net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2021 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 /* policy for the attributes */
 289 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 290
 291 static const struct nla_policy
 292 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 293         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 294         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 295                                         .len = U8_MAX },
 296         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 297                                              .len = U8_MAX },
 298 };
 299
 300 static const struct nla_policy
 301 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 302         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 303         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 304         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 305                 NLA_POLICY_MAX(NLA_U8, 15),
 306         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 307         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 308                 NLA_POLICY_MAX(NLA_U8, 15),
 309         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 310                 NLA_POLICY_MAX(NLA_U8, 31),
 311         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 312         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 313         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 314         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 315         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 316         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 317 };
 318
 319 static const struct nla_policy
 320 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 321         [NL80211_PMSR_TYPE_FTM] =
 322                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 323 };
 324
 325 static const struct nla_policy
 326 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 327         [NL80211_PMSR_REQ_ATTR_DATA] =
 328                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 329         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 330 };
 331
 332 static const struct nla_policy
 333 nl80211_psmr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 334         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 335         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 336         [NL80211_PMSR_PEER_ATTR_REQ] =
 337                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 338         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 339 };
 340
 341 static const struct nla_policy
 342 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 343         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 344         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 345         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 346         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 347         [NL80211_PMSR_ATTR_PEERS] =
 348                 NLA_POLICY_NESTED_ARRAY(nl80211_psmr_peer_attr_policy),
 349 };
 350
 351 static const struct nla_policy
 352 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 353         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 354                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 355         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 356                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 357         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 358                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 359         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 360                 NLA_POLICY_EXACT_LEN(8),
 361         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 362                 NLA_POLICY_EXACT_LEN(8),
 363         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 364 };
 365
 366 static const struct nla_policy
 367 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 368         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 369         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 370         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 371 };
 372
 373 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 374         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 375                                     .len = NL80211_MAX_SUPP_RATES },
 376         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 377                                 .len = NL80211_MAX_SUPP_HT_RATES },
 378         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 379         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 380         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 381         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 382                                                    NL80211_RATE_INFO_HE_GI_0_8,
 383                                                    NL80211_RATE_INFO_HE_GI_3_2),
 384         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 385                                                    NL80211_RATE_INFO_HE_1XLTF,
 386                                                    NL80211_RATE_INFO_HE_4XLTF),
 387 };
 388
 389 static const struct nla_policy
 390 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 391         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 392         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 393         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 394         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 395         [NL80211_TID_CONFIG_ATTR_NOACK] =
 396                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 397         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 398         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 399         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 400                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 401         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 402                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 403         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 404                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 405         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 406                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 407         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 408                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 409 };
 410
 411 static const struct nla_policy
 412 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 413         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 414         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 415         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 416                         NLA_POLICY_RANGE(NLA_BINARY,
 417                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 418                                          IEEE80211_MAX_DATA_LEN),
 419 };
 420
 421 static const struct nla_policy
 422 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 423         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 424         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 425                                                        .len = IEEE80211_MAX_DATA_LEN }
 426 };
 427
 428 static const struct nla_policy
 429 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 430         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 431         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 432 };
 433
 434 static const struct nla_policy
 435 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 436         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 437         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 438 };
 439
 440 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 441         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 442         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 443         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 444                                       .len = 20-1 },
 445         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 446
 447         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 448         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 449         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 450                                                 NL80211_EDMG_CHANNELS_MIN,
 451                                                 NL80211_EDMG_CHANNELS_MAX),
 452         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 453                                                 NL80211_EDMG_BW_CONFIG_MIN,
 454                                                 NL80211_EDMG_BW_CONFIG_MAX),
 455
 456         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 457         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 458         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 459         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 460
 461         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 462         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 463         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 464         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 465         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 466         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 467
 468         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 469         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 470         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 471
 472         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 473         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 474
 475         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 476         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 477                                     .len = WLAN_MAX_KEY_LEN },
 478         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 479         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 480         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 481         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 482         [NL80211_ATTR_KEY_TYPE] =
 483                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 484
 485         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 486         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 487         [NL80211_ATTR_BEACON_HEAD] =
 488                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 489                                        IEEE80211_MAX_DATA_LEN),
 490         [NL80211_ATTR_BEACON_TAIL] =
 491                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 492                                        IEEE80211_MAX_DATA_LEN),
 493         [NL80211_ATTR_STA_AID] =
 494                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 495         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 496         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 497         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 498                                                .len = NL80211_MAX_SUPP_RATES },
 499         [NL80211_ATTR_STA_PLINK_ACTION] =
 500                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 501         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 502                 NLA_POLICY_RANGE(NLA_U8,
 503                                  NL80211_TX_POWER_AUTOMATIC,
 504                                  NL80211_TX_POWER_FIXED),
 505         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 506         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 507         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 508         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 509                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 510         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 511
 512         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 513         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 514
 515         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 516         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 517         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 518         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 519                                            .len = NL80211_MAX_SUPP_RATES },
 520         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 521
 522         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 523         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 524
 525         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 526
 527         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 528         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 529                                                    validate_ie_attr,
 530                                                    IEEE80211_MAX_DATA_LEN),
 531         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 532         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 533
 534         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 535                                 .len = IEEE80211_MAX_SSID_LEN },
 536         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 537         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 538         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 539         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 540         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 541                                                   NL80211_MFP_NO,
 542                                                   NL80211_MFP_OPTIONAL),
 543         [NL80211_ATTR_STA_FLAGS2] = {
 544                 .len = sizeof(struct nl80211_sta_flag_update),
 545         },
 546         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 547         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 548         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 549         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 550         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 551         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 552         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 553         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 554         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 555         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 556         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 557         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 558         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 559         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 560         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 561                                  .len = IEEE80211_MAX_DATA_LEN },
 562         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 563         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 564                                                    NL80211_PS_DISABLED,
 565                                                    NL80211_PS_ENABLED),
 566         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 567         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 568         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 569         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 570         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 571         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 572         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 573         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 574         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 575         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 576         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 577         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 578         [NL80211_ATTR_STA_PLINK_STATE] =
 579                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 580         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 581         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 582         [NL80211_ATTR_MESH_PEER_AID] =
 583                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 584         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 585         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 586         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 587         [NL80211_ATTR_HIDDEN_SSID] =
 588                 NLA_POLICY_RANGE(NLA_U32,
 589                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 590                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 591         [NL80211_ATTR_IE_PROBE_RESP] =
 592                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 593                                        IEEE80211_MAX_DATA_LEN),
 594         [NL80211_ATTR_IE_ASSOC_RESP] =
 595                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 596                                        IEEE80211_MAX_DATA_LEN),
 597         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 598         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 599         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 600         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 601         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 602         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 603         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 604         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 605         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 606         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 607         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 608                                       .len = IEEE80211_MAX_DATA_LEN },
 609         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 610         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 611         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 612                 .len = NL80211_HT_CAPABILITY_LEN
 613         },
 614         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 615         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 616         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 617         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 618         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 619
 620         /* need to include at least Auth Transaction and Status Code */
 621         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 622
 623         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 624         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 625         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 626         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 627         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 628                 NLA_POLICY_RANGE(NLA_U32,
 629                                  NL80211_MESH_POWER_UNKNOWN + 1,
 630                                  NL80211_MESH_POWER_MAX),
 631         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 632         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 633         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 634         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 635         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 636         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 637         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 638                 .len = NL80211_VHT_CAPABILITY_LEN,
 639         },
 640         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 641         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 642                                   .len = IEEE80211_MAX_DATA_LEN },
 643         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 644         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 645                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 646         [NL80211_ATTR_PEER_AID] =
 647                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 648         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 649         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 650         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 651         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 652         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 653         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 654         /*
 655          * The value of the Length field of the Supported Operating
 656          * Classes element is between 2 and 253.
 657          */
 658         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 659                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 660         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 661         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 662         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 663         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 664         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 665         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 666                                                   IEEE80211_QOS_MAP_LEN_MIN,
 667                                                   IEEE80211_QOS_MAP_LEN_MAX),
 668         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 669         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 670         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 671         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 672         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 673         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 674         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 675         [NL80211_ATTR_USER_PRIO] =
 676                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 677         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 678         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 679         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 680         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 681         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 682         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 683         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 684         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 685         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 686         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 687         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 688                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 689         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 690                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 691         },
 692         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 693         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 694         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 695         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 696         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 697                                     .len = FILS_MAX_KEK_LEN },
 698         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 699         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 700         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 701         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 702         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 703                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 704         },
 705         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 706         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 707                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 708         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 709                                           .len = FILS_ERP_MAX_REALM_LEN },
 710         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 711         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 712                                         .len = FILS_ERP_MAX_RRK_LEN },
 713         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 714         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 715         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 716         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 717         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 718
 719         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 720         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 721         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 722         [NL80211_ATTR_HE_CAPABILITY] =
 723                 NLA_POLICY_RANGE(NLA_BINARY,
 724                                  NL80211_HE_MIN_CAPABILITY_LEN,
 725                                  NL80211_HE_MAX_CAPABILITY_LEN),
 726         [NL80211_ATTR_FTM_RESPONDER] =
 727                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 728         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 729         [NL80211_ATTR_PEER_MEASUREMENTS] =
 730                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 731         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 732         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 733                                         .len = SAE_PASSWORD_MAX_LEN },
 734         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 735         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 736         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 737         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 738         [NL80211_ATTR_TID_CONFIG] =
 739                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 740         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 741         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 742         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 743         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 744         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 745         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 746         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 747                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 748         [NL80211_ATTR_FILS_DISCOVERY] =
 749                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 750         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 751                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 752         [NL80211_ATTR_S1G_CAPABILITY] =
 753                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 754         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 755                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 756         [NL80211_ATTR_SAE_PWE] =
 757                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 758                                  NL80211_SAE_PWE_BOTH),
 759         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 760         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 761         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 762 };
 763
 764 /* policy for the key attributes */
 765 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 766         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 767         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 768         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 769         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 770         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 771         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 772         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 773         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 774         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 775 };
 776
 777 /* policy for the key default flags */
 778 static const struct nla_policy
 779 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 780         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 781         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 782 };
 783
 784 #ifdef CONFIG_PM
 785 /* policy for WoWLAN attributes */
 786 static const struct nla_policy
 787 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 788         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 789         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 790         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 791         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 792         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 793         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 794         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 795         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 796         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 797         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 798 };
 799
 800 static const struct nla_policy
 801 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 802         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 803         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 804         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 805         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 806         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 807         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 808         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 809                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 810         },
 811         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 812                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 813         },
 814         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 815         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 816         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 817 };
 818 #endif /* CONFIG_PM */
 819
 820 /* policy for coalesce rule attributes */
 821 static const struct nla_policy
 822 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 823         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 824         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 825                 NLA_POLICY_RANGE(NLA_U32,
 826                                  NL80211_COALESCE_CONDITION_MATCH,
 827                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 828         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 829 };
 830
 831 /* policy for GTK rekey offload attributes */
 832 static const struct nla_policy
 833 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 834         [NL80211_REKEY_DATA_KEK] = {
 835                 .type = NLA_BINARY,
 836                 .len = NL80211_KEK_EXT_LEN
 837         },
 838         [NL80211_REKEY_DATA_KCK] = {
 839                 .type = NLA_BINARY,
 840                 .len = NL80211_KCK_EXT_LEN
 841         },
 842         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 843         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 844 };
 845
 846 static const struct nla_policy
 847 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 848         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 849         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 850         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 851         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 852 };
 853
 854 static const struct nla_policy
 855 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 856         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 857                                                  .len = IEEE80211_MAX_SSID_LEN },
 858         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 859         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 860         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 861                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 862 };
 863
 864 static const struct nla_policy
 865 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 866         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 867         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 868 };
 869
 870 static const struct nla_policy
 871 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 872         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 873         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 874         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 875                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 876         },
 877 };
 878
 879 /* policy for NAN function attributes */
 880 static const struct nla_policy
 881 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 882         [NL80211_NAN_FUNC_TYPE] =
 883                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 884         [NL80211_NAN_FUNC_SERVICE_ID] = {
 885                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 886         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 887         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 888         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 889         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 890         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 891         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 892         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 893         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 894         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 895                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 896         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 897         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 898         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 899         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 900         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 901 };
 902
 903 /* policy for Service Response Filter attributes */
 904 static const struct nla_policy
 905 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 906         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 907         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 908                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 909         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 910         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 911 };
 912
 913 /* policy for packet pattern attributes */
 914 static const struct nla_policy
 915 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 916         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 917         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 918         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 919 };
 920
 921 int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 922                               struct cfg80211_registered_device **rdev,
 923                               struct wireless_dev **wdev)
 924 {
 925         int err;
 926
 927         if (!cb->args[0]) {
 928                 struct nlattr **attrbuf;
 929
 930                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 931                                   GFP_KERNEL);
 932                 if (!attrbuf)
 933                         return -ENOMEM;
 934
 935                 err = nlmsg_parse_deprecated(cb->nlh,
 936                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 937                                              attrbuf, nl80211_fam.maxattr,
 938                                              nl80211_policy, NULL);
 939                 if (err) {
 940                         kfree(attrbuf);
 941                         return err;
 942                 }
 943
 944                 rtnl_lock();
 945                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
 946                                                    attrbuf);
 947                 kfree(attrbuf);
 948                 if (IS_ERR(*wdev)) {
 949                         rtnl_unlock();
 950                         return PTR_ERR(*wdev);
 951                 }
 952                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 953                 mutex_lock(&(*rdev)->wiphy.mtx);
 954                 rtnl_unlock();
 955                 /* 0 is the first index - add 1 to parse only once */
 956                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 957                 cb->args[1] = (*wdev)->identifier;
 958         } else {
 959                 /* subtract the 1 again here */
 960                 struct wiphy *wiphy;
 961                 struct wireless_dev *tmp;
 962
 963                 rtnl_lock();
 964                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 965                 if (!wiphy) {
 966                         rtnl_unlock();
 967                         return -ENODEV;
 968                 }
 969                 *rdev = wiphy_to_rdev(wiphy);
 970                 *wdev = NULL;
 971
 972                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 973                         if (tmp->identifier == cb->args[1]) {
 974                                 *wdev = tmp;
 975                                 break;
 976                         }
 977                 }
 978
 979                 if (!*wdev) {
 980                         rtnl_unlock();
 981                         return -ENODEV;
 982                 }
 983                 mutex_lock(&(*rdev)->wiphy.mtx);
 984                 rtnl_unlock();
 985         }
 986
 987         return 0;
 988 }
 989
 990 /* message building helper */
 991 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 992                      int flags, u8 cmd)
 993 {
 994         /* since there is no private header just add the generic one */
 995         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 996 }
 997
 998 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 999                                      const struct ieee80211_reg_rule *rule)
1000 {
1001         int j;
1002         struct nlattr *nl_wmm_rules =
1003                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1004
1005         if (!nl_wmm_rules)
1006                 goto nla_put_failure;
1007
1008         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1009                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1010
1011                 if (!nl_wmm_rule)
1012                         goto nla_put_failure;
1013
1014                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1015                                 rule->wmm_rule.client[j].cw_min) ||
1016                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1017                                 rule->wmm_rule.client[j].cw_max) ||
1018                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1019                                rule->wmm_rule.client[j].aifsn) ||
1020                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1021                                 rule->wmm_rule.client[j].cot))
1022                         goto nla_put_failure;
1023
1024                 nla_nest_end(msg, nl_wmm_rule);
1025         }
1026         nla_nest_end(msg, nl_wmm_rules);
1027
1028         return 0;
1029
1030 nla_put_failure:
1031         return -ENOBUFS;
1032 }
1033
1034 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1035                                    struct ieee80211_channel *chan,
1036                                    bool large)
1037 {
1038         /* Some channels must be completely excluded from the
1039          * list to protect old user-space tools from breaking
1040          */
1041         if (!large && chan->flags &
1042             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1043                 return 0;
1044         if (!large && chan->freq_offset)
1045                 return 0;
1046
1047         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1048                         chan->center_freq))
1049                 goto nla_put_failure;
1050
1051         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1052                 goto nla_put_failure;
1053
1054         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1055             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1056                 goto nla_put_failure;
1057         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1058                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1059                         goto nla_put_failure;
1060                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1061                         goto nla_put_failure;
1062         }
1063         if (chan->flags & IEEE80211_CHAN_RADAR) {
1064                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1065                         goto nla_put_failure;
1066                 if (large) {
1067                         u32 time;
1068
1069                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1070
1071                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1072                                         chan->dfs_state))
1073                                 goto nla_put_failure;
1074                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1075                                         time))
1076                                 goto nla_put_failure;
1077                         if (nla_put_u32(msg,
1078                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1079                                         chan->dfs_cac_ms))
1080                                 goto nla_put_failure;
1081                 }
1082         }
1083
1084         if (large) {
1085                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1086                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1087                         goto nla_put_failure;
1088                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1089                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1090                         goto nla_put_failure;
1091                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1092                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1093                         goto nla_put_failure;
1094                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1095                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1096                         goto nla_put_failure;
1097                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1098                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1099                         goto nla_put_failure;
1100                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1101                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1102                         goto nla_put_failure;
1103                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1104                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1105                         goto nla_put_failure;
1106                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1107                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1108                         goto nla_put_failure;
1109                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1110                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1111                         goto nla_put_failure;
1112                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1113                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1114                         goto nla_put_failure;
1115                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1116                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1117                         goto nla_put_failure;
1118                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1119                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1120                         goto nla_put_failure;
1121                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1122                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1123                         goto nla_put_failure;
1124                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1125                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1126                         goto nla_put_failure;
1127         }
1128
1129         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1130                         DBM_TO_MBM(chan->max_power)))
1131                 goto nla_put_failure;
1132
1133         if (large) {
1134                 const struct ieee80211_reg_rule *rule =
1135                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1136
1137                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1138                         if (nl80211_msg_put_wmm_rules(msg, rule))
1139                                 goto nla_put_failure;
1140                 }
1141         }
1142
1143         return 0;
1144
1145  nla_put_failure:
1146         return -ENOBUFS;
1147 }
1148
1149 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1150                                   struct cfg80211_txq_stats *txqstats,
1151                                   int attrtype)
1152 {
1153         struct nlattr *txqattr;
1154
1155 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1156         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1157             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1158                 return false;                                             \
1159         } while (0)
1160
1161         txqattr = nla_nest_start_noflag(msg, attrtype);
1162         if (!txqattr)
1163                 return false;
1164
1165         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1166         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1167         PUT_TXQVAL_U32(FLOWS, flows);
1168         PUT_TXQVAL_U32(DROPS, drops);
1169         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1170         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1171         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1172         PUT_TXQVAL_U32(COLLISIONS, collisions);
1173         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1174         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1175         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1176         nla_nest_end(msg, txqattr);
1177
1178 #undef PUT_TXQVAL_U32
1179         return true;
1180 }
1181
1182 /* netlink command implementations */
1183
1184 struct key_parse {
1185         struct key_params p;
1186         int idx;
1187         int type;
1188         bool def, defmgmt, defbeacon;
1189         bool def_uni, def_multi;
1190 };
1191
1192 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1193                                  struct key_parse *k)
1194 {
1195         struct nlattr *tb[NL80211_KEY_MAX + 1];
1196         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1197                                               nl80211_key_policy,
1198                                               info->extack);
1199         if (err)
1200                 return err;
1201
1202         k->def = !!tb[NL80211_KEY_DEFAULT];
1203         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1204         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1205
1206         if (k->def) {
1207                 k->def_uni = true;
1208                 k->def_multi = true;
1209         }
1210         if (k->defmgmt || k->defbeacon)
1211                 k->def_multi = true;
1212
1213         if (tb[NL80211_KEY_IDX])
1214                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1215
1216         if (tb[NL80211_KEY_DATA]) {
1217                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1218                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1219         }
1220
1221         if (tb[NL80211_KEY_SEQ]) {
1222                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1223                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1224         }
1225
1226         if (tb[NL80211_KEY_CIPHER])
1227                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1228
1229         if (tb[NL80211_KEY_TYPE])
1230                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1231
1232         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1233                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1234
1235                 err = nla_parse_nested_deprecated(kdt,
1236                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1237                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1238                                                   nl80211_key_default_policy,
1239                                                   info->extack);
1240                 if (err)
1241                         return err;
1242
1243                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1244                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1245         }
1246
1247         if (tb[NL80211_KEY_MODE])
1248                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1249
1250         return 0;
1251 }
1252
1253 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1254 {
1255         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1256                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1257                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1258         }
1259
1260         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1261                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1262                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1263         }
1264
1265         if (info->attrs[NL80211_ATTR_KEY_IDX])
1266                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1267
1268         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1269                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1270
1271         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1272         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1273
1274         if (k->def) {
1275                 k->def_uni = true;
1276                 k->def_multi = true;
1277         }
1278         if (k->defmgmt)
1279                 k->def_multi = true;
1280
1281         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1282                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1283
1284         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1285                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1286                 int err = nla_parse_nested_deprecated(kdt,
1287                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1288                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1289                                                       nl80211_key_default_policy,
1290                                                       info->extack);
1291                 if (err)
1292                         return err;
1293
1294                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1295                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1296         }
1297
1298         return 0;
1299 }
1300
1301 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1302 {
1303         int err;
1304
1305         memset(k, 0, sizeof(*k));
1306         k->idx = -1;
1307         k->type = -1;
1308
1309         if (info->attrs[NL80211_ATTR_KEY])
1310                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1311         else
1312                 err = nl80211_parse_key_old(info, k);
1313
1314         if (err)
1315                 return err;
1316
1317         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1318             (k->defbeacon ? 1 : 0) > 1) {
1319                 GENL_SET_ERR_MSG(info,
1320                                  "key with multiple default flags is invalid");
1321                 return -EINVAL;
1322         }
1323
1324         if (k->defmgmt || k->defbeacon) {
1325                 if (k->def_uni || !k->def_multi) {
1326                         GENL_SET_ERR_MSG(info,
1327                                          "defmgmt/defbeacon key must be mcast");
1328                         return -EINVAL;
1329                 }
1330         }
1331
1332         if (k->idx != -1) {
1333                 if (k->defmgmt) {
1334                         if (k->idx < 4 || k->idx > 5) {
1335                                 GENL_SET_ERR_MSG(info,
1336                                                  "defmgmt key idx not 4 or 5");
1337                                 return -EINVAL;
1338                         }
1339                 } else if (k->defbeacon) {
1340                         if (k->idx < 6 || k->idx > 7) {
1341                                 GENL_SET_ERR_MSG(info,
1342                                                  "defbeacon key idx not 6 or 7");
1343                                 return -EINVAL;
1344                         }
1345                 } else if (k->def) {
1346                         if (k->idx < 0 || k->idx > 3) {
1347                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1348                                 return -EINVAL;
1349                         }
1350                 } else {
1351                         if (k->idx < 0 || k->idx > 7) {
1352                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1353                                 return -EINVAL;
1354                         }
1355                 }
1356         }
1357
1358         return 0;
1359 }
1360
1361 static struct cfg80211_cached_keys *
1362 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1363                        struct genl_info *info, bool *no_ht)
1364 {
1365         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1366         struct key_parse parse;
1367         struct nlattr *key;
1368         struct cfg80211_cached_keys *result;
1369         int rem, err, def = 0;
1370         bool have_key = false;
1371
1372         nla_for_each_nested(key, keys, rem) {
1373                 have_key = true;
1374                 break;
1375         }
1376
1377         if (!have_key)
1378                 return NULL;
1379
1380         result = kzalloc(sizeof(*result), GFP_KERNEL);
1381         if (!result)
1382                 return ERR_PTR(-ENOMEM);
1383
1384         result->def = -1;
1385
1386         nla_for_each_nested(key, keys, rem) {
1387                 memset(&parse, 0, sizeof(parse));
1388                 parse.idx = -1;
1389
1390                 err = nl80211_parse_key_new(info, key, &parse);
1391                 if (err)
1392                         goto error;
1393                 err = -EINVAL;
1394                 if (!parse.p.key)
1395                         goto error;
1396                 if (parse.idx < 0 || parse.idx > 3) {
1397                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1398                         goto error;
1399                 }
1400                 if (parse.def) {
1401                         if (def) {
1402                                 GENL_SET_ERR_MSG(info,
1403                                                  "only one key can be default");
1404                                 goto error;
1405                         }
1406                         def = 1;
1407                         result->def = parse.idx;
1408                         if (!parse.def_uni || !parse.def_multi)
1409                                 goto error;
1410                 } else if (parse.defmgmt)
1411                         goto error;
1412                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1413                                                      parse.idx, false, NULL);
1414                 if (err)
1415                         goto error;
1416                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1417                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1418                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1419                         err = -EINVAL;
1420                         goto error;
1421                 }
1422                 result->params[parse.idx].cipher = parse.p.cipher;
1423                 result->params[parse.idx].key_len = parse.p.key_len;
1424                 result->params[parse.idx].key = result->data[parse.idx];
1425                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1426
1427                 /* must be WEP key if we got here */
1428                 if (no_ht)
1429                         *no_ht = true;
1430         }
1431
1432         if (result->def < 0) {
1433                 err = -EINVAL;
1434                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1435                 goto error;
1436         }
1437
1438         return result;
1439  error:
1440         kfree(result);
1441         return ERR_PTR(err);
1442 }
1443
1444 static int nl80211_key_allowed(struct wireless_dev *wdev)
1445 {
1446         ASSERT_WDEV_LOCK(wdev);
1447
1448         switch (wdev->iftype) {
1449         case NL80211_IFTYPE_AP:
1450         case NL80211_IFTYPE_AP_VLAN:
1451         case NL80211_IFTYPE_P2P_GO:
1452         case NL80211_IFTYPE_MESH_POINT:
1453                 break;
1454         case NL80211_IFTYPE_ADHOC:
1455         case NL80211_IFTYPE_STATION:
1456         case NL80211_IFTYPE_P2P_CLIENT:
1457                 if (!wdev->current_bss)
1458                         return -ENOLINK;
1459                 break;
1460         case NL80211_IFTYPE_UNSPECIFIED:
1461         case NL80211_IFTYPE_OCB:
1462         case NL80211_IFTYPE_MONITOR:
1463         case NL80211_IFTYPE_NAN:
1464         case NL80211_IFTYPE_P2P_DEVICE:
1465         case NL80211_IFTYPE_WDS:
1466         case NUM_NL80211_IFTYPES:
1467                 return -EINVAL;
1468         }
1469
1470         return 0;
1471 }
1472
1473 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1474                                                         u32 freq)
1475 {
1476         struct ieee80211_channel *chan;
1477
1478         chan = ieee80211_get_channel_khz(wiphy, freq);
1479         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1480                 return NULL;
1481         return chan;
1482 }
1483
1484 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1485 {
1486         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1487         int i;
1488
1489         if (!nl_modes)
1490                 goto nla_put_failure;
1491
1492         i = 0;
1493         while (ifmodes) {
1494                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1495                         goto nla_put_failure;
1496                 ifmodes >>= 1;
1497                 i++;
1498         }
1499
1500         nla_nest_end(msg, nl_modes);
1501         return 0;
1502
1503 nla_put_failure:
1504         return -ENOBUFS;
1505 }
1506
1507 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1508                                           struct sk_buff *msg,
1509                                           bool large)
1510 {
1511         struct nlattr *nl_combis;
1512         int i, j;
1513
1514         nl_combis = nla_nest_start_noflag(msg,
1515                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1516         if (!nl_combis)
1517                 goto nla_put_failure;
1518
1519         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1520                 const struct ieee80211_iface_combination *c;
1521                 struct nlattr *nl_combi, *nl_limits;
1522
1523                 c = &wiphy->iface_combinations[i];
1524
1525                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1526                 if (!nl_combi)
1527                         goto nla_put_failure;
1528
1529                 nl_limits = nla_nest_start_noflag(msg,
1530                                                   NL80211_IFACE_COMB_LIMITS);
1531                 if (!nl_limits)
1532                         goto nla_put_failure;
1533
1534                 for (j = 0; j < c->n_limits; j++) {
1535                         struct nlattr *nl_limit;
1536
1537                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1538                         if (!nl_limit)
1539                                 goto nla_put_failure;
1540                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1541                                         c->limits[j].max))
1542                                 goto nla_put_failure;
1543                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1544                                                 c->limits[j].types))
1545                                 goto nla_put_failure;
1546                         nla_nest_end(msg, nl_limit);
1547                 }
1548
1549                 nla_nest_end(msg, nl_limits);
1550
1551                 if (c->beacon_int_infra_match &&
1552                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1553                         goto nla_put_failure;
1554                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1555                                 c->num_different_channels) ||
1556                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1557                                 c->max_interfaces))
1558                         goto nla_put_failure;
1559                 if (large &&
1560                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1561                                 c->radar_detect_widths) ||
1562                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1563                                 c->radar_detect_regions)))
1564                         goto nla_put_failure;
1565                 if (c->beacon_int_min_gcd &&
1566                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1567                                 c->beacon_int_min_gcd))
1568                         goto nla_put_failure;
1569
1570                 nla_nest_end(msg, nl_combi);
1571         }
1572
1573         nla_nest_end(msg, nl_combis);
1574
1575         return 0;
1576 nla_put_failure:
1577         return -ENOBUFS;
1578 }
1579
1580 #ifdef CONFIG_PM
1581 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1582                                         struct sk_buff *msg)
1583 {
1584         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1585         struct nlattr *nl_tcp;
1586
1587         if (!tcp)
1588                 return 0;
1589
1590         nl_tcp = nla_nest_start_noflag(msg,
1591                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1592         if (!nl_tcp)
1593                 return -ENOBUFS;
1594
1595         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1596                         tcp->data_payload_max))
1597                 return -ENOBUFS;
1598
1599         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1600                         tcp->data_payload_max))
1601                 return -ENOBUFS;
1602
1603         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1604                 return -ENOBUFS;
1605
1606         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1607                                 sizeof(*tcp->tok), tcp->tok))
1608                 return -ENOBUFS;
1609
1610         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1611                         tcp->data_interval_max))
1612                 return -ENOBUFS;
1613
1614         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1615                         tcp->wake_payload_max))
1616                 return -ENOBUFS;
1617
1618         nla_nest_end(msg, nl_tcp);
1619         return 0;
1620 }
1621
1622 static int nl80211_send_wowlan(struct sk_buff *msg,
1623                                struct cfg80211_registered_device *rdev,
1624                                bool large)
1625 {
1626         struct nlattr *nl_wowlan;
1627
1628         if (!rdev->wiphy.wowlan)
1629                 return 0;
1630
1631         nl_wowlan = nla_nest_start_noflag(msg,
1632                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1633         if (!nl_wowlan)
1634                 return -ENOBUFS;
1635
1636         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1637              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1638             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1639              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1640             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1641              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1642             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1643              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1644             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1645              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1646             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1647              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1648             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1649              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1650             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1651              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1652                 return -ENOBUFS;
1653
1654         if (rdev->wiphy.wowlan->n_patterns) {
1655                 struct nl80211_pattern_support pat = {
1656                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1657                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1658                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1659                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1660                 };
1661
1662                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1663                             sizeof(pat), &pat))
1664                         return -ENOBUFS;
1665         }
1666
1667         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1668             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1669                         rdev->wiphy.wowlan->max_nd_match_sets))
1670                 return -ENOBUFS;
1671
1672         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1673                 return -ENOBUFS;
1674
1675         nla_nest_end(msg, nl_wowlan);
1676
1677         return 0;
1678 }
1679 #endif
1680
1681 static int nl80211_send_coalesce(struct sk_buff *msg,
1682                                  struct cfg80211_registered_device *rdev)
1683 {
1684         struct nl80211_coalesce_rule_support rule;
1685
1686         if (!rdev->wiphy.coalesce)
1687                 return 0;
1688
1689         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1690         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1691         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1692         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1693         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1694         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1695
1696         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1697                 return -ENOBUFS;
1698
1699         return 0;
1700 }
1701
1702 static int
1703 nl80211_send_iftype_data(struct sk_buff *msg,
1704                          const struct ieee80211_supported_band *sband,
1705                          const struct ieee80211_sband_iftype_data *iftdata)
1706 {
1707         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1708
1709         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1710                                 iftdata->types_mask))
1711                 return -ENOBUFS;
1712
1713         if (he_cap->has_he) {
1714                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1715                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1716                             he_cap->he_cap_elem.mac_cap_info) ||
1717                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1718                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1719                             he_cap->he_cap_elem.phy_cap_info) ||
1720                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1721                             sizeof(he_cap->he_mcs_nss_supp),
1722                             &he_cap->he_mcs_nss_supp) ||
1723                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1724                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1725                         return -ENOBUFS;
1726         }
1727
1728         if (sband->band == NL80211_BAND_6GHZ &&
1729             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1730                     sizeof(iftdata->he_6ghz_capa),
1731                     &iftdata->he_6ghz_capa))
1732                 return -ENOBUFS;
1733
1734         return 0;
1735 }
1736
1737 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1738                                       struct ieee80211_supported_band *sband,
1739                                       bool large)
1740 {
1741         struct nlattr *nl_rates, *nl_rate;
1742         struct ieee80211_rate *rate;
1743         int i;
1744
1745         /* add HT info */
1746         if (sband->ht_cap.ht_supported &&
1747             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1748                      sizeof(sband->ht_cap.mcs),
1749                      &sband->ht_cap.mcs) ||
1750              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1751                          sband->ht_cap.cap) ||
1752              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1753                         sband->ht_cap.ampdu_factor) ||
1754              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1755                         sband->ht_cap.ampdu_density)))
1756                 return -ENOBUFS;
1757
1758         /* add VHT info */
1759         if (sband->vht_cap.vht_supported &&
1760             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1761                      sizeof(sband->vht_cap.vht_mcs),
1762                      &sband->vht_cap.vht_mcs) ||
1763              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1764                          sband->vht_cap.cap)))
1765                 return -ENOBUFS;
1766
1767         if (large && sband->n_iftype_data) {
1768                 struct nlattr *nl_iftype_data =
1769                         nla_nest_start_noflag(msg,
1770                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1771                 int err;
1772
1773                 if (!nl_iftype_data)
1774                         return -ENOBUFS;
1775
1776                 for (i = 0; i < sband->n_iftype_data; i++) {
1777                         struct nlattr *iftdata;
1778
1779                         iftdata = nla_nest_start_noflag(msg, i + 1);
1780                         if (!iftdata)
1781                                 return -ENOBUFS;
1782
1783                         err = nl80211_send_iftype_data(msg, sband,
1784                                                        &sband->iftype_data[i]);
1785                         if (err)
1786                                 return err;
1787
1788                         nla_nest_end(msg, iftdata);
1789                 }
1790
1791                 nla_nest_end(msg, nl_iftype_data);
1792         }
1793
1794         /* add EDMG info */
1795         if (large && sband->edmg_cap.channels &&
1796             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1797                        sband->edmg_cap.channels) ||
1798             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1799                        sband->edmg_cap.bw_config)))
1800
1801                 return -ENOBUFS;
1802
1803         /* add bitrates */
1804         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1805         if (!nl_rates)
1806                 return -ENOBUFS;
1807
1808         for (i = 0; i < sband->n_bitrates; i++) {
1809                 nl_rate = nla_nest_start_noflag(msg, i);
1810                 if (!nl_rate)
1811                         return -ENOBUFS;
1812
1813                 rate = &sband->bitrates[i];
1814                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1815                                 rate->bitrate))
1816                         return -ENOBUFS;
1817                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1818                     nla_put_flag(msg,
1819                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1820                         return -ENOBUFS;
1821
1822                 nla_nest_end(msg, nl_rate);
1823         }
1824
1825         nla_nest_end(msg, nl_rates);
1826
1827         return 0;
1828 }
1829
1830 static int
1831 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1832                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1833 {
1834         u16 stypes;
1835         struct nlattr *nl_ftypes, *nl_ifs;
1836         enum nl80211_iftype ift;
1837         int i;
1838
1839         if (!mgmt_stypes)
1840                 return 0;
1841
1842         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1843         if (!nl_ifs)
1844                 return -ENOBUFS;
1845
1846         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1847                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1848                 if (!nl_ftypes)
1849                         return -ENOBUFS;
1850                 i = 0;
1851                 stypes = mgmt_stypes[ift].tx;
1852                 while (stypes) {
1853                         if ((stypes & 1) &&
1854                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1855                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1856                                 return -ENOBUFS;
1857                         stypes >>= 1;
1858                         i++;
1859                 }
1860                 nla_nest_end(msg, nl_ftypes);
1861         }
1862
1863         nla_nest_end(msg, nl_ifs);
1864
1865         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1866         if (!nl_ifs)
1867                 return -ENOBUFS;
1868
1869         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1870                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1871                 if (!nl_ftypes)
1872                         return -ENOBUFS;
1873                 i = 0;
1874                 stypes = mgmt_stypes[ift].rx;
1875                 while (stypes) {
1876                         if ((stypes & 1) &&
1877                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1878                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1879                                 return -ENOBUFS;
1880                         stypes >>= 1;
1881                         i++;
1882                 }
1883                 nla_nest_end(msg, nl_ftypes);
1884         }
1885         nla_nest_end(msg, nl_ifs);
1886
1887         return 0;
1888 }
1889
1890 #define CMD(op, n)                                                      \
1891          do {                                                           \
1892                 if (rdev->ops->op) {                                    \
1893                         i++;                                            \
1894                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1895                                 goto nla_put_failure;                   \
1896                 }                                                       \
1897         } while (0)
1898
1899 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1900                                         struct sk_buff *msg)
1901 {
1902         int i = 0;
1903
1904         /*
1905          * do *NOT* add anything into this function, new things need to be
1906          * advertised only to new versions of userspace that can deal with
1907          * the split (and they can't possibly care about new features...
