                                                   info->rx_tstamp,
18779                                                   NL80211_ATTR_PAD)) ||
18780             (info->ack_tstamp && nla_put_u64_64bit(msg,
18781                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
18782                                                    info->ack_tstamp,
18783                                                    NL80211_ATTR_PAD)))
18784                 goto nla_put_failure;
18785
18786         genlmsg_end(msg, hdr);
18787
18788         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18789
18790  nla_put_failure:
18791         nlmsg_free(msg);
18792         return -ENOBUFS;
18793 }
18794
18795 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18796                                     struct cfg80211_tx_status *status,
18797                                     gfp_t gfp, enum nl80211_commands command)
18798 {
18799         struct wiphy *wiphy = wdev->wiphy;
18800         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18801         struct net_device *netdev = wdev->netdev;
18802         struct sk_buff *msg;
18803         void *hdr;
18804
18805         if (command == NL80211_CMD_FRAME_TX_STATUS)
18806                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18807                                               status->ack);
18808         else
18809                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18810                                                       status->ack);
18811
18812         msg = nlmsg_new(100 + status->len, gfp);
18813         if (!msg)
18814                 return;
18815
18816         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18817         if (!hdr) {
18818                 nlmsg_free(msg);
18819                 return;
18820         }
18821
18822         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18823             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18824                                    netdev->ifindex)) ||
18825             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18826                               NL80211_ATTR_PAD) ||
18827             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18828             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18829                               NL80211_ATTR_PAD) ||
18830             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18831             (status->tx_tstamp &&
18832              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18833                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
18834             (status->ack_tstamp &&
18835              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18836                                status->ack_tstamp, NL80211_ATTR_PAD)))
18837                 goto nla_put_failure;
18838
18839         genlmsg_end(msg, hdr);
18840
18841         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18842                                 NL80211_MCGRP_MLME, gfp);
18843         return;
18844
18845 nla_put_failure:
18846         nlmsg_free(msg);
18847 }
18848
18849 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18850                                      const u8 *buf, size_t len, bool ack,
18851                                      gfp_t gfp)
18852 {
18853         struct cfg80211_tx_status status = {
18854                 .cookie = cookie,
18855                 .buf = buf,
18856                 .len = len,
18857                 .ack = ack
18858         };
18859
18860         nl80211_frame_tx_status(wdev, &status, gfp,
18861                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18862 }
18863 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18864
18865 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18866                                  struct cfg80211_tx_status *status, gfp_t gfp)
18867 {
18868         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18869 }
18870 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18871
18872 static int __nl80211_rx_control_port(struct net_device *dev,
18873                                      struct sk_buff *skb,
18874                                      bool unencrypted,
18875                                      int link_id,
18876                                      gfp_t gfp)
18877 {
18878         struct wireless_dev *wdev = dev->ieee80211_ptr;
18879         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18880         struct ethhdr *ehdr = eth_hdr(skb);
18881         const u8 *addr = ehdr->h_source;
18882         u16 proto = be16_to_cpu(skb->protocol);
18883         struct sk_buff *msg;
18884         void *hdr;
18885         struct nlattr *frame;
18886
18887         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18888
18889         if (!nlportid)
18890                 return -ENOENT;
18891
18892         msg = nlmsg_new(100 + skb->len, gfp);
18893         if (!msg)
18894                 return -ENOMEM;
18895
18896         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18897         if (!hdr) {
18898                 nlmsg_free(msg);
18899                 return -ENOBUFS;
18900         }
18901
18902         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18903             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18904             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18905                               NL80211_ATTR_PAD) ||
18906             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18907             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18908             (link_id >= 0 &&
18909              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
18910             (unencrypted && nla_put_flag(msg,
18911                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18912                 goto nla_put_failure;
18913
18914         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18915         if (!frame)
18916                 goto nla_put_failure;
18917
18918         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18919         genlmsg_end(msg, hdr);
18920
18921         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18922
18923  nla_put_failure:
18924         nlmsg_free(msg);
18925         return -ENOBUFS;
18926 }
18927
18928 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
18929                               bool unencrypted, int link_id)
18930 {
18931         int ret;
18932
18933         trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
18934         ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