1908          */
1909         CMD(add_virtual_intf, NEW_INTERFACE);
1910         CMD(change_virtual_intf, SET_INTERFACE);
1911         CMD(add_key, NEW_KEY);
1912         CMD(start_ap, START_AP);
1913         CMD(add_station, NEW_STATION);
1914         CMD(add_mpath, NEW_MPATH);
1915         CMD(update_mesh_config, SET_MESH_CONFIG);
1916         CMD(change_bss, SET_BSS);
1917         CMD(auth, AUTHENTICATE);
1918         CMD(assoc, ASSOCIATE);
1919         CMD(deauth, DEAUTHENTICATE);
1920         CMD(disassoc, DISASSOCIATE);
1921         CMD(join_ibss, JOIN_IBSS);
1922         CMD(join_mesh, JOIN_MESH);
1923         CMD(set_pmksa, SET_PMKSA);
1924         CMD(del_pmksa, DEL_PMKSA);
1925         CMD(flush_pmksa, FLUSH_PMKSA);
1926         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1927                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1928         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1929         CMD(mgmt_tx, FRAME);
1930         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1931         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1932                 i++;
1933                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1934                         goto nla_put_failure;
1935         }
1936         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1937             rdev->ops->join_mesh) {
1938                 i++;
1939                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1940                         goto nla_put_failure;
1941         }
1942         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1943                 CMD(tdls_mgmt, TDLS_MGMT);
1944                 CMD(tdls_oper, TDLS_OPER);
1945         }
1946         if (rdev->wiphy.max_sched_scan_reqs)
1947                 CMD(sched_scan_start, START_SCHED_SCAN);
1948         CMD(probe_client, PROBE_CLIENT);
1949         CMD(set_noack_map, SET_NOACK_MAP);
1950         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1951                 i++;
1952                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1953                         goto nla_put_failure;
1954         }
1955         CMD(start_p2p_device, START_P2P_DEVICE);
1956         CMD(set_mcast_rate, SET_MCAST_RATE);
1957 #ifdef CONFIG_NL80211_TESTMODE
1958         CMD(testmode_cmd, TESTMODE);
1959 #endif
1960
1961         if (rdev->ops->connect || rdev->ops->auth) {
1962                 i++;
1963                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1964                         goto nla_put_failure;
1965         }
1966
1967         if (rdev->ops->disconnect || rdev->ops->deauth) {
1968                 i++;
1969                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1970                         goto nla_put_failure;
1971         }
1972
1973         return i;
1974  nla_put_failure:
1975         return -ENOBUFS;
1976 }
1977
1978 static int
1979 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1980                            struct sk_buff *msg)
1981 {
1982         struct nlattr *ftm;
1983
1984         if (!cap->ftm.supported)
1985                 return 0;
1986
1987         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
1988         if (!ftm)
1989                 return -ENOBUFS;
1990
1991         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
1992                 return -ENOBUFS;
1993         if (cap->ftm.non_asap &&
1994             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
1995                 return -ENOBUFS;
1996         if (cap->ftm.request_lci &&
1997             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
1998                 return -ENOBUFS;
1999         if (cap->ftm.request_civicloc &&
2000             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2001                 return -ENOBUFS;
2002         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2003                         cap->ftm.preambles))
2004                 return -ENOBUFS;
2005         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2006                         cap->ftm.bandwidths))
2007                 return -ENOBUFS;
2008         if (cap->ftm.max_bursts_exponent >= 0 &&
2009             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2010                         cap->ftm.max_bursts_exponent))
2011                 return -ENOBUFS;
2012         if (cap->ftm.max_ftms_per_burst &&
2013             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2014                         cap->ftm.max_ftms_per_burst))
2015                 return -ENOBUFS;
2016         if (cap->ftm.trigger_based &&
2017             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2018                 return -ENOBUFS;
2019         if (cap->ftm.non_trigger_based &&
2020             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2021                 return -ENOBUFS;
2022
2023         nla_nest_end(msg, ftm);
2024         return 0;
2025 }
2026
2027 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2028                                   struct sk_buff *msg)
2029 {
2030         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2031         struct nlattr *pmsr, *caps;
2032
2033         if (!cap)
2034                 return 0;
2035
2036         /*
2037          * we don't need to clean up anything here since the caller
2038          * will genlmsg_cancel() if we fail
2039          */
2040
2041         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2042         if (!pmsr)
2043                 return -ENOBUFS;
2044
2045         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2046                 return -ENOBUFS;
2047
2048         if (cap->report_ap_tsf &&
2049             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2050                 return -ENOBUFS;
2051
2052         if (cap->randomize_mac_addr &&
2053             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2054                 return -ENOBUFS;
2055
2056         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2057         if (!caps)
2058                 return -ENOBUFS;
2059
2060         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2061                 return -ENOBUFS;
2062
2063         nla_nest_end(msg, caps);
2064         nla_nest_end(msg, pmsr);
2065
2066         return 0;
2067 }
2068
2069 static int
2070 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2071                               struct sk_buff *msg)
2072 {
2073         int i;
2074         struct nlattr *nested, *nested_akms;
2075         const struct wiphy_iftype_akm_suites *iftype_akms;
2076
2077         if (!rdev->wiphy.num_iftype_akm_suites ||
2078             !rdev->wiphy.iftype_akm_suites)
2079                 return 0;
2080
2081         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2082         if (!nested)
2083                 return -ENOBUFS;
2084
2085         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2086                 nested_akms = nla_nest_start(msg, i + 1);
2087                 if (!nested_akms)
2088                         return -ENOBUFS;
2089
2090                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2091
2092                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2093                                         iftype_akms->iftypes_mask))
2094                         return -ENOBUFS;
2095
2096                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2097                             sizeof(u32) * iftype_akms->n_akm_suites,
2098                             iftype_akms->akm_suites)) {
2099                         return -ENOBUFS;
2100                 }
2101                 nla_nest_end(msg, nested_akms);
2102         }
2103
2104         nla_nest_end(msg, nested);
2105
2106         return 0;
2107 }
2108
2109 static int
2110 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2111                                struct sk_buff *msg)
2112 {
2113         struct nlattr *supp;
2114
2115         if (!rdev->wiphy.tid_config_support.vif &&
2116             !rdev->wiphy.tid_config_support.peer)
2117                 return 0;
2118
2119         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2120         if (!supp)
2121                 return -ENOSPC;
2122
2123         if (rdev->wiphy.tid_config_support.vif &&
2124             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2125                               rdev->wiphy.tid_config_support.vif,
2126                               NL80211_TID_CONFIG_ATTR_PAD))
2127                 goto fail;
2128
2129         if (rdev->wiphy.tid_config_support.peer &&
2130             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2131                               rdev->wiphy.tid_config_support.peer,
2132                               NL80211_TID_CONFIG_ATTR_PAD))
2133                 goto fail;
2134
2135         /* for now we just use the same value ... makes more sense */
2136         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2137                        rdev->wiphy.tid_config_support.max_retry))
2138                 goto fail;
2139         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2140                        rdev->wiphy.tid_config_support.max_retry))
2141                 goto fail;
2142
2143         nla_nest_end(msg, supp);
2144
2145         return 0;
2146 fail:
2147         nla_nest_cancel(msg, supp);
2148         return -ENOBUFS;
2149 }
2150
2151 static int
2152 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2153                       struct sk_buff *msg)
2154 {
2155         struct nlattr *sar_capa, *specs, *sub_freq_range;
2156         u8 num_freq_ranges;
2157         int i;
2158
2159         if (!rdev->wiphy.sar_capa)
2160                 return 0;
2161
2162         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2163
2164         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2165         if (!sar_capa)
2166                 return -ENOSPC;
2167
2168         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2169                 goto fail;
2170
2171         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2172         if (!specs)
2173                 goto fail;
2174
2175         /* report supported freq_ranges */
2176         for (i = 0; i < num_freq_ranges; i++) {
2177                 sub_freq_range = nla_nest_start(msg, i + 1);
2178                 if (!sub_freq_range)
2179                         goto fail;
2180
2181                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2182                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2183                         goto fail;
2184
2185                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2186                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2187                         goto fail;
2188
2189                 nla_nest_end(msg, sub_freq_range);
2190         }
2191
2192         nla_nest_end(msg, specs);
2193         nla_nest_end(msg, sar_capa);
2194
2195         return 0;
2196 fail:
2197         nla_nest_cancel(msg, sar_capa);
2198         return -ENOBUFS;
2199 }
2200
2201 struct nl80211_dump_wiphy_state {
2202         s64 filter_wiphy;
2203         long start;
2204         long split_start, band_start, chan_start, capa_start;
2205         bool split;
2206 };
2207
2208 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2209                               enum nl80211_commands cmd,
2210                               struct sk_buff *msg, u32 portid, u32 seq,
2211                               int flags, struct nl80211_dump_wiphy_state *state)
2212 {
2213         void *hdr;
2214         struct nlattr *nl_bands, *nl_band;
2215         struct nlattr *nl_freqs, *nl_freq;
2216         struct nlattr *nl_cmds;
2217         enum nl80211_band band;
2218         struct ieee80211_channel *chan;
2219         int i;
2220         const struct ieee80211_txrx_stypes *mgmt_stypes =
2221                                 rdev->wiphy.mgmt_stypes;
2222         u32 features;
2223
2224         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2225         if (!hdr)
2226                 return -ENOBUFS;
2227
2228         if (WARN_ON(!state))
2229                 return -EINVAL;
2230
2231         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2232             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2233                            wiphy_name(&rdev->wiphy)) ||
2234             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2235                         cfg80211_rdev_list_generation))
2236                 goto nla_put_failure;
2237
2238         if (cmd != NL80211_CMD_NEW_WIPHY)
2239                 goto finish;
2240
2241         switch (state->split_start) {
2242         case 0:
2243                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2244                                rdev->wiphy.retry_short) ||
2245                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2246                                rdev->wiphy.retry_long) ||
2247                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2248                                 rdev->wiphy.frag_threshold) ||
2249                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2250                                 rdev->wiphy.rts_threshold) ||
2251                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2252                                rdev->wiphy.coverage_class) ||
2253                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2254                                rdev->wiphy.max_scan_ssids) ||
2255                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2256                                rdev->wiphy.max_sched_scan_ssids) ||
2257                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2258                                 rdev->wiphy.max_scan_ie_len) ||
2259                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2260                                 rdev->wiphy.max_sched_scan_ie_len) ||
2261                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2262                                rdev->wiphy.max_match_sets))
2263                         goto nla_put_failure;
2264
2265                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2266                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2267                         goto nla_put_failure;
2268                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2269                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2270                         goto nla_put_failure;
2271                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2272                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2273                         goto nla_put_failure;
2274                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2275                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2276                         goto nla_put_failure;
2277                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2278                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2279                         goto nla_put_failure;
2280                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2281                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2282                         goto nla_put_failure;
2283                 state->split_start++;
2284                 if (state->split)
2285                         break;
2286                 fallthrough;
2287         case 1:
2288                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2289                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2290                             rdev->wiphy.cipher_suites))
2291                         goto nla_put_failure;
2292
2293                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2294                                rdev->wiphy.max_num_pmkids))
2295                         goto nla_put_failure;
2296
2297                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2298                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2299                         goto nla_put_failure;
2300
2301                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2302                                 rdev->wiphy.available_antennas_tx) ||
2303                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2304                                 rdev->wiphy.available_antennas_rx))
2305                         goto nla_put_failure;
2306
2307                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2308                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2309                                 rdev->wiphy.probe_resp_offload))
2310                         goto nla_put_failure;
2311
2312                 if ((rdev->wiphy.available_antennas_tx ||
2313                      rdev->wiphy.available_antennas_rx) &&
2314                     rdev->ops->get_antenna) {
2315                         u32 tx_ant = 0, rx_ant = 0;
2316                         int res;
2317
2318                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2319                         if (!res) {
2320                                 if (nla_put_u32(msg,
2321                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2322                                                 tx_ant) ||
2323                                     nla_put_u32(msg,
2324                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2325                                                 rx_ant))
2326                                         goto nla_put_failure;
2327                         }
2328                 }
2329
2330                 state->split_start++;
2331                 if (state->split)
2332                         break;
2333                 fallthrough;
2334         case 2:
2335                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2336                                         rdev->wiphy.interface_modes))
2337                                 goto nla_put_failure;
2338                 state->split_start++;
2339                 if (state->split)
2340                         break;
2341                 fallthrough;
2342         case 3:
2343                 nl_bands = nla_nest_start_noflag(msg,
2344                                                  NL80211_ATTR_WIPHY_BANDS);
2345                 if (!nl_bands)
2346                         goto nla_put_failure;
2347
2348                 for (band = state->band_start;
2349                      band < NUM_NL80211_BANDS; band++) {
2350                         struct ieee80211_supported_band *sband;
2351
2352                         /* omit higher bands for ancient software */
2353                         if (band > NL80211_BAND_5GHZ && !state->split)
2354                                 break;
2355
2356                         sband = rdev->wiphy.bands[band];
2357
2358                         if (!sband)
2359                                 continue;
2360
2361                         nl_band = nla_nest_start_noflag(msg, band);
2362                         if (!nl_band)
2363                                 goto nla_put_failure;
2364
2365                         switch (state->chan_start) {
2366                         case 0:
2367                                 if (nl80211_send_band_rateinfo(msg, sband,
2368                                                                state->split))
2369                                         goto nla_put_failure;
2370                                 state->chan_start++;
2371                                 if (state->split)
2372                                         break;
2373                                 fallthrough;
2374                         default:
2375                                 /* add frequencies */
2376                                 nl_freqs = nla_nest_start_noflag(msg,
2377                                                                  NL80211_BAND_ATTR_FREQS);
2378                                 if (!nl_freqs)
2379                                         goto nla_put_failure;
2380
2381                                 for (i = state->chan_start - 1;
2382                                      i < sband->n_channels;
2383                                      i++) {
2384                                         nl_freq = nla_nest_start_noflag(msg,
2385                                                                         i);
2386                                         if (!nl_freq)
2387                                                 goto nla_put_failure;
2388
2389                                         chan = &sband->channels[i];
2390
2391                                         if (nl80211_msg_put_channel(
2392                                                         msg, &rdev->wiphy, chan,
2393                                                         state->split))
2394                                                 goto nla_put_failure;
2395
2396                                         nla_nest_end(msg, nl_freq);
2397                                         if (state->split)
2398                                                 break;
2399                                 }
2400                                 if (i < sband->n_channels)
2401                                         state->chan_start = i + 2;
2402                                 else
2403                                         state->chan_start = 0;
2404                                 nla_nest_end(msg, nl_freqs);
2405                         }
2406
2407                         nla_nest_end(msg, nl_band);
2408
2409                         if (state->split) {
2410                                 /* start again here */
2411                                 if (state->chan_start)
2412                                         band--;
2413                                 break;
2414                         }
2415                 }
2416                 nla_nest_end(msg, nl_bands);
2417
2418                 if (band < NUM_NL80211_BANDS)
2419                         state->band_start = band + 1;
2420                 else
2421                         state->band_start = 0;
2422
2423                 /* if bands & channels are done, continue outside */
2424                 if (state->band_start == 0 && state->chan_start == 0)
2425                         state->split_start++;
2426                 if (state->split)
2427                         break;
2428                 fallthrough;
2429         case 4:
2430                 nl_cmds = nla_nest_start_noflag(msg,
2431                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2432                 if (!nl_cmds)
2433                         goto nla_put_failure;
2434
2435                 i = nl80211_add_commands_unsplit(rdev, msg);
2436                 if (i < 0)
2437                         goto nla_put_failure;
2438                 if (state->split) {
2439                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2440                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2441                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2442                                 CMD(channel_switch, CHANNEL_SWITCH);
2443                         CMD(set_qos_map, SET_QOS_MAP);
2444                         if (rdev->wiphy.features &
2445                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2446                                 CMD(add_tx_ts, ADD_TX_TS);
2447                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2448                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2449                         CMD(update_ft_ies, UPDATE_FT_IES);
2450                         if (rdev->wiphy.sar_capa)
2451                                 CMD(set_sar_specs, SET_SAR_SPECS);
2452                 }
2453 #undef CMD
2454
2455                 nla_nest_end(msg, nl_cmds);
2456                 state->split_start++;
2457                 if (state->split)
2458                         break;
2459                 fallthrough;
2460         case 5:
2461                 if (rdev->ops->remain_on_channel &&
2462                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2463                     nla_put_u32(msg,
2464                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2465                                 rdev->wiphy.max_remain_on_channel_duration))
2466                         goto nla_put_failure;
2467
2468                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2469                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2470                         goto nla_put_failure;
2471
2472                 state->split_start++;
2473                 if (state->split)
2474                         break;
2475                 fallthrough;
2476         case 6:
2477 #ifdef CONFIG_PM
2478                 if (nl80211_send_wowlan(msg, rdev, state->split))
2479                         goto nla_put_failure;
2480                 state->split_start++;
2481                 if (state->split)
2482                         break;
2483 #else
2484                 state->split_start++;
2485 #endif
2486                 fallthrough;
2487         case 7:
2488                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2489                                         rdev->wiphy.software_iftypes))
2490                         goto nla_put_failure;
2491
2492                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2493                                                    state->split))
2494                         goto nla_put_failure;
2495
2496                 state->split_start++;
2497                 if (state->split)
2498                         break;
2499                 fallthrough;
2500         case 8:
2501                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2502                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2503                                 rdev->wiphy.ap_sme_capa))
2504                         goto nla_put_failure;
2505
2506                 features = rdev->wiphy.features;
2507                 /*
2508                  * We can only add the per-channel limit information if the
2509                  * dump is split, otherwise it makes it too big. Therefore
2510                  * only advertise it in that case.
2511                  */
2512                 if (state->split)
2513                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2514                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2515                         goto nla_put_failure;
2516
2517                 if (rdev->wiphy.ht_capa_mod_mask &&
2518                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2519                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2520                             rdev->wiphy.ht_capa_mod_mask))
2521                         goto nla_put_failure;
2522
2523                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2524                     rdev->wiphy.max_acl_mac_addrs &&
2525                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2526                                 rdev->wiphy.max_acl_mac_addrs))
2527                         goto nla_put_failure;
2528
2529                 /*
2530                  * Any information below this point is only available to
2531                  * applications that can deal with it being split. This
2532                  * helps ensure that newly added capabilities don't break
2533                  * older tools by overrunning their buffers.
2534                  *
2535                  * We still increment split_start so that in the split
2536                  * case we'll continue with more data in the next round,
2537                  * but break unconditionally so unsplit data stops here.
2538                  */
2539                 if (state->split)
2540                         state->split_start++;
2541                 else
2542                         state->split_start = 0;
2543                 break;
2544         case 9:
2545                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2546                         goto nla_put_failure;
2547
2548                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2549                                 rdev->wiphy.max_sched_scan_plans) ||
2550                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2551                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2552                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2553                                 rdev->wiphy.max_sched_scan_plan_iterations))
2554                         goto nla_put_failure;
2555
2556                 if (rdev->wiphy.extended_capabilities &&
2557                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2558                              rdev->wiphy.extended_capabilities_len,
2559                              rdev->wiphy.extended_capabilities) ||
2560                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2561                              rdev->wiphy.extended_capabilities_len,
2562                              rdev->wiphy.extended_capabilities_mask)))
2563                         goto nla_put_failure;
2564
2565                 if (rdev->wiphy.vht_capa_mod_mask &&
2566                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2567                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2568                             rdev->wiphy.vht_capa_mod_mask))
2569                         goto nla_put_failure;
2570
2571                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2572                             rdev->wiphy.perm_addr))
2573                         goto nla_put_failure;
2574
2575                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2576                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2577                             rdev->wiphy.addr_mask))
2578                         goto nla_put_failure;
2579
2580                 if (rdev->wiphy.n_addresses > 1) {
2581                         void *attr;
2582
2583                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2584                         if (!attr)
2585                                 goto nla_put_failure;
2586
2587                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2588                                 if (nla_put(msg, i + 1, ETH_ALEN,
2589                                             rdev->wiphy.addresses[i].addr))
2590                                         goto nla_put_failure;
2591
2592                         nla_nest_end(msg, attr);
2593                 }
2594
2595                 state->split_start++;
2596                 break;
2597         case 10:
2598                 if (nl80211_send_coalesce(msg, rdev))
2599                         goto nla_put_failure;
2600
2601                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2602                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2603                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2604                         goto nla_put_failure;
2605
2606                 if (rdev->wiphy.max_ap_assoc_sta &&
2607                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2608                                 rdev->wiphy.max_ap_assoc_sta))
2609                         goto nla_put_failure;
2610
2611                 state->split_start++;
2612                 break;
2613         case 11:
2614                 if (rdev->wiphy.n_vendor_commands) {
2615                         const struct nl80211_vendor_cmd_info *info;
2616                         struct nlattr *nested;
2617
2618                         nested = nla_nest_start_noflag(msg,
2619                                                        NL80211_ATTR_VENDOR_DATA);
2620                         if (!nested)
2621                                 goto nla_put_failure;
2622
2623                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2624                                 info = &rdev->wiphy.vendor_commands[i].info;
2625                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2626                                         goto nla_put_failure;
2627                         }
2628                         nla_nest_end(msg, nested);
2629                 }
2630
2631                 if (rdev->wiphy.n_vendor_events) {
2632                         const struct nl80211_vendor_cmd_info *info;
2633                         struct nlattr *nested;
2634
2635                         nested = nla_nest_start_noflag(msg,
2636                                                        NL80211_ATTR_VENDOR_EVENTS);
2637                         if (!nested)
2638                                 goto nla_put_failure;
2639
2640                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2641                                 info = &rdev->wiphy.vendor_events[i];
2642                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2643                                         goto nla_put_failure;
2644                         }
2645                         nla_nest_end(msg, nested);
2646                 }
2647                 state->split_start++;
2648                 break;
2649         case 12:
2650                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2651                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2652                                rdev->wiphy.max_num_csa_counters))
2653                         goto nla_put_failure;
2654
2655                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2656                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2657                         goto nla_put_failure;
2658
2659                 if (rdev->wiphy.max_sched_scan_reqs &&
2660                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2661                                 rdev->wiphy.max_sched_scan_reqs))
2662                         goto nla_put_failure;
2663
2664                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2665                             sizeof(rdev->wiphy.ext_features),
2666                             rdev->wiphy.ext_features))
2667                         goto nla_put_failure;
2668
2669                 if (rdev->wiphy.bss_select_support) {
2670                         struct nlattr *nested;
2671                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2672
2673                         nested = nla_nest_start_noflag(msg,
2674                                                        NL80211_ATTR_BSS_SELECT);
2675                         if (!nested)
2676                                 goto nla_put_failure;
2677
2678                         i = 0;
2679                         while (bss_select_support) {
2680                                 if ((bss_select_support & 1) &&
2681                                     nla_put_flag(msg, i))
2682                                         goto nla_put_failure;
2683                                 i++;
2684                                 bss_select_support >>= 1;
2685                         }
2686                         nla_nest_end(msg, nested);
2687                 }
2688
2689                 state->split_start++;
2690                 break;
2691         case 13:
2692                 if (rdev->wiphy.num_iftype_ext_capab &&
2693                     rdev->wiphy.iftype_ext_capab) {
2694                         struct nlattr *nested_ext_capab, *nested;
2695
2696                         nested = nla_nest_start_noflag(msg,
2697                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2698                         if (!nested)
2699                                 goto nla_put_failure;
2700
2701                         for (i = state->capa_start;
2702                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2703                                 const struct wiphy_iftype_ext_capab *capab;
2704
2705                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2706
2707                                 nested_ext_capab = nla_nest_start_noflag(msg,
2708                                                                          i);
2709                                 if (!nested_ext_capab ||
2710                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2711                                                 capab->iftype) ||
2712                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2713                                             capab->extended_capabilities_len,
2714                                             capab->extended_capabilities) ||
2715                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2716                                             capab->extended_capabilities_len,
2717                                             capab->extended_capabilities_mask))
2718                                         goto nla_put_failure;
2719
2720                                 nla_nest_end(msg, nested_ext_capab);
2721                                 if (state->split)
2722                                         break;
2723                         }
2724                         nla_nest_end(msg, nested);
2725                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2726                                 state->capa_start = i + 1;
2727                                 break;
2728                         }
2729                 }
2730
2731                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2732                                 rdev->wiphy.nan_supported_bands))
2733                         goto nla_put_failure;
2734
2735                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2736                                             NL80211_EXT_FEATURE_TXQS)) {
2737                         struct cfg80211_txq_stats txqstats = {};
2738                         int res;
2739
2740                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2741                         if (!res &&
2742                             !nl80211_put_txq_stats(msg, &txqstats,
2743                                                    NL80211_ATTR_TXQ_STATS))
2744                                 goto nla_put_failure;
2745
2746                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2747                                         rdev->wiphy.txq_limit))
2748                                 goto nla_put_failure;
2749                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2750                                         rdev->wiphy.txq_memory_limit))
2751                                 goto nla_put_failure;
2752                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2753                                         rdev->wiphy.txq_quantum))
2754                                 goto nla_put_failure;
2755                 }
2756
2757                 state->split_start++;
2758                 break;
2759         case 14:
2760                 if (nl80211_send_pmsr_capa(rdev, msg))
2761                         goto nla_put_failure;
2762
2763                 state->split_start++;
2764                 break;
2765         case 15:
2766                 if (rdev->wiphy.akm_suites &&
2767                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2768                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2769                             rdev->wiphy.akm_suites))
2770                         goto nla_put_failure;
2771
2772                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2773                         goto nla_put_failure;
2774
2775                 if (nl80211_put_tid_config_support(rdev, msg))
2776                         goto nla_put_failure;
2777                 state->split_start++;
2778                 break;
2779         case 16:
2780                 if (nl80211_put_sar_specs(rdev, msg))
2781                         goto nla_put_failure;
2782
2783                 /* done */
2784                 state->split_start = 0;
2785                 break;
2786         }
2787  finish:
2788         genlmsg_end(msg, hdr);
2789         return 0;
2790
2791  nla_put_failure:
2792         genlmsg_cancel(msg, hdr);
2793         return -EMSGSIZE;
2794 }
2795
2796 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2797                                     struct netlink_callback *cb,
2798                                     struct nl80211_dump_wiphy_state *state)
2799 {
2800         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2801         int ret;
2802
2803         if (!tb)
2804                 return -ENOMEM;
2805
2806         ret = nlmsg_parse_deprecated(cb->nlh,
2807                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2808                                      tb, nl80211_fam.maxattr,
2809                                      nl80211_policy, NULL);
2810         /* ignore parse errors for backward compatibility */
2811         if (ret) {
2812                 ret = 0;
2813                 goto out;
2814         }
2815
2816         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2817         if (tb[NL80211_ATTR_WIPHY])
2818                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2819         if (tb[NL80211_ATTR_WDEV])
2820                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2821         if (tb[NL80211_ATTR_IFINDEX]) {
2822                 struct net_device *netdev;
2823                 struct cfg80211_registered_device *rdev;
2824                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2825
2826                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2827                 if (!netdev) {
2828                         ret = -ENODEV;
2829                         goto out;
2830                 }
2831                 if (netdev->ieee80211_ptr) {
2832                         rdev = wiphy_to_rdev(
2833                                 netdev->ieee80211_ptr->wiphy);
2834                         state->filter_wiphy = rdev->wiphy_idx;
2835                 }
2836         }
2837
2838         ret = 0;
2839 out:
2840         kfree(tb);
2841         return ret;
2842 }
2843
2844 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2845 {
2846         int idx = 0, ret;
2847         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2848         struct cfg80211_registered_device *rdev;
2849
2850         rtnl_lock();
2851         if (!state) {
2852                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2853                 if (!state) {
2854                         rtnl_unlock();
2855                         return -ENOMEM;
2856                 }
2857                 state->filter_wiphy = -1;
2858                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2859                 if (ret) {
2860                         kfree(state);
2861                         rtnl_unlock();
2862                         return ret;
2863                 }
2864                 cb->args[0] = (long)state;
2865         }
2866
2867         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2868                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2869                         continue;
2870                 if (++idx <= state->start)
2871                         continue;
2872                 if (state->filter_wiphy != -1 &&
2873                     state->filter_wiphy != rdev->wiphy_idx)
2874                         continue;
2875                 /* attempt to fit multiple wiphy data chunks into the skb */
2876                 do {
2877                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2878                                                  skb,
2879                                                  NETLINK_CB(cb->skb).portid,
2880                                                  cb->nlh->nlmsg_seq,
2881                                                  NLM_F_MULTI, state);
2882                         if (ret < 0) {
2883                                 /*
2884                                  * If sending the wiphy data didn't fit (ENOBUFS
2885                                  * or EMSGSIZE returned), this SKB is still
2886                                  * empty (so it's not too big because another
2887                                  * wiphy dataset is already in the skb) and
2888                                  * we've not tried to adjust the dump allocation
2889                                  * yet ... then adjust the alloc size to be
2890                                  * bigger, and return 1 but with the empty skb.
2891                                  * This results in an empty message being RX'ed
2892                                  * in userspace, but that is ignored.
2893                                  *
2894                                  * We can then retry with the larger buffer.
2895                                  */
2896                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2897                                     !skb->len && !state->split &&
2898                                     cb->min_dump_alloc < 4096) {
2899                                         cb->min_dump_alloc = 4096;
2900                                         state->split_start = 0;
2901                                         rtnl_unlock();
2902                                         return 1;
2903                                 }
2904                                 idx--;
2905                                 break;
2906                         }
2907                 } while (state->split_start > 0);
2908                 break;
2909         }
2910         rtnl_unlock();
2911
2912         state->start = idx;
2913
2914         return skb->len;
2915 }
2916
2917 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2918 {
2919         kfree((void *)cb->args[0]);
2920         return 0;
2921 }
2922
2923 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2924 {
2925         struct sk_buff *msg;
2926         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2927         struct nl80211_dump_wiphy_state state = {};
2928
2929         msg = nlmsg_new(4096, GFP_KERNEL);
2930         if (!msg)
2931                 return -ENOMEM;
2932
2933         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2934                                info->snd_portid, info->snd_seq, 0,
2935                                &state) < 0) {
2936                 nlmsg_free(msg);
2937                 return -ENOBUFS;
2938         }
2939
2940         return genlmsg_reply(msg, info);
2941 }
2942
2943 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2944         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2945         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2946         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2947         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2948         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2949 };
2950
2951 static int parse_txq_params(struct nlattr *tb[],
2952                             struct ieee80211_txq_params *txq_params)
2953 {
2954         u8 ac;
2955
2956         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2957             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2958             !tb[NL80211_TXQ_ATTR_AIFS])
2959                 return -EINVAL;
2960
2961         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2962         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2963         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2964         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2965         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2966
2967         if (ac >= NL80211_NUM_ACS)
2968                 return -EINVAL;
2969         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2970         return 0;
2971 }
2972
2973 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2974 {
2975         /*
2976          * You can only set the channel explicitly for some interfaces,
2977          * most have their channel managed via their respective
2978          * "establish a connection" command (connect, join, ...)
2979          *
2980          * For AP/GO and mesh mode, the channel can be set with the
2981          * channel userspace API, but is only stored and passed to the
2982          * low-level driver when the AP starts or the mesh is joined.
2983          * This is for backward compatibility, userspace can also give
2984          * the channel in the start-ap or join-mesh commands instead.
2985          *
2986          * Monitors are special as they are normally slaved to
2987          * whatever else is going on, so they have their own special
2988          * operation to set the monitor channel if possible.
2989          */
2990         return !wdev ||
2991                 wdev->iftype == NL80211_IFTYPE_AP ||
2992                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2993                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2994                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2995 }
2996
2997 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2998                           struct genl_info *info,
2999                           struct cfg80211_chan_def *chandef)
3000 {
3001         struct netlink_ext_ack *extack = info->extack;
3002         struct nlattr **attrs = info->attrs;
3003         u32 control_freq;
3004
3005         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
3006                 return -EINVAL;
3007
3008         control_freq = MHZ_TO_KHZ(
3009                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3010         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3011                 control_freq +=
3012                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3013
3014         memset(chandef, 0, sizeof(*chandef));
3015         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3016         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3017         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3018         chandef->freq1_offset = control_freq % 1000;
3019         chandef->center_freq2 = 0;
3020
3021         /* Primary channel not allowed */
3022         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3023                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3024                                     "Channel is disabled");
3025                 return -EINVAL;
3026         }
3027
3028         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3029                 enum nl80211_channel_type chantype;
3030
3031                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3032
3033                 switch (chantype) {
3034                 case NL80211_CHAN_NO_HT:
3035                 case NL80211_CHAN_HT20:
3036                 case NL80211_CHAN_HT40PLUS:
3037                 case NL80211_CHAN_HT40MINUS:
3038                         cfg80211_chandef_create(chandef, chandef->chan,
3039                                                 chantype);
3040                         /* user input for center_freq is incorrect */
3041                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3042                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3043                                 NL_SET_ERR_MSG_ATTR(extack,
3044                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3045                                                     "bad center frequency 1");
3046                                 return -EINVAL;
3047                         }
3048                         /* center_freq2 must be zero */
3049                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3050                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3051                                 NL_SET_ERR_MSG_ATTR(extack,
3052                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3053                                                     "center frequency 2 can't be used");
3054                                 return -EINVAL;
3055                         }
3056                         break;
3057                 default:
3058                         NL_SET_ERR_MSG_ATTR(extack,
3059                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3060                                             "invalid channel type");
3061                         return -EINVAL;
3062                 }
3063         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3064                 chandef->width =
3065                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3066                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3067                         chandef->center_freq1 =
3068                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3069                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3070                                 chandef->freq1_offset = nla_get_u32(
3071                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3072                         else
3073                                 chandef->freq1_offset = 0;
3074                 }
3075                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3076                         chandef->center_freq2 =
3077                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3078         }
3079
3080         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3081                 chandef->edmg.channels =
3082                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3083
3084                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3085                         chandef->edmg.bw_config =
3086                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3087         } else {
3088                 chandef->edmg.bw_config = 0;
3089                 chandef->edmg.channels = 0;
3090         }
3091
3092         if (!cfg80211_chandef_valid(chandef)) {
3093                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3094                 return -EINVAL;
3095         }
3096
3097         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3098                                      IEEE80211_CHAN_DISABLED)) {
3099                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3100                 return -EINVAL;
3101         }
3102
3103         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3104              chandef->width == NL80211_CHAN_WIDTH_10) &&
3105             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3106                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3107                 return -EINVAL;
3108         }
3109
3110         return 0;
3111 }
3112
3113 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3114                                  struct net_device *dev,
3115                                  struct genl_info *info)
3116 {
3117         struct cfg80211_chan_def chandef;
3118         int result;
3119         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3120         struct wireless_dev *wdev = NULL;
3121
3122         if (dev)
3123                 wdev = dev->ieee80211_ptr;
3124         if (!nl80211_can_set_dev_channel(wdev))
3125                 return -EOPNOTSUPP;
3126         if (wdev)
3127                 iftype = wdev->iftype;
3128
3129         result = nl80211_parse_chandef(rdev, info, &chandef);
3130         if (result)
3131                 return result;
3132
3133         switch (iftype) {
3134         case NL80211_IFTYPE_AP:
3135         case NL80211_IFTYPE_P2P_GO:
3136                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3137                                                    iftype)) {
3138                         result = -EINVAL;
3139                         break;
3140                 }
3141                 if (wdev->beacon_interval) {
3142                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3143                             !(rdev->wiphy.features &
3144                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
3145                                 result = -EBUSY;
3146                                 break;
3147                         }
3148
3149                         /* Only allow dynamic channel width changes */
3150                         if (chandef.chan != wdev->preset_chandef.chan) {
3151                                 result = -EBUSY;
3152                                 break;
3153                         }
3154                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
3155                         if (result)
3156                                 break;
3157                 }
3158                 wdev->preset_chandef = chandef;
3159                 result = 0;
3160                 break;
3161         case NL80211_IFTYPE_MESH_POINT:
3162                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3163                 break;
3164         case NL80211_IFTYPE_MONITOR:
3165                 result = cfg80211_set_monitor_channel(rdev, &chandef);
3166                 break;
3167         default:
3168                 result = -EINVAL;
3169         }
3170
3171         return result;
3172 }
3173
3174 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3175 {
3176         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3177         struct net_device *netdev = info->user_ptr[1];
3178
3179         return __nl80211_set_channel(rdev, netdev, info);
3180 }
3181
3182 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3183 {
3184         struct cfg80211_registered_device *rdev = NULL;
3185         struct net_device *netdev = NULL;
3186         struct wireless_dev *wdev;
3187         int result = 0, rem_txq_params = 0;
3188         struct nlattr *nl_txq_params;
3189         u32 changed;
3190         u8 retry_short = 0, retry_long = 0;
3191         u32 frag_threshold = 0, rts_threshold = 0;
3192         u8 coverage_class = 0;
3193         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3194
3195         rtnl_lock();
3196         /*
3197          * Try to find the wiphy and netdev. Normally this
3198          * function shouldn't need the netdev, but this is
3199          * done for backward compatibility -- previously
3200          * setting the channel was done per wiphy, but now
3201          * it is per netdev. Previous userland like hostapd
3202          * also passed a netdev to set_wiphy, so that it is
3203          * possible to let that go to the right netdev!
3204          */
3205
3206         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3207                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3208
3209                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3210                 if (netdev && netdev->ieee80211_ptr)
3211                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3212                 else
3213                         netdev = NULL;
3214         }
3215
3216         if (!netdev) {
3217                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3218                                                   info->attrs);
3219                 if (IS_ERR(rdev)) {
3220                         rtnl_unlock();
3221                         return PTR_ERR(rdev);
3222                 }
3223                 wdev = NULL;
3224                 netdev = NULL;
3225                 result = 0;
3226         } else
3227                 wdev = netdev->ieee80211_ptr;
3228
3229         wiphy_lock(&rdev->wiphy);
3230
3231         /*
3232          * end workaround code, by now the rdev is available
3233          * and locked, and wdev may or may not be NULL.
3234          */
3235
3236         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3237                 result = cfg80211_dev_rename(
3238                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3239         rtnl_unlock();
3240
3241         if (result)
3242                 goto out;
3243
3244         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3245                 struct ieee80211_txq_params txq_params;
3246                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3247
3248                 if (!rdev->ops->set_txq_params) {
3249                         result = -EOPNOTSUPP;
3250                         goto out;
3251                 }
3252
3253                 if (!netdev) {
3254                         result = -EINVAL;
3255                         goto out;
3256                 }
3257
3258                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3259                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3260                         result = -EINVAL;
3261                         goto out;
3262                 }
3263
3264                 if (!netif_running(netdev)) {
3265                         result = -ENETDOWN;
3266                         goto out;
3267                 }
3268
3269                 nla_for_each_nested(nl_txq_params,
3270                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3271                                     rem_txq_params) {
3272                         result = nla_parse_nested_deprecated(tb,
3273                                                              NL80211_TXQ_ATTR_MAX,
3274                                                              nl_txq_params,
3275                                                              txq_params_policy,
3276                                                              info->extack);
3277                         if (result)
3278                                 goto out;
3279                         result = parse_txq_params(tb, &txq_params);
3280                         if (result)
3281                                 goto out;
3282
3283                         result = rdev_set_txq_params(rdev, netdev,
3284                                                      &txq_params);
3285                         if (result)
3286                                 goto out;
3287                 }
3288         }
3289
3290         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3291                 result = __nl80211_set_channel(
3292                         rdev,
3293                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3294                         info);
3295                 if (result)
3296                         goto out;
3297         }
3298
3299         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3300                 struct wireless_dev *txp_wdev = wdev;
3301                 enum nl80211_tx_power_setting type;
3302                 int idx, mbm = 0;
3303
3304                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3305                         txp_wdev = NULL;
3306
3307                 if (!rdev->ops->set_tx_power) {
3308                         result = -EOPNOTSUPP;
3309                         goto out;
3310                 }
3311
3312                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3313                 type = nla_get_u32(info->attrs[idx]);
3314
3315                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3316                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3317                         result = -EINVAL;
3318                         goto out;
3319                 }
3320
3321                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3322                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3323                         mbm = nla_get_u32(info->attrs[idx]);
3324                 }
3325
3326                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3327                 if (result)
3328                         goto out;
3329         }
3330
3331         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3332             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3333                 u32 tx_ant, rx_ant;
3334
3335                 if ((!rdev->wiphy.available_antennas_tx &&
3336                      !rdev->wiphy.available_antennas_rx) ||
3337                     !rdev->ops->set_antenna) {
3338                         result = -EOPNOTSUPP;
3339                         goto out;
3340                 }
3341
3342                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3343                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3344
3345                 /* reject antenna configurations which don't match the
3346                  * available antenna masks, except for the "all" mask */
3347                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3348                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3349                         result = -EINVAL;
3350                         goto out;
3351                 }
3352
3353                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3354                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3355
3356                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3357                 if (result)
3358                         goto out;
3359         }
3360
3361         changed = 0;
3362
3363         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3364                 retry_short = nla_get_u8(
3365                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3366
3367                 changed |= WIPHY_PARAM_RETRY_SHORT;
3368         }
3369
3370         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3371                 retry_long = nla_get_u8(
3372                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3373
3374                 changed |= WIPHY_PARAM_RETRY_LONG;
3375         }
3376
3377         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3378                 frag_threshold = nla_get_u32(
3379                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3380                 if (frag_threshold < 256) {
3381                         result = -EINVAL;
3382                         goto out;
3383                 }
3384
3385                 if (frag_threshold != (u32) -1) {
3386                         /*
3387                          * Fragments (apart from the last one) are required to
3388                          * have even length. Make the fragmentation code
3389                          * simpler by stripping LSB should someone try to use
3390                          * odd threshold value.