18935                                         GFP_ATOMIC);
18936         trace_cfg80211_return_bool(ret == 0);
18937         return ret == 0;
18938 }
18939 EXPORT_SYMBOL(cfg80211_rx_control_port);
18940
18941 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
18942                                             const char *mac, gfp_t gfp)
18943 {
18944         struct wireless_dev *wdev = dev->ieee80211_ptr;
18945         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18946         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18947         void **cb;
18948
18949         if (!msg)
18950                 return NULL;
18951
18952         cb = (void **)msg->cb;
18953
18954         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
18955         if (!cb[0]) {
18956                 nlmsg_free(msg);
18957                 return NULL;
18958         }
18959
18960         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18961             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18962                 goto nla_put_failure;
18963
18964         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18965                 goto nla_put_failure;
18966
18967         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
18968         if (!cb[1])
18969                 goto nla_put_failure;
18970
18971         cb[2] = rdev;
18972
18973         return msg;
18974  nla_put_failure:
18975         nlmsg_free(msg);
18976         return NULL;
18977 }
18978
18979 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
18980 {
18981         void **cb = (void **)msg->cb;
18982         struct cfg80211_registered_device *rdev = cb[2];
18983
18984         nla_nest_end(msg, cb[1]);
18985         genlmsg_end(msg, cb[0]);
18986
18987         memset(msg->cb, 0, sizeof(msg->cb));
18988
18989         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18990                                 NL80211_MCGRP_MLME, gfp);
18991 }
18992
18993 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18994                               enum nl80211_cqm_rssi_threshold_event rssi_event,
18995                               s32 rssi_level, gfp_t gfp)
18996 {
18997         struct wireless_dev *wdev = dev->ieee80211_ptr;
18998         struct cfg80211_cqm_config *cqm_config;
18999
19000         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19001
19002         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19003                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19004                 return;
19005
19006         rcu_read_lock();
19007         cqm_config = rcu_dereference(wdev->cqm_config);
19008         if (cqm_config) {
19009                 cqm_config->last_rssi_event_value = rssi_level;
19010                 cqm_config->last_rssi_event_type = rssi_event;
19011                 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
19012         }
19013         rcu_read_unlock();
19014 }
19015 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19016
19017 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
19018 {
19019         struct wireless_dev *wdev = container_of(work, struct wireless_dev,
19020                                                  cqm_rssi_work);
19021         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19022         enum nl80211_cqm_rssi_threshold_event rssi_event;
19023         struct cfg80211_cqm_config *cqm_config;
19024         struct sk_buff *msg;
19025         s32 rssi_level;
19026
19027         cqm_config = wiphy_dereference(wdev->wiphy, wdev->cqm_config);
19028         if (!cqm_config)
19029                 return;
19030
19031         if (cqm_config->use_range_api)
19032                 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
19033
19034         rssi_level = cqm_config->last_rssi_event_value;
19035         rssi_event = cqm_config->last_rssi_event_type;
19036
19037         msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
19038         if (!msg)
19039                 return;
19040
19041         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19042                         rssi_event))
19043                 goto nla_put_failure;
19044
19045         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19046                                       rssi_level))
19047                 goto nla_put_failure;
19048
19049         cfg80211_send_cqm(msg, GFP_KERNEL);
19050
19051         return;
19052
19053  nla_put_failure:
19054         nlmsg_free(msg);
19055 }
19056
19057 void cfg80211_cqm_txe_notify(struct net_device *dev,
19058                              const u8 *peer, u32 num_packets,
19059                              u32 rate, u32 intvl, gfp_t gfp)
19060 {
19061         struct sk_buff *msg;
19062
19063         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19064         if (!msg)
19065                 return;
19066
19067         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19068                 goto nla_put_failure;
19069
19070         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19071                 goto nla_put_failure;
19072
19073         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19074                 goto nla_put_failure;
19075
19076         cfg80211_send_cqm(msg, gfp);
19077         return;
19078
19079  nla_put_failure:
19080         nlmsg_free(msg);
19081 }
19082 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19083
19084 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19085                                  const u8 *peer, u32 num_packets, gfp_t gfp)
19086 {
19087         struct sk_buff *msg;
19088
19089         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19090
19091         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19092         if (!msg)
19093                 return;
19094
19095         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19096                 goto nla_put_failure;
19097
19098         cfg80211_send_cqm(msg, gfp);
19099         return;
19100
19101  nla_put_failure:
19102         nlmsg_free(msg);
19103 }
19104 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19105
19106 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19107 {
19108         struct sk_buff *msg;
19109
19110         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19111         if (!msg)
19112                 return;
19113
19114         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19115                 goto nla_put_failure;
19116
19117         cfg80211_send_cqm(msg, gfp);
19118         return;
19119
19120  nla_put_failure:
19121         nlmsg_free(msg);
19122 }
19123 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19124
19125 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19126                                      struct net_device *netdev, const u8 *bssid,
19127                                      const u8 *replay_ctr, gfp_t gfp)
19128 {
19129         struct sk_buff *msg;
19130         struct nlattr *rekey_attr;
19131         void *hdr;
19132
19133         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19134         if (!msg)
19135                 return;
19136
19137         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19138         if (!hdr) {
19139                 nlmsg_free(msg);
19140                 return;
19141         }
19142
19143         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19144             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19145             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19146                 goto nla_put_failure;
19147
19148         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19149         if (!rekey_attr)
19150                 goto nla_put_failure;
19151
19152         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19153                     NL80211_REPLAY_CTR_LEN, replay_ctr))
19154                 goto nla_put_failure;
19155
19156         nla_nest_end(msg, rekey_attr);
19157
19158         genlmsg_end(msg, hdr);
19159
19160         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19161                                 NL80211_MCGRP_MLME, gfp);
19162         return;
19163
19164  nla_put_failure:
19165         nlmsg_free(msg);
19166 }
19167
19168 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19169                                const u8 *replay_ctr, gfp_t gfp)
19170 {
19171         struct wireless_dev *wdev = dev->ieee80211_ptr;
19172         struct wiphy *wiphy = wdev->wiphy;
19173         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19174
19175         trace_cfg80211_gtk_rekey_notify(dev, bssid);
19176         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19177 }
19178 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19179
19180 static void
19181 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19182                                struct net_device *netdev, int index,
19183                                const u8 *bssid, bool preauth, gfp_t gfp)
19184 {
19185         struct sk_buff *msg;
19186         struct nlattr *attr;
19187         void *hdr;
19188
19189         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19190         if (!msg)
19191                 return;
19192
19193         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19194         if (!hdr) {
19195                 nlmsg_free(msg);
19196                 return;
19197         }
19198
19199         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19200             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19201                 goto nla_put_failure;
19202
19203         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19204         if (!attr)
19205                 goto nla_put_failure;
19206
19207         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19208             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19209             (preauth &&
19210              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19211                 goto nla_put_failure;
19212
19213         nla_nest_end(msg, attr);
19214
19215         genlmsg_end(msg, hdr);
19216
19217         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19218                                 NL80211_MCGRP_MLME, gfp);
19219         return;
19220
19221  nla_put_failure:
19222         nlmsg_free(msg);
19223 }
19224
19225 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19226                                      const u8 *bssid, bool preauth, gfp_t gfp)
19227 {
19228         struct wireless_dev *wdev = dev->ieee80211_ptr;
19229         struct wiphy *wiphy = wdev->wiphy;
19230         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19231
19232         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19233         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19234 }
19235 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19236
19237 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19238                                      struct net_device *netdev,
19239                                      unsigned int link_id,
19240                                      struct cfg80211_chan_def *chandef,
19241                                      gfp_t gfp,
19242                                      enum nl80211_commands notif,
19243                                      u8 count, bool quiet, u16 punct_bitmap)
19244 {
19245         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19246         struct sk_buff *msg;
19247         void *hdr;
19248
19249         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19250         if (!msg)
19251                 return;
19252
19253         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19254         if (!hdr) {
19255                 nlmsg_free(msg);
19256                 return;
19257         }
19258
19259         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19260                 goto nla_put_failure;
19261
19262         if (wdev->valid_links &&
19263             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19264                 goto nla_put_failure;
19265
19266         if (nl80211_send_chandef(msg, chandef))
19267                 goto nla_put_failure;
19268
19269         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19270                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19271                         goto nla_put_failure;
19272                 if (quiet &&
19273                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19274                         goto nla_put_failure;
19275         }
19276
19277         if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19278                 goto nla_put_failure;
19279
19280         genlmsg_end(msg, hdr);
19281
19282         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19283                                 NL80211_MCGRP_MLME, gfp);
19284         return;
19285
19286  nla_put_failure:
19287         nlmsg_free(msg);
19288 }
19289
19290 void cfg80211_ch_switch_notify(struct net_device *dev,
19291                                struct cfg80211_chan_def *chandef,
19292                                unsigned int link_id, u16 punct_bitmap)