3391                          */
3392                         frag_threshold &= ~0x1;
3393                 }
3394                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3395         }
3396
3397         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3398                 rts_threshold = nla_get_u32(
3399                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3400                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3401         }
3402
3403         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3404                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3405                         result = -EINVAL;
3406                         goto out;
3407                 }
3408
3409                 coverage_class = nla_get_u8(
3410                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3411                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3412         }
3413
3414         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3415                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3416                         result = -EOPNOTSUPP;
3417                         goto out;
3418                 }
3419
3420                 changed |= WIPHY_PARAM_DYN_ACK;
3421         }
3422
3423         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3424                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3425                                              NL80211_EXT_FEATURE_TXQS)) {
3426                         result = -EOPNOTSUPP;
3427                         goto out;
3428                 }
3429                 txq_limit = nla_get_u32(
3430                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3431                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3432         }
3433
3434         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3435                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3436                                              NL80211_EXT_FEATURE_TXQS)) {
3437                         result = -EOPNOTSUPP;
3438                         goto out;
3439                 }
3440                 txq_memory_limit = nla_get_u32(
3441                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3442                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3443         }
3444
3445         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3446                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3447                                              NL80211_EXT_FEATURE_TXQS)) {
3448                         result = -EOPNOTSUPP;
3449                         goto out;
3450                 }
3451                 txq_quantum = nla_get_u32(
3452                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3453                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3454         }
3455
3456         if (changed) {
3457                 u8 old_retry_short, old_retry_long;
3458                 u32 old_frag_threshold, old_rts_threshold;
3459                 u8 old_coverage_class;
3460                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3461
3462                 if (!rdev->ops->set_wiphy_params) {
3463                         result = -EOPNOTSUPP;
3464                         goto out;
3465                 }
3466
3467                 old_retry_short = rdev->wiphy.retry_short;
3468                 old_retry_long = rdev->wiphy.retry_long;
3469                 old_frag_threshold = rdev->wiphy.frag_threshold;
3470                 old_rts_threshold = rdev->wiphy.rts_threshold;
3471                 old_coverage_class = rdev->wiphy.coverage_class;
3472                 old_txq_limit = rdev->wiphy.txq_limit;
3473                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3474                 old_txq_quantum = rdev->wiphy.txq_quantum;
3475
3476                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3477                         rdev->wiphy.retry_short = retry_short;
3478                 if (changed & WIPHY_PARAM_RETRY_LONG)
3479                         rdev->wiphy.retry_long = retry_long;
3480                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3481                         rdev->wiphy.frag_threshold = frag_threshold;
3482                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3483                         rdev->wiphy.rts_threshold = rts_threshold;
3484                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3485                         rdev->wiphy.coverage_class = coverage_class;
3486                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3487                         rdev->wiphy.txq_limit = txq_limit;
3488                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3489                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3490                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3491                         rdev->wiphy.txq_quantum = txq_quantum;
3492
3493                 result = rdev_set_wiphy_params(rdev, changed);
3494                 if (result) {
3495                         rdev->wiphy.retry_short = old_retry_short;
3496                         rdev->wiphy.retry_long = old_retry_long;
3497                         rdev->wiphy.frag_threshold = old_frag_threshold;
3498                         rdev->wiphy.rts_threshold = old_rts_threshold;
3499                         rdev->wiphy.coverage_class = old_coverage_class;
3500                         rdev->wiphy.txq_limit = old_txq_limit;
3501                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3502                         rdev->wiphy.txq_quantum = old_txq_quantum;
3503                         goto out;
3504                 }
3505         }
3506
3507         result = 0;
3508
3509 out:
3510         wiphy_unlock(&rdev->wiphy);
3511         return result;
3512 }
3513
3514 static int nl80211_send_chandef(struct sk_buff *msg,
3515                                 const struct cfg80211_chan_def *chandef)
3516 {
3517         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3518                 return -EINVAL;
3519
3520         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3521                         chandef->chan->center_freq))
3522                 return -ENOBUFS;
3523         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3524                         chandef->chan->freq_offset))
3525                 return -ENOBUFS;
3526         switch (chandef->width) {
3527         case NL80211_CHAN_WIDTH_20_NOHT:
3528         case NL80211_CHAN_WIDTH_20:
3529         case NL80211_CHAN_WIDTH_40:
3530                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3531                                 cfg80211_get_chandef_type(chandef)))
3532                         return -ENOBUFS;
3533                 break;
3534         default:
3535                 break;
3536         }
3537         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3538                 return -ENOBUFS;
3539         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3540                 return -ENOBUFS;
3541         if (chandef->center_freq2 &&
3542             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3543                 return -ENOBUFS;
3544         return 0;
3545 }
3546
3547 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3548                               struct cfg80211_registered_device *rdev,
3549                               struct wireless_dev *wdev,
3550                               enum nl80211_commands cmd)
3551 {
3552         struct net_device *dev = wdev->netdev;
3553         void *hdr;
3554
3555         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3556                 cmd != NL80211_CMD_DEL_INTERFACE &&
3557                 cmd != NL80211_CMD_SET_INTERFACE);
3558
3559         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3560         if (!hdr)
3561                 return -1;
3562
3563         if (dev &&
3564             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3565              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3566                 goto nla_put_failure;
3567
3568         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3569             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3570             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3571                               NL80211_ATTR_PAD) ||
3572             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3573             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3574                         rdev->devlist_generation ^
3575                         (cfg80211_rdev_list_generation << 2)) ||
3576             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3577                 goto nla_put_failure;
3578
3579         if (rdev->ops->get_channel) {
3580                 int ret;
3581                 struct cfg80211_chan_def chandef = {};
3582
3583                 ret = rdev_get_channel(rdev, wdev, &chandef);
3584                 if (ret == 0) {
3585                         if (nl80211_send_chandef(msg, &chandef))
3586                                 goto nla_put_failure;
3587                 }
3588         }
3589
3590         if (rdev->ops->get_tx_power) {
3591                 int dbm, ret;
3592
3593                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3594                 if (ret == 0 &&
3595                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3596                                 DBM_TO_MBM(dbm)))
3597                         goto nla_put_failure;
3598         }
3599
3600         wdev_lock(wdev);
3601         switch (wdev->iftype) {
3602         case NL80211_IFTYPE_AP:
3603                 if (wdev->ssid_len &&
3604                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3605                         goto nla_put_failure_locked;
3606                 break;
3607         case NL80211_IFTYPE_STATION:
3608         case NL80211_IFTYPE_P2P_CLIENT:
3609         case NL80211_IFTYPE_ADHOC: {
3610                 const u8 *ssid_ie;
3611                 if (!wdev->current_bss)
3612                         break;
3613                 rcu_read_lock();
3614                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3615                                                WLAN_EID_SSID);
3616                 if (ssid_ie &&
3617                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3618                         goto nla_put_failure_rcu_locked;
3619                 rcu_read_unlock();
3620                 break;
3621                 }
3622         default:
3623                 /* nothing */
3624                 break;
3625         }
3626         wdev_unlock(wdev);
3627
3628         if (rdev->ops->get_txq_stats) {
3629                 struct cfg80211_txq_stats txqstats = {};
3630                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3631
3632                 if (ret == 0 &&
3633                     !nl80211_put_txq_stats(msg, &txqstats,
3634                                            NL80211_ATTR_TXQ_STATS))
3635                         goto nla_put_failure;
3636         }
3637
3638         genlmsg_end(msg, hdr);
3639         return 0;
3640
3641  nla_put_failure_rcu_locked:
3642         rcu_read_unlock();
3643  nla_put_failure_locked:
3644         wdev_unlock(wdev);
3645  nla_put_failure:
3646         genlmsg_cancel(msg, hdr);
3647         return -EMSGSIZE;
3648 }
3649
3650 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3651 {
3652         int wp_idx = 0;
3653         int if_idx = 0;
3654         int wp_start = cb->args[0];
3655         int if_start = cb->args[1];
3656         int filter_wiphy = -1;
3657         struct cfg80211_registered_device *rdev;
3658         struct wireless_dev *wdev;
3659         int ret;
3660
3661         rtnl_lock();
3662         if (!cb->args[2]) {
3663                 struct nl80211_dump_wiphy_state state = {
3664                         .filter_wiphy = -1,
3665                 };
3666
3667                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3668                 if (ret)
3669                         goto out_unlock;
3670
3671                 filter_wiphy = state.filter_wiphy;
3672
3673                 /*
3674                  * if filtering, set cb->args[2] to +1 since 0 is the default
3675                  * value needed to determine that parsing is necessary.
3676                  */
3677                 if (filter_wiphy >= 0)
3678                         cb->args[2] = filter_wiphy + 1;
3679                 else
3680                         cb->args[2] = -1;
3681         } else if (cb->args[2] > 0) {
3682                 filter_wiphy = cb->args[2] - 1;
3683         }
3684
3685         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3686                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3687                         continue;
3688                 if (wp_idx < wp_start) {
3689                         wp_idx++;
3690                         continue;
3691                 }
3692
3693                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3694                         continue;
3695
3696                 if_idx = 0;
3697
3698                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3699                         if (if_idx < if_start) {
3700                                 if_idx++;
3701                                 continue;
3702                         }
3703                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3704                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3705                                                rdev, wdev,
3706                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3707                                 goto out;
3708                         }
3709                         if_idx++;
3710                 }
3711
3712                 wp_idx++;
3713         }
3714  out:
3715         cb->args[0] = wp_idx;
3716         cb->args[1] = if_idx;
3717
3718         ret = skb->len;
3719  out_unlock:
3720         rtnl_unlock();
3721
3722         return ret;
3723 }
3724
3725 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3726 {
3727         struct sk_buff *msg;
3728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3729         struct wireless_dev *wdev = info->user_ptr[1];
3730
3731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3732         if (!msg)
3733                 return -ENOMEM;
3734
3735         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3736                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3737                 nlmsg_free(msg);
3738                 return -ENOBUFS;
3739         }
3740
3741         return genlmsg_reply(msg, info);
3742 }
3743
3744 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3745         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3746         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3747         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3748         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3749         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3750         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3751 };
3752
3753 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3754 {
3755         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3756         int flag;
3757
3758         *mntrflags = 0;
3759
3760         if (!nla)
3761                 return -EINVAL;
3762
3763         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3764                 return -EINVAL;
3765
3766         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3767                 if (flags[flag])
3768                         *mntrflags |= (1<<flag);
3769
3770         *mntrflags |= MONITOR_FLAG_CHANGED;
3771
3772         return 0;
3773 }
3774
3775 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3776                                      enum nl80211_iftype type,
3777                                      struct genl_info *info,
3778                                      struct vif_params *params)
3779 {
3780         bool change = false;
3781         int err;
3782
3783         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3784                 if (type != NL80211_IFTYPE_MONITOR)
3785                         return -EINVAL;
3786
3787                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3788                                           &params->flags);
3789                 if (err)
3790                         return err;
3791
3792                 change = true;
3793         }
3794
3795         if (params->flags & MONITOR_FLAG_ACTIVE &&
3796             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3797                 return -EOPNOTSUPP;
3798
3799         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3800                 const u8 *mumimo_groups;
3801                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3802
3803                 if (type != NL80211_IFTYPE_MONITOR)
3804                         return -EINVAL;
3805
3806                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3807                         return -EOPNOTSUPP;
3808
3809                 mumimo_groups =
3810                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3811
3812                 /* bits 0 and 63 are reserved and must be zero */
3813                 if ((mumimo_groups[0] & BIT(0)) ||
3814                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3815                         return -EINVAL;
3816
3817                 params->vht_mumimo_groups = mumimo_groups;
3818                 change = true;
3819         }
3820
3821         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3822                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3823
3824                 if (type != NL80211_IFTYPE_MONITOR)
3825                         return -EINVAL;
3826
3827                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3828                         return -EOPNOTSUPP;
3829
3830                 params->vht_mumimo_follow_addr =
3831                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3832                 change = true;
3833         }
3834
3835         return change ? 1 : 0;
3836 }
3837
3838 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3839                                struct net_device *netdev, u8 use_4addr,
3840                                enum nl80211_iftype iftype)
3841 {
3842         if (!use_4addr) {
3843                 if (netdev && netif_is_bridge_port(netdev))
3844                         return -EBUSY;
3845                 return 0;
3846         }
3847
3848         switch (iftype) {
3849         case NL80211_IFTYPE_AP_VLAN:
3850                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3851                         return 0;
3852                 break;
3853         case NL80211_IFTYPE_STATION:
3854                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3855                         return 0;
3856                 break;
3857         default:
3858                 break;
3859         }
3860
3861         return -EOPNOTSUPP;
3862 }
3863
3864 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3865 {
3866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3867         struct vif_params params;
3868         int err;
3869         enum nl80211_iftype otype, ntype;
3870         struct net_device *dev = info->user_ptr[1];
3871         bool change = false;
3872
3873         memset(&params, 0, sizeof(params));
3874
3875         otype = ntype = dev->ieee80211_ptr->iftype;
3876
3877         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3878                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3879                 if (otype != ntype)
3880                         change = true;
3881         }
3882
3883         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3884                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3885
3886                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3887                         return -EINVAL;
3888                 if (netif_running(dev))
3889                         return -EBUSY;
3890
3891                 wdev_lock(wdev);
3892                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3893                              IEEE80211_MAX_MESH_ID_LEN);
3894                 wdev->mesh_id_up_len =
3895                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3896                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3897                        wdev->mesh_id_up_len);
3898                 wdev_unlock(wdev);
3899         }
3900
3901         if (info->attrs[NL80211_ATTR_4ADDR]) {
3902                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3903                 change = true;
3904                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3905                 if (err)
3906                         return err;
3907         } else {
3908                 params.use_4addr = -1;
3909         }
3910
3911         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3912         if (err < 0)
3913                 return err;
3914         if (err > 0)
3915                 change = true;
3916
3917         if (change)
3918                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3919         else
3920                 err = 0;
3921
3922         if (!err && params.use_4addr != -1)
3923                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3924
3925         if (change && !err) {
3926                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3927
3928                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3929         }
3930
3931         return err;
3932 }
3933
3934 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3935 {
3936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3937         struct vif_params params;
3938         struct wireless_dev *wdev;
3939         struct sk_buff *msg;
3940         int err;
3941         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3942
3943         memset(&params, 0, sizeof(params));
3944
3945         if (!info->attrs[NL80211_ATTR_IFNAME])
3946                 return -EINVAL;
3947
3948         if (info->attrs[NL80211_ATTR_IFTYPE])
3949                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3950
3951         if (!rdev->ops->add_virtual_intf)
3952                 return -EOPNOTSUPP;
3953
3954         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3955              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3956             info->attrs[NL80211_ATTR_MAC]) {
3957                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3958                            ETH_ALEN);
3959                 if (!is_valid_ether_addr(params.macaddr))
3960                         return -EADDRNOTAVAIL;
3961         }
3962
3963         if (info->attrs[NL80211_ATTR_4ADDR]) {
3964                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3965                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3966                 if (err)
3967                         return err;
3968         }
3969
3970         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3971                 return -EOPNOTSUPP;
3972
3973         err = nl80211_parse_mon_options(rdev, type, info, &params);
3974         if (err < 0)
3975                 return err;
3976
3977         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3978         if (!msg)
3979                 return -ENOMEM;
3980
3981         wdev = rdev_add_virtual_intf(rdev,
3982                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3983                                 NET_NAME_USER, type, &params);
3984         if (WARN_ON(!wdev)) {
3985                 nlmsg_free(msg);
3986                 return -EPROTO;
3987         } else if (IS_ERR(wdev)) {
3988                 nlmsg_free(msg);
3989                 return PTR_ERR(wdev);
3990         }
3991
3992         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3993                 wdev->owner_nlportid = info->snd_portid;
3994
3995         switch (type) {
3996         case NL80211_IFTYPE_MESH_POINT:
3997                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3998                         break;
3999                 wdev_lock(wdev);
4000                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4001                              IEEE80211_MAX_MESH_ID_LEN);
4002                 wdev->mesh_id_up_len =
4003                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4004                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4005                        wdev->mesh_id_up_len);
4006                 wdev_unlock(wdev);
4007                 break;
4008         case NL80211_IFTYPE_NAN:
4009         case NL80211_IFTYPE_P2P_DEVICE:
4010                 /*
4011                  * P2P Device and NAN do not have a netdev, so don't go
4012                  * through the netdev notifier and must be added here
4013                  */
4014                 cfg80211_init_wdev(wdev);
4015                 cfg80211_register_wdev(rdev, wdev);
4016                 break;
4017         default:
4018                 break;
4019         }
4020
4021         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4022                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4023                 nlmsg_free(msg);
4024                 return -ENOBUFS;
4025         }
4026
4027         return genlmsg_reply(msg, info);
4028 }
4029
4030 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4031 {
4032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4033         int ret;
4034
4035         /* to avoid failing a new interface creation due to pending removal */
4036         cfg80211_destroy_ifaces(rdev);
4037
4038         wiphy_lock(&rdev->wiphy);
4039         ret = _nl80211_new_interface(skb, info);
4040         wiphy_unlock(&rdev->wiphy);
4041
4042         return ret;
4043 }
4044
4045 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4046 {
4047         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4048         struct wireless_dev *wdev = info->user_ptr[1];
4049
4050         if (!rdev->ops->del_virtual_intf)
4051                 return -EOPNOTSUPP;
4052
4053         /*
4054          * We hold RTNL, so this is safe, without RTNL opencount cannot
4055          * reach 0, and thus the rdev cannot be deleted.
4056          *
4057          * We need to do it for the dev_close(), since that will call
4058          * the netdev notifiers, and we need to acquire the mutex there
4059          * but don't know if we get there from here or from some other
4060          * place (e.g. "ip link set ... down").
4061          */
4062         mutex_unlock(&rdev->wiphy.mtx);
4063
4064         /*
4065          * If we remove a wireless device without a netdev then clear
4066          * user_ptr[1] so that nl80211_post_doit won't dereference it
4067          * to check if it needs to do dev_put(). Otherwise it crashes
4068          * since the wdev has been freed, unlike with a netdev where
4069          * we need the dev_put() for the netdev to really be freed.
4070          */
4071         if (!wdev->netdev)
4072                 info->user_ptr[1] = NULL;
4073         else
4074                 dev_close(wdev->netdev);
4075
4076         mutex_lock(&rdev->wiphy.mtx);
4077
4078         return rdev_del_virtual_intf(rdev, wdev);
4079 }
4080
4081 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4082 {
4083         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4084         struct net_device *dev = info->user_ptr[1];
4085         u16 noack_map;
4086
4087         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4088                 return -EINVAL;
4089
4090         if (!rdev->ops->set_noack_map)
4091                 return -EOPNOTSUPP;
4092
4093         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4094
4095         return rdev_set_noack_map(rdev, dev, noack_map);
4096 }
4097
4098 struct get_key_cookie {
4099         struct sk_buff *msg;
4100         int error;
4101         int idx;
4102 };
4103
4104 static void get_key_callback(void *c, struct key_params *params)
4105 {
4106         struct nlattr *key;
4107         struct get_key_cookie *cookie = c;
4108
4109         if ((params->key &&
4110              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4111                      params->key_len, params->key)) ||
4112             (params->seq &&
4113              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4114                      params->seq_len, params->seq)) ||
4115             (params->cipher &&
4116              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4117                          params->cipher)))
4118                 goto nla_put_failure;
4119
4120         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4121         if (!key)
4122                 goto nla_put_failure;
4123
4124         if ((params->key &&
4125              nla_put(cookie->msg, NL80211_KEY_DATA,
4126                      params->key_len, params->key)) ||
4127             (params->seq &&
4128              nla_put(cookie->msg, NL80211_KEY_SEQ,
4129                      params->seq_len, params->seq)) ||
4130             (params->cipher &&
4131              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4132                          params->cipher)))
4133                 goto nla_put_failure;
4134
4135         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4136                 goto nla_put_failure;
4137
4138         nla_nest_end(cookie->msg, key);
4139
4140         return;
4141  nla_put_failure:
4142         cookie->error = 1;
4143 }
4144
4145 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4146 {
4147         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4148         int err;
4149         struct net_device *dev = info->user_ptr[1];
4150         u8 key_idx = 0;
4151         const u8 *mac_addr = NULL;
4152         bool pairwise;
4153         struct get_key_cookie cookie = {
4154                 .error = 0,
4155         };
4156         void *hdr;
4157         struct sk_buff *msg;
4158         bool bigtk_support = false;
4159
4160         if (wiphy_ext_feature_isset(&rdev->wiphy,
4161                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4162                 bigtk_support = true;
4163
4164         if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4165              dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4166             wiphy_ext_feature_isset(&rdev->wiphy,
4167                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4168                 bigtk_support = true;
4169
4170         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4171                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4172
4173                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4174                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4175                         return -EINVAL;
4176                 }
4177         }
4178
4179         if (info->attrs[NL80211_ATTR_MAC])
4180                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4181
4182         pairwise = !!mac_addr;
4183         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4184                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4185
4186                 if (kt != NL80211_KEYTYPE_GROUP &&
4187                     kt != NL80211_KEYTYPE_PAIRWISE)
4188                         return -EINVAL;
4189                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4190         }
4191
4192         if (!rdev->ops->get_key)
4193                 return -EOPNOTSUPP;
4194
4195         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4196                 return -ENOENT;
4197
4198         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4199         if (!msg)
4200                 return -ENOMEM;
4201
4202         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4203                              NL80211_CMD_NEW_KEY);
4204         if (!hdr)
4205                 goto nla_put_failure;
4206
4207         cookie.msg = msg;
4208         cookie.idx = key_idx;
4209
4210         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4211             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4212                 goto nla_put_failure;
4213         if (mac_addr &&
4214             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4215                 goto nla_put_failure;
4216
4217         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4218                            get_key_callback);
4219
4220         if (err)
4221                 goto free_msg;
4222
4223         if (cookie.error)
4224                 goto nla_put_failure;
4225
4226         genlmsg_end(msg, hdr);
4227         return genlmsg_reply(msg, info);
4228
4229  nla_put_failure:
4230         err = -ENOBUFS;
4231  free_msg:
4232         nlmsg_free(msg);
4233         return err;
4234 }
4235
4236 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4237 {
4238         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4239         struct key_parse key;
4240         int err;
4241         struct net_device *dev = info->user_ptr[1];
4242
4243         err = nl80211_parse_key(info, &key);
4244         if (err)
4245                 return err;
4246
4247         if (key.idx < 0)
4248                 return -EINVAL;
4249
4250         /* Only support setting default key and
4251          * Extended Key ID action NL80211_KEY_SET_TX.
4252          */
4253         if (!key.def && !key.defmgmt && !key.defbeacon &&
4254             !(key.p.mode == NL80211_KEY_SET_TX))
4255                 return -EINVAL;
4256
4257         wdev_lock(dev->ieee80211_ptr);
4258
4259         if (key.def) {
4260                 if (!rdev->ops->set_default_key) {
4261                         err = -EOPNOTSUPP;
4262                         goto out;
4263                 }
4264
4265                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4266                 if (err)
4267                         goto out;
4268
4269                 err = rdev_set_default_key(rdev, dev, key.idx,
4270                                                  key.def_uni, key.def_multi);
4271
4272                 if (err)
4273                         goto out;
4274
4275 #ifdef CONFIG_CFG80211_WEXT
4276                 dev->ieee80211_ptr->wext.default_key = key.idx;
4277 #endif
4278         } else if (key.defmgmt) {
4279                 if (key.def_uni || !key.def_multi) {
4280                         err = -EINVAL;
4281                         goto out;
4282                 }
4283
4284                 if (!rdev->ops->set_default_mgmt_key) {
4285                         err = -EOPNOTSUPP;
4286                         goto out;
4287                 }
4288
4289                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4290                 if (err)
4291                         goto out;
4292
4293                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4294                 if (err)
4295                         goto out;
4296
4297 #ifdef CONFIG_CFG80211_WEXT
4298                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4299 #endif
4300         } else if (key.defbeacon) {
4301                 if (key.def_uni || !key.def_multi) {
4302                         err = -EINVAL;
4303                         goto out;
4304                 }
4305
4306                 if (!rdev->ops->set_default_beacon_key) {
4307                         err = -EOPNOTSUPP;
4308                         goto out;
4309                 }
4310
4311                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4312                 if (err)
4313                         goto out;
4314
4315                 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4316                 if (err)
4317                         goto out;
4318         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4319                    wiphy_ext_feature_isset(&rdev->wiphy,
4320                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4321                 u8 *mac_addr = NULL;
4322
4323                 if (info->attrs[NL80211_ATTR_MAC])
4324                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4325
4326                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4327                         err = -EINVAL;
4328                         goto out;
4329                 }
4330
4331                 err = rdev_add_key(rdev, dev, key.idx,
4332                                    NL80211_KEYTYPE_PAIRWISE,
4333                                    mac_addr, &key.p);
4334         } else {
4335                 err = -EINVAL;
4336         }
4337  out:
4338         wdev_unlock(dev->ieee80211_ptr);
4339
4340         return err;
4341 }
4342
4343 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4344 {
4345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4346         int err;
4347         struct net_device *dev = info->user_ptr[1];
4348         struct key_parse key;
4349         const u8 *mac_addr = NULL;
4350
4351         err = nl80211_parse_key(info, &key);
4352         if (err)
4353                 return err;
4354
4355         if (!key.p.key) {
4356                 GENL_SET_ERR_MSG(info, "no key");
4357                 return -EINVAL;
4358         }
4359
4360         if (info->attrs[NL80211_ATTR_MAC])
4361                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4362
4363         if (key.type == -1) {
4364                 if (mac_addr)
4365                         key.type = NL80211_KEYTYPE_PAIRWISE;
4366                 else
4367                         key.type = NL80211_KEYTYPE_GROUP;
4368         }
4369
4370         /* for now */
4371         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4372             key.type != NL80211_KEYTYPE_GROUP) {
4373                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4374                 return -EINVAL;
4375         }
4376
4377         if (key.type == NL80211_KEYTYPE_GROUP &&
4378             info->attrs[NL80211_ATTR_VLAN_ID])
4379                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4380
4381         if (!rdev->ops->add_key)
4382                 return -EOPNOTSUPP;
4383
4384         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4385                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4386                                            mac_addr)) {
4387                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4388                 return -EINVAL;
4389         }
4390
4391         wdev_lock(dev->ieee80211_ptr);
4392         err = nl80211_key_allowed(dev->ieee80211_ptr);
4393         if (err)
4394                 GENL_SET_ERR_MSG(info, "key not allowed");
4395         if (!err) {
4396                 err = rdev_add_key(rdev, dev, key.idx,
4397                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4398                                     mac_addr, &key.p);
4399                 if (err)
4400                         GENL_SET_ERR_MSG(info, "key addition failed");
4401         }
4402         wdev_unlock(dev->ieee80211_ptr);
4403
4404         return err;
4405 }
4406
4407 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4408 {
4409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4410         int err;
4411         struct net_device *dev = info->user_ptr[1];
4412         u8 *mac_addr = NULL;
4413         struct key_parse key;
4414
4415         err = nl80211_parse_key(info, &key);
4416         if (err)
4417                 return err;
4418
4419         if (info->attrs[NL80211_ATTR_MAC])
4420                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4421
4422         if (key.type == -1) {
4423                 if (mac_addr)
4424                         key.type = NL80211_KEYTYPE_PAIRWISE;
4425                 else
4426                         key.type = NL80211_KEYTYPE_GROUP;
4427         }
4428
4429         /* for now */
4430         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4431             key.type != NL80211_KEYTYPE_GROUP)
4432                 return -EINVAL;
4433
4434         if (!cfg80211_valid_key_idx(rdev, key.idx,
4435                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4436                 return -EINVAL;
4437
4438         if (!rdev->ops->del_key)
4439                 return -EOPNOTSUPP;
4440
4441         wdev_lock(dev->ieee80211_ptr);
4442         err = nl80211_key_allowed(dev->ieee80211_ptr);
4443
4444         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4445             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4446                 err = -ENOENT;
4447
4448         if (!err)
4449                 err = rdev_del_key(rdev, dev, key.idx,
4450                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4451                                    mac_addr);
4452
4453 #ifdef CONFIG_CFG80211_WEXT
4454         if (!err) {
4455                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4456                         dev->ieee80211_ptr->wext.default_key = -1;
4457                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4458                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4459         }
4460 #endif
4461         wdev_unlock(dev->ieee80211_ptr);
4462
4463         return err;
4464 }
4465
4466 /* This function returns an error or the number of nested attributes */
4467 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4468 {
4469         struct nlattr *attr;
4470         int n_entries = 0, tmp;
4471
4472         nla_for_each_nested(attr, nl_attr, tmp) {
4473                 if (nla_len(attr) != ETH_ALEN)
4474                         return -EINVAL;
4475
4476                 n_entries++;
4477         }
4478
4479         return n_entries;
4480 }
4481
4482 /*
4483  * This function parses ACL information and allocates memory for ACL data.
4484  * On successful return, the calling function is responsible to free the
4485  * ACL buffer returned by this function.
4486  */
4487 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4488                                                 struct genl_info *info)
4489 {
4490         enum nl80211_acl_policy acl_policy;
4491         struct nlattr *attr;
4492         struct cfg80211_acl_data *acl;
4493         int i = 0, n_entries, tmp;
4494
4495         if (!wiphy->max_acl_mac_addrs)
4496                 return ERR_PTR(-EOPNOTSUPP);
4497
4498         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4499                 return ERR_PTR(-EINVAL);
4500
4501         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4502         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4503             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4504                 return ERR_PTR(-EINVAL);
4505
4506         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4507                 return ERR_PTR(-EINVAL);
4508
4509         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4510         if (n_entries < 0)
4511                 return ERR_PTR(n_entries);
4512
4513         if (n_entries > wiphy->max_acl_mac_addrs)
4514                 return ERR_PTR(-ENOTSUPP);
4515
4516         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4517         if (!acl)
4518                 return ERR_PTR(-ENOMEM);
4519
4520         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4521                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4522                 i++;
4523         }
4524
4525         acl->n_acl_entries = n_entries;
4526         acl->acl_policy = acl_policy;
4527
4528         return acl;
4529 }
4530
4531 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4532 {
4533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4534         struct net_device *dev = info->user_ptr[1];
4535         struct cfg80211_acl_data *acl;
4536         int err;
4537
4538         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4539             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4540                 return -EOPNOTSUPP;
4541
4542         if (!dev->ieee80211_ptr->beacon_interval)
4543                 return -EINVAL;
4544
4545         acl = parse_acl_data(&rdev->wiphy, info);
4546         if (IS_ERR(acl))
4547                 return PTR_ERR(acl);
4548
4549         err = rdev_set_mac_acl(rdev, dev, acl);
4550
4551         kfree(acl);
4552
4553         return err;
4554 }
4555
4556 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4557                            u8 *rates, u8 rates_len)
4558 {
4559         u8 i;
4560         u32 mask = 0;
4561
4562         for (i = 0; i < rates_len; i++) {
4563                 int rate = (rates[i] & 0x7f) * 5;
4564                 int ridx;
4565
4566                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4567                         struct ieee80211_rate *srate =
4568                                 &sband->bitrates[ridx];
4569                         if (rate == srate->bitrate) {
4570                                 mask |= 1 << ridx;
4571                                 break;
4572                         }
4573                 }
4574                 if (ridx == sband->n_bitrates)
4575                         return 0; /* rate not found */
4576         }
4577
4578         return mask;
4579 }
4580
4581 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4582                                u8 *rates, u8 rates_len,
4583                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4584 {
4585         u8 i;
4586
4587         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4588
4589         for (i = 0; i < rates_len; i++) {
4590                 int ridx, rbit;
4591
4592                 ridx = rates[i] / 8;
4593                 rbit = BIT(rates[i] % 8);
4594
4595                 /* check validity */
4596                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4597                         return false;
4598
4599                 /* check availability */
4600                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4601                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4602                         mcs[ridx] |= rbit;
4603                 else
4604                         return false;
4605         }
4606
4607         return true;
4608 }
4609
4610 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4611 {
4612         u16 mcs_mask = 0;
4613
4614         switch (vht_mcs_map) {
4615         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4616                 break;
4617         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4618                 mcs_mask = 0x00FF;
4619                 break;
4620         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4621                 mcs_mask = 0x01FF;
4622                 break;
4623         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4624                 mcs_mask = 0x03FF;
4625                 break;
4626         default:
4627                 break;
4628         }
4629
4630         return mcs_mask;
4631 }
4632
4633 static void vht_build_mcs_mask(u16 vht_mcs_map,
4634                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4635 {
4636         u8 nss;
4637
4638         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4639                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4640                 vht_mcs_map >>= 2;
4641         }
4642 }
4643
4644 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4645                              struct nl80211_txrate_vht *txrate,
4646                              u16 mcs[NL80211_VHT_NSS_MAX])
4647 {
4648         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4649         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4650         u8 i;
4651
4652         if (!sband->vht_cap.vht_supported)
4653                 return false;
4654
4655         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4656
4657         /* Build vht_mcs_mask from VHT capabilities */
4658         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4659
4660         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4661                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4662                         mcs[i] = txrate->mcs[i];
4663                 else
4664                         return false;
4665         }
4666
4667         return true;
4668 }
4669
4670 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4671 {
4672         switch (he_mcs_map) {
4673         case IEEE80211_HE_MCS_NOT_SUPPORTED:
4674                 return 0;
4675         case IEEE80211_HE_MCS_SUPPORT_0_7:
4676                 return 0x00FF;
4677         case IEEE80211_HE_MCS_SUPPORT_0_9:
4678                 return 0x03FF;
4679         case IEEE80211_HE_MCS_SUPPORT_0_11:
4680                 return 0xFFF;
4681         default:
4682                 break;
4683         }
4684         return 0;
4685 }
4686
4687 static void he_build_mcs_mask(u16 he_mcs_map,
4688                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4689 {
4690         u8 nss;
4691
4692         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4693                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4694                 he_mcs_map >>= 2;
4695         }
4696 }
4697
4698 static u16 he_get_txmcsmap(struct genl_info *info,
4699                            const struct ieee80211_sta_he_cap *he_cap)
4700 {
4701         struct net_device *dev = info->user_ptr[1];
4702         struct wireless_dev *wdev = dev->ieee80211_ptr;
4703         __le16  tx_mcs;
4704
4705         switch (wdev->chandef.width) {
4706         case NL80211_CHAN_WIDTH_80P80:
4707                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4708                 break;
4709         case NL80211_CHAN_WIDTH_160:
4710                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4711                 break;
4712         default:
4713                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4714                 break;
4715         }
4716         return le16_to_cpu(tx_mcs);
4717 }
4718
4719 static bool he_set_mcs_mask(struct genl_info *info,
4720                             struct wireless_dev *wdev,
4721                             struct ieee80211_supported_band *sband,
4722                             struct nl80211_txrate_he *txrate,
4723                             u16 mcs[NL80211_HE_NSS_MAX])
4724 {
4725         const struct ieee80211_sta_he_cap *he_cap;
4726         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4727         u16 tx_mcs_map = 0;
4728         u8 i;
4729
4730         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4731         if (!he_cap)
4732                 return false;
4733
4734         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4735
4736         tx_mcs_map = he_get_txmcsmap(info, he_cap);
4737
4738         /* Build he_mcs_mask from HE capabilities */
4739         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4740
4741         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4742                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4743                         mcs[i] = txrate->mcs[i];
4744                 else
4745                         return false;
4746         }
4747
4748         return true;
4749 }
4750
4751 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4752                                          struct nlattr *attrs[],
4753                                          enum nl80211_attrs attr,
4754                                          struct cfg80211_bitrate_mask *mask,
4755                                          struct net_device *dev,
4756                                          bool default_all_enabled)
4757 {
4758         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4760         struct wireless_dev *wdev = dev->ieee80211_ptr;
4761         int rem, i;
4762         struct nlattr *tx_rates;
4763         struct ieee80211_supported_band *sband;
4764         u16 vht_tx_mcs_map, he_tx_mcs_map;
4765
4766         memset(mask, 0, sizeof(*mask));
4767         /* Default to all rates enabled */
4768         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4769                 const struct ieee80211_sta_he_cap *he_cap;
4770
4771                 if (!default_all_enabled)
4772                         break;
4773
4774                 sband = rdev->wiphy.bands[i];
4775
4776                 if (!sband)
4777                         continue;
4778
4779                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4780                 memcpy(mask->control[i].ht_mcs,
4781                        sband->ht_cap.mcs.rx_mask,
4782                        sizeof(mask->control[i].ht_mcs));
4783
4784                 if (sband->vht_cap.vht_supported) {
4785                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4786                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4787                 }
4788
4789                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4790                 if (!he_cap)
4791                         continue;
4792
4793                 he_tx_mcs_map = he_get_txmcsmap(info, he_cap);
4794                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4795
4796                 mask->control[i].he_gi = 0xFF;
4797                 mask->control[i].he_ltf = 0xFF;
4798         }
4799
4800         /* if no rates are given set it back to the defaults */
4801         if (!attrs[attr])
4802                 goto out;
4803
4804         /* The nested attribute uses enum nl80211_band as the index. This maps
4805          * directly to the enum nl80211_band values used in cfg80211.
4806          */
4807         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4808         nla_for_each_nested(tx_rates, attrs[attr], rem) {
4809                 enum nl80211_band band = nla_type(tx_rates);
4810                 int err;
4811
4812                 if (band < 0 || band >= NUM_NL80211_BANDS)
4813                         return -EINVAL;
4814                 sband = rdev->wiphy.bands[band];
4815                 if (sband == NULL)
4816                         return -EINVAL;
4817                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4818                                                   tx_rates,
4819                                                   nl80211_txattr_policy,
4820                                                   info->extack);
4821                 if (err)
4822                         return err;
4823                 if (tb[NL80211_TXRATE_LEGACY]) {
4824                         mask->control[band].legacy = rateset_to_mask(
4825                                 sband,
4826                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4827                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4828                         if ((mask->control[band].legacy == 0) &&
4829                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4830                                 return -EINVAL;
4831                 }
4832                 if (tb[NL80211_TXRATE_HT]) {
4833                         if (!ht_rateset_to_mask(
4834                                         sband,
4835                                         nla_data(tb[NL80211_TXRATE_HT]),
4836                                         nla_len(tb[NL80211_TXRATE_HT]),
4837                                         mask->control[band].ht_mcs))
4838                                 return -EINVAL;
4839                 }
4840
4841                 if (tb[NL80211_TXRATE_VHT]) {
4842                         if (!vht_set_mcs_mask(
4843                                         sband,
4844                                         nla_data(tb[NL80211_TXRATE_VHT]),
4845                                         mask->control[band].vht_mcs))
4846                                 return -EINVAL;
4847                 }
4848
4849                 if (tb[NL80211_TXRATE_GI]) {
4850                         mask->control[band].gi =
4851                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4852                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4853                                 return -EINVAL;
4854                 }
4855                 if (tb[NL80211_TXRATE_HE] &&
4856                     !he_set_mcs_mask(info, wdev, sband,
4857                                      nla_data(tb[NL80211_TXRATE_HE]),
4858                                      mask->control[band].he_mcs))
4859                         return -EINVAL;
4860
4861                 if (tb[NL80211_TXRATE_HE_GI])
4862                         mask->control[band].he_gi =
4863                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
4864                 if (tb[NL80211_TXRATE_HE_LTF])
4865                         mask->control[band].he_ltf =
4866                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
4867
4868                 if (mask->control[band].legacy == 0) {
4869                         /* don't allow empty legacy rates if HT, VHT or HE
4870                          * are not even supported.
4871                          */
4872                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4873                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
4874                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
4875                                 return -EINVAL;
4876
4877                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4878                                 if (mask->control[band].ht_mcs[i])
4879                                         goto out;
4880
4881                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4882                                 if (mask->control[band].vht_mcs[i])
4883                                         goto out;
4884
4885                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
4886                                 if (mask->control[band].he_mcs[i])
4887                                         goto out;
4888
4889                         /* legacy and mcs rates may not be both empty */
4890                         return -EINVAL;
4891                 }
4892         }
4893
4894 out:
4895         return 0;
4896 }
4897
4898 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4899                                    enum nl80211_band band,
4900                                    struct cfg80211_bitrate_mask *beacon_rate)
4901 {
4902         u32 count_ht, count_vht, count_he, i;
4903         u32 rate = beacon_rate->control[band].legacy;
4904
4905         /* Allow only one rate */
4906         if (hweight32(rate) > 1)
4907                 return -EINVAL;
4908
4909         count_ht = 0;
4910         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4911                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4912                         return -EINVAL;
4913                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4914                         count_ht++;
4915                         if (count_ht > 1)
4916                                 return -EINVAL;
4917                 }
4918                 if (count_ht && rate)
4919                         return -EINVAL;
4920         }
4921
4922         count_vht = 0;
4923         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4924                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4925                         return -EINVAL;
4926                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4927                         count_vht++;
4928                         if (count_vht > 1)
4929                                 return -EINVAL;
4930                 }
4931                 if (count_vht && rate)
4932                         return -EINVAL;
4933         }
4934
4935         count_he = 0;
4936         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4937                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
4938                         return -EINVAL;
4939                 } else if (beacon_rate->control[band].he_mcs[i]) {
4940                         count_he++;
4941                         if (count_he > 1)
4942                                 return -EINVAL;
4943                 }
4944                 if (count_he && rate)
4945                         return -EINVAL;
4946         }
4947
4948         if ((count_ht && count_vht && count_he) ||
4949             (!rate && !count_ht && !count_vht && !count_he))
4950                 return -EINVAL;
4951
4952         if (rate &&
4953             !wiphy_ext_feature_isset(&rdev->wiphy,
4954                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4955                 return -EINVAL;
4956         if (count_ht &&
4957             !wiphy_ext_feature_isset(&rdev->wiphy,
4958                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4959                 return -EINVAL;
4960         if (count_vht &&
4961             !wiphy_ext_feature_isset(&rdev->wiphy,
4962                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4963                 return -EINVAL;
4964         if (count_he &&
4965             !wiphy_ext_feature_isset(&rdev->wiphy,
4966                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
4967                 return -EINVAL;
4968
4969         return 0;
4970 }
4971
4972 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4973                                 struct nlattr *attrs[],
4974                                 struct cfg80211_beacon_data *bcn)
4975 {
4976         bool haveinfo = false;
4977         int err;
4978
4979         memset(bcn, 0, sizeof(*bcn));
4980
4981         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4982                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4983                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4984                 if (!bcn->head_len)
4985                         return -EINVAL;
4986                 haveinfo = true;
4987         }
4988
4989         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4990                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4991                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4992                 haveinfo = true;
4993         }
4994
4995         if (!haveinfo)
4996                 return -EINVAL;
4997
4998         if (attrs[NL80211_ATTR_IE]) {
4999                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5000                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5001         }
5002
5003         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5004                 bcn->proberesp_ies =
5005                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5006                 bcn->proberesp_ies_len =
5007                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5008         }
5009
5010         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5011                 bcn->assocresp_ies =
5012                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5013                 bcn->assocresp_ies_len =
5014                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5015         }
5016
5017         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5018                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5019                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5020         }
5021
5022         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5023                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5024
5025                 err = nla_parse_nested_deprecated(tb,
5026                                                   NL80211_FTM_RESP_ATTR_MAX,
5027                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5028                                                   NULL, NULL);
5029                 if (err)
5030                         return err;
5031
5032                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5033                     wiphy_ext_feature_isset(&rdev->wiphy,
5034                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5035                         bcn->ftm_responder = 1;
5036                 else
5037                         return -EOPNOTSUPP;
5038
5039                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5040                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5041                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5042                 }
5043
5044                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5045                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5046                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5047                 }
5048         } else {
5049                 bcn->ftm_responder = -1;
5050         }
5051
5052         return 0;
5053 }
5054
5055 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5056                                     struct ieee80211_he_obss_pd *he_obss_pd)
5057 {
5058         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5059         int err;
5060
5061         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5062                                he_obss_pd_policy, NULL);
5063         if (err)
5064                 return err;
5065
5066         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5067                 return -EINVAL;
5068
5069         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5070
5071         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5072                 he_obss_pd->min_offset =
5073                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5074         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5075                 he_obss_pd->max_offset =
5076                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5077         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5078                 he_obss_pd->non_srg_max_offset =
5079                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5080
5081         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5082                 return -EINVAL;
5083
5084         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5085                 memcpy(he_obss_pd->bss_color_bitmap,
5086                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5087                        sizeof(he_obss_pd->bss_color_bitmap));
5088
5089         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5090                 memcpy(he_obss_pd->partial_bssid_bitmap,
5091                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5092                        sizeof(he_obss_pd->partial_bssid_bitmap));
5093
5094         he_obss_pd->enable = true;
5095
5096         return 0;
5097 }
5098
5099 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5100                                       struct cfg80211_he_bss_color *he_bss_color)
5101 {
5102         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5103         int err;
5104
5105         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5106                                he_bss_color_policy, NULL);
5107         if (err)
5108                 return err;
5109
5110         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5111                 return -EINVAL;
5112
5113         he_bss_color->color =
5114                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5115         he_bss_color->enabled =
5116                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5117         he_bss_color->partial =
5118                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5119
5120         return 0;
5121 }
5122
5123 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5124                                         struct nlattr *attrs,
5125                                         struct cfg80211_ap_settings *params)
5126 {
5127         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5128         int ret;
5129         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5130
5131         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5132                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5133                 return -EINVAL;
5134
5135         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5136                                NULL, NULL);
5137         if (ret)
5138                 return ret;
5139
5140         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5141             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5142             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5143                 return -EINVAL;
5144
5145         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5146         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5147         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5148         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5149
5150         return 0;
5151 }
5152
5153 static int
5154 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5155                                      struct nlattr *attrs,
5156                                      struct cfg80211_ap_settings *params)
5157 {
5158         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5159         int ret;
5160         struct cfg80211_unsol_bcast_probe_resp *presp =
5161                                         &params->unsol_bcast_probe_resp;
5162
5163         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5164                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5165                 return -EINVAL;
5166
5167         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5168                                attrs, NULL, NULL);
5169         if (ret)
5170                 return ret;
5171
5172         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5173             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5174                 return -EINVAL;
5175
5176         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5177         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5178         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5179         return 0;
5180 }
5181
5182 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5183                                             const u8 *rates)
5184 {
5185         int i;
5186
5187         if (!rates)
5188                 return;
5189
5190         for (i = 0; i < rates[1]; i++) {
5191                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5192                         params->ht_required = true;
5193                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5194                         params->vht_required = true;
5195                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5196                         params->he_required = true;
5197                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5198                         params->sae_h2e_required = true;
5199         }
5200 }
5201
5202 /*
5203  * Since the nl80211 API didn't include, from the beginning, attributes about
5204  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5205  * benefit of drivers that rebuild IEs in the firmware.
5206  */
5207 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5208 {
5209         const struct cfg80211_beacon_data *bcn = &params->beacon;
5210         size_t ies_len = bcn->tail_len;
5211         const u8 *ies = bcn->tail;
5212         const u8 *rates;
5213         const u8 *cap;
5214
5215         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
5216         nl80211_check_ap_rate_selectors(params, rates);
5217
5218         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5219         nl80211_check_ap_rate_selectors(params, rates);
5220
5221         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5222         if (cap && cap[1] >= sizeof(*params->ht_cap))
5223                 params->ht_cap = (void *)(cap + 2);
5224         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5225         if (cap && cap[1] >= sizeof(*params->vht_cap))
5226                 params->vht_cap = (void *)(cap + 2);
5227         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5228         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
5229                 params->he_cap = (void *)(cap + 3);
5230         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5231         if (cap && cap[1] >= sizeof(*params->he_oper) + 1)
5232                 params->he_oper = (void *)(cap + 3);
5233 }
5234
5235 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5236                                    struct cfg80211_ap_settings *params)
5237 {
5238         struct wireless_dev *wdev;
5239         bool ret = false;
5240
5241         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5242                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5243                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5244                         continue;
5245
5246                 if (!wdev->preset_chandef.chan)
5247                         continue;
5248
5249                 params->chandef = wdev->preset_chandef;
5250                 ret = true;
5251                 break;
5252         }
5253
5254         return ret;
5255 }
5256
5257 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5258                                     enum nl80211_auth_type auth_type,
5259                                     enum nl80211_commands cmd)
5260 {
5261         if (auth_type > NL80211_AUTHTYPE_MAX)
5262                 return false;
5263
5264         switch (cmd) {
5265         case NL80211_CMD_AUTHENTICATE:
5266                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5267                     auth_type == NL80211_AUTHTYPE_SAE)
5268                         return false;
5269                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5270                                              NL80211_EXT_FEATURE_FILS_STA) &&
5271                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5272                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5273                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5274                         return false;
5275                 return true;
5276         case NL80211_CMD_CONNECT:
5277                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5278                     !wiphy_ext_feature_isset(&rdev->wiphy,
5279                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5280                     auth_type == NL80211_AUTHTYPE_SAE)
5281                         return false;
5282
5283                 /* FILS with SK PFS or PK not supported yet */
5284                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5285                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5286                         return false;
5287                 if (!wiphy_ext_feature_isset(
5288                             &rdev->wiphy,
5289                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5290                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5291                         return false;
5292                 return true;
5293         case NL80211_CMD_START_AP:
5294                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5295                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5296                     auth_type == NL80211_AUTHTYPE_SAE)
5297                         return false;
5298                 /* FILS not supported yet */
5299                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5300                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5301                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5302                         return false;
5303                 return true;
5304         default:
5305                 return false;
5306         }
5307 }
5308
5309 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5310 {
5311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5312         struct net_device *dev = info->user_ptr[1];
5313         struct wireless_dev *wdev = dev->ieee80211_ptr;
5314         struct cfg80211_ap_settings params;
5315         int err;
5316
5317         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5318             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5319                 return -EOPNOTSUPP;
5320
5321         if (!rdev->ops->start_ap)
5322                 return -EOPNOTSUPP;
5323
5324         if (wdev->beacon_interval)
5325                 return -EALREADY;
5326
5327         memset(&params, 0, sizeof(params));
5328
5329         /* these are required for START_AP */
5330         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5331             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5332             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5333                 return -EINVAL;
5334
5335         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
5336         if (err)
5337                 return err;
5338
5339         params.beacon_interval =
5340                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5341         params.dtim_period =
5342                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5343
5344         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5345                                            params.beacon_interval);
5346         if (err)
5347                 return err;
5348
5349         /*
5350          * In theory, some of these attributes should be required here
5351          * but since they were not used when the command was originally
5352          * added, keep them optional for old user space programs to let
5353          * them continue to work with drivers that do not need the
5354          * additional information -- drivers must check!
5355          */
5356         if (info->attrs[NL80211_ATTR_SSID]) {
5357                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5358                 params.ssid_len =
5359                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5360                 if (params.ssid_len == 0)
5361                         return -EINVAL;
5362         }
5363
5364         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5365                 params.hidden_ssid = nla_get_u32(
5366                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5367
5368         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5369
5370         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5371                 params.auth_type = nla_get_u32(
5372                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5373                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
5374                                              NL80211_CMD_START_AP))
5375                         return -EINVAL;
5376         } else
5377                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5378
5379         err = nl80211_crypto_settings(rdev, info, &params.crypto,
5380                                       NL80211_MAX_NR_CIPHER_SUITES);
5381         if (err)
5382                 return err;
5383
5384         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5385                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
5386                         return -EOPNOTSUPP;
5387                 params.inactivity_timeout = nla_get_u16(
5388                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5389         }
5390
5391         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5392                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5393                         return -EINVAL;
5394                 params.p2p_ctwindow =
5395                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5396                 if (params.p2p_ctwindow != 0 &&
5397                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5398                         return -EINVAL;
5399         }
5400
5401         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5402                 u8 tmp;
5403
5404                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5405                         return -EINVAL;
5406                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5407                 params.p2p_opp_ps = tmp;
5408                 if (params.p2p_opp_ps != 0 &&
5409                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5410                         return -EINVAL;
5411         }
5412
5413         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5414                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
5415                 if (err)
5416                         return err;
5417         } else if (wdev->preset_chandef.chan) {
5418                 params.chandef = wdev->preset_chandef;
5419         } else if (!nl80211_get_ap_channel(rdev, &params))
5420                 return -EINVAL;
5421
5422         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
5423                                            wdev->iftype))
5424                 return -EINVAL;
5425
5426         if (info->attrs[NL80211_ATTR_TX_RATES]) {
5427                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5428                                                     NL80211_ATTR_TX_RATES,
5429                                                     &params.beacon_rate,
5430                                                     dev, false);
5431                 if (err)
5432                         return err;
5433
5434                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
5435                                               &params.beacon_rate);
5436                 if (err)
5437                         return err;
5438         }
5439
5440         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5441                 params.smps_mode =
5442                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5443                 switch (params.smps_mode) {
5444                 case NL80211_SMPS_OFF:
5445                         break;
5446                 case NL80211_SMPS_STATIC:
5447                         if (!(rdev->wiphy.features &
5448                               NL80211_FEATURE_STATIC_SMPS))
5449                                 return -EINVAL;
5450                         break;
5451                 case NL80211_SMPS_DYNAMIC:
5452                         if (!(rdev->wiphy.features &
5453                               NL80211_FEATURE_DYNAMIC_SMPS))
5454                                 return -EINVAL;
5455                         break;
5456                 default:
5457                         return -EINVAL;
5458                 }
5459         } else {
5460                 params.smps_mode = NL80211_SMPS_OFF;
5461         }
5462
5463         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5464         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
5465                 return -EOPNOTSUPP;
5466
5467         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5468                 params.acl = parse_acl_data(&rdev->wiphy, info);
5469                 if (IS_ERR(params.acl))
5470                         return PTR_ERR(params.acl);
5471         }
5472
5473         params.twt_responder =
5474                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5475
5476         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5477                 err = nl80211_parse_he_obss_pd(
5478                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
5479                                         &params.he_obss_pd);
5480                 if (err)
5481                         goto out;
5482         }
5483
5484         if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5485                 err = nl80211_parse_he_bss_color(
5486                                         info->attrs[NL80211_ATTR_HE_BSS_COLOR],
5487                                         &params.he_bss_color);
5488                 if (err)
5489                         goto out;
5490         }
5491
5492         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5493                 err = nl80211_parse_fils_discovery(rdev,
5494                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5495                                                    &params);
5496                 if (err)
5497                         goto out;
5498         }
5499
5500         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5501                 err = nl80211_parse_unsol_bcast_probe_resp(
5502                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5503                         &params);
5504                 if (err)
5505                         goto out;
5506         }
5507
5508         nl80211_calculate_ap_params(&params);
5509
5510         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5511                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5512
5513         wdev_lock(wdev);
5514         err = rdev_start_ap(rdev, dev, &params);
5515         if (!err) {
5516                 wdev->preset_chandef = params.chandef;
5517                 wdev->beacon_interval = params.beacon_interval;
5518                 wdev->chandef = params.chandef;
5519                 wdev->ssid_len = params.ssid_len;
5520                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5521
5522                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5523                         wdev->conn_owner_nlportid = info->snd_portid;
5524         }
5525         wdev_unlock(wdev);
5526
5527 out:
5528         kfree(params.acl);
5529
5530         return err;
5531 }
5532
5533 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5534 {
5535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5536         struct net_device *dev = info->user_ptr[1];
5537         struct wireless_dev *wdev = dev->ieee80211_ptr;
5538         struct cfg80211_beacon_data params;
5539         int err;
5540
5541         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5542             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5543                 return -EOPNOTSUPP;
5544
5545         if (!rdev->ops->change_beacon)
5546                 return -EOPNOTSUPP;
5547
5548         if (!wdev->beacon_interval)
5549                 return -EINVAL;
5550
5551         err = nl80211_parse_beacon(rdev, info->attrs, &params);
5552         if (err)
5553                 return err;
5554
5555         wdev_lock(wdev);
5556         err = rdev_change_beacon(rdev, dev, &params);
5557         wdev_unlock(wdev);
5558
5559         return err;
5560 }
5561
5562 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5563 {
5564         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5565         struct net_device *dev = info->user_ptr[1];
5566
5567         return cfg80211_stop_ap(rdev, dev, false);
5568 }
5569
5570 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5571         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5572         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5573         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5574         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5575         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5576         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5577 };
5578
5579 static int parse_station_flags(struct genl_info *info,
5580                                enum nl80211_iftype iftype,
5581                                struct station_parameters *params)
5582 {
5583         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5584         struct nlattr *nla;
5585         int flag;
5586
5587         /*
5588          * Try parsing the new attribute first so userspace
5589          * can specify both for older kernels.
5590          */
5591         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5592         if (nla) {
5593                 struct nl80211_sta_flag_update *sta_flags;
5594
5595                 sta_flags = nla_data(nla);
5596                 params->sta_flags_mask = sta_flags->mask;
5597                 params->sta_flags_set = sta_flags->set;
5598                 params->sta_flags_set &= params->sta_flags_mask;
5599                 if ((params->sta_flags_mask |
5600                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5601                         return -EINVAL;
5602                 return 0;
5603         }
5604
5605         /* if present, parse the old attribute */
5606
5607         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5608         if (!nla)
5609                 return 0;
5610
5611         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5612                 return -EINVAL;
5613
5614         /*
5615          * Only allow certain flags for interface types so that
5616          * other attributes are silently ignored. Remember that
5617          * this is backward compatibility code with old userspace
5618          * and shouldn't be hit in other cases anyway.
5619          */
5620         switch (iftype) {
5621         case NL80211_IFTYPE_AP:
5622         case NL80211_IFTYPE_AP_VLAN:
5623         case NL80211_IFTYPE_P2P_GO:
5624                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5625                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5626                                          BIT(NL80211_STA_FLAG_WME) |
5627                                          BIT(NL80211_STA_FLAG_MFP);
5628                 break;
5629         case NL80211_IFTYPE_P2P_CLIENT:
5630         case NL80211_IFTYPE_STATION:
5631                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5632                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
5633                 break;
5634         case NL80211_IFTYPE_MESH_POINT:
5635                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5636                                          BIT(NL80211_STA_FLAG_MFP) |
5637                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
5638                 break;
5639         default:
5640                 return -EINVAL;
5641         }
5642
5643         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5644                 if (flags[flag]) {
5645                         params->sta_flags_set |= (1<<flag);
5646
5647                         /* no longer support new API additions in old API */
5648                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5649                                 return -EINVAL;
5650                 }
5651         }
5652
5653         return 0;
5654 }
5655
5656 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5657 {
5658         struct nlattr *rate;
5659         u32 bitrate;
5660         u16 bitrate_compat;
5661         enum nl80211_rate_info rate_flg;
5662
5663         rate = nla_nest_start_noflag(msg, attr);
5664         if (!rate)
5665                 return false;
5666
5667         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5668         bitrate = cfg80211_calculate_bitrate(info);
5669         /* report 16-bit bitrate only if we can */
5670         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5671         if (bitrate > 0 &&
5672             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5673                 return false;
5674         if (bitrate_compat > 0 &&
5675             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5676                 return false;
5677
5678         switch (info->bw) {
5679         case RATE_INFO_BW_5:
5680                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5681                 break;
5682         case RATE_INFO_BW_10:
5683                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5684                 break;
5685         default:
5686                 WARN_ON(1);
5687                 fallthrough;
5688         case RATE_INFO_BW_20:
5689                 rate_flg = 0;
5690                 break;
5691         case RATE_INFO_BW_40:
5692                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5693                 break;
5694         case RATE_INFO_BW_80:
5695                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5696                 break;
5697         case RATE_INFO_BW_160:
5698                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5699                 break;
5700         case RATE_INFO_BW_HE_RU:
5701                 rate_flg = 0;
5702                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5703         }
5704
5705         if (rate_flg && nla_put_flag(msg, rate_flg))
5706                 return false;
5707
5708         if (info->flags & RATE_INFO_FLAGS_MCS) {
5709                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5710                         return false;
5711                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5712                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5713                         return false;
5714         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5715                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5716                         return false;
5717                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5718                         return false;
5719                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5720                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5721                         return false;
5722         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5723                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5724                         return false;
5725                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5726                         return false;
5727                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5728                         return false;
5729                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5730                         return false;
5731                 if (info->bw == RATE_INFO_BW_HE_RU &&
5732                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5733                                info->he_ru_alloc))
5734                         return false;
5735         }
5736
5737         nla_nest_end(msg, rate);
5738         return true;
5739 }
5740
5741 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5742                                int id)
5743 {
5744         void *attr;
5745         int i = 0;
5746
5747         if (!mask)
5748                 return true;
5749
5750         attr = nla_nest_start_noflag(msg, id);
5751         if (!attr)
5752                 return false;
5753
5754         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5755                 if (!(mask & BIT(i)))
5756                         continue;
5757
5758                 if (nla_put_u8(msg, i, signal[i]))
5759                         return false;
5760         }
5761
5762         nla_nest_end(msg, attr);
5763
5764         return true;
5765 }
5766
5767 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5768                                 u32 seq, int flags,
5769                                 struct cfg80211_registered_device *rdev,
5770                                 struct net_device *dev,
5771                                 const u8 *mac_addr, struct station_info *sinfo)
5772 {
5773         void *hdr;
5774         struct nlattr *sinfoattr, *bss_param;
5775
5776         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5777         if (!hdr) {
5778                 cfg80211_sinfo_release_content(sinfo);
5779                 return -1;
5780         }
5781
5782         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5783             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5784             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5785                 goto nla_put_failure;
5786
5787         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5788         if (!sinfoattr)
5789                 goto nla_put_failure;
5790
5791 #define PUT_SINFO(attr, memb, type) do {                                \
5792         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5793         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5794             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5795                              sinfo->memb))                              \
5796                 goto nla_put_failure;                                   \
5797         } while (0)
5798 #define PUT_SINFO_U64(attr, memb) do {                                  \
5799         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5800             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5801                               sinfo->memb, NL80211_STA_INFO_PAD))       \
5802                 goto nla_put_failure;                                   \
5803         } while (0)
5804
5805         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5806         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5807         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5808
5809         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5810                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5811             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5812                         (u32)sinfo->rx_bytes))
5813                 goto nla_put_failure;
5814
5815         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5816                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5817             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5818                         (u32)sinfo->tx_bytes))
5819                 goto nla_put_failure;
5820
5821         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5822         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5823         PUT_SINFO(LLID, llid, u16);
5824         PUT_SINFO(PLID, plid, u16);
5825         PUT_SINFO(PLINK_STATE, plink_state, u8);
5826         PUT_SINFO_U64(RX_DURATION, rx_duration);
5827         PUT_SINFO_U64(TX_DURATION, tx_duration);
5828
5829         if (wiphy_ext_feature_isset(&rdev->wiphy,
5830                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5831                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5832
5833         switch (rdev->wiphy.signal_type) {
5834         case CFG80211_SIGNAL_TYPE_MBM:
5835                 PUT_SINFO(SIGNAL, signal, u8);
5836                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5837                 break;
5838         default:
5839                 break;
5840         }
5841         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5842                 if (!nl80211_put_signal(msg, sinfo->chains,
5843                                         sinfo->chain_signal,
5844                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5845                         goto nla_put_failure;
5846         }
5847         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5848                 if (!nl80211_put_signal(msg, sinfo->chains,
5849                                         sinfo->chain_signal_avg,
5850                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5851                         goto nla_put_failure;
5852         }
5853         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5854                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5855                                           NL80211_STA_INFO_TX_BITRATE))
5856                         goto nla_put_failure;
5857         }
5858         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5859                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5860                                           NL80211_STA_INFO_RX_BITRATE))
5861                         goto nla_put_failure;
5862         }
5863
5864         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5865         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5866         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5867         PUT_SINFO(TX_FAILED, tx_failed, u32);
5868         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5869         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5870         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5871         PUT_SINFO(LOCAL_PM, local_pm, u32);
5872         PUT_SINFO(PEER_PM, peer_pm, u32);
5873         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5874         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5875         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
5876
5877         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5878                 bss_param = nla_nest_start_noflag(msg,
5879                                                   NL80211_STA_INFO_BSS_PARAM);
5880                 if (!bss_param)
5881                         goto nla_put_failure;
5882
5883                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5884                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5885                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5886                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5887                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5888                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5889                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5890                                sinfo->bss_param.dtim_period) ||
5891                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5892                                 sinfo->bss_param.beacon_interval))
5893                         goto nla_put_failure;
5894
5895                 nla_nest_end(msg, bss_param);
5896         }
5897         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5898             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5899                     sizeof(struct nl80211_sta_flag_update),
5900                     &sinfo->sta_flags))
5901                 goto nla_put_failure;
5902
5903         PUT_SINFO_U64(T_OFFSET, t_offset);
5904         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5905         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5906         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5907         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5908         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5909         if (wiphy_ext_feature_isset(&rdev->wiphy,
5910                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5911                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5912                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5913         }
5914
5915 #undef PUT_SINFO
5916 #undef PUT_SINFO_U64
5917
5918         if (sinfo->pertid) {
5919                 struct nlattr *tidsattr;
5920                 int tid;
5921
5922                 tidsattr = nla_nest_start_noflag(msg,
5923                                                  NL80211_STA_INFO_TID_STATS);
5924                 if (!tidsattr)
5925                         goto nla_put_failure;
5926
5927                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5928                         struct cfg80211_tid_stats *tidstats;
5929                         struct nlattr *tidattr;
5930
5931                         tidstats = &sinfo->pertid[tid];
5932
5933                         if (!tidstats->filled)
5934                                 continue;
5935
5936                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5937                         if (!tidattr)
5938                                 goto nla_put_failure;
5939
5940 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5941         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5942             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5943                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5944                 goto nla_put_failure;                                   \
5945         } while (0)
5946
5947                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5948                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5949                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5950                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5951
5952 #undef PUT_TIDVAL_U64
5953                         if ((tidstats->filled &
5954                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5955                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5956                                                    NL80211_TID_STATS_TXQ_STATS))
5957                                 goto nla_put_failure;
5958
5959                         nla_nest_end(msg, tidattr);
5960                 }
5961
5962                 nla_nest_end(msg, tidsattr);
5963         }
5964
5965         nla_nest_end(msg, sinfoattr);
5966
5967         if (sinfo->assoc_req_ies_len &&
5968             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5969                     sinfo->assoc_req_ies))
5970                 goto nla_put_failure;
5971
5972         cfg80211_sinfo_release_content(sinfo);
5973         genlmsg_end(msg, hdr);
5974         return 0;
5975
5976  nla_put_failure:
5977         cfg80211_sinfo_release_content(sinfo);
5978         genlmsg_cancel(msg, hdr);
5979         return -EMSGSIZE;
5980 }
5981
5982 static int nl80211_dump_station(struct sk_buff *skb,
5983                                 struct netlink_callback *cb)
5984 {
5985         struct station_info sinfo;
5986         struct cfg80211_registered_device *rdev;
5987         struct wireless_dev *wdev;
5988         u8 mac_addr[ETH_ALEN];
5989         int sta_idx = cb->args[2];
5990         int err;
5991
5992         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5993         if (err)
5994                 return err;
5995         /* nl80211_prepare_wdev_dump acquired it in the successful case */
5996         __acquire(&rdev->wiphy.mtx);
5997
5998         if (!wdev->netdev) {
5999                 err = -EINVAL;
6000                 goto out_err;
6001         }
6002
6003         if (!rdev->ops->dump_station) {
6004                 err = -EOPNOTSUPP;
6005                 goto out_err;
6006         }
6007
6008         while (1) {
6009                 memset(&sinfo, 0, sizeof(sinfo));
6010                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6011                                         mac_addr, &sinfo);
6012                 if (err == -ENOENT)
6013                         break;
6014                 if (err)
6015                         goto out_err;
6016
6017                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6018                                 NETLINK_CB(cb->skb).portid,
6019                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6020                                 rdev, wdev->netdev, mac_addr,
6021                                 &sinfo) < 0)
6022                         goto out;
6023
6024                 sta_idx++;
6025         }
6026
6027  out:
6028         cb->args[2] = sta_idx;
6029         err = skb->len;
6030  out_err:
6031         wiphy_unlock(&rdev->wiphy);
6032
6033         return err;
6034 }
6035
6036 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6037 {
6038         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6039         struct net_device *dev = info->user_ptr[1];
6040         struct station_info sinfo;
6041         struct sk_buff *msg;
6042         u8 *mac_addr = NULL;
6043         int err;
6044
6045         memset(&sinfo, 0, sizeof(sinfo));
6046
6047         if (!info->attrs[NL80211_ATTR_MAC])
6048                 return -EINVAL;
6049
6050         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6051
6052         if (!rdev->ops->get_station)
6053                 return -EOPNOTSUPP;
6054
6055         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6056         if (err)
6057                 return err;
6058
6059         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6060         if (!msg) {
6061                 cfg80211_sinfo_release_content(&sinfo);
6062                 return -ENOMEM;
6063         }
6064
6065         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6066                                  info->snd_portid, info->snd_seq, 0,
6067                                  rdev, dev, mac_addr, &sinfo) < 0) {
6068                 nlmsg_free(msg);
6069                 return -ENOBUFS;
6070         }
6071
6072         return genlmsg_reply(msg, info);
6073 }
6074
6075 int cfg80211_check_station_change(struct wiphy *wiphy,
6076                                   struct station_parameters *params,
6077                                   enum cfg80211_station_type statype)
6078 {
6079         if (params->listen_interval != -1 &&
6080             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6081                 return -EINVAL;
6082
6083         if (params->support_p2p_ps != -1 &&
6084             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6085                 return -EINVAL;
6086
6087         if (params->aid &&
6088             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6089             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6090                 return -EINVAL;
6091
6092         /* When you run into this, adjust the code below for the new flag */
6093         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6094
6095         switch (statype) {
6096         case CFG80211_STA_MESH_PEER_KERNEL:
6097         case CFG80211_STA_MESH_PEER_USER:
6098                 /*
6099                  * No ignoring the TDLS flag here -- the userspace mesh
6100                  * code doesn't have the bug of including TDLS in the
6101                  * mask everywhere.
6102                  */
6103                 if (params->sta_flags_mask &
6104                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6105                                   BIT(NL80211_STA_FLAG_MFP) |
6106                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6107                         return -EINVAL;
6108                 break;
6109         case CFG80211_STA_TDLS_PEER_SETUP:
6110         case CFG80211_STA_TDLS_PEER_ACTIVE:
6111                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6112                         return -EINVAL;
6113                 /* ignore since it can't change */
6114                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6115                 break;
6116         default:
6117                 /* disallow mesh-specific things */
6118                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6119                         return -EINVAL;
6120                 if (params->local_pm)
6121                         return -EINVAL;
6122                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6123                         return -EINVAL;
6124         }
6125
6126         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6127             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6128                 /* TDLS can't be set, ... */
6129                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6130                         return -EINVAL;
6131                 /*
6132                  * ... but don't bother the driver with it. This works around
6133                  * a hostapd/wpa_supplicant issue -- it always includes the
6134                  * TLDS_PEER flag in the mask even for AP mode.
6135                  */
6136                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6137         }
6138
6139         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6140             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6141                 /* reject other things that can't change */
6142                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6143                         return -EINVAL;
6144                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6145                         return -EINVAL;
6146                 if (params->supported_rates)
6147                         return -EINVAL;
6148                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
6149                     params->he_capa)
6150                         return -EINVAL;
6151         }
6152
6153         if (statype != CFG80211_STA_AP_CLIENT &&
6154             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6155                 if (params->vlan)
6156                         return -EINVAL;
6157         }
6158
6159         switch (statype) {
6160         case CFG80211_STA_AP_MLME_CLIENT:
6161                 /* Use this only for authorizing/unauthorizing a station */
6162                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6163                         return -EOPNOTSUPP;
6164                 break;
6165         case CFG80211_STA_AP_CLIENT:
6166         case CFG80211_STA_AP_CLIENT_UNASSOC:
6167                 /* accept only the listed bits */
6168                 if (params->sta_flags_mask &
6169                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6170                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6171                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6172                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6173                                   BIT(NL80211_STA_FLAG_WME) |
6174                                   BIT(NL80211_STA_FLAG_MFP)))
6175                         return -EINVAL;
6176
6177                 /* but authenticated/associated only if driver handles it */
6178                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6179                     params->sta_flags_mask &
6180                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6181                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6182                         return -EINVAL;
6183                 break;
6184         case CFG80211_STA_IBSS:
6185         case CFG80211_STA_AP_STA:
6186                 /* reject any changes other than AUTHORIZED */
6187                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6188                         return -EINVAL;
6189                 break;
6190         case CFG80211_STA_TDLS_PEER_SETUP:
6191                 /* reject any changes other than AUTHORIZED or WME */
6192                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6193                                                BIT(NL80211_STA_FLAG_WME)))
6194                         return -EINVAL;
6195                 /* force (at least) rates when authorizing */
6196                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6197                     !params->supported_rates)
6198                         return -EINVAL;
6199                 break;
6200         case CFG80211_STA_TDLS_PEER_ACTIVE:
6201                 /* reject any changes */
6202                 return -EINVAL;
6203         case CFG80211_STA_MESH_PEER_KERNEL:
6204                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6205                         return -EINVAL;
6206                 break;
6207         case CFG80211_STA_MESH_PEER_USER:
6208                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6209                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6210                         return -EINVAL;
6211                 break;
6212         }
6213
6214         /*
6215          * Older kernel versions ignored this attribute entirely, so don't
6216          * reject attempts to update it but mark it as unused instead so the
6217          * driver won't look at the data.
6218          */
6219         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6220             statype != CFG80211_STA_TDLS_PEER_SETUP)
6221                 params->opmode_notif_used = false;
6222
6223         return 0;
6224 }
6225 EXPORT_SYMBOL(cfg80211_check_station_change);
6226
6227 /*
6228  * Get vlan interface making sure it is running and on the right wiphy.
6229  */
6230 static struct net_device *get_vlan(struct genl_info *info,
6231                                    struct cfg80211_registered_device *rdev)
6232 {
6233         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6234         struct net_device *v;
6235         int ret;
6236
6237         if (!vlanattr)
6238                 return NULL;
6239
6240         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6241         if (!v)
6242                 return ERR_PTR(-ENODEV);
6243
6244         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6245                 ret = -EINVAL;
6246                 goto error;
6247         }
6248
6249         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6250             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6251             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6252                 ret = -EINVAL;
6253                 goto error;
6254         }
6255
6256         if (!netif_running(v)) {
6257                 ret = -ENETDOWN;
6258                 goto error;
6259         }
6260
6261         return v;
6262  error:
6263         dev_put(v);
6264         return ERR_PTR(ret);
6265 }
6266
6267 static const struct nla_policy
6268 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6269         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6270         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6271 };
6272
6273 static int nl80211_parse_sta_wme(struct genl_info *info,
6274                                  struct station_parameters *params)
6275 {
6276         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6277         struct nlattr *nla;
6278         int err;
6279
6280         /* parse WME attributes if present */
6281         if (!info->attrs[NL80211_ATTR_STA_WME])
6282                 return 0;
6283
6284         nla = info->attrs[NL80211_ATTR_STA_WME];
6285         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6286                                           nl80211_sta_wme_policy,
6287                                           info->extack);
6288         if (err)
6289                 return err;
6290
6291         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6292                 params->uapsd_queues = nla_get_u8(
6293                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
6294         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6295                 return -EINVAL;
6296
6297         if (tb[NL80211_STA_WME_MAX_SP])
6298                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6299
6300         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6301                 return -EINVAL;
6302
6303         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6304
6305         return 0;
6306 }
6307
6308 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6309                                       struct station_parameters *params)
6310 {
6311         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6312                 params->supported_channels =
6313                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6314                 params->supported_channels_len =
6315                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6316                 /*
6317                  * Need to include at least one (first channel, number of
6318                  * channels) tuple for each subband (checked in policy),
6319                  * and must have proper tuples for the rest of the data as well.
6320                  */
6321                 if (params->supported_channels_len % 2)
6322                         return -EINVAL;
6323         }
6324
6325         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6326                 params->supported_oper_classes =
6327                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6328                 params->supported_oper_classes_len =
6329                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6330         }
6331         return 0;
6332 }
6333
6334 static int nl80211_set_station_tdls(struct genl_info *info,
6335                                     struct station_parameters *params)
6336 {
6337         int err;
6338         /* Dummy STA entry gets updated once the peer capabilities are known */
6339         if (info->attrs[NL80211_ATTR_PEER_AID])
6340                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6341         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6342                 params->ht_capa =
6343                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6344         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6345                 params->vht_capa =
6346                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6347         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6348                 params->he_capa =
6349                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6350                 params->he_capa_len =
6351                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6352         }
6353
6354         err = nl80211_parse_sta_channel_info(info, params);
6355         if (err)
6356                 return err;
6357
6358         return nl80211_parse_sta_wme(info, params);
6359 }
6360
6361 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6362                                              struct station_parameters *params)
6363 {
6364         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6365         int idx;
6366
6367         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6368                 if (!rdev->ops->set_tx_power ||
6369                     !wiphy_ext_feature_isset(&rdev->wiphy,
6370                                          NL80211_EXT_FEATURE_STA_TX_PWR))
6371                         return -EOPNOTSUPP;
6372
6373                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6374                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6375
6376                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6377                         idx = NL80211_ATTR_STA_TX_POWER;
6378
6379                         if (info->attrs[idx])
6380                                 params->txpwr.power =
6381                                         nla_get_s16(info->attrs[idx]);
6382                         else
6383                                 return -EINVAL;
6384                 }
6385                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6386         }
6387
6388         return 0;
6389 }
6390
6391 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6392 {
6393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6394         struct net_device *dev = info->user_ptr[1];
6395         struct station_parameters params;
6396         u8 *mac_addr;
6397         int err;
6398
6399         memset(&params, 0, sizeof(params));
6400
6401         if (!rdev->ops->change_station)
6402                 return -EOPNOTSUPP;
6403
6404         /*
6405          * AID and listen_interval properties can be set only for unassociated
6406          * station. Include these parameters here and will check them in
6407          * cfg80211_check_station_change().