19293 {
19294         struct wireless_dev *wdev = dev->ieee80211_ptr;
19295         struct wiphy *wiphy = wdev->wiphy;
19296         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19297
19298         lockdep_assert_wiphy(wdev->wiphy);
19299         WARN_INVALID_LINK_ID(wdev, link_id);
19300
19301         trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19302
19303         switch (wdev->iftype) {
19304         case NL80211_IFTYPE_STATION:
19305         case NL80211_IFTYPE_P2P_CLIENT:
19306                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19307                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19308                                                         chandef->chan);
19309                 break;
19310         case NL80211_IFTYPE_MESH_POINT:
19311                 wdev->u.mesh.chandef = *chandef;
19312                 wdev->u.mesh.preset_chandef = *chandef;
19313                 break;
19314         case NL80211_IFTYPE_AP:
19315         case NL80211_IFTYPE_P2P_GO:
19316                 wdev->links[link_id].ap.chandef = *chandef;
19317                 break;
19318         case NL80211_IFTYPE_ADHOC:
19319                 wdev->u.ibss.chandef = *chandef;
19320                 break;
19321         default:
19322                 WARN_ON(1);
19323                 break;
19324         }
19325
19326         cfg80211_sched_dfs_chan_update(rdev);
19327
19328         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19329                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19330                                  punct_bitmap);
19331 }
19332 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19333
19334 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19335                                        struct cfg80211_chan_def *chandef,
19336                                        unsigned int link_id, u8 count,
19337                                        bool quiet, u16 punct_bitmap)
19338 {
19339         struct wireless_dev *wdev = dev->ieee80211_ptr;
19340         struct wiphy *wiphy = wdev->wiphy;
19341         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19342
19343         lockdep_assert_wiphy(wdev->wiphy);
19344         WARN_INVALID_LINK_ID(wdev, link_id);
19345
19346         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19347                                                 punct_bitmap);
19348
19349
19350         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19351                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19352                                  count, quiet, punct_bitmap);
19353 }
19354 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19355
19356 int cfg80211_bss_color_notify(struct net_device *dev,
19357                               enum nl80211_commands cmd, u8 count,
19358                               u64 color_bitmap)
19359 {
19360         struct wireless_dev *wdev = dev->ieee80211_ptr;
19361         struct wiphy *wiphy = wdev->wiphy;
19362         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19363         struct sk_buff *msg;
19364         void *hdr;
19365
19366         lockdep_assert_wiphy(wdev->wiphy);
19367
19368         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19369
19370         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19371         if (!msg)
19372                 return -ENOMEM;
19373
19374         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19375         if (!hdr)
19376                 goto nla_put_failure;
19377
19378         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19379                 goto nla_put_failure;
19380
19381         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19382             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19383                 goto nla_put_failure;
19384
19385         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19386             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19387                               color_bitmap, NL80211_ATTR_PAD))
19388                 goto nla_put_failure;
19389
19390         genlmsg_end(msg, hdr);
19391
19392         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19393                                        msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19394
19395 nla_put_failure:
19396         nlmsg_free(msg);
19397         return -EINVAL;
19398 }
19399 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19400
19401 void
19402 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19403                      const struct cfg80211_chan_def *chandef,
19404                      enum nl80211_radar_event event,
19405                      struct net_device *netdev, gfp_t gfp)
19406 {
19407         struct sk_buff *msg;
19408         void *hdr;
19409
19410         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19411         if (!msg)
19412                 return;
19413
19414         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19415         if (!hdr) {
19416                 nlmsg_free(msg);
19417                 return;
19418         }
19419
19420         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19421                 goto nla_put_failure;
19422
19423         /* NOP and radar events don't need a netdev parameter */
19424         if (netdev) {
19425                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19426
19427                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19428                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19429                                       NL80211_ATTR_PAD))
19430                         goto nla_put_failure;
19431         }
19432
19433         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19434                 goto nla_put_failure;
19435
19436         if (nl80211_send_chandef(msg, chandef))
19437                 goto nla_put_failure;
19438
19439         genlmsg_end(msg, hdr);
19440
19441         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19442                                 NL80211_MCGRP_MLME, gfp);
19443         return;
19444
19445  nla_put_failure:
19446         nlmsg_free(msg);
19447 }
19448
19449 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19450                                        struct sta_opmode_info *sta_opmode,
19451                                        gfp_t gfp)
19452 {
19453         struct sk_buff *msg;
19454         struct wireless_dev *wdev = dev->ieee80211_ptr;
19455         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19456         void *hdr;