6408          */
6409         if (info->attrs[NL80211_ATTR_STA_AID])
6410                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6411
6412         if (info->attrs[NL80211_ATTR_VLAN_ID])
6413                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6414
6415         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6416                 params.listen_interval =
6417                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6418         else
6419                 params.listen_interval = -1;
6420
6421         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6422                 params.support_p2p_ps =
6423                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6424         else
6425                 params.support_p2p_ps = -1;
6426
6427         if (!info->attrs[NL80211_ATTR_MAC])
6428                 return -EINVAL;
6429
6430         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6431
6432         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6433                 params.supported_rates =
6434                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6435                 params.supported_rates_len =
6436                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6437         }
6438
6439         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6440                 params.capability =
6441                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6442                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6443         }
6444
6445         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6446                 params.ext_capab =
6447                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6448                 params.ext_capab_len =
6449                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6450         }
6451
6452         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6453                 return -EINVAL;
6454
6455         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6456                 params.plink_action =
6457                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6458
6459         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6460                 params.plink_state =
6461                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6462                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6463                         params.peer_aid = nla_get_u16(
6464                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6465                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6466         }
6467
6468         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6469                 params.local_pm = nla_get_u32(
6470                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6471
6472         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6473                 params.opmode_notif_used = true;
6474                 params.opmode_notif =
6475                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6476         }
6477
6478         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6479                 params.he_6ghz_capa =
6480                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6481
6482         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6483                 params.airtime_weight =
6484                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6485
6486         if (params.airtime_weight &&
6487             !wiphy_ext_feature_isset(&rdev->wiphy,
6488                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6489                 return -EOPNOTSUPP;
6490
6491         err = nl80211_parse_sta_txpower_setting(info, &params);
6492         if (err)
6493                 return err;
6494
6495         /* Include parameters for TDLS peer (will check later) */
6496         err = nl80211_set_station_tdls(info, &params);
6497         if (err)
6498                 return err;
6499
6500         params.vlan = get_vlan(info, rdev);
6501         if (IS_ERR(params.vlan))
6502                 return PTR_ERR(params.vlan);
6503
6504         switch (dev->ieee80211_ptr->iftype) {
6505         case NL80211_IFTYPE_AP:
6506         case NL80211_IFTYPE_AP_VLAN:
6507         case NL80211_IFTYPE_P2P_GO:
6508         case NL80211_IFTYPE_P2P_CLIENT:
6509         case NL80211_IFTYPE_STATION:
6510         case NL80211_IFTYPE_ADHOC:
6511         case NL80211_IFTYPE_MESH_POINT:
6512                 break;
6513         default:
6514                 err = -EOPNOTSUPP;
6515                 goto out_put_vlan;
6516         }
6517
6518         /* driver will call cfg80211_check_station_change() */
6519         err = rdev_change_station(rdev, dev, mac_addr, &params);
6520
6521  out_put_vlan:
6522         if (params.vlan)
6523                 dev_put(params.vlan);
6524
6525         return err;
6526 }
6527
6528 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6529 {
6530         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6531         int err;
6532         struct net_device *dev = info->user_ptr[1];
6533         struct station_parameters params;
6534         u8 *mac_addr = NULL;
6535         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6536                          BIT(NL80211_STA_FLAG_ASSOCIATED);
6537
6538         memset(&params, 0, sizeof(params));
6539
6540         if (!rdev->ops->add_station)
6541                 return -EOPNOTSUPP;
6542
6543         if (!info->attrs[NL80211_ATTR_MAC])
6544                 return -EINVAL;
6545
6546         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6547                 return -EINVAL;
6548
6549         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6550                 return -EINVAL;
6551
6552         if (!info->attrs[NL80211_ATTR_STA_AID] &&
6553             !info->attrs[NL80211_ATTR_PEER_AID])
6554                 return -EINVAL;
6555
6556         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6557         params.supported_rates =
6558                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6559         params.supported_rates_len =
6560                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6561         params.listen_interval =
6562                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6563
6564         if (info->attrs[NL80211_ATTR_VLAN_ID])
6565                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6566
6567         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6568                 params.support_p2p_ps =
6569                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6570         } else {
6571                 /*
6572                  * if not specified, assume it's supported for P2P GO interface,
6573                  * and is NOT supported for AP interface
6574                  */
6575                 params.support_p2p_ps =
6576                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6577         }
6578
6579         if (info->attrs[NL80211_ATTR_PEER_AID])
6580                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6581         else
6582                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6583
6584         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6585                 params.capability =
6586                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6587                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6588         }
6589
6590         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6591                 params.ext_capab =
6592                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6593                 params.ext_capab_len =
6594                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6595         }
6596
6597         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6598                 params.ht_capa =
6599                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6600
6601         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6602                 params.vht_capa =
6603                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6604
6605         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6606                 params.he_capa =
6607                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6608                 params.he_capa_len =
6609                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6610         }
6611
6612         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6613                 params.he_6ghz_capa =
6614                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6615
6616         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6617                 params.opmode_notif_used = true;
6618                 params.opmode_notif =
6619                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6620         }
6621
6622         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6623                 params.plink_action =
6624                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6625
6626         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6627                 params.airtime_weight =
6628                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6629
6630         if (params.airtime_weight &&
6631             !wiphy_ext_feature_isset(&rdev->wiphy,
6632                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6633                 return -EOPNOTSUPP;
6634
6635         err = nl80211_parse_sta_txpower_setting(info, &params);
6636         if (err)
6637                 return err;
6638
6639         err = nl80211_parse_sta_channel_info(info, &params);
6640         if (err)
6641                 return err;
6642
6643         err = nl80211_parse_sta_wme(info, &params);
6644         if (err)
6645                 return err;
6646
6647         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6648                 return -EINVAL;
6649
6650         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6651          * as userspace might just pass through the capabilities from the IEs
6652          * directly, rather than enforcing this restriction and returning an
6653          * error in this case.
6654          */
6655         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6656                 params.ht_capa = NULL;
6657                 params.vht_capa = NULL;
6658
6659                 /* HE requires WME */
6660                 if (params.he_capa_len || params.he_6ghz_capa)
6661                         return -EINVAL;
6662         }
6663
6664         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
6665         if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
6666                 return -EINVAL;
6667
6668         /* When you run into this, adjust the code below for the new flag */
6669         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6670
6671         switch (dev->ieee80211_ptr->iftype) {
6672         case NL80211_IFTYPE_AP:
6673         case NL80211_IFTYPE_AP_VLAN:
6674         case NL80211_IFTYPE_P2P_GO:
6675                 /* ignore WME attributes if iface/sta is not capable */
6676                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6677                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6678                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6679
6680                 /* TDLS peers cannot be added */
6681                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6682                     info->attrs[NL80211_ATTR_PEER_AID])
6683                         return -EINVAL;
6684                 /* but don't bother the driver with it */
6685                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6686
6687                 /* allow authenticated/associated only if driver handles it */
6688                 if (!(rdev->wiphy.features &
6689                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6690                     params.sta_flags_mask & auth_assoc)
6691                         return -EINVAL;
6692
6693                 /* Older userspace, or userspace wanting to be compatible with
6694                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6695                  * and assoc flags in the mask, but assumes the station will be
6696                  * added as associated anyway since this was the required driver
6697                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6698                  * introduced.
6699                  * In order to not bother drivers with this quirk in the API
6700                  * set the flags in both the mask and set for new stations in
6701                  * this case.
6702                  */
6703                 if (!(params.sta_flags_mask & auth_assoc)) {
6704                         params.sta_flags_mask |= auth_assoc;
6705                         params.sta_flags_set |= auth_assoc;
6706                 }
6707
6708                 /* must be last in here for error handling */
6709                 params.vlan = get_vlan(info, rdev);
6710                 if (IS_ERR(params.vlan))
6711                         return PTR_ERR(params.vlan);
6712                 break;
6713         case NL80211_IFTYPE_MESH_POINT:
6714                 /* ignore uAPSD data */
6715                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6716
6717                 /* associated is disallowed */
6718                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6719                         return -EINVAL;
6720                 /* TDLS peers cannot be added */
6721                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6722                     info->attrs[NL80211_ATTR_PEER_AID])
6723                         return -EINVAL;
6724                 break;
6725         case NL80211_IFTYPE_STATION:
6726         case NL80211_IFTYPE_P2P_CLIENT:
6727                 /* ignore uAPSD data */
6728                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6729
6730                 /* these are disallowed */
6731                 if (params.sta_flags_mask &
6732                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6733                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6734                         return -EINVAL;
6735                 /* Only TDLS peers can be added */
6736                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6737                         return -EINVAL;
6738                 /* Can only add if TDLS ... */
6739                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6740                         return -EOPNOTSUPP;
6741                 /* ... with external setup is supported */
6742                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6743                         return -EOPNOTSUPP;
6744                 /*
6745                  * Older wpa_supplicant versions always mark the TDLS peer
6746                  * as authorized, but it shouldn't yet be.
6747                  */
6748                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6749                 break;
6750         default:
6751                 return -EOPNOTSUPP;
6752         }
6753
6754         /* be aware of params.vlan when changing code here */
6755
6756         err = rdev_add_station(rdev, dev, mac_addr, &params);
6757
6758         if (params.vlan)
6759                 dev_put(params.vlan);
6760         return err;
6761 }
6762
6763 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6764 {
6765         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6766         struct net_device *dev = info->user_ptr[1];
6767         struct station_del_parameters params;
6768
6769         memset(&params, 0, sizeof(params));
6770
6771         if (info->attrs[NL80211_ATTR_MAC])
6772                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6773
6774         switch (dev->ieee80211_ptr->iftype) {
6775         case NL80211_IFTYPE_AP:
6776         case NL80211_IFTYPE_AP_VLAN:
6777         case NL80211_IFTYPE_MESH_POINT:
6778         case NL80211_IFTYPE_P2P_GO:
6779                 /* always accept these */
6780                 break;
6781         case NL80211_IFTYPE_ADHOC:
6782                 /* conditionally accept */
6783                 if (wiphy_ext_feature_isset(&rdev->wiphy,
6784                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
6785                         break;
6786                 return -EINVAL;
6787         default:
6788                 return -EINVAL;
6789         }
6790
6791         if (!rdev->ops->del_station)
6792                 return -EOPNOTSUPP;
6793
6794         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6795                 params.subtype =
6796                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6797                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6798                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6799                         return -EINVAL;
6800         } else {
6801                 /* Default to Deauthentication frame */
6802                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6803         }
6804
6805         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6806                 params.reason_code =
6807                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6808                 if (params.reason_code == 0)
6809                         return -EINVAL; /* 0 is reserved */
6810         } else {
6811                 /* Default to reason code 2 */
6812                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6813         }
6814
6815         return rdev_del_station(rdev, dev, &params);
6816 }
6817
6818 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6819                                 int flags, struct net_device *dev,
6820                                 u8 *dst, u8 *next_hop,
6821                                 struct mpath_info *pinfo)
6822 {
6823         void *hdr;
6824         struct nlattr *pinfoattr;
6825
6826         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6827         if (!hdr)
6828                 return -1;
6829
6830         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6831             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6832             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6833             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6834                 goto nla_put_failure;
6835
6836         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6837         if (!pinfoattr)
6838                 goto nla_put_failure;
6839         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6840             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6841                         pinfo->frame_qlen))
6842                 goto nla_put_failure;
6843         if (((pinfo->filled & MPATH_INFO_SN) &&
6844              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6845             ((pinfo->filled & MPATH_INFO_METRIC) &&
6846              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6847                          pinfo->metric)) ||
6848             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6849              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6850                          pinfo->exptime)) ||
6851             ((pinfo->filled & MPATH_INFO_FLAGS) &&
6852              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6853                         pinfo->flags)) ||
6854             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6855              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6856                          pinfo->discovery_timeout)) ||
6857             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6858              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6859                         pinfo->discovery_retries)) ||
6860             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6861              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6862                         pinfo->hop_count)) ||
6863             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6864              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6865                          pinfo->path_change_count)))
6866                 goto nla_put_failure;
6867
6868         nla_nest_end(msg, pinfoattr);
6869
6870         genlmsg_end(msg, hdr);
6871         return 0;
6872
6873  nla_put_failure:
6874         genlmsg_cancel(msg, hdr);
6875         return -EMSGSIZE;
6876 }
6877
6878 static int nl80211_dump_mpath(struct sk_buff *skb,
6879                               struct netlink_callback *cb)
6880 {
6881         struct mpath_info pinfo;
6882         struct cfg80211_registered_device *rdev;
6883         struct wireless_dev *wdev;
6884         u8 dst[ETH_ALEN];
6885         u8 next_hop[ETH_ALEN];
6886         int path_idx = cb->args[2];
6887         int err;
6888
6889         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
6890         if (err)
6891                 return err;
6892         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6893         __acquire(&rdev->wiphy.mtx);
6894
6895         if (!rdev->ops->dump_mpath) {
6896                 err = -EOPNOTSUPP;
6897                 goto out_err;
6898         }
6899
6900         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6901                 err = -EOPNOTSUPP;
6902                 goto out_err;
6903         }
6904
6905         while (1) {
6906                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6907                                       next_hop, &pinfo);
6908                 if (err == -ENOENT)
6909                         break;
6910                 if (err)
6911                         goto out_err;
6912
6913                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6914                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6915                                        wdev->netdev, dst, next_hop,
6916                                        &pinfo) < 0)
6917                         goto out;
6918
6919                 path_idx++;
6920         }
6921
6922  out:
6923         cb->args[2] = path_idx;
6924         err = skb->len;
6925  out_err:
6926         wiphy_unlock(&rdev->wiphy);
6927         return err;
6928 }
6929
6930 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6931 {
6932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6933         int err;
6934         struct net_device *dev = info->user_ptr[1];
6935         struct mpath_info pinfo;
6936         struct sk_buff *msg;
6937         u8 *dst = NULL;
6938         u8 next_hop[ETH_ALEN];
6939
6940         memset(&pinfo, 0, sizeof(pinfo));
6941
6942         if (!info->attrs[NL80211_ATTR_MAC])
6943                 return -EINVAL;
6944
6945         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6946
6947         if (!rdev->ops->get_mpath)
6948                 return -EOPNOTSUPP;
6949
6950         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6951                 return -EOPNOTSUPP;
6952
6953         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6954         if (err)
6955                 return err;
6956
6957         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6958         if (!msg)
6959                 return -ENOMEM;
6960
6961         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6962                                  dev, dst, next_hop, &pinfo) < 0) {
6963                 nlmsg_free(msg);
6964                 return -ENOBUFS;
6965         }
6966
6967         return genlmsg_reply(msg, info);
6968 }
6969
6970 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6971 {
6972         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6973         struct net_device *dev = info->user_ptr[1];
6974         u8 *dst = NULL;
6975         u8 *next_hop = NULL;
6976
6977         if (!info->attrs[NL80211_ATTR_MAC])
6978                 return -EINVAL;
6979
6980         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
6981                 return -EINVAL;
6982
6983         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6984         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
6985
6986         if (!rdev->ops->change_mpath)
6987                 return -EOPNOTSUPP;
6988
6989         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6990                 return -EOPNOTSUPP;
6991
6992         return rdev_change_mpath(rdev, dev, dst, next_hop);
6993 }
6994
6995 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
6996 {
6997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6998         struct net_device *dev = info->user_ptr[1];
6999         u8 *dst = NULL;
7000         u8 *next_hop = NULL;
7001
7002         if (!info->attrs[NL80211_ATTR_MAC])
7003                 return -EINVAL;
7004
7005         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7006                 return -EINVAL;
7007
7008         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7009         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7010
7011         if (!rdev->ops->add_mpath)
7012                 return -EOPNOTSUPP;
7013
7014         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7015                 return -EOPNOTSUPP;
7016
7017         return rdev_add_mpath(rdev, dev, dst, next_hop);
7018 }
7019
7020 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7021 {
7022         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7023         struct net_device *dev = info->user_ptr[1];
7024         u8 *dst = NULL;
7025
7026         if (info->attrs[NL80211_ATTR_MAC])
7027                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7028
7029         if (!rdev->ops->del_mpath)
7030                 return -EOPNOTSUPP;
7031
7032         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7033                 return -EOPNOTSUPP;
7034
7035         return rdev_del_mpath(rdev, dev, dst);
7036 }
7037
7038 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7039 {
7040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7041         int err;
7042         struct net_device *dev = info->user_ptr[1];
7043         struct mpath_info pinfo;
7044         struct sk_buff *msg;
7045         u8 *dst = NULL;
7046         u8 mpp[ETH_ALEN];
7047
7048         memset(&pinfo, 0, sizeof(pinfo));
7049
7050         if (!info->attrs[NL80211_ATTR_MAC])
7051                 return -EINVAL;
7052
7053         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7054
7055         if (!rdev->ops->get_mpp)
7056                 return -EOPNOTSUPP;
7057
7058         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7059                 return -EOPNOTSUPP;
7060
7061         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7062         if (err)
7063                 return err;
7064
7065         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7066         if (!msg)
7067                 return -ENOMEM;
7068
7069         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7070                                dev, dst, mpp, &pinfo) < 0) {
7071                 nlmsg_free(msg);
7072                 return -ENOBUFS;
7073         }
7074
7075         return genlmsg_reply(msg, info);
7076 }
7077
7078 static int nl80211_dump_mpp(struct sk_buff *skb,
7079                             struct netlink_callback *cb)
7080 {
7081         struct mpath_info pinfo;
7082         struct cfg80211_registered_device *rdev;
7083         struct wireless_dev *wdev;
7084         u8 dst[ETH_ALEN];
7085         u8 mpp[ETH_ALEN];
7086         int path_idx = cb->args[2];
7087         int err;
7088
7089         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
7090         if (err)
7091                 return err;
7092         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7093         __acquire(&rdev->wiphy.mtx);
7094
7095         if (!rdev->ops->dump_mpp) {
7096                 err = -EOPNOTSUPP;
7097                 goto out_err;
7098         }
7099
7100         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7101                 err = -EOPNOTSUPP;
7102                 goto out_err;
7103         }
7104
7105         while (1) {
7106                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7107                                     mpp, &pinfo);
7108                 if (err == -ENOENT)
7109                         break;
7110                 if (err)
7111                         goto out_err;
7112
7113                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7114                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7115                                        wdev->netdev, dst, mpp,
7116                                        &pinfo) < 0)
7117                         goto out;
7118
7119                 path_idx++;
7120         }
7121
7122  out:
7123         cb->args[2] = path_idx;
7124         err = skb->len;
7125  out_err:
7126         wiphy_unlock(&rdev->wiphy);
7127         return err;
7128 }
7129
7130 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7131 {
7132         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7133         struct net_device *dev = info->user_ptr[1];
7134         struct wireless_dev *wdev = dev->ieee80211_ptr;
7135         struct bss_parameters params;
7136         int err;
7137
7138         memset(&params, 0, sizeof(params));
7139         /* default to not changing parameters */
7140         params.use_cts_prot = -1;
7141         params.use_short_preamble = -1;
7142         params.use_short_slot_time = -1;
7143         params.ap_isolate = -1;
7144         params.ht_opmode = -1;
7145         params.p2p_ctwindow = -1;
7146         params.p2p_opp_ps = -1;
7147
7148         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7149                 params.use_cts_prot =
7150                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7151         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7152                 params.use_short_preamble =
7153                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7154         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7155                 params.use_short_slot_time =
7156                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7157         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7158                 params.basic_rates =
7159                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7160                 params.basic_rates_len =
7161                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7162         }
7163         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7164                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7165         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7166                 params.ht_opmode =
7167                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7168
7169         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7170                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7171                         return -EINVAL;
7172                 params.p2p_ctwindow =
7173                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7174                 if (params.p2p_ctwindow != 0 &&
7175                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7176                         return -EINVAL;
7177         }
7178
7179         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7180                 u8 tmp;
7181
7182                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7183                         return -EINVAL;
7184                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7185                 params.p2p_opp_ps = tmp;
7186                 if (params.p2p_opp_ps &&
7187                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7188                         return -EINVAL;
7189         }
7190
7191         if (!rdev->ops->change_bss)
7192                 return -EOPNOTSUPP;
7193
7194         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7195             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7196                 return -EOPNOTSUPP;
7197
7198         wdev_lock(wdev);
7199         err = rdev_change_bss(rdev, dev, &params);
7200         wdev_unlock(wdev);
7201
7202         return err;
7203 }
7204
7205 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7206 {
7207         char *data = NULL;
7208         bool is_indoor;
7209         enum nl80211_user_reg_hint_type user_reg_hint_type;
7210         u32 owner_nlportid;
7211
7212         /*
7213          * You should only get this when cfg80211 hasn't yet initialized
7214          * completely when built-in to the kernel right between the time
7215          * window between nl80211_init() and regulatory_init(), if that is
7216          * even possible.
7217          */
7218         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7219                 return -EINPROGRESS;
7220
7221         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7222                 user_reg_hint_type =
7223                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7224         else
7225                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7226
7227         switch (user_reg_hint_type) {
7228         case NL80211_USER_REG_HINT_USER:
7229         case NL80211_USER_REG_HINT_CELL_BASE:
7230                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7231                         return -EINVAL;
7232
7233                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7234                 return regulatory_hint_user(data, user_reg_hint_type);
7235         case NL80211_USER_REG_HINT_INDOOR:
7236                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7237                         owner_nlportid = info->snd_portid;
7238                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7239                 } else {
7240                         owner_nlportid = 0;
7241                         is_indoor = true;
7242                 }
7243
7244                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7245         default:
7246                 return -EINVAL;
7247         }
7248 }
7249
7250 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7251 {
7252         return reg_reload_regdb();
7253 }
7254
7255 static int nl80211_get_mesh_config(struct sk_buff *skb,
7256                                    struct genl_info *info)
7257 {
7258         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7259         struct net_device *dev = info->user_ptr[1];
7260         struct wireless_dev *wdev = dev->ieee80211_ptr;
7261         struct mesh_config cur_params;
7262         int err = 0;
7263         void *hdr;
7264         struct nlattr *pinfoattr;
7265         struct sk_buff *msg;
7266
7267         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7268                 return -EOPNOTSUPP;
7269
7270         if (!rdev->ops->get_mesh_config)
7271                 return -EOPNOTSUPP;
7272
7273         wdev_lock(wdev);
7274         /* If not connected, get default parameters */
7275         if (!wdev->mesh_id_len)
7276                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7277         else
7278                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7279         wdev_unlock(wdev);
7280
7281         if (err)
7282                 return err;
7283
7284         /* Draw up a netlink message to send back */
7285         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7286         if (!msg)
7287                 return -ENOMEM;
7288         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7289                              NL80211_CMD_GET_MESH_CONFIG);
7290         if (!hdr)
7291                 goto out;
7292         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7293         if (!pinfoattr)
7294                 goto nla_put_failure;
7295         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7296             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7297                         cur_params.dot11MeshRetryTimeout) ||
7298             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7299                         cur_params.dot11MeshConfirmTimeout) ||
7300             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7301                         cur_params.dot11MeshHoldingTimeout) ||
7302             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7303                         cur_params.dot11MeshMaxPeerLinks) ||
7304             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7305                        cur_params.dot11MeshMaxRetries) ||
7306             nla_put_u8(msg, NL80211_MESHCONF_TTL,
7307                        cur_params.dot11MeshTTL) ||
7308             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7309                        cur_params.element_ttl) ||
7310             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7311                        cur_params.auto_open_plinks) ||
7312             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7313                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7314             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7315                        cur_params.dot11MeshHWMPmaxPREQretries) ||
7316             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7317                         cur_params.path_refresh_time) ||
7318             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7319                         cur_params.min_discovery_timeout) ||
7320             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7321                         cur_params.dot11MeshHWMPactivePathTimeout) ||
7322             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7323                         cur_params.dot11MeshHWMPpreqMinInterval) ||
7324             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7325                         cur_params.dot11MeshHWMPperrMinInterval) ||
7326             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7327                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7328             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7329                        cur_params.dot11MeshHWMPRootMode) ||
7330             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7331                         cur_params.dot11MeshHWMPRannInterval) ||
7332             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7333                        cur_params.dot11MeshGateAnnouncementProtocol) ||
7334             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7335                        cur_params.dot11MeshForwarding) ||
7336             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7337                         cur_params.rssi_threshold) ||
7338             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7339                         cur_params.ht_opmode) ||
7340             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7341                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7342             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7343                         cur_params.dot11MeshHWMProotInterval) ||
7344             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7345                         cur_params.dot11MeshHWMPconfirmationInterval) ||
7346             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7347                         cur_params.power_mode) ||
7348             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7349                         cur_params.dot11MeshAwakeWindowDuration) ||
7350             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7351                         cur_params.plink_timeout) ||
7352             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7353                        cur_params.dot11MeshConnectedToMeshGate) ||
7354             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7355                        cur_params.dot11MeshNolearn) ||
7356             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7357                        cur_params.dot11MeshConnectedToAuthServer))
7358                 goto nla_put_failure;
7359         nla_nest_end(msg, pinfoattr);
7360         genlmsg_end(msg, hdr);
7361         return genlmsg_reply(msg, info);
7362
7363  nla_put_failure:
7364  out:
7365         nlmsg_free(msg);
7366         return -ENOBUFS;
7367 }
7368
7369 static const struct nla_policy
7370 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7371         [NL80211_MESHCONF_RETRY_TIMEOUT] =
7372                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7373         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7374                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7375         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7376                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7377         [NL80211_MESHCONF_MAX_PEER_LINKS] =
7378                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7379         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7380         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7381         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7382         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7383         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7384                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7385         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7386         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7387         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7388         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7389         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7390                 NLA_POLICY_MIN(NLA_U16, 1),
7391         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7392                 NLA_POLICY_MIN(NLA_U16, 1),
7393         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7394                 NLA_POLICY_MIN(NLA_U16, 1),
7395         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7396         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7397                 NLA_POLICY_MIN(NLA_U16, 1),
7398         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7399         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7400         [NL80211_MESHCONF_RSSI_THRESHOLD] =
7401                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7402         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7403         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7404         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7405                 NLA_POLICY_MIN(NLA_U16, 1),
7406         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7407                 NLA_POLICY_MIN(NLA_U16, 1),
7408         [NL80211_MESHCONF_POWER_MODE] =
7409                 NLA_POLICY_RANGE(NLA_U32,
7410                                  NL80211_MESH_POWER_ACTIVE,
7411                                  NL80211_MESH_POWER_MAX),
7412         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7413         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7414         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7415         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7416         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7417 };
7418
7419 static const struct nla_policy
7420         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7421         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7422         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7423         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7424         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7425         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7426         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7427         [NL80211_MESH_SETUP_IE] =
7428                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7429                                        IEEE80211_MAX_DATA_LEN),
7430         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7431 };
7432
7433 static int nl80211_parse_mesh_config(struct genl_info *info,
7434                                      struct mesh_config *cfg,
7435                                      u32 *mask_out)
7436 {
7437         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7438         u32 mask = 0;
7439         u16 ht_opmode;
7440
7441 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
7442 do {                                                                    \
7443         if (tb[attr]) {                                                 \
7444                 cfg->param = fn(tb[attr]);                              \
7445                 mask |= BIT((attr) - 1);                                \
7446         }                                                               \
7447 } while (0)
7448
7449         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7450                 return -EINVAL;
7451         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7452                 return -EINVAL;
7453
7454         /* This makes sure that there aren't more than 32 mesh config
7455          * parameters (otherwise our bitfield scheme would not work.) */
7456         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7457
7458         /* Fill in the params struct */
7459         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7460                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7461         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7462                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
7463                                   nla_get_u16);
7464         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7465                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
7466                                   nla_get_u16);
7467         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7468                                   NL80211_MESHCONF_MAX_PEER_LINKS,
7469                                   nla_get_u16);
7470         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7471                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7472         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7473                                   NL80211_MESHCONF_TTL, nla_get_u8);
7474         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7475                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7476         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7477                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7478                                   nla_get_u8);
7479         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7480                                   mask,
7481                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7482                                   nla_get_u32);
7483         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7484                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7485                                   nla_get_u8);
7486         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7487                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
7488                                   nla_get_u32);
7489         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7490             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7491                 return -EINVAL;
7492         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7493                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7494                                   nla_get_u16);
7495         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7496                                   mask,
7497                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7498                                   nla_get_u32);
7499         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7500             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7501              cfg->dot11MeshHWMPactivePathTimeout > 65535))
7502                 return -EINVAL;
7503         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7504                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7505                                   nla_get_u16);
7506         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7507                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7508                                   nla_get_u16);
7509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7510                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
7511                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7512                                   nla_get_u16);
7513         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7514                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7515         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7516                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7517                                   nla_get_u16);
7518         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7519                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7520                                   nla_get_u8);
7521         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7522                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
7523         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7524                                   NL80211_MESHCONF_RSSI_THRESHOLD,
7525                                   nla_get_s32);
7526         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7527                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
7528                                   nla_get_u8);
7529         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7530                                   NL80211_MESHCONF_CONNECTED_TO_AS,
7531                                   nla_get_u8);
7532         /*
7533          * Check HT operation mode based on
7534          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7535          */
7536         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7537                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7538
7539                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7540                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7541                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7542                         return -EINVAL;
7543
7544                 /* NON_HT_STA bit is reserved, but some programs set it */
7545                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7546
7547                 cfg->ht_opmode = ht_opmode;
7548                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7549         }
7550         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7551                                   dot11MeshHWMPactivePathToRootTimeout, mask,
7552                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7553                                   nla_get_u32);
7554         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7555             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7556              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7557                 return -EINVAL;
7558         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7559                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7560                                   nla_get_u16);
7561         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7562                                   mask,
7563                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7564                                   nla_get_u16);
7565         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7566                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7567         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7568                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7569         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7570                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7571         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7572                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
7573         if (mask_out)
7574                 *mask_out = mask;
7575
7576         return 0;
7577
7578 #undef FILL_IN_MESH_PARAM_IF_SET
7579 }
7580
7581 static int nl80211_parse_mesh_setup(struct genl_info *info,
7582                                      struct mesh_setup *setup)
7583 {
7584         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7585         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7586
7587         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7588                 return -EINVAL;
7589         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7590                 return -EINVAL;
7591
7592         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7593                 setup->sync_method =
7594                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7595                  IEEE80211_SYNC_METHOD_VENDOR :
7596                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7597
7598         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7599                 setup->path_sel_proto =
7600                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7601                  IEEE80211_PATH_PROTOCOL_VENDOR :
7602                  IEEE80211_PATH_PROTOCOL_HWMP;
7603
7604         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7605                 setup->path_metric =
7606                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7607                  IEEE80211_PATH_METRIC_VENDOR :
7608                  IEEE80211_PATH_METRIC_AIRTIME;
7609
7610         if (tb[NL80211_MESH_SETUP_IE]) {
7611                 struct nlattr *ieattr =
7612                         tb[NL80211_MESH_SETUP_IE];
7613                 setup->ie = nla_data(ieattr);
7614                 setup->ie_len = nla_len(ieattr);
7615         }
7616         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7617             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7618                 return -EINVAL;
7619         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7620         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7621         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7622         if (setup->is_secure)
7623                 setup->user_mpm = true;
7624
7625         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7626                 if (!setup->user_mpm)
7627                         return -EINVAL;
7628                 setup->auth_id =
7629                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7630         }
7631
7632         return 0;
7633 }
7634
7635 static int nl80211_update_mesh_config(struct sk_buff *skb,
7636                                       struct genl_info *info)
7637 {
7638         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7639         struct net_device *dev = info->user_ptr[1];
7640         struct wireless_dev *wdev = dev->ieee80211_ptr;
7641         struct mesh_config cfg;
7642         u32 mask;
7643         int err;
7644
7645         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7646                 return -EOPNOTSUPP;
7647
7648         if (!rdev->ops->update_mesh_config)
7649                 return -EOPNOTSUPP;
7650
7651         err = nl80211_parse_mesh_config(info, &cfg, &mask);
7652         if (err)
7653                 return err;
7654
7655         wdev_lock(wdev);
7656         if (!wdev->mesh_id_len)
7657                 err = -ENOLINK;
7658
7659         if (!err)
7660                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7661
7662         wdev_unlock(wdev);
7663
7664         return err;
7665 }
7666
7667 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7668                               struct sk_buff *msg)
7669 {
7670         struct nlattr *nl_reg_rules;
7671         unsigned int i;
7672
7673         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7674             (regdom->dfs_region &&
7675              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7676                 goto nla_put_failure;
7677
7678         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7679         if (!nl_reg_rules)
7680                 goto nla_put_failure;
7681
7682         for (i = 0; i < regdom->n_reg_rules; i++) {
7683                 struct nlattr *nl_reg_rule;
7684                 const struct ieee80211_reg_rule *reg_rule;
7685                 const struct ieee80211_freq_range *freq_range;
7686                 const struct ieee80211_power_rule *power_rule;
7687                 unsigned int max_bandwidth_khz;
7688
7689                 reg_rule = &regdom->reg_rules[i];
7690                 freq_range = &reg_rule->freq_range;
7691                 power_rule = &reg_rule->power_rule;
7692
7693                 nl_reg_rule = nla_nest_start_noflag(msg, i);
7694                 if (!nl_reg_rule)
7695                         goto nla_put_failure;
7696
7697                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
7698                 if (!max_bandwidth_khz)
7699                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7700                                                                   reg_rule);
7701
7702                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7703                                 reg_rule->flags) ||
7704                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7705                                 freq_range->start_freq_khz) ||
7706                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7707                                 freq_range->end_freq_khz) ||
7708                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7709                                 max_bandwidth_khz) ||
7710                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7711                                 power_rule->max_antenna_gain) ||
7712                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7713                                 power_rule->max_eirp) ||
7714                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7715                                 reg_rule->dfs_cac_ms))
7716                         goto nla_put_failure;
7717
7718                 nla_nest_end(msg, nl_reg_rule);
7719         }
7720
7721         nla_nest_end(msg, nl_reg_rules);
7722         return 0;
7723
7724 nla_put_failure:
7725         return -EMSGSIZE;
7726 }
7727
7728 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7729 {
7730         const struct ieee80211_regdomain *regdom = NULL;
7731         struct cfg80211_registered_device *rdev;
7732         struct wiphy *wiphy = NULL;
7733         struct sk_buff *msg;
7734         void *hdr;
7735
7736         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7737         if (!msg)
7738                 return -ENOBUFS;
7739
7740         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7741                              NL80211_CMD_GET_REG);
7742         if (!hdr)
7743                 goto put_failure;
7744
7745         rtnl_lock();
7746
7747         if (info->attrs[NL80211_ATTR_WIPHY]) {
7748                 bool self_managed;
7749
7750                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7751                 if (IS_ERR(rdev)) {
7752                         nlmsg_free(msg);
7753                         rtnl_unlock();
7754                         return PTR_ERR(rdev);
7755                 }
7756
7757                 wiphy = &rdev->wiphy;
7758                 self_managed = wiphy->regulatory_flags &
7759                                REGULATORY_WIPHY_SELF_MANAGED;
7760                 regdom = get_wiphy_regdom(wiphy);
7761
7762                 /* a self-managed-reg device must have a private regdom */
7763                 if (WARN_ON(!regdom && self_managed)) {
7764                         nlmsg_free(msg);
7765                         rtnl_unlock();
7766                         return -EINVAL;
7767                 }
7768
7769                 if (regdom &&
7770                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7771                         goto nla_put_failure;
7772         }
7773
7774         if (!wiphy && reg_last_request_cell_base() &&
7775             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7776                         NL80211_USER_REG_HINT_CELL_BASE))
7777                 goto nla_put_failure;
7778
7779         rcu_read_lock();
7780
7781         if (!regdom)
7782                 regdom = rcu_dereference(cfg80211_regdomain);
7783
7784         if (nl80211_put_regdom(regdom, msg))
7785                 goto nla_put_failure_rcu;
7786
7787         rcu_read_unlock();
7788
7789         genlmsg_end(msg, hdr);
7790         rtnl_unlock();
7791         return genlmsg_reply(msg, info);
7792
7793 nla_put_failure_rcu:
7794         rcu_read_unlock();
7795 nla_put_failure:
7796         rtnl_unlock();
7797 put_failure:
7798         nlmsg_free(msg);
7799         return -EMSGSIZE;
7800 }
7801
7802 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7803                                u32 seq, int flags, struct wiphy *wiphy,
7804                                const struct ieee80211_regdomain *regdom)
7805 {
7806         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7807                                    NL80211_CMD_GET_REG);
7808
7809         if (!hdr)
7810                 return -1;
7811
7812         genl_dump_check_consistent(cb, hdr);
7813
7814         if (nl80211_put_regdom(regdom, msg))
7815                 goto nla_put_failure;
7816
7817         if (!wiphy && reg_last_request_cell_base() &&
7818             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7819                         NL80211_USER_REG_HINT_CELL_BASE))
7820                 goto nla_put_failure;
7821
7822         if (wiphy &&
7823             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7824                 goto nla_put_failure;
7825
7826         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7827             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7828                 goto nla_put_failure;
7829
7830         genlmsg_end(msg, hdr);
7831         return 0;
7832
7833 nla_put_failure:
7834         genlmsg_cancel(msg, hdr);
7835         return -EMSGSIZE;
7836 }
7837
7838 static int nl80211_get_reg_dump(struct sk_buff *skb,
7839                                 struct netlink_callback *cb)
7840 {
7841         const struct ieee80211_regdomain *regdom = NULL;
7842         struct cfg80211_registered_device *rdev;
7843         int err, reg_idx, start = cb->args[2];
7844
7845         rtnl_lock();
7846
7847         if (cfg80211_regdomain && start == 0) {
7848                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7849                                           NLM_F_MULTI, NULL,
7850                                           rtnl_dereference(cfg80211_regdomain));
7851                 if (err < 0)
7852                         goto out_err;
7853         }
7854
7855         /* the global regdom is idx 0 */
7856         reg_idx = 1;
7857         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7858                 regdom = get_wiphy_regdom(&rdev->wiphy);
7859                 if (!regdom)
7860                         continue;
7861
7862                 if (++reg_idx <= start)
7863                         continue;
7864
7865                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7866                                           NLM_F_MULTI, &rdev->wiphy, regdom);
7867                 if (err < 0) {
7868                         reg_idx--;
7869                         break;
7870                 }
7871         }
7872
7873         cb->args[2] = reg_idx;
7874         err = skb->len;
7875 out_err:
7876         rtnl_unlock();
7877         return err;
7878 }
7879
7880 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7881 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7882         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7883         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7884         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7885         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7886         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7887         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7888         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7889 };
7890
7891 static int parse_reg_rule(struct nlattr *tb[],
7892         struct ieee80211_reg_rule *reg_rule)
7893 {
7894         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7895         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7896
7897         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7898                 return -EINVAL;
7899         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7900                 return -EINVAL;
7901         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7902                 return -EINVAL;
7903         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7904                 return -EINVAL;
7905         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7906                 return -EINVAL;
7907
7908         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7909
7910         freq_range->start_freq_khz =
7911                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7912         freq_range->end_freq_khz =
7913                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7914         freq_range->max_bandwidth_khz =
7915                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7916
7917         power_rule->max_eirp =
7918                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7919
7920         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7921                 power_rule->max_antenna_gain =
7922                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7923
7924         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7925                 reg_rule->dfs_cac_ms =
7926                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7927
7928         return 0;
7929 }
7930
7931 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7932 {
7933         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7934         struct nlattr *nl_reg_rule;
7935         char *alpha2;
7936         int rem_reg_rules, r;
7937         u32 num_rules = 0, rule_idx = 0;
7938         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7939         struct ieee80211_regdomain *rd;
7940
7941         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7942                 return -EINVAL;
7943
7944         if (!info->attrs[NL80211_ATTR_REG_RULES])
7945                 return -EINVAL;
7946
7947         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7948
7949         if (info->attrs[NL80211_ATTR_DFS_REGION])
7950                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7951
7952         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7953                             rem_reg_rules) {
7954                 num_rules++;
7955                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7956                         return -EINVAL;
7957         }
7958
7959         rtnl_lock();
7960         if (!reg_is_valid_request(alpha2)) {
7961                 r = -EINVAL;
7962                 goto out;
7963         }
7964
7965         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7966         if (!rd) {
7967                 r = -ENOMEM;
7968                 goto out;
7969         }
7970
7971         rd->n_reg_rules = num_rules;
7972         rd->alpha2[0] = alpha2[0];
7973         rd->alpha2[1] = alpha2[1];
7974
7975         /*
7976          * Disable DFS master mode if the DFS region was
7977          * not supported or known on this kernel.
7978          */
7979         if (reg_supported_dfs_region(dfs_region))
7980                 rd->dfs_region = dfs_region;
7981
7982         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7983                             rem_reg_rules) {
7984                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
7985                                                 nl_reg_rule, reg_rule_policy,
7986                                                 info->extack);
7987                 if (r)
7988                         goto bad_reg;
7989                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
7990                 if (r)
7991                         goto bad_reg;
7992
7993                 rule_idx++;
7994
7995                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
7996                         r = -EINVAL;
7997                         goto bad_reg;
7998                 }
7999         }
8000
8001         r = set_regdom(rd, REGD_SOURCE_CRDA);
8002         /* set_regdom takes ownership of rd */
8003         rd = NULL;
8004  bad_reg:
8005         kfree(rd);
8006  out:
8007         rtnl_unlock();
8008         return r;
8009 }
8010 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8011
8012 static int validate_scan_freqs(struct nlattr *freqs)
8013 {
8014         struct nlattr *attr1, *attr2;
8015         int n_channels = 0, tmp1, tmp2;
8016
8017         nla_for_each_nested(attr1, freqs, tmp1)
8018                 if (nla_len(attr1) != sizeof(u32))
8019                         return 0;
8020
8021         nla_for_each_nested(attr1, freqs, tmp1) {
8022                 n_channels++;
8023                 /*
8024                  * Some hardware has a limited channel list for
8025                  * scanning, and it is pretty much nonsensical
8026                  * to scan for a channel twice, so disallow that
8027                  * and don't require drivers to check that the
8028                  * channel list they get isn't longer than what
8029                  * they can scan, as long as they can scan all
8030                  * the channels they registered at once.
8031                  */
8032                 nla_for_each_nested(attr2, freqs, tmp2)
8033                         if (attr1 != attr2 &&
8034                             nla_get_u32(attr1) == nla_get_u32(attr2))
8035                                 return 0;
8036         }
8037
8038         return n_channels;
8039 }
8040
8041 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8042 {
8043         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8044 }
8045
8046 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8047                             struct cfg80211_bss_selection *bss_select)
8048 {
8049         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8050         struct nlattr *nest;
8051         int err;
8052         bool found = false;
8053         int i;
8054
8055         /* only process one nested attribute */
8056         nest = nla_data(nla);
8057         if (!nla_ok(nest, nla_len(nest)))
8058                 return -EINVAL;
8059
8060         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8061                                           nest, nl80211_bss_select_policy,
8062                                           NULL);
8063         if (err)
8064                 return err;
8065
8066         /* only one attribute may be given */
8067         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8068                 if (attr[i]) {
8069                         if (found)
8070                                 return -EINVAL;
8071                         found = true;
8072                 }
8073         }
8074
8075         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8076
8077         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8078                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8079
8080         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8081                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8082                 bss_select->param.band_pref =
8083                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8084                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8085                         return -EINVAL;
8086         }
8087
8088         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8089                 struct nl80211_bss_select_rssi_adjust *adj_param;
8090
8091                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8092                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8093                 bss_select->param.adjust.band = adj_param->band;
8094                 bss_select->param.adjust.delta = adj_param->delta;
8095                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8096                         return -EINVAL;
8097         }
8098
8099         /* user-space did not provide behaviour attribute */
8100         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8101                 return -EINVAL;
8102
8103         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8104                 return -EINVAL;
8105
8106         return 0;
8107 }
8108
8109 int nl80211_parse_random_mac(struct nlattr **attrs,
8110                              u8 *mac_addr, u8 *mac_addr_mask)
8111 {
8112         int i;
8113
8114         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8115                 eth_zero_addr(mac_addr);
8116                 eth_zero_addr(mac_addr_mask);
8117                 mac_addr[0] = 0x2;
8118                 mac_addr_mask[0] = 0x3;
8119
8120                 return 0;
8121         }
8122
8123         /* need both or none */
8124         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8125                 return -EINVAL;
8126
8127         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8128         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8129
8130         /* don't allow or configure an mcast address */
8131         if (!is_multicast_ether_addr(mac_addr_mask) ||
8132             is_multicast_ether_addr(mac_addr))
8133                 return -EINVAL;
8134
8135         /*
8136          * allow users to pass a MAC address that has bits set outside
8137          * of the mask, but don't bother drivers with having to deal
8138          * with such bits
8139          */
8140         for (i = 0; i < ETH_ALEN; i++)
8141                 mac_addr[i] &= mac_addr_mask[i];
8142
8143         return 0;
8144 }
8145
8146 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
8147 {
8148         ASSERT_WDEV_LOCK(wdev);
8149
8150         if (!cfg80211_beaconing_iface_active(wdev))
8151                 return true;
8152
8153         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
8154                 return true;
8155
8156         return regulatory_pre_cac_allowed(wdev->wiphy);
8157 }
8158
8159 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8160                                     enum nl80211_ext_feature_index feat)
8161 {
8162         if (!(flags & flag))
8163                 return true;
8164         if (wiphy_ext_feature_isset(wiphy, feat))
8165                 return true;
8166         return false;
8167 }
8168
8169 static int
8170 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8171                          void *request, struct nlattr **attrs,
8172                          bool is_sched_scan)
8173 {
8174         u8 *mac_addr, *mac_addr_mask;
8175         u32 *flags;
8176         enum nl80211_feature_flags randomness_flag;
8177
8178         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8179                 return 0;
8180
8181         if (is_sched_scan) {
8182                 struct cfg80211_sched_scan_request *req = request;
8183
8184                 randomness_flag = wdev ?
8185                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8186                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8187                 flags = &req->flags;
8188                 mac_addr = req->mac_addr;
8189                 mac_addr_mask = req->mac_addr_mask;
8190         } else {
8191                 struct cfg80211_scan_request *req = request;
8192
8193                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8194                 flags = &req->flags;
8195                 mac_addr = req->mac_addr;
8196                 mac_addr_mask = req->mac_addr_mask;
8197         }
8198
8199         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8200
8201         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8202              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8203             !nl80211_check_scan_feat(wiphy, *flags,
8204                                      NL80211_SCAN_FLAG_LOW_SPAN,
8205                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8206             !nl80211_check_scan_feat(wiphy, *flags,
8207                                      NL80211_SCAN_FLAG_LOW_POWER,
8208                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8209             !nl80211_check_scan_feat(wiphy, *flags,
8210                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
8211                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8212             !nl80211_check_scan_feat(wiphy, *flags,
8213                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8214                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8215             !nl80211_check_scan_feat(wiphy, *flags,
8216                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8217                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8218             !nl80211_check_scan_feat(wiphy, *flags,
8219                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8220                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8221             !nl80211_check_scan_feat(wiphy, *flags,
8222                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8223                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8224             !nl80211_check_scan_feat(wiphy, *flags,
8225                                      NL80211_SCAN_FLAG_RANDOM_SN,
8226                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8227             !nl80211_check_scan_feat(wiphy, *flags,
8228                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8229                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8230                 return -EOPNOTSUPP;
8231
8232         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8233                 int err;
8234
8235                 if (!(wiphy->features & randomness_flag) ||
8236                     (wdev && wdev->current_bss))
8237                         return -EOPNOTSUPP;
8238
8239                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8240                 if (err)
8241                         return err;
8242         }
8243
8244         return 0;
8245 }
8246
8247 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8248 {
8249         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8250         struct wireless_dev *wdev = info->user_ptr[1];
8251         struct cfg80211_scan_request *request;
8252         struct nlattr *scan_freqs = NULL;
8253         bool scan_freqs_khz = false;
8254         struct nlattr *attr;
8255         struct wiphy *wiphy;
8256         int err, tmp, n_ssids = 0, n_channels, i;
8257         size_t ie_len;
8258
8259         wiphy = &rdev->wiphy;
8260
8261         if (wdev->iftype == NL80211_IFTYPE_NAN)
8262                 return -EOPNOTSUPP;
8263
8264         if (!rdev->ops->scan)
8265                 return -EOPNOTSUPP;
8266
8267         if (rdev->scan_req || rdev->scan_msg)
8268                 return -EBUSY;
8269
8270         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8271                 if (!wiphy_ext_feature_isset(wiphy,
8272                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8273                         return -EOPNOTSUPP;
8274                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8275                 scan_freqs_khz = true;
8276         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8277                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8278
8279         if (scan_freqs) {
8280                 n_channels = validate_scan_freqs(scan_freqs);
8281                 if (!n_channels)
8282                         return -EINVAL;
8283         } else {
8284                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8285         }
8286
8287         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8288                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8289                         n_ssids++;
8290
8291         if (n_ssids > wiphy->max_scan_ssids)
8292                 return -EINVAL;
8293
8294         if (info->attrs[NL80211_ATTR_IE])
8295                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8296         else
8297                 ie_len = 0;
8298
8299         if (ie_len > wiphy->max_scan_ie_len)
8300                 return -EINVAL;
8301
8302         request = kzalloc(sizeof(*request)
8303                         + sizeof(*request->ssids) * n_ssids
8304                         + sizeof(*request->channels) * n_channels
8305                         + ie_len, GFP_KERNEL);
8306         if (!request)
8307                 return -ENOMEM;
8308
8309         if (n_ssids)
8310                 request->ssids = (void *)&request->channels[n_channels];
8311         request->n_ssids = n_ssids;
8312         if (ie_len) {
8313                 if (n_ssids)
8314                         request->ie = (void *)(request->ssids + n_ssids);
8315                 else
8316                         request->ie = (void *)(request->channels + n_channels);
8317         }
8318
8319         i = 0;
8320         if (scan_freqs) {
8321                 /* user specified, bail out if channel not found */
8322                 nla_for_each_nested(attr, scan_freqs, tmp) {
8323                         struct ieee80211_channel *chan;
8324                         int freq = nla_get_u32(attr);
8325
8326                         if (!scan_freqs_khz)
8327                                 freq = MHZ_TO_KHZ(freq);
8328
8329                         chan = ieee80211_get_channel_khz(wiphy, freq);
8330                         if (!chan) {
8331                                 err = -EINVAL;
8332                                 goto out_free;
8333                         }
8334
8335                         /* ignore disabled channels */
8336                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8337                                 continue;
8338
8339                         request->channels[i] = chan;
8340                         i++;
8341                 }
8342         } else {
8343                 enum nl80211_band band;
8344
8345                 /* all channels */
8346                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8347                         int j;
8348
8349                         if (!wiphy->bands[band])
8350                                 continue;
8351                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8352                                 struct ieee80211_channel *chan;
8353
8354                                 chan = &wiphy->bands[band]->channels[j];
8355
8356                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8357                                         continue;
8358
8359                                 request->channels[i] = chan;
8360                                 i++;
8361                         }
8362                 }
8363         }
8364
8365         if (!i) {
8366                 err = -EINVAL;
8367                 goto out_free;
8368         }
8369
8370         request->n_channels = i;
8371
8372         wdev_lock(wdev);
8373         if (!cfg80211_off_channel_oper_allowed(wdev)) {
8374                 struct ieee80211_channel *chan;
8375
8376                 if (request->n_channels != 1) {
8377                         wdev_unlock(wdev);
8378                         err = -EBUSY;
8379                         goto out_free;
8380                 }
8381
8382                 chan = request->channels[0];
8383                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
8384                         wdev_unlock(wdev);
8385                         err = -EBUSY;
8386                         goto out_free;
8387                 }
8388         }
8389         wdev_unlock(wdev);
8390
8391         i = 0;
8392         if (n_ssids) {
8393                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8394                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8395                                 err = -EINVAL;
8396                                 goto out_free;
8397                         }
8398                         request->ssids[i].ssid_len = nla_len(attr);
8399                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8400                         i++;
8401                 }
8402         }
8403
8404         if (info->attrs[NL80211_ATTR_IE]) {
8405                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8406                 memcpy((void *)request->ie,
8407                        nla_data(info->attrs[NL80211_ATTR_IE]),
8408                        request->ie_len);
8409         }
8410
8411         for (i = 0; i < NUM_NL80211_BANDS; i++)
8412                 if (wiphy->bands[i])
8413                         request->rates[i] =
8414                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
8415
8416         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8417                 nla_for_each_nested(attr,
8418                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8419                                     tmp) {
8420                         enum nl80211_band band = nla_type(attr);
8421
8422                         if (band < 0 || band >= NUM_NL80211_BANDS) {
8423                                 err = -EINVAL;
8424                                 goto out_free;
8425                         }
8426
8427                         if (!wiphy->bands[band])
8428                                 continue;
8429
8430                         err = ieee80211_get_ratemask(wiphy->bands[band],
8431                                                      nla_data(attr),
8432                                                      nla_len(attr),
8433                                                      &request->rates[band]);
8434                         if (err)
8435                                 goto out_free;
8436                 }
8437         }
8438
8439         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8440                 request->duration =
8441                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8442                 request->duration_mandatory =
8443                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8444         }
8445
8446         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8447                                        false);
8448         if (err)
8449                 goto out_free;
8450
8451         request->no_cck =
8452                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8453
8454         /* Initial implementation used NL80211_ATTR_MAC to set the specific
8455          * BSSID to scan for. This was problematic because that same attribute
8456          * was already used for another purpose (local random MAC address). The
8457          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8458          * compatibility with older userspace components, also use the
8459          * NL80211_ATTR_MAC value here if it can be determined to be used for
8460          * the specific BSSID use case instead of the random MAC address
8461          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8462          */
8463         if (info->attrs[NL80211_ATTR_BSSID])
8464                 memcpy(request->bssid,
8465                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8466         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8467                  info->attrs[NL80211_ATTR_MAC])
8468                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8469                        ETH_ALEN);
8470         else
8471                 eth_broadcast_addr(request->bssid);
8472
8473         request->wdev = wdev;
8474         request->wiphy = &rdev->wiphy;
8475         request->scan_start = jiffies;
8476
8477         rdev->scan_req = request;
8478         err = cfg80211_scan(rdev);
8479
8480         if (err)
8481                 goto out_free;
8482
8483         nl80211_send_scan_start(rdev, wdev);
8484         if (wdev->netdev)
8485                 dev_hold(wdev->netdev);
8486
8487         return 0;
8488
8489  out_free:
8490         rdev->scan_req = NULL;
8491         kfree(request);
8492
8493         return err;
8494 }
8495
8496 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8497 {
8498         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8499         struct wireless_dev *wdev = info->user_ptr[1];
8500
8501         if (!rdev->ops->abort_scan)
8502                 return -EOPNOTSUPP;
8503
8504         if (rdev->scan_msg)
8505                 return 0;
8506
8507         if (!rdev->scan_req)
8508                 return -ENOENT;
8509
8510         rdev_abort_scan(rdev, wdev);
8511         return 0;
8512 }
8513
8514 static int
8515 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8516                                struct cfg80211_sched_scan_request *request,
8517                                struct nlattr **attrs)
8518 {
8519         int tmp, err, i = 0;
8520         struct nlattr *attr;
8521
8522         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8523                 u32 interval;
8524
8525                 /*
8526                  * If scan plans are not specified,
8527                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8528                  * case one scan plan will be set with the specified scan
8529                  * interval and infinite number of iterations.
8530                  */
8531                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8532                 if (!interval)
8533                         return -EINVAL;
8534
8535                 request->scan_plans[0].interval =
8536                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
8537                 if (!request->scan_plans[0].interval)
8538                         return -EINVAL;
8539
8540                 if (request->scan_plans[0].interval >
8541                     wiphy->max_sched_scan_plan_interval)
8542                         request->scan_plans[0].interval =
8543                                 wiphy->max_sched_scan_plan_interval;
8544
8545                 return 0;
8546         }
8547
8548         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8549                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8550
8551                 if (WARN_ON(i >= n_plans))
8552                         return -EINVAL;
8553
8554                 err = nla_parse_nested_deprecated(plan,
8555                                                   NL80211_SCHED_SCAN_PLAN_MAX,
8556                                                   attr, nl80211_plan_policy,
8557                                                   NULL);
8558                 if (err)
8559                         return err;
8560
8561                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8562                         return -EINVAL;
8563
8564                 request->scan_plans[i].interval =
8565                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8566                 if (!request->scan_plans[i].interval ||
8567                     request->scan_plans[i].interval >
8568                     wiphy->max_sched_scan_plan_interval)
8569                         return -EINVAL;
8570
8571                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8572                         request->scan_plans[i].iterations =
8573                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8574                         if (!request->scan_plans[i].iterations ||
8575                             (request->scan_plans[i].iterations >
8576                              wiphy->max_sched_scan_plan_iterations))
8577                                 return -EINVAL;
8578                 } else if (i < n_plans - 1) {
8579                         /*
8580                          * All scan plans but the last one must specify
8581                          * a finite number of iterations
8582                          */
8583                         return -EINVAL;
8584                 }
8585
8586                 i++;
8587         }
8588
8589         /*
8590          * The last scan plan must not specify the number of
8591          * iterations, it is supposed to run infinitely
8592          */
8593         if (request->scan_plans[n_plans - 1].iterations)
8594                 return  -EINVAL;
8595
8596         return 0;
8597 }
8598
8599 static int
8600 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8601                                        struct cfg80211_match_set *match_sets,
8602                                        struct nlattr *tb_band_rssi,
8603                                        s32 rssi_thold)
8604 {
8605         struct nlattr *attr;
8606         int i, tmp, ret = 0;
8607
8608         if (!wiphy_ext_feature_isset(wiphy,
8609                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8610                 if (tb_band_rssi)
8611                         ret = -EOPNOTSUPP;
8612                 else
8613                         for (i = 0; i < NUM_NL80211_BANDS; i++)
8614                                 match_sets->per_band_rssi_thold[i] =
8615                                         NL80211_SCAN_RSSI_THOLD_OFF;
8616                 return ret;
8617         }
8618
8619         for (i = 0; i < NUM_NL80211_BANDS; i++)
8620                 match_sets->per_band_rssi_thold[i] = rssi_thold;
8621
8622         nla_for_each_nested(attr, tb_band_rssi, tmp) {
8623                 enum nl80211_band band = nla_type(attr);
8624
8625                 if (band < 0 || band >= NUM_NL80211_BANDS)
8626                         return -EINVAL;
8627
8628                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
8629         }
8630
8631         return 0;
8632 }
8633
8634 static struct cfg80211_sched_scan_request *
8635 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8636                          struct nlattr **attrs, int max_match_sets)
8637 {
8638         struct cfg80211_sched_scan_request *request;
8639         struct nlattr *attr;
8640         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8641         enum nl80211_band band;
8642         size_t ie_len;
8643         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8644         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8645
8646         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8647                 n_channels = validate_scan_freqs(
8648                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8649                 if (!n_channels)
8650                         return ERR_PTR(-EINVAL);
8651         } else {
8652                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8653         }
8654
8655         if (attrs[NL80211_ATTR_SCAN_SSIDS])
8656                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8657                                     tmp)
8658                         n_ssids++;
8659
8660         if (n_ssids > wiphy->max_sched_scan_ssids)
8661                 return ERR_PTR(-EINVAL);
8662
8663         /*
8664          * First, count the number of 'real' matchsets. Due to an issue with
8665          * the old implementation, matchsets containing only the RSSI attribute
8666          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8667          * RSSI for all matchsets, rather than their own matchset for reporting
8668          * all APs with a strong RSSI. This is needed to be compatible with
8669          * older userspace that treated a matchset with only the RSSI as the
8670          * global RSSI for all other matchsets - if there are other matchsets.
8671          */
8672         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8673                 nla_for_each_nested(attr,
8674                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8675                                     tmp) {
8676                         struct nlattr *rssi;
8677
8678                         err = nla_parse_nested_deprecated(tb,
8679                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8680                                                           attr,
8681                                                           nl80211_match_policy,
8682                                                           NULL);
8683                         if (err)
8684                                 return ERR_PTR(err);
8685
8686                         /* SSID and BSSID are mutually exclusive */
8687                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8688                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8689                                 return ERR_PTR(-EINVAL);
8690
8691                         /* add other standalone attributes here */
8692                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8693                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8694                                 n_match_sets++;
8695                                 continue;
8696                         }
8697                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8698                         if (rssi)
8699                                 default_match_rssi = nla_get_s32(rssi);
8700                 }
8701         }
8702
8703         /* However, if there's no other matchset, add the RSSI one */
8704         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8705                 n_match_sets = 1;
8706
8707         if (n_match_sets > max_match_sets)
8708                 return ERR_PTR(-EINVAL);
8709
8710         if (attrs[NL80211_ATTR_IE])
8711                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8712         else
8713                 ie_len = 0;
8714
8715         if (ie_len > wiphy->max_sched_scan_ie_len)
8716                 return ERR_PTR(-EINVAL);
8717
8718         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8719                 /*
8720                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8721                  * each scan plan already specifies its own interval
8722                  */
8723                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8724                         return ERR_PTR(-EINVAL);
8725
8726                 nla_for_each_nested(attr,
8727                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8728                         n_plans++;
8729         } else {
8730                 /*
8731                  * The scan interval attribute is kept for backward
8732                  * compatibility. If no scan plans are specified and sched scan
8733                  * interval is specified, one scan plan will be set with this
8734                  * scan interval and infinite number of iterations.
8735                  */
8736                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8737                         return ERR_PTR(-EINVAL);
8738
8739                 n_plans = 1;
8740         }
8741
8742         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8743                 return ERR_PTR(-EINVAL);
8744
8745         if (!wiphy_ext_feature_isset(
8746                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8747             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8748              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8749                 return ERR_PTR(-EINVAL);
8750
8751         request = kzalloc(sizeof(*request)
8752                         + sizeof(*request->ssids) * n_ssids
8753                         + sizeof(*request->match_sets) * n_match_sets
8754                         + sizeof(*request->scan_plans) * n_plans
8755                         + sizeof(*request->channels) * n_channels
8756                         + ie_len, GFP_KERNEL);
8757         if (!request)
8758                 return ERR_PTR(-ENOMEM);
8759
8760         if (n_ssids)
8761                 request->ssids = (void *)&request->channels[n_channels];
8762         request->n_ssids = n_ssids;
8763         if (ie_len) {
8764                 if (n_ssids)
8765                         request->ie = (void *)(request->ssids + n_ssids);
8766                 else
8767                         request->ie = (void *)(request->channels + n_channels);
8768         }
8769
8770         if (n_match_sets) {
8771                 if (request->ie)
8772                         request->match_sets = (void *)(request->ie + ie_len);
8773                 else if (n_ssids)
8774                         request->match_sets =
8775                                 (void *)(request->ssids + n_ssids);
8776                 else
8777                         request->match_sets =
8778                                 (void *)(request->channels + n_channels);
8779         }
8780         request->n_match_sets = n_match_sets;
8781
8782         if (n_match_sets)
8783                 request->scan_plans = (void *)(request->match_sets +
8784                                                n_match_sets);
8785         else if (request->ie)
8786                 request->scan_plans = (void *)(request->ie + ie_len);
8787         else if (n_ssids)
8788                 request->scan_plans = (void *)(request->ssids + n_ssids);
8789         else
8790                 request->scan_plans = (void *)(request->channels + n_channels);
8791
8792         request->n_scan_plans = n_plans;
8793
8794         i = 0;
8795         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8796                 /* user specified, bail out if channel not found */
8797                 nla_for_each_nested(attr,
8798                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8799                                     tmp) {
8800                         struct ieee80211_channel *chan;
8801
8802                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8803
8804                         if (!chan) {
8805                                 err = -EINVAL;
8806                                 goto out_free;
8807                         }
8808
8809                         /* ignore disabled channels */
8810                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8811                                 continue;
8812
8813                         request->channels[i] = chan;
8814                         i++;
8815                 }
8816         } else {
8817                 /* all channels */
8818                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8819                         int j;
8820
8821                         if (!wiphy->bands[band])
8822                                 continue;
8823                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8824                                 struct ieee80211_channel *chan;
8825
8826                                 chan = &wiphy->bands[band]->channels[j];
8827
8828                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8829                                         continue;
8830
8831                                 request->channels[i] = chan;
8832                                 i++;
8833                         }
8834                 }
8835         }
8836
8837         if (!i) {
8838                 err = -EINVAL;
8839                 goto out_free;
8840         }
8841
8842         request->n_channels = i;
8843
8844         i = 0;
8845         if (n_ssids) {
8846                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8847                                     tmp) {
8848                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8849                                 err = -EINVAL;
8850                                 goto out_free;
8851                         }
8852                         request->ssids[i].ssid_len = nla_len(attr);
8853                         memcpy(request->ssids[i].ssid, nla_data(attr),
8854                                nla_len(attr));
8855                         i++;
8856                 }
8857         }
8858
8859         i = 0;
8860         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8861                 nla_for_each_nested(attr,
8862                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8863                                     tmp) {
8864                         struct nlattr *ssid, *bssid, *rssi;
8865
8866                         err = nla_parse_nested_deprecated(tb,
8867                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8868                                                           attr,
8869                                                           nl80211_match_policy,
8870                                                           NULL);
8871                         if (err)
8872                                 goto out_free;
8873                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8874                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8875
8876                         if (!ssid && !bssid) {
8877                                 i++;
8878                                 continue;
8879                         }
8880
8881                         if (WARN_ON(i >= n_match_sets)) {
8882                                 /* this indicates a programming error,
8883                                  * the loop above should have verified
8884                                  * things properly
8885                                  */
8886                                 err = -EINVAL;
8887                                 goto out_free;
8888                         }
8889
8890                         if (ssid) {
8891                                 memcpy(request->match_sets[i].ssid.ssid,
8892                                        nla_data(ssid), nla_len(ssid));
8893                                 request->match_sets[i].ssid.ssid_len =
8894                                         nla_len(ssid);
8895                         }
8896                         if (bssid)
8897                                 memcpy(request->match_sets[i].bssid,
8898                                        nla_data(bssid), ETH_ALEN);
8899
8900                         /* special attribute - old implementation w/a */
8901                         request->match_sets[i].rssi_thold = default_match_rssi;
8902                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8903                         if (rssi)
8904                                 request->match_sets[i].rssi_thold =
8905                                         nla_get_s32(rssi);
8906
8907                         /* Parse per band RSSI attribute */
8908                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8909                                 &request->match_sets[i],
8910                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8911                                 request->match_sets[i].rssi_thold);
8912                         if (err)
8913                                 goto out_free;
8914
8915                         i++;
8916                 }
8917
8918                 /* there was no other matchset, so the RSSI one is alone */
8919                 if (i == 0 && n_match_sets)
8920                         request->match_sets[0].rssi_thold = default_match_rssi;
8921
8922                 request->min_rssi_thold = INT_MAX;
8923                 for (i = 0; i < n_match_sets; i++)
8924                         request->min_rssi_thold =
8925                                 min(request->match_sets[i].rssi_thold,
8926                                     request->min_rssi_thold);
8927         } else {
8928                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8929         }
8930
8931         if (ie_len) {
8932                 request->ie_len = ie_len;
8933                 memcpy((void *)request->ie,
8934                        nla_data(attrs[NL80211_ATTR_IE]),
8935                        request->ie_len);
8936         }
8937
8938         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8939         if (err)
8940                 goto out_free;
8941
8942         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8943                 request->delay =
8944                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8945
8946         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8947                 request->relative_rssi = nla_get_s8(
8948                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8949                 request->relative_rssi_set = true;
8950         }
8951
8952         if (request->relative_rssi_set &&
8953             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8954                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8955
8956                 rssi_adjust = nla_data(
8957                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8958                 request->rssi_adjust.band = rssi_adjust->band;
8959                 request->rssi_adjust.delta = rssi_adjust->delta;
8960                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8961                         err = -EINVAL;
8962                         goto out_free;
8963                 }
8964         }
8965
8966         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8967         if (err)
8968                 goto out_free;
8969
8970         request->scan_start = jiffies;
8971
8972         return request;
8973
8974 out_free:
8975         kfree(request);
8976         return ERR_PTR(err);
8977 }
8978
8979 static int nl80211_start_sched_scan(struct sk_buff *skb,
8980                                     struct genl_info *info)
8981 {
8982         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8983         struct net_device *dev = info->user_ptr[1];
8984         struct wireless_dev *wdev = dev->ieee80211_ptr;
8985         struct cfg80211_sched_scan_request *sched_scan_req;
8986         bool want_multi;
8987         int err;
8988
8989         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
8990                 return -EOPNOTSUPP;
8991
8992         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
8993         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
8994         if (err)
8995                 return err;
8996
8997         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
8998                                                   info->attrs,
8999                                                   rdev->wiphy.max_match_sets);
9000
9001         err = PTR_ERR_OR_ZERO(sched_scan_req);
9002         if (err)
9003                 goto out_err;
9004
9005         /* leave request id zero for legacy request
9006          * or if driver does not support multi-scheduled scan
9007          */
9008         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9009                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9010
9011         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9012         if (err)
9013                 goto out_free;
9014
9015         sched_scan_req->dev = dev;
9016         sched_scan_req->wiphy = &rdev->wiphy;
9017
9018         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9019                 sched_scan_req->owner_nlportid = info->snd_portid;
9020
9021         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9022
9023         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9024         return 0;
9025
9026 out_free:
9027         kfree(sched_scan_req);
9028 out_err:
9029         return err;
9030 }
9031
9032 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9033                                    struct genl_info *info)
9034 {
9035         struct cfg80211_sched_scan_request *req;
9036         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9037         u64 cookie;
9038
9039         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9040                 return -EOPNOTSUPP;
9041
9042         if (info->attrs[NL80211_ATTR_COOKIE]) {
9043                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9044                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9045         }
9046
9047         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9048                                      struct cfg80211_sched_scan_request,
9049                                      list);
9050         if (!req || req->reqid ||
9051             (req->owner_nlportid &&
9052              req->owner_nlportid != info->snd_portid))
9053                 return -ENOENT;
9054
9055         return cfg80211_stop_sched_scan_req(rdev, req, false);
9056 }
9057
9058 static int nl80211_start_radar_detection(struct sk_buff *skb,
9059                                          struct genl_info *info)
9060 {
9061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9062         struct net_device *dev = info->user_ptr[1];
9063         struct wireless_dev *wdev = dev->ieee80211_ptr;
9064         struct wiphy *wiphy = wdev->wiphy;
9065         struct cfg80211_chan_def chandef;
9066         enum nl80211_dfs_regions dfs_region;
9067         unsigned int cac_time_ms;
9068         int err;
9069
9070         dfs_region = reg_get_dfs_region(wiphy);
9071         if (dfs_region == NL80211_DFS_UNSET)
9072                 return -EINVAL;
9073
9074         err = nl80211_parse_chandef(rdev, info, &chandef);
9075         if (err)
9076                 return err;
9077
9078         if (netif_carrier_ok(dev))
9079                 return -EBUSY;
9080
9081         if (wdev->cac_started)
9082                 return -EBUSY;
9083
9084         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9085         if (err < 0)
9086                 return err;
9087
9088         if (err == 0)
9089                 return -EINVAL;
9090
9091         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
9092                 return -EINVAL;
9093
9094         /* CAC start is offloaded to HW and can't be started manually */
9095         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
9096                 return -EOPNOTSUPP;
9097
9098         if (!rdev->ops->start_radar_detection)
9099                 return -EOPNOTSUPP;
9100
9101         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9102         if (WARN_ON(!cac_time_ms))
9103                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9104
9105         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9106         if (!err) {
9107                 wdev->chandef = chandef;
9108                 wdev->cac_started = true;
9109                 wdev->cac_start_time = jiffies;
9110                 wdev->cac_time_ms = cac_time_ms;
9111         }
9112         return err;
9113 }
9114
9115 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9116                                           struct genl_info *info)
9117 {
9118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9119         struct net_device *dev = info->user_ptr[1];
9120         struct wireless_dev *wdev = dev->ieee80211_ptr;
9121         struct wiphy *wiphy = wdev->wiphy;
9122         struct cfg80211_chan_def chandef;
9123         enum nl80211_dfs_regions dfs_region;
9124         int err;
9125
9126         dfs_region = reg_get_dfs_region(wiphy);
9127         if (dfs_region == NL80211_DFS_UNSET) {
9128                 GENL_SET_ERR_MSG(info,
9129                                  "DFS Region is not set. Unexpected Radar indication");
9130                 return -EINVAL;
9131         }
9132
9133         err = nl80211_parse_chandef(rdev, info, &chandef);
9134         if (err) {
9135                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9136                 return err;
9137         }
9138
9139         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9140         if (err < 0) {
9141                 GENL_SET_ERR_MSG(info, "chandef is invalid");
9142                 return err;
9143         }
9144
9145         if (err == 0) {
9146                 GENL_SET_ERR_MSG(info,
9147                                  "Unexpected Radar indication for chandef/iftype");
9148                 return -EINVAL;
9149         }
9150
9151         /* Do not process this notification if radar is already detected
9152          * by kernel on this channel, and return success.
9153          */
9154         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9155                 return 0;
9156
9157         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9158
9159         cfg80211_sched_dfs_chan_update(rdev);
9160
9161         rdev->radar_chandef = chandef;
9162
9163         /* Propagate this notification to other radios as well */
9164         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9165
9166         return 0;
9167 }
9168
9169 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9170 {
9171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9172         struct net_device *dev = info->user_ptr[1];
9173         struct wireless_dev *wdev = dev->ieee80211_ptr;
9174         struct cfg80211_csa_settings params;
9175         struct nlattr **csa_attrs = NULL;
9176         int err;
9177         bool need_new_beacon = false;
9178         bool need_handle_dfs_flag = true;
9179         int len, i;
9180         u32 cs_count;
9181
9182         if (!rdev->ops->channel_switch ||
9183             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9184                 return -EOPNOTSUPP;
9185
9186         switch (dev->ieee80211_ptr->iftype) {
9187         case NL80211_IFTYPE_AP:
9188         case NL80211_IFTYPE_P2P_GO:
9189                 need_new_beacon = true;
9190                 /* For all modes except AP the handle_dfs flag needs to be
9191                  * supplied to tell the kernel that userspace will handle radar
9192                  * events when they happen. Otherwise a switch to a channel
9193                  * requiring DFS will be rejected.
9194                  */
9195                 need_handle_dfs_flag = false;
9196
9197                 /* useless if AP is not running */
9198                 if (!wdev->beacon_interval)
9199                         return -ENOTCONN;
9200                 break;
9201         case NL80211_IFTYPE_ADHOC:
9202                 if (!wdev->ssid_len)
9203                         return -ENOTCONN;
9204                 break;
9205         case NL80211_IFTYPE_MESH_POINT:
9206                 if (!wdev->mesh_id_len)
9207                         return -ENOTCONN;
9208                 break;
9209         default:
9210                 return -EOPNOTSUPP;
9211         }
9212
9213         memset(&params, 0, sizeof(params));
9214         params.beacon_csa.ftm_responder = -1;
9215
9216         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9217             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9218                 return -EINVAL;
9219
9220         /* only important for AP, IBSS and mesh create IEs internally */
9221         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9222                 return -EINVAL;
9223
9224         /* Even though the attribute is u32, the specification says
9225          * u8, so let's make sure we don't overflow.