19457
19458         if (WARN_ON(!mac))
19459                 return;
19460
19461         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19462         if (!msg)
19463                 return;
19464
19465         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19466         if (!hdr) {
19467                 nlmsg_free(msg);
19468                 return;
19469         }
19470
19471         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19472                 goto nla_put_failure;
19473
19474         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19475                 goto nla_put_failure;
19476
19477         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19478                 goto nla_put_failure;
19479
19480         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19481             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19482                 goto nla_put_failure;
19483
19484         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19485             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19486                 goto nla_put_failure;
19487
19488         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19489             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19490                 goto nla_put_failure;
19491
19492         genlmsg_end(msg, hdr);
19493
19494         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19495                                 NL80211_MCGRP_MLME, gfp);
19496
19497         return;
19498
19499 nla_put_failure:
19500         nlmsg_free(msg);
19501 }
19502 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19503
19504 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19505                            u64 cookie, bool acked, s32 ack_signal,
19506                            bool is_valid_ack_signal, gfp_t gfp)
19507 {
19508         struct wireless_dev *wdev = dev->ieee80211_ptr;
19509         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19510         struct sk_buff *msg;
19511         void *hdr;
19512
19513         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19514
19515         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19516
19517         if (!msg)
19518                 return;
19519
19520         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19521         if (!hdr) {
19522                 nlmsg_free(msg);
19523                 return;
19524         }
19525
19526         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19527             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19528             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19529             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19530                               NL80211_ATTR_PAD) ||
19531             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19532             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19533                                                 ack_signal)))
19534                 goto nla_put_failure;
19535
19536         genlmsg_end(msg, hdr);
19537
19538         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19539                                 NL80211_MCGRP_MLME, gfp);
19540         return;
19541
19542  nla_put_failure:
19543         nlmsg_free(msg);
19544 }
19545 EXPORT_SYMBOL(cfg80211_probe_status);
19546
19547 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19548                                      size_t len, int freq, int sig_dbm)
19549 {
19550         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19551         struct sk_buff *msg;
19552         void *hdr;
19553         struct cfg80211_beacon_registration *reg;
19554
19555         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19556
19557         spin_lock_bh(&rdev->beacon_registrations_lock);
19558         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19559                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19560                 if (!msg) {
19561                         spin_unlock_bh(&rdev->beacon_registrations_lock);
19562                         return;
19563                 }
19564
19565                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19566                 if (!hdr)
19567                         goto nla_put_failure;
19568
19569                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19570                     (freq &&
19571                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19572                                   KHZ_TO_MHZ(freq)) ||
19573                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19574                                   freq % 1000))) ||
19575                     (sig_dbm &&
19576                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19577                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19578                         goto nla_put_failure;
19579
19580                 genlmsg_end(msg, hdr);
19581
19582                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19583         }
19584         spin_unlock_bh(&rdev->beacon_registrations_lock);
19585         return;
19586
19587  nla_put_failure:
19588         spin_unlock_bh(&rdev->beacon_registrations_lock);
19589         nlmsg_free(msg);
19590 }
19591 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19592
19593 #ifdef CONFIG_PM
19594 static int cfg80211_net_detect_results(struct sk_buff *msg,
19595                                        struct cfg80211_wowlan_wakeup *wakeup)
19596 {
19597         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19598         struct nlattr *nl_results, *nl_match, *nl_freqs;
19599         int i, j;
19600
19601         nl_results = nla_nest_start_noflag(msg,
19602                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19603         if (!nl_results)
19604                 return -EMSGSIZE;
19605
19606         for (i = 0; i < nd->n_matches; i++) {
19607                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19608
19609                 nl_match = nla_nest_start_noflag(msg, i);
19610                 if (!nl_match)
19611                         break;
19612
19613                 /* The SSID attribute is optional in nl80211, but for
19614                  * simplicity reasons it's always present in the
19615                  * cfg80211 structure.  If a driver can't pass the
19616                  * SSID, that needs to be changed.  A zero length SSID
19617                  * is still a valid SSID (wildcard), so it cannot be
19618                  * used for this purpose.