9226          */
9227         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9228         if (cs_count > 255)
9229                 return -EINVAL;
9230
9231         params.count = cs_count;
9232
9233         if (!need_new_beacon)
9234                 goto skip_beacons;
9235
9236         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
9237         if (err)
9238                 return err;
9239
9240         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
9241                             GFP_KERNEL);
9242         if (!csa_attrs)
9243                 return -ENOMEM;
9244
9245         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9246                                           info->attrs[NL80211_ATTR_CSA_IES],
9247                                           nl80211_policy, info->extack);
9248         if (err)
9249                 goto free;
9250
9251         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
9252         if (err)
9253                 goto free;
9254
9255         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
9256                 err = -EINVAL;
9257                 goto free;
9258         }
9259
9260         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9261         if (!len || (len % sizeof(u16))) {
9262                 err = -EINVAL;
9263                 goto free;
9264         }
9265
9266         params.n_counter_offsets_beacon = len / sizeof(u16);
9267         if (rdev->wiphy.max_num_csa_counters &&
9268             (params.n_counter_offsets_beacon >
9269              rdev->wiphy.max_num_csa_counters)) {
9270                 err = -EINVAL;
9271                 goto free;
9272         }
9273
9274         params.counter_offsets_beacon =
9275                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9276
9277         /* sanity checks - counters should fit and be the same */
9278         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9279                 u16 offset = params.counter_offsets_beacon[i];
9280
9281                 if (offset >= params.beacon_csa.tail_len) {
9282                         err = -EINVAL;
9283                         goto free;
9284                 }
9285
9286                 if (params.beacon_csa.tail[offset] != params.count) {
9287                         err = -EINVAL;
9288                         goto free;
9289                 }
9290         }
9291
9292         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9293                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9294                 if (!len || (len % sizeof(u16))) {
9295                         err = -EINVAL;
9296                         goto free;
9297                 }
9298
9299                 params.n_counter_offsets_presp = len / sizeof(u16);
9300                 if (rdev->wiphy.max_num_csa_counters &&
9301                     (params.n_counter_offsets_presp >
9302                      rdev->wiphy.max_num_csa_counters)) {
9303                         err = -EINVAL;
9304                         goto free;
9305                 }
9306
9307                 params.counter_offsets_presp =
9308                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9309
9310                 /* sanity checks - counters should fit and be the same */
9311                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9312                         u16 offset = params.counter_offsets_presp[i];
9313
9314                         if (offset >= params.beacon_csa.probe_resp_len) {
9315                                 err = -EINVAL;
9316                                 goto free;
9317                         }
9318
9319                         if (params.beacon_csa.probe_resp[offset] !=
9320                             params.count) {
9321                                 err = -EINVAL;
9322                                 goto free;
9323                         }
9324                 }
9325         }
9326
9327 skip_beacons:
9328         err = nl80211_parse_chandef(rdev, info, &params.chandef);
9329         if (err)
9330                 goto free;
9331
9332         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
9333                                            wdev->iftype)) {
9334                 err = -EINVAL;
9335                 goto free;
9336         }
9337
9338         err = cfg80211_chandef_dfs_required(wdev->wiphy,
9339                                             &params.chandef,
9340                                             wdev->iftype);
9341         if (err < 0)
9342                 goto free;
9343
9344         if (err > 0) {
9345                 params.radar_required = true;
9346                 if (need_handle_dfs_flag &&
9347                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9348                         err = -EINVAL;
9349                         goto free;
9350                 }
9351         }
9352
9353         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9354                 params.block_tx = true;
9355
9356         wdev_lock(wdev);
9357         err = rdev_channel_switch(rdev, dev, &params);
9358         wdev_unlock(wdev);
9359
9360 free:
9361         kfree(csa_attrs);
9362         return err;
9363 }
9364
9365 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9366                             u32 seq, int flags,
9367                             struct cfg80211_registered_device *rdev,
9368                             struct wireless_dev *wdev,
9369                             struct cfg80211_internal_bss *intbss)
9370 {
9371         struct cfg80211_bss *res = &intbss->pub;
9372         const struct cfg80211_bss_ies *ies;
9373         void *hdr;
9374         struct nlattr *bss;
9375
9376         ASSERT_WDEV_LOCK(wdev);
9377
9378         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9379                              NL80211_CMD_NEW_SCAN_RESULTS);
9380         if (!hdr)
9381                 return -1;
9382
9383         genl_dump_check_consistent(cb, hdr);
9384
9385         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9386                 goto nla_put_failure;
9387         if (wdev->netdev &&
9388             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9389                 goto nla_put_failure;
9390         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9391                               NL80211_ATTR_PAD))
9392                 goto nla_put_failure;
9393
9394         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9395         if (!bss)
9396                 goto nla_put_failure;
9397         if ((!is_zero_ether_addr(res->bssid) &&
9398              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9399                 goto nla_put_failure;
9400
9401         rcu_read_lock();
9402         /* indicate whether we have probe response data or not */
9403         if (rcu_access_pointer(res->proberesp_ies) &&
9404             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9405                 goto fail_unlock_rcu;
9406
9407         /* this pointer prefers to be pointed to probe response data
9408          * but is always valid
9409          */
9410         ies = rcu_dereference(res->ies);
9411         if (ies) {
9412                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9413                                       NL80211_BSS_PAD))
9414                         goto fail_unlock_rcu;
9415                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9416                                         ies->len, ies->data))
9417                         goto fail_unlock_rcu;
9418         }
9419
9420         /* and this pointer is always (unless driver didn't know) beacon data */
9421         ies = rcu_dereference(res->beacon_ies);
9422         if (ies && ies->from_beacon) {
9423                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9424                                       NL80211_BSS_PAD))
9425                         goto fail_unlock_rcu;
9426                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9427                                         ies->len, ies->data))
9428                         goto fail_unlock_rcu;
9429         }
9430         rcu_read_unlock();
9431
9432         if (res->beacon_interval &&
9433             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9434                 goto nla_put_failure;
9435         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9436             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9437             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9438                         res->channel->freq_offset) ||
9439             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9440             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9441                         jiffies_to_msecs(jiffies - intbss->ts)))
9442                 goto nla_put_failure;
9443
9444         if (intbss->parent_tsf &&
9445             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9446                                intbss->parent_tsf, NL80211_BSS_PAD) ||
9447              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9448                      intbss->parent_bssid)))
9449                 goto nla_put_failure;
9450
9451         if (intbss->ts_boottime &&
9452             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9453                               intbss->ts_boottime, NL80211_BSS_PAD))
9454                 goto nla_put_failure;
9455
9456         if (!nl80211_put_signal(msg, intbss->pub.chains,
9457                                 intbss->pub.chain_signal,
9458                                 NL80211_BSS_CHAIN_SIGNAL))
9459                 goto nla_put_failure;
9460
9461         switch (rdev->wiphy.signal_type) {
9462         case CFG80211_SIGNAL_TYPE_MBM:
9463                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9464                         goto nla_put_failure;
9465                 break;
9466         case CFG80211_SIGNAL_TYPE_UNSPEC:
9467                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9468                         goto nla_put_failure;
9469                 break;
9470         default:
9471                 break;
9472         }
9473
9474         switch (wdev->iftype) {
9475         case NL80211_IFTYPE_P2P_CLIENT:
9476         case NL80211_IFTYPE_STATION:
9477                 if (intbss == wdev->current_bss &&
9478                     nla_put_u32(msg, NL80211_BSS_STATUS,
9479                                 NL80211_BSS_STATUS_ASSOCIATED))
9480                         goto nla_put_failure;
9481                 break;
9482         case NL80211_IFTYPE_ADHOC:
9483                 if (intbss == wdev->current_bss &&
9484                     nla_put_u32(msg, NL80211_BSS_STATUS,
9485                                 NL80211_BSS_STATUS_IBSS_JOINED))
9486                         goto nla_put_failure;
9487                 break;
9488         default:
9489                 break;
9490         }
9491
9492         nla_nest_end(msg, bss);
9493
9494         genlmsg_end(msg, hdr);
9495         return 0;
9496
9497  fail_unlock_rcu:
9498         rcu_read_unlock();
9499  nla_put_failure:
9500         genlmsg_cancel(msg, hdr);
9501         return -EMSGSIZE;
9502 }
9503
9504 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9505 {
9506         struct cfg80211_registered_device *rdev;
9507         struct cfg80211_internal_bss *scan;
9508         struct wireless_dev *wdev;
9509         int start = cb->args[2], idx = 0;
9510         int err;
9511
9512         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9513         if (err)
9514                 return err;
9515         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9516         __acquire(&rdev->wiphy.mtx);
9517
9518         wdev_lock(wdev);
9519         spin_lock_bh(&rdev->bss_lock);
9520
9521         /*
9522          * dump_scan will be called multiple times to break up the scan results
9523          * into multiple messages.  It is unlikely that any more bss-es will be
9524          * expired after the first call, so only call only call this on the
9525          * first dump_scan invocation.
9526          */
9527         if (start == 0)
9528                 cfg80211_bss_expire(rdev);
9529
9530         cb->seq = rdev->bss_generation;
9531
9532         list_for_each_entry(scan, &rdev->bss_list, list) {
9533                 if (++idx <= start)
9534                         continue;
9535                 if (nl80211_send_bss(skb, cb,
9536                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9537                                 rdev, wdev, scan) < 0) {
9538                         idx--;
9539                         break;
9540                 }
9541         }
9542
9543         spin_unlock_bh(&rdev->bss_lock);
9544         wdev_unlock(wdev);
9545
9546         cb->args[2] = idx;
9547         wiphy_unlock(&rdev->wiphy);
9548
9549         return skb->len;
9550 }
9551
9552 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
9553                                int flags, struct net_device *dev,
9554                                bool allow_radio_stats,
9555                                struct survey_info *survey)
9556 {
9557         void *hdr;
9558         struct nlattr *infoattr;
9559
9560         /* skip radio stats if userspace didn't request them */
9561         if (!survey->channel && !allow_radio_stats)
9562                 return 0;
9563
9564         hdr = nl80211hdr_put(msg, portid, seq, flags,
9565                              NL80211_CMD_NEW_SURVEY_RESULTS);
9566         if (!hdr)
9567                 return -ENOMEM;
9568
9569         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9570                 goto nla_put_failure;
9571
9572         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9573         if (!infoattr)
9574                 goto nla_put_failure;
9575
9576         if (survey->channel &&
9577             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9578                         survey->channel->center_freq))
9579                 goto nla_put_failure;
9580
9581         if (survey->channel && survey->channel->freq_offset &&
9582             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
9583                         survey->channel->freq_offset))
9584                 goto nla_put_failure;
9585
9586         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9587             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9588                 goto nla_put_failure;
9589         if ((survey->filled & SURVEY_INFO_IN_USE) &&
9590             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9591                 goto nla_put_failure;
9592         if ((survey->filled & SURVEY_INFO_TIME) &&
9593             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9594                         survey->time, NL80211_SURVEY_INFO_PAD))
9595                 goto nla_put_failure;
9596         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9597             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9598                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
9599                 goto nla_put_failure;
9600         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9601             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9602                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9603                 goto nla_put_failure;
9604         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9605             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9606                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
9607                 goto nla_put_failure;
9608         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9609             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9610                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
9611                 goto nla_put_failure;
9612         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9613             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9614                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
9615                 goto nla_put_failure;
9616         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9617             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9618                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9619                 goto nla_put_failure;
9620
9621         nla_nest_end(msg, infoattr);
9622
9623         genlmsg_end(msg, hdr);
9624         return 0;
9625
9626  nla_put_failure:
9627         genlmsg_cancel(msg, hdr);
9628         return -EMSGSIZE;
9629 }
9630
9631 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9632 {
9633         struct nlattr **attrbuf;
9634         struct survey_info survey;
9635         struct cfg80211_registered_device *rdev;
9636         struct wireless_dev *wdev;
9637         int survey_idx = cb->args[2];
9638         int res;
9639         bool radio_stats;
9640
9641         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9642         if (!attrbuf)
9643                 return -ENOMEM;
9644
9645         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
9646         if (res) {
9647                 kfree(attrbuf);
9648                 return res;
9649         }
9650         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9651         __acquire(&rdev->wiphy.mtx);
9652
9653         /* prepare_wdev_dump parsed the attributes */
9654         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9655
9656         if (!wdev->netdev) {
9657                 res = -EINVAL;
9658                 goto out_err;
9659         }
9660
9661         if (!rdev->ops->dump_survey) {
9662                 res = -EOPNOTSUPP;
9663                 goto out_err;
9664         }
9665
9666         while (1) {
9667                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9668                 if (res == -ENOENT)
9669                         break;
9670                 if (res)
9671                         goto out_err;
9672
9673                 /* don't send disabled channels, but do send non-channel data */
9674                 if (survey.channel &&
9675                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9676                         survey_idx++;
9677                         continue;
9678                 }
9679
9680                 if (nl80211_send_survey(skb,
9681                                 NETLINK_CB(cb->skb).portid,
9682                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9683                                 wdev->netdev, radio_stats, &survey) < 0)
9684                         goto out;
9685                 survey_idx++;
9686         }
9687
9688  out:
9689         cb->args[2] = survey_idx;
9690         res = skb->len;
9691  out_err:
9692         kfree(attrbuf);
9693         wiphy_unlock(&rdev->wiphy);
9694         return res;
9695 }
9696
9697 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9698 {
9699         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9700                                   NL80211_WPA_VERSION_2 |
9701                                   NL80211_WPA_VERSION_3));
9702 }
9703
9704 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9705 {
9706         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9707         struct net_device *dev = info->user_ptr[1];
9708         struct ieee80211_channel *chan;
9709         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9710         int err, ssid_len, ie_len = 0, auth_data_len = 0;
9711         enum nl80211_auth_type auth_type;
9712         struct key_parse key;
9713         bool local_state_change;
9714         u32 freq;
9715
9716         if (!info->attrs[NL80211_ATTR_MAC])
9717                 return -EINVAL;
9718
9719         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9720                 return -EINVAL;
9721
9722         if (!info->attrs[NL80211_ATTR_SSID])
9723                 return -EINVAL;
9724
9725         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9726                 return -EINVAL;
9727
9728         err = nl80211_parse_key(info, &key);
9729         if (err)
9730                 return err;
9731
9732         if (key.idx >= 0) {
9733                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9734                         return -EINVAL;
9735                 if (!key.p.key || !key.p.key_len)
9736                         return -EINVAL;
9737                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9738                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9739                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9740                      key.p.key_len != WLAN_KEY_LEN_WEP104))
9741                         return -EINVAL;
9742                 if (key.idx > 3)
9743                         return -EINVAL;
9744         } else {
9745                 key.p.key_len = 0;
9746                 key.p.key = NULL;
9747         }
9748
9749         if (key.idx >= 0) {
9750                 int i;
9751                 bool ok = false;
9752
9753                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9754                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9755                                 ok = true;
9756                                 break;
9757                         }
9758                 }
9759                 if (!ok)
9760                         return -EINVAL;
9761         }
9762
9763         if (!rdev->ops->auth)
9764                 return -EOPNOTSUPP;
9765
9766         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9767             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9768                 return -EOPNOTSUPP;
9769
9770         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9771         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9772         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9773                 freq +=
9774                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9775
9776         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9777         if (!chan)
9778                 return -EINVAL;
9779
9780         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9781         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9782
9783         if (info->attrs[NL80211_ATTR_IE]) {
9784                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9785                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9786         }
9787
9788         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9789         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9790                 return -EINVAL;
9791
9792         if ((auth_type == NL80211_AUTHTYPE_SAE ||
9793              auth_type == NL80211_AUTHTYPE_FILS_SK ||
9794              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9795              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9796             !info->attrs[NL80211_ATTR_AUTH_DATA])
9797                 return -EINVAL;
9798
9799         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9800                 if (auth_type != NL80211_AUTHTYPE_SAE &&
9801                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
9802                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9803                     auth_type != NL80211_AUTHTYPE_FILS_PK)
9804                         return -EINVAL;
9805                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9806                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9807         }
9808
9809         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9810
9811         /*
9812          * Since we no longer track auth state, ignore
9813          * requests to only change local state.
9814          */
9815         if (local_state_change)
9816                 return 0;
9817
9818         wdev_lock(dev->ieee80211_ptr);
9819         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9820                                  ssid, ssid_len, ie, ie_len,
9821                                  key.p.key, key.p.key_len, key.idx,
9822                                  auth_data, auth_data_len);
9823         wdev_unlock(dev->ieee80211_ptr);
9824         return err;
9825 }
9826
9827 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9828                                      struct genl_info *info)
9829 {
9830         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9831                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9832                 return -EINVAL;
9833         }
9834
9835         if (!rdev->ops->tx_control_port ||
9836             !wiphy_ext_feature_isset(&rdev->wiphy,
9837                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9838                 return -EOPNOTSUPP;
9839
9840         return 0;
9841 }
9842
9843 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9844                                    struct genl_info *info,
9845                                    struct cfg80211_crypto_settings *settings,
9846                                    int cipher_limit)
9847 {
9848         memset(settings, 0, sizeof(*settings));
9849
9850         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9851
9852         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9853                 u16 proto;
9854
9855                 proto = nla_get_u16(
9856                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9857                 settings->control_port_ethertype = cpu_to_be16(proto);
9858                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9859                     proto != ETH_P_PAE)
9860                         return -EINVAL;
9861                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9862                         settings->control_port_no_encrypt = true;
9863         } else
9864                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9865
9866         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9867                 int r = validate_pae_over_nl80211(rdev, info);
9868
9869                 if (r < 0)
9870                         return r;
9871
9872                 settings->control_port_over_nl80211 = true;
9873
9874                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
9875                         settings->control_port_no_preauth = true;
9876         }
9877
9878         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9879                 void *data;
9880                 int len, i;
9881
9882                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9883                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9884                 settings->n_ciphers_pairwise = len / sizeof(u32);
9885
9886                 if (len % sizeof(u32))
9887                         return -EINVAL;
9888
9889                 if (settings->n_ciphers_pairwise > cipher_limit)
9890                         return -EINVAL;
9891
9892                 memcpy(settings->ciphers_pairwise, data, len);
9893
9894                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9895                         if (!cfg80211_supported_cipher_suite(
9896                                         &rdev->wiphy,
9897                                         settings->ciphers_pairwise[i]))
9898                                 return -EINVAL;
9899         }
9900
9901         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9902                 settings->cipher_group =
9903                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9904                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9905                                                      settings->cipher_group))
9906                         return -EINVAL;
9907         }
9908
9909         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9910                 settings->wpa_versions =
9911                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9912                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9913                         return -EINVAL;
9914         }
9915
9916         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9917                 void *data;
9918                 int len;
9919
9920                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9921                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9922                 settings->n_akm_suites = len / sizeof(u32);
9923
9924                 if (len % sizeof(u32))
9925                         return -EINVAL;
9926
9927                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9928                         return -EINVAL;
9929
9930                 memcpy(settings->akm_suites, data, len);
9931         }
9932
9933         if (info->attrs[NL80211_ATTR_PMK]) {
9934                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9935                         return -EINVAL;
9936                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9937                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
9938                     !wiphy_ext_feature_isset(&rdev->wiphy,
9939                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
9940                         return -EINVAL;
9941                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9942         }
9943
9944         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9945                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9946                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
9947                     !wiphy_ext_feature_isset(&rdev->wiphy,
9948                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
9949                         return -EINVAL;
9950                 settings->sae_pwd =
9951                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9952                 settings->sae_pwd_len =
9953                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9954         }
9955
9956         if (info->attrs[NL80211_ATTR_SAE_PWE])
9957                 settings->sae_pwe =
9958                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
9959         else
9960                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
9961
9962         return 0;
9963 }
9964
9965 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9966 {
9967         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9968         struct net_device *dev = info->user_ptr[1];
9969         struct ieee80211_channel *chan;
9970         struct cfg80211_assoc_request req = {};
9971         const u8 *bssid, *ssid;
9972         int err, ssid_len = 0;
9973         u32 freq;
9974
9975         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9976             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9977                 return -EPERM;
9978
9979         if (!info->attrs[NL80211_ATTR_MAC] ||
9980             !info->attrs[NL80211_ATTR_SSID] ||
9981             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
9982                 return -EINVAL;
9983
9984         if (!rdev->ops->assoc)
9985                 return -EOPNOTSUPP;
9986
9987         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9988             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9989                 return -EOPNOTSUPP;
9990
9991         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9992
9993         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9994         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9995                 freq +=
9996                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9997         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9998         if (!chan)
9999                 return -EINVAL;
10000
10001         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10002         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10003
10004         if (info->attrs[NL80211_ATTR_IE]) {
10005                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10006                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10007         }
10008
10009         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10010                 enum nl80211_mfp mfp =
10011                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10012                 if (mfp == NL80211_MFP_REQUIRED)
10013                         req.use_mfp = true;
10014                 else if (mfp != NL80211_MFP_NO)
10015                         return -EINVAL;
10016         }
10017
10018         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10019                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10020
10021         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10022                 req.flags |= ASSOC_REQ_DISABLE_HT;
10023
10024         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10025                 memcpy(&req.ht_capa_mask,
10026                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10027                        sizeof(req.ht_capa_mask));
10028
10029         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10030                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10031                         return -EINVAL;
10032                 memcpy(&req.ht_capa,
10033                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10034                        sizeof(req.ht_capa));
10035         }
10036
10037         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10038                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10039
10040         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10041                 req.flags |= ASSOC_REQ_DISABLE_HE;
10042
10043         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10044                 memcpy(&req.vht_capa_mask,
10045                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10046                        sizeof(req.vht_capa_mask));
10047
10048         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10049                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10050                         return -EINVAL;
10051                 memcpy(&req.vht_capa,
10052                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10053                        sizeof(req.vht_capa));
10054         }
10055
10056         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10057                 if (!((rdev->wiphy.features &
10058                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10059                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10060                     !wiphy_ext_feature_isset(&rdev->wiphy,
10061                                              NL80211_EXT_FEATURE_RRM))
10062                         return -EINVAL;
10063                 req.flags |= ASSOC_REQ_USE_RRM;
10064         }
10065
10066         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10067                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10068                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10069                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10070                         return -EINVAL;
10071                 req.fils_nonces =
10072                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10073         }
10074
10075         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10076                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10077                         return -EINVAL;
10078                 memcpy(&req.s1g_capa_mask,
10079                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10080                        sizeof(req.s1g_capa_mask));
10081         }
10082
10083         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10084                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10085                         return -EINVAL;
10086                 memcpy(&req.s1g_capa,
10087                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10088                        sizeof(req.s1g_capa));
10089         }
10090
10091         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
10092         if (!err) {
10093                 wdev_lock(dev->ieee80211_ptr);
10094
10095                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
10096                                           ssid, ssid_len, &req);
10097
10098                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10099                         dev->ieee80211_ptr->conn_owner_nlportid =
10100                                 info->snd_portid;
10101                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10102                                bssid, ETH_ALEN);
10103                 }
10104
10105                 wdev_unlock(dev->ieee80211_ptr);
10106         }
10107
10108         return err;
10109 }
10110
10111 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
10112 {
10113         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10114         struct net_device *dev = info->user_ptr[1];
10115         const u8 *ie = NULL, *bssid;
10116         int ie_len = 0, err;
10117         u16 reason_code;
10118         bool local_state_change;
10119
10120         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10121             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10122                 return -EPERM;
10123
10124         if (!info->attrs[NL80211_ATTR_MAC])
10125                 return -EINVAL;
10126
10127         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10128                 return -EINVAL;
10129
10130         if (!rdev->ops->deauth)
10131                 return -EOPNOTSUPP;
10132
10133         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10134             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10135                 return -EOPNOTSUPP;
10136
10137         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10138
10139         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10140         if (reason_code == 0) {
10141                 /* Reason Code 0 is reserved */
10142                 return -EINVAL;
10143         }
10144
10145         if (info->attrs[NL80211_ATTR_IE]) {
10146                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10147                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10148         }
10149
10150         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10151
10152         wdev_lock(dev->ieee80211_ptr);
10153         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
10154                                    local_state_change);
10155         wdev_unlock(dev->ieee80211_ptr);
10156         return err;
10157 }
10158
10159 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
10160 {
10161         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10162         struct net_device *dev = info->user_ptr[1];
10163         const u8 *ie = NULL, *bssid;
10164         int ie_len = 0, err;
10165         u16 reason_code;
10166         bool local_state_change;
10167
10168         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10169             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10170                 return -EPERM;
10171
10172         if (!info->attrs[NL80211_ATTR_MAC])
10173                 return -EINVAL;
10174
10175         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10176                 return -EINVAL;
10177
10178         if (!rdev->ops->disassoc)
10179                 return -EOPNOTSUPP;
10180
10181         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10182             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10183                 return -EOPNOTSUPP;
10184
10185         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10186
10187         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10188         if (reason_code == 0) {
10189                 /* Reason Code 0 is reserved */
10190                 return -EINVAL;
10191         }
10192
10193         if (info->attrs[NL80211_ATTR_IE]) {
10194                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10195                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10196         }
10197
10198         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10199
10200         wdev_lock(dev->ieee80211_ptr);
10201         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
10202                                      local_state_change);
10203         wdev_unlock(dev->ieee80211_ptr);
10204         return err;
10205 }
10206
10207 static bool
10208 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
10209                          int mcast_rate[NUM_NL80211_BANDS],
10210                          int rateval)
10211 {
10212         struct wiphy *wiphy = &rdev->wiphy;
10213         bool found = false;
10214         int band, i;
10215
10216         for (band = 0; band < NUM_NL80211_BANDS; band++) {
10217                 struct ieee80211_supported_band *sband;
10218
10219                 sband = wiphy->bands[band];
10220                 if (!sband)
10221                         continue;
10222
10223                 for (i = 0; i < sband->n_bitrates; i++) {
10224                         if (sband->bitrates[i].bitrate == rateval) {
10225                                 mcast_rate[band] = i + 1;
10226                                 found = true;
10227                                 break;
10228                         }
10229                 }
10230         }
10231
10232         return found;
10233 }
10234
10235 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10236 {
10237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10238         struct net_device *dev = info->user_ptr[1];
10239         struct cfg80211_ibss_params ibss;
10240         struct wiphy *wiphy;
10241         struct cfg80211_cached_keys *connkeys = NULL;
10242         int err;
10243
10244         memset(&ibss, 0, sizeof(ibss));
10245
10246         if (!info->attrs[NL80211_ATTR_SSID] ||
10247             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10248                 return -EINVAL;
10249
10250         ibss.beacon_interval = 100;
10251
10252         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10253                 ibss.beacon_interval =
10254                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10255
10256         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10257                                            ibss.beacon_interval);
10258         if (err)
10259                 return err;
10260
10261         if (!rdev->ops->join_ibss)
10262                 return -EOPNOTSUPP;
10263
10264         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10265                 return -EOPNOTSUPP;
10266
10267         wiphy = &rdev->wiphy;
10268
10269         if (info->attrs[NL80211_ATTR_MAC]) {
10270                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10271
10272                 if (!is_valid_ether_addr(ibss.bssid))
10273                         return -EINVAL;
10274         }
10275         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10276         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10277
10278         if (info->attrs[NL80211_ATTR_IE]) {
10279                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10280                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10281         }
10282
10283         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10284         if (err)
10285                 return err;
10286
10287         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10288                                      NL80211_IFTYPE_ADHOC))
10289                 return -EINVAL;
10290
10291         switch (ibss.chandef.width) {
10292         case NL80211_CHAN_WIDTH_5:
10293         case NL80211_CHAN_WIDTH_10:
10294         case NL80211_CHAN_WIDTH_20_NOHT:
10295                 break;
10296         case NL80211_CHAN_WIDTH_20:
10297         case NL80211_CHAN_WIDTH_40:
10298                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10299                         return -EINVAL;
10300                 break;
10301         case NL80211_CHAN_WIDTH_80:
10302         case NL80211_CHAN_WIDTH_80P80:
10303         case NL80211_CHAN_WIDTH_160:
10304                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10305                         return -EINVAL;
10306                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10307                                              NL80211_EXT_FEATURE_VHT_IBSS))
10308                         return -EINVAL;
10309                 break;
10310         default:
10311                 return -EINVAL;
10312         }
10313
10314         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10315         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10316
10317         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10318                 u8 *rates =
10319                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10320                 int n_rates =
10321                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10322                 struct ieee80211_supported_band *sband =
10323                         wiphy->bands[ibss.chandef.chan->band];
10324
10325                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10326                                              &ibss.basic_rates);
10327                 if (err)
10328                         return err;
10329         }
10330
10331         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10332                 memcpy(&ibss.ht_capa_mask,
10333                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10334                        sizeof(ibss.ht_capa_mask));
10335
10336         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10337                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10338                         return -EINVAL;
10339                 memcpy(&ibss.ht_capa,
10340                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10341                        sizeof(ibss.ht_capa));
10342         }
10343
10344         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10345             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10346                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10347                 return -EINVAL;
10348
10349         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10350                 bool no_ht = false;
10351
10352                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10353                 if (IS_ERR(connkeys))
10354                         return PTR_ERR(connkeys);
10355
10356                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10357                     no_ht) {
10358                         kfree_sensitive(connkeys);
10359                         return -EINVAL;
10360                 }
10361         }
10362
10363         ibss.control_port =
10364                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10365
10366         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10367                 int r = validate_pae_over_nl80211(rdev, info);
10368
10369                 if (r < 0) {
10370                         kfree_sensitive(connkeys);
10371                         return r;
10372                 }
10373
10374                 ibss.control_port_over_nl80211 = true;
10375         }
10376
10377         ibss.userspace_handles_dfs =
10378                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10379
10380         wdev_lock(dev->ieee80211_ptr);
10381         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10382         if (err)
10383                 kfree_sensitive(connkeys);
10384         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10385                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10386         wdev_unlock(dev->ieee80211_ptr);
10387
10388         return err;
10389 }
10390
10391 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10392 {
10393         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10394         struct net_device *dev = info->user_ptr[1];
10395
10396         if (!rdev->ops->leave_ibss)
10397                 return -EOPNOTSUPP;
10398
10399         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10400                 return -EOPNOTSUPP;
10401
10402         return cfg80211_leave_ibss(rdev, dev, false);
10403 }
10404
10405 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10406 {
10407         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10408         struct net_device *dev = info->user_ptr[1];
10409         int mcast_rate[NUM_NL80211_BANDS];
10410         u32 nla_rate;
10411         int err;
10412
10413         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10414             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10415             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10416                 return -EOPNOTSUPP;
10417
10418         if (!rdev->ops->set_mcast_rate)
10419                 return -EOPNOTSUPP;
10420
10421         memset(mcast_rate, 0, sizeof(mcast_rate));
10422
10423         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10424                 return -EINVAL;
10425
10426         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10427         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10428                 return -EINVAL;
10429
10430         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10431
10432         return err;
10433 }
10434
10435 static struct sk_buff *
10436 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10437                             struct wireless_dev *wdev, int approxlen,
10438                             u32 portid, u32 seq, enum nl80211_commands cmd,
10439                             enum nl80211_attrs attr,
10440                             const struct nl80211_vendor_cmd_info *info,
10441                             gfp_t gfp)
10442 {
10443         struct sk_buff *skb;
10444         void *hdr;
10445         struct nlattr *data;
10446
10447         skb = nlmsg_new(approxlen + 100, gfp);
10448         if (!skb)
10449                 return NULL;
10450
10451         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10452         if (!hdr) {
10453                 kfree_skb(skb);
10454                 return NULL;
10455         }
10456
10457         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10458                 goto nla_put_failure;
10459
10460         if (info) {
10461                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10462                                 info->vendor_id))
10463                         goto nla_put_failure;
10464                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10465                                 info->subcmd))
10466                         goto nla_put_failure;
10467         }
10468
10469         if (wdev) {
10470                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10471                                       wdev_id(wdev), NL80211_ATTR_PAD))
10472                         goto nla_put_failure;
10473                 if (wdev->netdev &&
10474                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10475                                 wdev->netdev->ifindex))
10476                         goto nla_put_failure;
10477         }
10478
10479         data = nla_nest_start_noflag(skb, attr);
10480         if (!data)
10481                 goto nla_put_failure;
10482
10483         ((void **)skb->cb)[0] = rdev;
10484         ((void **)skb->cb)[1] = hdr;
10485         ((void **)skb->cb)[2] = data;
10486
10487         return skb;
10488
10489  nla_put_failure:
10490         kfree_skb(skb);
10491         return NULL;
10492 }
10493
10494 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10495                                            struct wireless_dev *wdev,
10496                                            enum nl80211_commands cmd,
10497                                            enum nl80211_attrs attr,
10498                                            unsigned int portid,
10499                                            int vendor_event_idx,
10500                                            int approxlen, gfp_t gfp)
10501 {
10502         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10503         const struct nl80211_vendor_cmd_info *info;
10504
10505         switch (cmd) {
10506         case NL80211_CMD_TESTMODE:
10507                 if (WARN_ON(vendor_event_idx != -1))
10508                         return NULL;
10509                 info = NULL;
10510                 break;
10511         case NL80211_CMD_VENDOR:
10512                 if (WARN_ON(vendor_event_idx < 0 ||
10513                             vendor_event_idx >= wiphy->n_vendor_events))
10514                         return NULL;
10515                 info = &wiphy->vendor_events[vendor_event_idx];
10516                 break;
10517         default:
10518                 WARN_ON(1);
10519                 return NULL;
10520         }
10521
10522         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10523                                            cmd, attr, info, gfp);
10524 }
10525 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10526
10527 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10528 {
10529         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10530         void *hdr = ((void **)skb->cb)[1];
10531         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
10532         struct nlattr *data = ((void **)skb->cb)[2];
10533         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
10534
10535         /* clear CB data for netlink core to own from now on */
10536         memset(skb->cb, 0, sizeof(skb->cb));
10537
10538         nla_nest_end(skb, data);
10539         genlmsg_end(skb, hdr);
10540
10541         if (nlhdr->nlmsg_pid) {
10542                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
10543                                 nlhdr->nlmsg_pid);
10544         } else {
10545                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
10546                         mcgrp = NL80211_MCGRP_VENDOR;
10547
10548                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
10549                                         skb, 0, mcgrp, gfp);
10550         }
10551 }
10552 EXPORT_SYMBOL(__cfg80211_send_event_skb);
10553
10554 #ifdef CONFIG_NL80211_TESTMODE
10555 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
10556 {
10557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10558         struct wireless_dev *wdev;
10559         int err;
10560
10561         lockdep_assert_held(&rdev->wiphy.mtx);
10562
10563         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
10564                                           info->attrs);
10565
10566         if (!rdev->ops->testmode_cmd)
10567                 return -EOPNOTSUPP;
10568
10569         if (IS_ERR(wdev)) {
10570                 err = PTR_ERR(wdev);
10571                 if (err != -EINVAL)
10572                         return err;
10573                 wdev = NULL;
10574         } else if (wdev->wiphy != &rdev->wiphy) {
10575                 return -EINVAL;
10576         }
10577
10578         if (!info->attrs[NL80211_ATTR_TESTDATA])
10579                 return -EINVAL;
10580
10581         rdev->cur_cmd_info = info;
10582         err = rdev_testmode_cmd(rdev, wdev,
10583                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
10584                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
10585         rdev->cur_cmd_info = NULL;
10586
10587         return err;
10588 }
10589
10590 static int nl80211_testmode_dump(struct sk_buff *skb,
10591                                  struct netlink_callback *cb)
10592 {
10593         struct cfg80211_registered_device *rdev;
10594         struct nlattr **attrbuf = NULL;
10595         int err;
10596         long phy_idx;
10597         void *data = NULL;
10598         int data_len = 0;
10599
10600         rtnl_lock();
10601
10602         if (cb->args[0]) {
10603                 /*
10604                  * 0 is a valid index, but not valid for args[0],
10605                  * so we need to offset by 1.
10606                  */
10607                 phy_idx = cb->args[0] - 1;
10608
10609                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10610                 if (!rdev) {
10611                         err = -ENOENT;
10612                         goto out_err;
10613                 }
10614         } else {
10615                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10616                                   GFP_KERNEL);
10617                 if (!attrbuf) {
10618                         err = -ENOMEM;
10619                         goto out_err;
10620                 }
10621
10622                 err = nlmsg_parse_deprecated(cb->nlh,
10623                                              GENL_HDRLEN + nl80211_fam.hdrsize,
10624                                              attrbuf, nl80211_fam.maxattr,
10625                                              nl80211_policy, NULL);
10626                 if (err)
10627                         goto out_err;
10628
10629                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10630                 if (IS_ERR(rdev)) {
10631                         err = PTR_ERR(rdev);
10632                         goto out_err;
10633                 }
10634                 phy_idx = rdev->wiphy_idx;
10635
10636                 if (attrbuf[NL80211_ATTR_TESTDATA])
10637                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10638         }
10639
10640         if (cb->args[1]) {
10641                 data = nla_data((void *)cb->args[1]);
10642                 data_len = nla_len((void *)cb->args[1]);
10643         }
10644
10645         if (!rdev->ops->testmode_dump) {
10646                 err = -EOPNOTSUPP;
10647                 goto out_err;
10648         }
10649
10650         while (1) {
10651                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10652                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10653                                            NL80211_CMD_TESTMODE);
10654                 struct nlattr *tmdata;
10655
10656                 if (!hdr)
10657                         break;
10658
10659                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10660                         genlmsg_cancel(skb, hdr);
10661                         break;
10662                 }
10663
10664                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10665                 if (!tmdata) {
10666                         genlmsg_cancel(skb, hdr);
10667                         break;
10668                 }
10669                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10670                 nla_nest_end(skb, tmdata);
10671
10672                 if (err == -ENOBUFS || err == -ENOENT) {
10673                         genlmsg_cancel(skb, hdr);
10674                         break;
10675                 } else if (err) {
10676                         genlmsg_cancel(skb, hdr);
10677                         goto out_err;
10678                 }
10679
10680                 genlmsg_end(skb, hdr);
10681         }
10682
10683         err = skb->len;
10684         /* see above */
10685         cb->args[0] = phy_idx + 1;
10686  out_err:
10687         kfree(attrbuf);
10688         rtnl_unlock();
10689         return err;
10690 }
10691 #endif
10692
10693 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10694 {
10695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10696         struct net_device *dev = info->user_ptr[1];
10697         struct cfg80211_connect_params connect;
10698         struct wiphy *wiphy;
10699         struct cfg80211_cached_keys *connkeys = NULL;
10700         u32 freq = 0;
10701         int err;
10702
10703         memset(&connect, 0, sizeof(connect));
10704
10705         if (!info->attrs[NL80211_ATTR_SSID] ||
10706             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10707                 return -EINVAL;
10708
10709         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10710                 connect.auth_type =
10711                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10712                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10713                                              NL80211_CMD_CONNECT))
10714                         return -EINVAL;
10715         } else
10716                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10717
10718         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10719
10720         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10721             !wiphy_ext_feature_isset(&rdev->wiphy,
10722                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10723                 return -EINVAL;
10724         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10725
10726         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10727                                       NL80211_MAX_NR_CIPHER_SUITES);
10728         if (err)
10729                 return err;
10730
10731         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10732             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10733                 return -EOPNOTSUPP;
10734
10735         wiphy = &rdev->wiphy;
10736
10737         connect.bg_scan_period = -1;
10738         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10739                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10740                 connect.bg_scan_period =
10741                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10742         }
10743
10744         if (info->attrs[NL80211_ATTR_MAC])
10745                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10746         else if (info->attrs[NL80211_ATTR_MAC_HINT])
10747                 connect.bssid_hint =
10748                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10749         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10750         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10751
10752         if (info->attrs[NL80211_ATTR_IE]) {
10753                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10754                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10755         }
10756
10757         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10758                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10759                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
10760                     !wiphy_ext_feature_isset(&rdev->wiphy,
10761                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
10762                         return -EOPNOTSUPP;
10763         } else {
10764                 connect.mfp = NL80211_MFP_NO;
10765         }
10766
10767         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10768                 connect.prev_bssid =
10769                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10770
10771         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
10772                 freq = MHZ_TO_KHZ(nla_get_u32(
10773                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10774         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10775                 freq +=
10776                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10777
10778         if (freq) {
10779                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
10780                 if (!connect.channel)
10781                         return -EINVAL;
10782         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10783                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10784                 freq = MHZ_TO_KHZ(freq);
10785                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
10786                 if (!connect.channel_hint)
10787                         return -EINVAL;
10788         }
10789
10790         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10791                 connect.edmg.channels =
10792                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10793
10794                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10795                         connect.edmg.bw_config =
10796                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10797         }
10798
10799         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10800                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10801                 if (IS_ERR(connkeys))
10802                         return PTR_ERR(connkeys);
10803         }
10804
10805         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10806                 connect.flags |= ASSOC_REQ_DISABLE_HT;
10807
10808         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10809                 memcpy(&connect.ht_capa_mask,
10810                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10811                        sizeof(connect.ht_capa_mask));
10812
10813         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10814                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10815                         kfree_sensitive(connkeys);
10816                         return -EINVAL;
10817                 }
10818                 memcpy(&connect.ht_capa,
10819                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10820                        sizeof(connect.ht_capa));
10821         }
10822
10823         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10824                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10825
10826         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10827                 connect.flags |= ASSOC_REQ_DISABLE_HE;
10828
10829         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10830                 memcpy(&connect.vht_capa_mask,
10831                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10832                        sizeof(connect.vht_capa_mask));
10833
10834         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10835                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10836                         kfree_sensitive(connkeys);
10837                         return -EINVAL;
10838                 }
10839                 memcpy(&connect.vht_capa,
10840                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10841                        sizeof(connect.vht_capa));
10842         }
10843
10844         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10845                 if (!((rdev->wiphy.features &
10846                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10847                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10848                     !wiphy_ext_feature_isset(&rdev->wiphy,
10849                                              NL80211_EXT_FEATURE_RRM)) {
10850                         kfree_sensitive(connkeys);
10851                         return -EINVAL;
10852                 }
10853                 connect.flags |= ASSOC_REQ_USE_RRM;
10854         }
10855
10856         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10857         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10858                 kfree_sensitive(connkeys);
10859                 return -EOPNOTSUPP;
10860         }
10861
10862         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10863                 /* bss selection makes no sense if bssid is set */
10864                 if (connect.bssid) {
10865                         kfree_sensitive(connkeys);
10866                         return -EINVAL;
10867                 }
10868
10869                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10870                                        wiphy, &connect.bss_select);
10871                 if (err) {
10872                         kfree_sensitive(connkeys);
10873                         return err;
10874                 }
10875         }
10876
10877         if (wiphy_ext_feature_isset(&rdev->wiphy,
10878                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10879             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10880             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10881             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10882             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10883                 connect.fils_erp_username =
10884                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10885                 connect.fils_erp_username_len =
10886                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10887                 connect.fils_erp_realm =
10888                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10889                 connect.fils_erp_realm_len =
10890                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10891                 connect.fils_erp_next_seq_num =
10892                         nla_get_u16(
10893                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10894                 connect.fils_erp_rrk =
10895                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10896                 connect.fils_erp_rrk_len =
10897                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10898         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10899                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10900                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10901                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10902                 kfree_sensitive(connkeys);
10903                 return -EINVAL;
10904         }
10905
10906         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10907                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10908                         kfree_sensitive(connkeys);
10909                         GENL_SET_ERR_MSG(info,
10910                                          "external auth requires connection ownership");
10911                         return -EINVAL;
10912                 }
10913                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10914         }
10915
10916         wdev_lock(dev->ieee80211_ptr);
10917
10918         err = cfg80211_connect(rdev, dev, &connect, connkeys,
10919                                connect.prev_bssid);
10920         if (err)
10921                 kfree_sensitive(connkeys);
10922
10923         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10924                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10925                 if (connect.bssid)
10926                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10927                                connect.bssid, ETH_ALEN);
10928                 else
10929                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
10930         }
10931
10932         wdev_unlock(dev->ieee80211_ptr);
10933
10934         return err;
10935 }
10936
10937 static int nl80211_update_connect_params(struct sk_buff *skb,
10938                                          struct genl_info *info)
10939 {
10940         struct cfg80211_connect_params connect = {};
10941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10942         struct net_device *dev = info->user_ptr[1];
10943         struct wireless_dev *wdev = dev->ieee80211_ptr;
10944         bool fils_sk_offload;
10945         u32 auth_type;
10946         u32 changed = 0;
10947         int ret;
10948
10949         if (!rdev->ops->update_connect_params)
10950                 return -EOPNOTSUPP;
10951
10952         if (info->attrs[NL80211_ATTR_IE]) {
10953                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10954                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10955                 changed |= UPDATE_ASSOC_IES;
10956         }
10957
10958         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10959                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10960
10961         /*
10962          * when driver supports fils-sk offload all attributes must be
10963          * provided. So the else covers "fils-sk-not-all" and
10964          * "no-fils-sk-any".