19619                  */
19620                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19621                             match->ssid.ssid)) {
19622                         nla_nest_cancel(msg, nl_match);
19623                         goto out;
19624                 }
19625
19626                 if (match->n_channels) {
19627                         nl_freqs = nla_nest_start_noflag(msg,
19628                                                          NL80211_ATTR_SCAN_FREQUENCIES);
19629                         if (!nl_freqs) {
19630                                 nla_nest_cancel(msg, nl_match);
19631                                 goto out;
19632                         }
19633
19634                         for (j = 0; j < match->n_channels; j++) {
19635                                 if (nla_put_u32(msg, j, match->channels[j])) {
19636                                         nla_nest_cancel(msg, nl_freqs);
19637                                         nla_nest_cancel(msg, nl_match);
19638                                         goto out;
19639                                 }
19640                         }
19641
19642                         nla_nest_end(msg, nl_freqs);
19643                 }
19644
19645                 nla_nest_end(msg, nl_match);
19646         }
19647
19648 out:
19649         nla_nest_end(msg, nl_results);
19650         return 0;
19651 }
19652
19653 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19654                                    struct cfg80211_wowlan_wakeup *wakeup,
19655                                    gfp_t gfp)
19656 {
19657         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19658         struct sk_buff *msg;
19659         void *hdr;
19660         int size = 200;
19661
19662         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19663
19664         if (wakeup)
19665                 size += wakeup->packet_present_len;
19666
19667         msg = nlmsg_new(size, gfp);
19668         if (!msg)
19669                 return;
19670
19671         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19672         if (!hdr)
19673                 goto free_msg;
19674
19675         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19676             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19677                               NL80211_ATTR_PAD))
19678                 goto free_msg;
19679
19680         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19681                                         wdev->netdev->ifindex))
19682                 goto free_msg;
19683
19684         if (wakeup) {
19685                 struct nlattr *reasons;
19686
19687                 reasons = nla_nest_start_noflag(msg,
19688                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
19689                 if (!reasons)
19690                         goto free_msg;
19691
19692                 if (wakeup->disconnect &&
19693                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19694                         goto free_msg;
19695                 if (wakeup->magic_pkt &&
19696                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19697                         goto free_msg;
19698                 if (wakeup->gtk_rekey_failure &&
19699                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19700                         goto free_msg;
19701                 if (wakeup->eap_identity_req &&
19702                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19703                         goto free_msg;
19704                 if (wakeup->four_way_handshake &&
19705                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19706                         goto free_msg;
19707                 if (wakeup->rfkill_release &&
19708                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19709                         goto free_msg;
19710
19711                 if (wakeup->pattern_idx >= 0 &&
19712                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19713                                 wakeup->pattern_idx))
19714                         goto free_msg;
19715
19716                 if (wakeup->tcp_match &&
19717                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19718                         goto free_msg;
19719
19720                 if (wakeup->tcp_connlost &&
19721                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19722                         goto free_msg;
19723
19724                 if (wakeup->tcp_nomoretokens &&
19725                     nla_put_flag(msg,
19726                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19727                         goto free_msg;
19728
19729                 if (wakeup->packet) {
19730                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19731                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19732
19733                         if (!wakeup->packet_80211) {
19734                                 pkt_attr =
19735                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19736                                 len_attr =
19737                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19738                         }
19739
19740                         if (wakeup->packet_len &&
19741                             nla_put_u32(msg, len_attr, wakeup->packet_len))
19742                                 goto free_msg;
19743
19744                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19745                                     wakeup->packet))
19746                                 goto free_msg;
19747                 }
19748
19749                 if (wakeup->net_detect &&
19750                     cfg80211_net_detect_results(msg, wakeup))
19751                                 goto free_msg;
19752
19753                 nla_nest_end(msg, reasons);
19754         }
19755
19756         genlmsg_end(msg, hdr);
19757
19758         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19759                                 NL80211_MCGRP_MLME, gfp);
19760         return;
19761
19762  free_msg:
19763         nlmsg_free(msg);
19764 }
19765 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19766 #endif
19767
19768 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19769                                 enum nl80211_tdls_operation oper,
19770                                 u16 reason_code, gfp_t gfp)
19771 {
19772         struct wireless_dev *wdev = dev->ieee80211_ptr;
19773         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19774         struct sk_buff *msg;
19775         void *hdr;
19776
19777         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19778                                          reason_code);
19779
19780         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19781         if (!msg)
19782                 return;
19783
19784         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19785         if (!hdr) {
19786                 nlmsg_free(msg);
19787                 return;
19788         }
19789
19790         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19791             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19792             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19793             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19794             (reason_code > 0 &&
19795              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19796                 goto nla_put_failure;
19797
19798         genlmsg_end(msg, hdr);
19799
19800         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19801                                 NL80211_MCGRP_MLME, gfp);
19802         return;
19803
19804  nla_put_failure:
19805         nlmsg_free(msg);
19806 }
19807 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19808
19809 static int nl80211_netlink_notify(struct notifier_block * nb,
19810                                   unsigned long state,
19811                                   void *_notify)
19812 {
19813         struct netlink_notify *notify = _notify;
19814         struct cfg80211_registered_device *rdev;
19815         struct wireless_dev *wdev;
19816         struct cfg80211_beacon_registration *reg, *tmp;
19817
19818         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19819                 return NOTIFY_DONE;
19820
19821         rcu_read_lock();
19822
19823         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19824                 struct cfg80211_sched_scan_request *sched_scan_req;
19825
19826                 list_for_each_entry_rcu(sched_scan_req,
19827                                         &rdev->sched_scan_req_list,
19828                                         list) {
19829                         if (sched_scan_req->owner_nlportid == notify->portid) {
19830                                 sched_scan_req->nl_owner_dead = true;
19831                                 wiphy_work_queue(&rdev->wiphy,
19832                                                  &rdev->sched_scan_stop_wk);
19833                         }
19834                 }
19835
19836                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19837                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
19838
19839                         if (wdev->owner_nlportid == notify->portid) {
19840                                 wdev->nl_owner_dead = true;
19841                                 schedule_work(&rdev->destroy_work);
19842                         } else if (wdev->conn_owner_nlportid == notify->portid) {
19843                                 schedule_work(&wdev->disconnect_wk);
19844                         }
19845
19846                         cfg80211_release_pmsr(wdev, notify->portid);
19847                 }
19848
19849                 spin_lock_bh(&rdev->beacon_registrations_lock);
19850                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19851                                          list) {
19852                         if (reg->nlportid == notify->portid) {
19853                                 list_del(&reg->list);
19854                                 kfree(reg);
19855                                 break;
19856                         }
19857                 }
19858                 spin_unlock_bh(&rdev->beacon_registrations_lock);
19859         }
19860
19861         rcu_read_unlock();
19862
19863         /*
19864          * It is possible that the user space process that is controlling the
19865          * indoor setting disappeared, so notify the regulatory core.
19866          */
19867         regulatory_netlink_notify(notify->portid);
19868         return NOTIFY_OK;
19869 }
19870
19871 static struct notifier_block nl80211_netlink_notifier = {
19872         .notifier_call = nl80211_netlink_notify,
19873 };
19874
19875 void cfg80211_ft_event(struct net_device *netdev,
19876                        struct cfg80211_ft_event_params *ft_event)
19877 {
19878         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19879         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19880         struct sk_buff *msg;
19881         void *hdr;
19882
19883         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19884
19885         if (!ft_event->target_ap)
19886                 return;
19887
19888         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19889                         GFP_KERNEL);
19890         if (!msg)
19891                 return;
19892
19893         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19894         if (!hdr)
19895                 goto out;
19896
19897         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19898             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19899             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19900                 goto out;
19901
19902         if (ft_event->ies &&
19903             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19904                 goto out;
19905         if (ft_event->ric_ies &&
19906             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19907                     ft_event->ric_ies))
19908                 goto out;
19909
19910         genlmsg_end(msg, hdr);
19911
19912         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19913                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19914         return;
19915  out:
19916         nlmsg_free(msg);
19917 }
19918 EXPORT_SYMBOL(cfg80211_ft_event);
19919
19920 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19921 {
19922         struct cfg80211_registered_device *rdev;
19923         struct sk_buff *msg;
19924         void *hdr;
19925         u32 nlportid;
19926
19927         rdev = wiphy_to_rdev(wdev->wiphy);
19928         if (!rdev->crit_proto_nlportid)
19929                 return;
19930
19931         nlportid = rdev->crit_proto_nlportid;
19932         rdev->crit_proto_nlportid = 0;
19933
19934         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19935         if (!msg)
19936                 return;
19937
19938         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19939         if (!hdr)
19940                 goto nla_put_failure;
19941
19942         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19943             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19944                               NL80211_ATTR_PAD))
19945                 goto nla_put_failure;
19946
19947         genlmsg_end(msg, hdr);
19948
19949         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19950         return;
19951
19952  nla_put_failure:
19953         nlmsg_free(msg);
19954 }
19955 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
19956
19957 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
19958 {
19959         struct wiphy *wiphy = wdev->wiphy;
19960         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19961         struct sk_buff *msg;
19962         void *hdr;
19963
19964         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19965         if (!msg)
19966                 return;
19967
19968         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
19969         if (!hdr)
19970                 goto out;
19971
19972         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19973             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
19974             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19975                               NL80211_ATTR_PAD) ||
19976             (wdev->valid_links &&
19977              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
19978                 goto out;
19979
19980         genlmsg_end(msg, hdr);
19981
19982         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
19983                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19984         return;
19985  out:
19986         nlmsg_free(msg);
19987 }
19988
19989 int cfg80211_external_auth_request(struct net_device *dev,
19990                                    struct cfg80211_external_auth_params *params,
19991                                    gfp_t gfp)
19992 {
19993         struct wireless_dev *wdev = dev->ieee80211_ptr;
19994         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19995         struct sk_buff *msg;
19996         void *hdr;
19997
19998         if (!wdev->conn_owner_nlportid)
19999                 return -EINVAL;
20000
20001         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20002         if (!msg)
20003                 return -ENOMEM;
20004
20005         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20006         if (!hdr)
20007                 goto nla_put_failure;
20008
20009         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20010             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20011             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
20012             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20013                         params->action) ||
20014             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20015             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20016                     params->ssid.ssid) ||
20017             (!is_zero_ether_addr(params->mld_addr) &&
20018              nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20019                 goto nla_put_failure;
20020
20021         genlmsg_end(msg, hdr);
20022         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20023                         wdev->conn_owner_nlportid);
20024         return 0;
20025
20026  nla_put_failure:
20027         nlmsg_free(msg);
20028         return -ENOBUFS;
20029 }
20030 EXPORT_SYMBOL(cfg80211_external_auth_request);
20031
20032 void cfg80211_update_owe_info_event(struct net_device *netdev,
20033                                     struct cfg80211_update_owe_info *owe_info,
20034                                     gfp_t gfp)
20035 {
20036         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20037         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20038         struct sk_buff *msg;
20039         void *hdr;
20040
20041         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20042
20043         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20044         if (!msg)
20045                 return;
20046
20047         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20048         if (!hdr)
20049                 goto nla_put_failure;
20050
20051         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20052             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20053             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20054                 goto nla_put_failure;
20055
20056         if (!owe_info->ie_len ||
20057             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20058                 goto nla_put_failure;
20059
20060         if (owe_info->assoc_link_id != -1) {
20061                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20062                                owe_info->assoc_link_id))
20063                         goto nla_put_failure;
20064
20065                 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20066                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20067                             owe_info->peer_mld_addr))
20068                         goto nla_put_failure;
20069         }
20070
20071         genlmsg_end(msg, hdr);
20072
20073         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20074                                 NL80211_MCGRP_MLME, gfp);
20075         return;
20076
20077 nla_put_failure:
20078         genlmsg_cancel(msg, hdr);
20079         nlmsg_free(msg);
20080 }
20081 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20082
20083 /* initialisation/exit functions */
20084
20085 int __init nl80211_init(void)
20086 {
20087         int err;
20088
20089         err = genl_register_family(&nl80211_fam);
20090         if (err)
20091                 return err;
20092
20093         err = netlink_register_notifier(&nl80211_netlink_notifier);
20094         if (err)
20095                 goto err_out;
20096
20097         return 0;
20098  err_out:
20099         genl_unregister_family(&nl80211_fam);
20100         return err;
20101 }
20102
20103 void nl80211_exit(void)
20104 {
20105         netlink_unregister_notifier(&nl80211_netlink_notifier);
20106         genl_unregister_family(&nl80211_fam);
20107 }