10965          */
10966         if (fils_sk_offload &&
10967             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10968             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10969             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10970             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10971                 connect.fils_erp_username =
10972                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10973                 connect.fils_erp_username_len =
10974                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10975                 connect.fils_erp_realm =
10976                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10977                 connect.fils_erp_realm_len =
10978                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10979                 connect.fils_erp_next_seq_num =
10980                         nla_get_u16(
10981                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10982                 connect.fils_erp_rrk =
10983                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10984                 connect.fils_erp_rrk_len =
10985                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10986                 changed |= UPDATE_FILS_ERP_INFO;
10987         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10988                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10989                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10990                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10991                 return -EINVAL;
10992         }
10993
10994         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10995                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10996                 if (!nl80211_valid_auth_type(rdev, auth_type,
10997                                              NL80211_CMD_CONNECT))
10998                         return -EINVAL;
10999
11000                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
11001                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
11002                         return -EINVAL;
11003
11004                 connect.auth_type = auth_type;
11005                 changed |= UPDATE_AUTH_TYPE;
11006         }
11007
11008         wdev_lock(dev->ieee80211_ptr);
11009         if (!wdev->current_bss)
11010                 ret = -ENOLINK;
11011         else
11012                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11013         wdev_unlock(dev->ieee80211_ptr);
11014
11015         return ret;
11016 }
11017
11018 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11019 {
11020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11021         struct net_device *dev = info->user_ptr[1];
11022         u16 reason;
11023         int ret;
11024
11025         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11026             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11027                 return -EPERM;
11028
11029         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11030                 reason = WLAN_REASON_DEAUTH_LEAVING;
11031         else
11032                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11033
11034         if (reason == 0)
11035                 return -EINVAL;
11036
11037         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11038             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11039                 return -EOPNOTSUPP;
11040
11041         wdev_lock(dev->ieee80211_ptr);
11042         ret = cfg80211_disconnect(rdev, dev, reason, true);
11043         wdev_unlock(dev->ieee80211_ptr);
11044         return ret;
11045 }
11046
11047 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
11048 {
11049         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11050         struct net *net;
11051         int err;
11052
11053         if (info->attrs[NL80211_ATTR_PID]) {
11054                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
11055
11056                 net = get_net_ns_by_pid(pid);
11057         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
11058                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
11059
11060                 net = get_net_ns_by_fd(fd);
11061         } else {
11062                 return -EINVAL;
11063         }
11064
11065         if (IS_ERR(net))
11066                 return PTR_ERR(net);
11067
11068         err = 0;
11069
11070         /* check if anything to do */
11071         if (!net_eq(wiphy_net(&rdev->wiphy), net))
11072                 err = cfg80211_switch_netns(rdev, net);
11073
11074         put_net(net);
11075         return err;
11076 }
11077
11078 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
11079 {
11080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11081         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
11082                         struct cfg80211_pmksa *pmksa) = NULL;
11083         struct net_device *dev = info->user_ptr[1];
11084         struct cfg80211_pmksa pmksa;
11085
11086         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
11087
11088         if (!info->attrs[NL80211_ATTR_PMKID])
11089                 return -EINVAL;
11090
11091         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11092
11093         if (info->attrs[NL80211_ATTR_MAC]) {
11094                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11095         } else if (info->attrs[NL80211_ATTR_SSID] &&
11096                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
11097                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
11098                     info->attrs[NL80211_ATTR_PMK])) {
11099                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11100                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11101                 pmksa.cache_id =
11102                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
11103         } else {
11104                 return -EINVAL;
11105         }
11106         if (info->attrs[NL80211_ATTR_PMK]) {
11107                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11108                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
11109         }
11110
11111         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
11112                 pmksa.pmk_lifetime =
11113                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
11114
11115         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
11116                 pmksa.pmk_reauth_threshold =
11117                         nla_get_u8(
11118                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
11119
11120         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11121             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
11122             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
11123               wiphy_ext_feature_isset(&rdev->wiphy,
11124                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
11125                 return -EOPNOTSUPP;
11126
11127         switch (info->genlhdr->cmd) {
11128         case NL80211_CMD_SET_PMKSA:
11129                 rdev_ops = rdev->ops->set_pmksa;
11130                 break;
11131         case NL80211_CMD_DEL_PMKSA:
11132                 rdev_ops = rdev->ops->del_pmksa;
11133                 break;
11134         default:
11135                 WARN_ON(1);
11136                 break;
11137         }
11138
11139         if (!rdev_ops)
11140                 return -EOPNOTSUPP;
11141
11142         return rdev_ops(&rdev->wiphy, dev, &pmksa);
11143 }
11144
11145 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
11146 {
11147         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11148         struct net_device *dev = info->user_ptr[1];
11149
11150         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11151             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11152                 return -EOPNOTSUPP;
11153
11154         if (!rdev->ops->flush_pmksa)
11155                 return -EOPNOTSUPP;
11156
11157         return rdev_flush_pmksa(rdev, dev);
11158 }
11159
11160 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
11161 {
11162         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11163         struct net_device *dev = info->user_ptr[1];
11164         u8 action_code, dialog_token;
11165         u32 peer_capability = 0;
11166         u16 status_code;
11167         u8 *peer;
11168         bool initiator;
11169
11170         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11171             !rdev->ops->tdls_mgmt)
11172                 return -EOPNOTSUPP;
11173
11174         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
11175             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
11176             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
11177             !info->attrs[NL80211_ATTR_IE] ||
11178             !info->attrs[NL80211_ATTR_MAC])
11179                 return -EINVAL;
11180
11181         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11182         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
11183         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11184         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
11185         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
11186         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
11187                 peer_capability =
11188                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
11189
11190         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
11191                               dialog_token, status_code, peer_capability,
11192                               initiator,
11193                               nla_data(info->attrs[NL80211_ATTR_IE]),
11194                               nla_len(info->attrs[NL80211_ATTR_IE]));
11195 }
11196
11197 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
11198 {
11199         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11200         struct net_device *dev = info->user_ptr[1];
11201         enum nl80211_tdls_operation operation;
11202         u8 *peer;
11203
11204         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11205             !rdev->ops->tdls_oper)
11206                 return -EOPNOTSUPP;
11207
11208         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
11209             !info->attrs[NL80211_ATTR_MAC])
11210                 return -EINVAL;
11211
11212         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
11213         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11214
11215         return rdev_tdls_oper(rdev, dev, peer, operation);
11216 }
11217
11218 static int nl80211_remain_on_channel(struct sk_buff *skb,
11219                                      struct genl_info *info)
11220 {
11221         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11222         struct wireless_dev *wdev = info->user_ptr[1];
11223         struct cfg80211_chan_def chandef;
11224         const struct cfg80211_chan_def *compat_chandef;
11225         struct sk_buff *msg;
11226         void *hdr;
11227         u64 cookie;
11228         u32 duration;
11229         int err;
11230
11231         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11232             !info->attrs[NL80211_ATTR_DURATION])
11233                 return -EINVAL;
11234
11235         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11236
11237         if (!rdev->ops->remain_on_channel ||
11238             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11239                 return -EOPNOTSUPP;
11240
11241         /*
11242          * We should be on that channel for at least a minimum amount of
11243          * time (10ms) but no longer than the driver supports.
11244          */
11245         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11246             duration > rdev->wiphy.max_remain_on_channel_duration)
11247                 return -EINVAL;
11248
11249         err = nl80211_parse_chandef(rdev, info, &chandef);
11250         if (err)
11251                 return err;
11252
11253         wdev_lock(wdev);
11254         if (!cfg80211_off_channel_oper_allowed(wdev) &&
11255             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
11256                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
11257                                                              &chandef);
11258                 if (compat_chandef != &chandef) {
11259                         wdev_unlock(wdev);
11260                         return -EBUSY;
11261                 }
11262         }
11263         wdev_unlock(wdev);
11264
11265         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11266         if (!msg)
11267                 return -ENOMEM;
11268
11269         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11270                              NL80211_CMD_REMAIN_ON_CHANNEL);
11271         if (!hdr) {
11272                 err = -ENOBUFS;
11273                 goto free_msg;
11274         }
11275
11276         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11277                                      duration, &cookie);
11278
11279         if (err)
11280                 goto free_msg;
11281
11282         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11283                               NL80211_ATTR_PAD))
11284                 goto nla_put_failure;
11285
11286         genlmsg_end(msg, hdr);
11287
11288         return genlmsg_reply(msg, info);
11289
11290  nla_put_failure:
11291         err = -ENOBUFS;
11292  free_msg:
11293         nlmsg_free(msg);
11294         return err;
11295 }
11296
11297 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11298                                             struct genl_info *info)
11299 {
11300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11301         struct wireless_dev *wdev = info->user_ptr[1];
11302         u64 cookie;
11303
11304         if (!info->attrs[NL80211_ATTR_COOKIE])
11305                 return -EINVAL;
11306
11307         if (!rdev->ops->cancel_remain_on_channel)
11308                 return -EOPNOTSUPP;
11309
11310         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11311
11312         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11313 }
11314
11315 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11316                                        struct genl_info *info)
11317 {
11318         struct cfg80211_bitrate_mask mask;
11319         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11320         struct net_device *dev = info->user_ptr[1];
11321         int err;
11322
11323         if (!rdev->ops->set_bitrate_mask)
11324                 return -EOPNOTSUPP;
11325
11326         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11327                                             NL80211_ATTR_TX_RATES, &mask,
11328                                             dev, true);
11329         if (err)
11330                 return err;
11331
11332         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
11333 }
11334
11335 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11336 {
11337         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11338         struct wireless_dev *wdev = info->user_ptr[1];
11339         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11340
11341         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11342                 return -EINVAL;
11343
11344         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11345                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11346
11347         switch (wdev->iftype) {
11348         case NL80211_IFTYPE_STATION:
11349         case NL80211_IFTYPE_ADHOC:
11350         case NL80211_IFTYPE_P2P_CLIENT:
11351         case NL80211_IFTYPE_AP:
11352         case NL80211_IFTYPE_AP_VLAN:
11353         case NL80211_IFTYPE_MESH_POINT:
11354         case NL80211_IFTYPE_P2P_GO:
11355         case NL80211_IFTYPE_P2P_DEVICE:
11356                 break;
11357         case NL80211_IFTYPE_NAN:
11358         default:
11359                 return -EOPNOTSUPP;
11360         }
11361
11362         /* not much point in registering if we can't reply */
11363         if (!rdev->ops->mgmt_tx)
11364                 return -EOPNOTSUPP;
11365
11366         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11367             !wiphy_ext_feature_isset(&rdev->wiphy,
11368                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11369                 GENL_SET_ERR_MSG(info,
11370                                  "multicast RX registrations are not supported");
11371                 return -EOPNOTSUPP;
11372         }
11373
11374         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11375                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11376                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11377                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11378                                            info->extack);
11379 }
11380
11381 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11382 {
11383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11384         struct wireless_dev *wdev = info->user_ptr[1];
11385         struct cfg80211_chan_def chandef;
11386         int err;
11387         void *hdr = NULL;
11388         u64 cookie;
11389         struct sk_buff *msg = NULL;
11390         struct cfg80211_mgmt_tx_params params = {
11391                 .dont_wait_for_ack =
11392                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11393         };
11394
11395         if (!info->attrs[NL80211_ATTR_FRAME])
11396                 return -EINVAL;
11397
11398         if (!rdev->ops->mgmt_tx)
11399                 return -EOPNOTSUPP;
11400
11401         switch (wdev->iftype) {
11402         case NL80211_IFTYPE_P2P_DEVICE:
11403                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11404                         return -EINVAL;
11405                 break;
11406         case NL80211_IFTYPE_STATION:
11407         case NL80211_IFTYPE_ADHOC:
11408         case NL80211_IFTYPE_P2P_CLIENT:
11409         case NL80211_IFTYPE_AP:
11410         case NL80211_IFTYPE_AP_VLAN:
11411         case NL80211_IFTYPE_MESH_POINT:
11412         case NL80211_IFTYPE_P2P_GO:
11413                 break;
11414         case NL80211_IFTYPE_NAN:
11415         default:
11416                 return -EOPNOTSUPP;
11417         }
11418
11419         if (info->attrs[NL80211_ATTR_DURATION]) {
11420                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11421                         return -EINVAL;
11422                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11423
11424                 /*
11425                  * We should wait on the channel for at least a minimum amount
11426                  * of time (10ms) but no longer than the driver supports.
11427                  */
11428                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11429                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
11430                         return -EINVAL;
11431         }
11432
11433         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11434
11435         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11436                 return -EINVAL;
11437
11438         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11439
11440         /* get the channel if any has been specified, otherwise pass NULL to
11441          * the driver. The latter will use the current one
11442          */
11443         chandef.chan = NULL;
11444         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11445                 err = nl80211_parse_chandef(rdev, info, &chandef);
11446                 if (err)
11447                         return err;
11448         }
11449
11450         if (!chandef.chan && params.offchan)
11451                 return -EINVAL;
11452
11453         wdev_lock(wdev);
11454         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
11455                 wdev_unlock(wdev);
11456                 return -EBUSY;
11457         }
11458         wdev_unlock(wdev);
11459
11460         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11461         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11462
11463         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11464                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11465                 int i;
11466
11467                 if (len % sizeof(u16))
11468                         return -EINVAL;
11469
11470                 params.n_csa_offsets = len / sizeof(u16);
11471                 params.csa_offsets =
11472                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11473
11474                 /* check that all the offsets fit the frame */
11475                 for (i = 0; i < params.n_csa_offsets; i++) {
11476                         if (params.csa_offsets[i] >= params.len)
11477                                 return -EINVAL;
11478                 }
11479         }
11480
11481         if (!params.dont_wait_for_ack) {
11482                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11483                 if (!msg)
11484                         return -ENOMEM;
11485
11486                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11487                                      NL80211_CMD_FRAME);
11488                 if (!hdr) {
11489                         err = -ENOBUFS;
11490                         goto free_msg;
11491                 }
11492         }
11493
11494         params.chan = chandef.chan;
11495         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
11496         if (err)
11497                 goto free_msg;
11498
11499         if (msg) {
11500                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11501                                       NL80211_ATTR_PAD))
11502                         goto nla_put_failure;
11503
11504                 genlmsg_end(msg, hdr);
11505                 return genlmsg_reply(msg, info);
11506         }
11507
11508         return 0;
11509
11510  nla_put_failure:
11511         err = -ENOBUFS;
11512  free_msg:
11513         nlmsg_free(msg);
11514         return err;
11515 }
11516
11517 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
11518 {
11519         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11520         struct wireless_dev *wdev = info->user_ptr[1];
11521         u64 cookie;
11522
11523         if (!info->attrs[NL80211_ATTR_COOKIE])
11524                 return -EINVAL;
11525
11526         if (!rdev->ops->mgmt_tx_cancel_wait)
11527                 return -EOPNOTSUPP;
11528
11529         switch (wdev->iftype) {
11530         case NL80211_IFTYPE_STATION:
11531         case NL80211_IFTYPE_ADHOC:
11532         case NL80211_IFTYPE_P2P_CLIENT:
11533         case NL80211_IFTYPE_AP:
11534         case NL80211_IFTYPE_AP_VLAN:
11535         case NL80211_IFTYPE_P2P_GO:
11536         case NL80211_IFTYPE_P2P_DEVICE:
11537                 break;
11538         case NL80211_IFTYPE_NAN:
11539         default:
11540                 return -EOPNOTSUPP;
11541         }
11542
11543         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11544
11545         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
11546 }
11547
11548 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
11549 {
11550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11551         struct wireless_dev *wdev;
11552         struct net_device *dev = info->user_ptr[1];
11553         u8 ps_state;
11554         bool state;
11555         int err;
11556
11557         if (!info->attrs[NL80211_ATTR_PS_STATE])
11558                 return -EINVAL;
11559
11560         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
11561
11562         wdev = dev->ieee80211_ptr;
11563
11564         if (!rdev->ops->set_power_mgmt)
11565                 return -EOPNOTSUPP;
11566
11567         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
11568
11569         if (state == wdev->ps)
11570                 return 0;
11571
11572         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
11573         if (!err)
11574                 wdev->ps = state;
11575         return err;
11576 }
11577
11578 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
11579 {
11580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11581         enum nl80211_ps_state ps_state;
11582         struct wireless_dev *wdev;
11583         struct net_device *dev = info->user_ptr[1];
11584         struct sk_buff *msg;
11585         void *hdr;
11586         int err;
11587
11588         wdev = dev->ieee80211_ptr;
11589
11590         if (!rdev->ops->set_power_mgmt)
11591                 return -EOPNOTSUPP;
11592
11593         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11594         if (!msg)
11595                 return -ENOMEM;
11596
11597         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11598                              NL80211_CMD_GET_POWER_SAVE);
11599         if (!hdr) {
11600                 err = -ENOBUFS;
11601                 goto free_msg;
11602         }
11603
11604         if (wdev->ps)
11605                 ps_state = NL80211_PS_ENABLED;
11606         else
11607                 ps_state = NL80211_PS_DISABLED;
11608
11609         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
11610                 goto nla_put_failure;
11611
11612         genlmsg_end(msg, hdr);
11613         return genlmsg_reply(msg, info);
11614
11615  nla_put_failure:
11616         err = -ENOBUFS;
11617  free_msg:
11618         nlmsg_free(msg);
11619         return err;
11620 }
11621
11622 static const struct nla_policy
11623 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
11624         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
11625         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
11626         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
11627         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
11628         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
11629         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
11630         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
11631 };
11632
11633 static int nl80211_set_cqm_txe(struct genl_info *info,
11634                                u32 rate, u32 pkts, u32 intvl)
11635 {
11636         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11637         struct net_device *dev = info->user_ptr[1];
11638         struct wireless_dev *wdev = dev->ieee80211_ptr;
11639
11640         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11641                 return -EINVAL;
11642
11643         if (!rdev->ops->set_cqm_txe_config)
11644                 return -EOPNOTSUPP;
11645
11646         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11647             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11648                 return -EOPNOTSUPP;
11649
11650         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11651 }
11652
11653 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11654                                     struct net_device *dev)
11655 {
11656         struct wireless_dev *wdev = dev->ieee80211_ptr;
11657         s32 last, low, high;
11658         u32 hyst;
11659         int i, n, low_index;
11660         int err;
11661
11662         /* RSSI reporting disabled? */
11663         if (!wdev->cqm_config)
11664                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11665
11666         /*
11667          * Obtain current RSSI value if possible, if not and no RSSI threshold
11668          * event has been received yet, we should receive an event after a
11669          * connection is established and enough beacons received to calculate
11670          * the average.
11671          */
11672         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11673             rdev->ops->get_station) {
11674                 struct station_info sinfo = {};
11675                 u8 *mac_addr;
11676
11677                 mac_addr = wdev->current_bss->pub.bssid;
11678
11679                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11680                 if (err)
11681                         return err;
11682
11683                 cfg80211_sinfo_release_content(&sinfo);
11684                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11685                         wdev->cqm_config->last_rssi_event_value =
11686                                 (s8) sinfo.rx_beacon_signal_avg;
11687         }
11688
11689         last = wdev->cqm_config->last_rssi_event_value;
11690         hyst = wdev->cqm_config->rssi_hyst;
11691         n = wdev->cqm_config->n_rssi_thresholds;
11692
11693         for (i = 0; i < n; i++) {
11694                 i = array_index_nospec(i, n);
11695                 if (last < wdev->cqm_config->rssi_thresholds[i])
11696                         break;
11697         }
11698
11699         low_index = i - 1;
11700         if (low_index >= 0) {
11701                 low_index = array_index_nospec(low_index, n);
11702                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11703         } else {
11704                 low = S32_MIN;
11705         }
11706         if (i < n) {
11707                 i = array_index_nospec(i, n);
11708                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11709         } else {
11710                 high = S32_MAX;
11711         }
11712
11713         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11714 }
11715
11716 static int nl80211_set_cqm_rssi(struct genl_info *info,
11717                                 const s32 *thresholds, int n_thresholds,
11718                                 u32 hysteresis)
11719 {
11720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11721         struct net_device *dev = info->user_ptr[1];
11722         struct wireless_dev *wdev = dev->ieee80211_ptr;
11723         int i, err;
11724         s32 prev = S32_MIN;
11725
11726         /* Check all values negative and sorted */
11727         for (i = 0; i < n_thresholds; i++) {
11728                 if (thresholds[i] > 0 || thresholds[i] <= prev)
11729                         return -EINVAL;
11730
11731                 prev = thresholds[i];
11732         }
11733
11734         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11735             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11736                 return -EOPNOTSUPP;
11737
11738         wdev_lock(wdev);
11739         cfg80211_cqm_config_free(wdev);
11740         wdev_unlock(wdev);
11741
11742         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11743                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11744                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11745
11746                 return rdev_set_cqm_rssi_config(rdev, dev,
11747                                                 thresholds[0], hysteresis);
11748         }
11749
11750         if (!wiphy_ext_feature_isset(&rdev->wiphy,
11751                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11752                 return -EOPNOTSUPP;
11753
11754         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11755                 n_thresholds = 0;
11756
11757         wdev_lock(wdev);
11758         if (n_thresholds) {
11759                 struct cfg80211_cqm_config *cqm_config;
11760
11761                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11762                                      n_thresholds * sizeof(s32), GFP_KERNEL);
11763                 if (!cqm_config) {
11764                         err = -ENOMEM;
11765                         goto unlock;
11766                 }
11767
11768                 cqm_config->rssi_hyst = hysteresis;
11769                 cqm_config->n_rssi_thresholds = n_thresholds;
11770                 memcpy(cqm_config->rssi_thresholds, thresholds,
11771                        n_thresholds * sizeof(s32));
11772
11773                 wdev->cqm_config = cqm_config;
11774         }
11775
11776         err = cfg80211_cqm_rssi_update(rdev, dev);
11777
11778 unlock:
11779         wdev_unlock(wdev);
11780
11781         return err;
11782 }
11783
11784 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11785 {
11786         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11787         struct nlattr *cqm;
11788         int err;
11789
11790         cqm = info->attrs[NL80211_ATTR_CQM];
11791         if (!cqm)
11792                 return -EINVAL;
11793
11794         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11795                                           nl80211_attr_cqm_policy,
11796                                           info->extack);
11797         if (err)
11798                 return err;
11799
11800         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11801             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11802                 const s32 *thresholds =
11803                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11804                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11805                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11806
11807                 if (len % 4)
11808                         return -EINVAL;
11809
11810                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11811                                             hysteresis);
11812         }
11813
11814         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11815             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11816             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11817                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11818                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11819                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11820
11821                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11822         }
11823
11824         return -EINVAL;
11825 }
11826
11827 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11828 {
11829         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11830         struct net_device *dev = info->user_ptr[1];
11831         struct ocb_setup setup = {};
11832         int err;
11833
11834         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11835         if (err)
11836                 return err;
11837
11838         return cfg80211_join_ocb(rdev, dev, &setup);
11839 }
11840
11841 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11842 {
11843         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11844         struct net_device *dev = info->user_ptr[1];
11845
11846         return cfg80211_leave_ocb(rdev, dev);
11847 }
11848
11849 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11850 {
11851         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11852         struct net_device *dev = info->user_ptr[1];
11853         struct mesh_config cfg;
11854         struct mesh_setup setup;
11855         int err;
11856
11857         /* start with default */
11858         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11859         memcpy(&setup, &default_mesh_setup, sizeof(setup));
11860
11861         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11862                 /* and parse parameters if given */
11863                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11864                 if (err)
11865                         return err;
11866         }
11867
11868         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11869             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11870                 return -EINVAL;
11871
11872         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11873         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11874
11875         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11876             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11877                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11878                         return -EINVAL;
11879
11880         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11881                 setup.beacon_interval =
11882                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11883
11884                 err = cfg80211_validate_beacon_int(rdev,
11885                                                    NL80211_IFTYPE_MESH_POINT,
11886                                                    setup.beacon_interval);
11887                 if (err)
11888                         return err;
11889         }
11890
11891         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11892                 setup.dtim_period =
11893                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11894                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11895                         return -EINVAL;
11896         }
11897
11898         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11899                 /* parse additional setup parameters if given */
11900                 err = nl80211_parse_mesh_setup(info, &setup);
11901                 if (err)
11902                         return err;
11903         }
11904
11905         if (setup.user_mpm)
11906                 cfg.auto_open_plinks = false;
11907
11908         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11909                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11910                 if (err)
11911                         return err;
11912         } else {
11913                 /* __cfg80211_join_mesh() will sort it out */
11914                 setup.chandef.chan = NULL;
11915         }
11916
11917         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11918                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11919                 int n_rates =
11920                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11921                 struct ieee80211_supported_band *sband;
11922
11923                 if (!setup.chandef.chan)
11924                         return -EINVAL;
11925
11926                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11927
11928                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11929                                              &setup.basic_rates);
11930                 if (err)
11931                         return err;
11932         }
11933
11934         if (info->attrs[NL80211_ATTR_TX_RATES]) {
11935                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11936                                                     NL80211_ATTR_TX_RATES,
11937                                                     &setup.beacon_rate,
11938                                                     dev, false);
11939                 if (err)
11940                         return err;
11941
11942                 if (!setup.chandef.chan)
11943                         return -EINVAL;
11944
11945                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11946                                               &setup.beacon_rate);
11947                 if (err)
11948                         return err;
11949         }
11950
11951         setup.userspace_handles_dfs =
11952                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11953
11954         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11955                 int r = validate_pae_over_nl80211(rdev, info);
11956
11957                 if (r < 0)
11958                         return r;
11959
11960                 setup.control_port_over_nl80211 = true;
11961         }
11962
11963         wdev_lock(dev->ieee80211_ptr);
11964         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11965         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11966                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11967         wdev_unlock(dev->ieee80211_ptr);
11968
11969         return err;
11970 }
11971
11972 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
11973 {
11974         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11975         struct net_device *dev = info->user_ptr[1];
11976
11977         return cfg80211_leave_mesh(rdev, dev);
11978 }
11979
11980 #ifdef CONFIG_PM
11981 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
11982                                         struct cfg80211_registered_device *rdev)
11983 {
11984         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
11985         struct nlattr *nl_pats, *nl_pat;
11986         int i, pat_len;
11987
11988         if (!wowlan->n_patterns)
11989                 return 0;
11990
11991         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
11992         if (!nl_pats)
11993                 return -ENOBUFS;
11994
11995         for (i = 0; i < wowlan->n_patterns; i++) {
11996                 nl_pat = nla_nest_start_noflag(msg, i + 1);
11997                 if (!nl_pat)
11998                         return -ENOBUFS;
11999                 pat_len = wowlan->patterns[i].pattern_len;
12000                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
12001                             wowlan->patterns[i].mask) ||
12002                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12003                             wowlan->patterns[i].pattern) ||
12004                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12005                                 wowlan->patterns[i].pkt_offset))
12006                         return -ENOBUFS;
12007                 nla_nest_end(msg, nl_pat);
12008         }
12009         nla_nest_end(msg, nl_pats);
12010
12011         return 0;
12012 }
12013
12014 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
12015                                    struct cfg80211_wowlan_tcp *tcp)
12016 {
12017         struct nlattr *nl_tcp;
12018
12019         if (!tcp)
12020                 return 0;
12021
12022         nl_tcp = nla_nest_start_noflag(msg,
12023                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
12024         if (!nl_tcp)
12025                 return -ENOBUFS;
12026
12027         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
12028             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
12029             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
12030             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
12031             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
12032             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
12033                     tcp->payload_len, tcp->payload) ||
12034             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
12035                         tcp->data_interval) ||
12036             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
12037                     tcp->wake_len, tcp->wake_data) ||
12038             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
12039                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
12040                 return -ENOBUFS;
12041
12042         if (tcp->payload_seq.len &&
12043             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
12044                     sizeof(tcp->payload_seq), &tcp->payload_seq))
12045                 return -ENOBUFS;
12046
12047         if (tcp->payload_tok.len &&
12048             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
12049                     sizeof(tcp->payload_tok) + tcp->tokens_size,
12050                     &tcp->payload_tok))
12051                 return -ENOBUFS;
12052
12053         nla_nest_end(msg, nl_tcp);
12054
12055         return 0;
12056 }
12057
12058 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
12059                                   struct cfg80211_sched_scan_request *req)
12060 {
12061         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
12062         int i;
12063
12064         if (!req)
12065                 return 0;
12066
12067         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
12068         if (!nd)
12069                 return -ENOBUFS;
12070
12071         if (req->n_scan_plans == 1 &&
12072             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
12073                         req->scan_plans[0].interval * 1000))
12074                 return -ENOBUFS;
12075
12076         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
12077                 return -ENOBUFS;
12078
12079         if (req->relative_rssi_set) {
12080                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
12081
12082                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
12083                                req->relative_rssi))
12084                         return -ENOBUFS;
12085
12086                 rssi_adjust.band = req->rssi_adjust.band;
12087                 rssi_adjust.delta = req->rssi_adjust.delta;
12088                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
12089                             sizeof(rssi_adjust), &rssi_adjust))
12090                         return -ENOBUFS;
12091         }
12092
12093         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12094         if (!freqs)
12095                 return -ENOBUFS;
12096
12097         for (i = 0; i < req->n_channels; i++) {
12098                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12099                         return -ENOBUFS;
12100         }
12101
12102         nla_nest_end(msg, freqs);
12103
12104         if (req->n_match_sets) {
12105                 matches = nla_nest_start_noflag(msg,
12106                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
12107                 if (!matches)
12108                         return -ENOBUFS;
12109
12110                 for (i = 0; i < req->n_match_sets; i++) {
12111                         match = nla_nest_start_noflag(msg, i);
12112                         if (!match)
12113                                 return -ENOBUFS;
12114
12115                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
12116                                     req->match_sets[i].ssid.ssid_len,
12117                                     req->match_sets[i].ssid.ssid))
12118                                 return -ENOBUFS;
12119                         nla_nest_end(msg, match);
12120                 }
12121                 nla_nest_end(msg, matches);
12122         }
12123
12124         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
12125         if (!scan_plans)
12126                 return -ENOBUFS;
12127
12128         for (i = 0; i < req->n_scan_plans; i++) {
12129                 scan_plan = nla_nest_start_noflag(msg, i + 1);
12130                 if (!scan_plan)
12131                         return -ENOBUFS;
12132
12133                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
12134                                 req->scan_plans[i].interval) ||
12135                     (req->scan_plans[i].iterations &&
12136                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
12137                                  req->scan_plans[i].iterations)))
12138                         return -ENOBUFS;
12139                 nla_nest_end(msg, scan_plan);
12140         }
12141         nla_nest_end(msg, scan_plans);
12142
12143         nla_nest_end(msg, nd);
12144
12145         return 0;
12146 }
12147
12148 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
12149 {
12150         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12151         struct sk_buff *msg;
12152         void *hdr;
12153         u32 size = NLMSG_DEFAULT_SIZE;
12154
12155         if (!rdev->wiphy.wowlan)
12156                 return -EOPNOTSUPP;
12157
12158         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
12159                 /* adjust size to have room for all the data */
12160                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
12161                         rdev->wiphy.wowlan_config->tcp->payload_len +
12162                         rdev->wiphy.wowlan_config->tcp->wake_len +
12163                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
12164         }
12165
12166         msg = nlmsg_new(size, GFP_KERNEL);
12167         if (!msg)
12168                 return -ENOMEM;
12169
12170         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12171                              NL80211_CMD_GET_WOWLAN);
12172         if (!hdr)
12173                 goto nla_put_failure;
12174
12175         if (rdev->wiphy.wowlan_config) {
12176                 struct nlattr *nl_wowlan;
12177
12178                 nl_wowlan = nla_nest_start_noflag(msg,
12179                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
12180                 if (!nl_wowlan)
12181                         goto nla_put_failure;
12182
12183                 if ((rdev->wiphy.wowlan_config->any &&
12184                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
12185                     (rdev->wiphy.wowlan_config->disconnect &&
12186                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
12187                     (rdev->wiphy.wowlan_config->magic_pkt &&
12188                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
12189                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
12190                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
12191                     (rdev->wiphy.wowlan_config->eap_identity_req &&
12192                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
12193                     (rdev->wiphy.wowlan_config->four_way_handshake &&
12194                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
12195                     (rdev->wiphy.wowlan_config->rfkill_release &&
12196                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
12197                         goto nla_put_failure;
12198
12199                 if (nl80211_send_wowlan_patterns(msg, rdev))
12200                         goto nla_put_failure;
12201
12202                 if (nl80211_send_wowlan_tcp(msg,
12203                                             rdev->wiphy.wowlan_config->tcp))
12204                         goto nla_put_failure;
12205
12206                 if (nl80211_send_wowlan_nd(
12207                             msg,
12208                             rdev->wiphy.wowlan_config->nd_config))
12209                         goto nla_put_failure;
12210
12211                 nla_nest_end(msg, nl_wowlan);
12212         }
12213
12214         genlmsg_end(msg, hdr);
12215         return genlmsg_reply(msg, info);
12216
12217 nla_put_failure:
12218         nlmsg_free(msg);
12219         return -ENOBUFS;
12220 }
12221
12222 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
12223                                     struct nlattr *attr,
12224                                     struct cfg80211_wowlan *trig)
12225 {
12226         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
12227         struct cfg80211_wowlan_tcp *cfg;
12228         struct nl80211_wowlan_tcp_data_token *tok = NULL;
12229         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
12230         u32 size;
12231         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
12232         int err, port;
12233
12234         if (!rdev->wiphy.wowlan->tcp)
12235                 return -EINVAL;
12236
12237         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12238                                           nl80211_wowlan_tcp_policy, NULL);
12239         if (err)
12240                 return err;
12241
12242         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12243             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12244             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12245             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12246             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12247             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12248             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12249             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12250                 return -EINVAL;
12251
12252         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12253         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12254                 return -EINVAL;
12255
12256         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12257                         rdev->wiphy.wowlan->tcp->data_interval_max ||
12258             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12259                 return -EINVAL;
12260
12261         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12262         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12263                 return -EINVAL;
12264
12265         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12266         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12267                 return -EINVAL;
12268
12269         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12270                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12271
12272                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12273                 tokens_size = tokln - sizeof(*tok);
12274
12275                 if (!tok->len || tokens_size % tok->len)
12276                         return -EINVAL;
12277                 if (!rdev->wiphy.wowlan->tcp->tok)
12278                         return -EINVAL;
12279                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12280                         return -EINVAL;
12281                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12282                         return -EINVAL;
12283                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12284                         return -EINVAL;
12285                 if (tok->offset + tok->len > data_size)
12286                         return -EINVAL;
12287         }
12288
12289         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12290                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12291                 if (!rdev->wiphy.wowlan->tcp->seq)
12292                         return -EINVAL;
12293                 if (seq->len == 0 || seq->len > 4)
12294                         return -EINVAL;
12295                 if (seq->len + seq->offset > data_size)
12296                         return -EINVAL;
12297         }
12298
12299         size = sizeof(*cfg);
12300         size += data_size;
12301         size += wake_size + wake_mask_size;
12302         size += tokens_size;
12303
12304         cfg = kzalloc(size, GFP_KERNEL);
12305         if (!cfg)
12306                 return -ENOMEM;
12307         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12308         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12309         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12310                ETH_ALEN);
12311         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12312                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12313         else
12314                 port = 0;
12315 #ifdef CONFIG_INET
12316         /* allocate a socket and port for it and use it */
12317         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12318                             IPPROTO_TCP, &cfg->sock, 1);
12319         if (err) {
12320                 kfree(cfg);
12321                 return err;
12322         }
12323         if (inet_csk_get_port(cfg->sock->sk, port)) {
12324                 sock_release(cfg->sock);
12325                 kfree(cfg);
12326                 return -EADDRINUSE;
12327         }
12328         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12329 #else
12330         if (!port) {
12331                 kfree(cfg);
12332                 return -EINVAL;
12333         }
12334         cfg->src_port = port;
12335 #endif
12336
12337         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12338         cfg->payload_len = data_size;
12339         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12340         memcpy((void *)cfg->payload,
12341                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12342                data_size);
12343         if (seq)
12344                 cfg->payload_seq = *seq;
12345         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12346         cfg->wake_len = wake_size;
12347         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12348         memcpy((void *)cfg->wake_data,
12349                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12350                wake_size);
12351         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12352                          data_size + wake_size;
12353         memcpy((void *)cfg->wake_mask,
12354                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12355                wake_mask_size);
12356         if (tok) {
12357                 cfg->tokens_size = tokens_size;
12358                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12359         }
12360
12361         trig->tcp = cfg;
12362
12363         return 0;
12364 }
12365
12366 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12367                                    const struct wiphy_wowlan_support *wowlan,
12368                                    struct nlattr *attr,
12369                                    struct cfg80211_wowlan *trig)
12370 {
12371         struct nlattr **tb;
12372         int err;
12373
12374         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12375         if (!tb)
12376                 return -ENOMEM;
12377
12378         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12379                 err = -EOPNOTSUPP;
12380                 goto out;
12381         }
12382
12383         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12384                                           nl80211_policy, NULL);
12385         if (err)
12386                 goto out;
12387
12388         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12389                                                    wowlan->max_nd_match_sets);
12390         err = PTR_ERR_OR_ZERO(trig->nd_config);
12391         if (err)
12392                 trig->nd_config = NULL;
12393
12394 out:
12395         kfree(tb);
12396         return err;
12397 }
12398
12399 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12400 {
12401         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12402         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12403         struct cfg80211_wowlan new_triggers = {};
12404         struct cfg80211_wowlan *ntrig;
12405         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12406         int err, i;
12407         bool prev_enabled = rdev->wiphy.wowlan_config;
12408         bool regular = false;
12409
12410         if (!wowlan)
12411                 return -EOPNOTSUPP;
12412
12413         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12414                 cfg80211_rdev_free_wowlan(rdev);
12415                 rdev->wiphy.wowlan_config = NULL;
12416                 goto set_wakeup;
12417         }
12418
12419         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12420                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12421                                           nl80211_wowlan_policy, info->extack);
12422         if (err)
12423                 return err;
12424
12425         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12426                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12427                         return -EINVAL;
12428                 new_triggers.any = true;
12429         }
12430
12431         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12432                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12433                         return -EINVAL;
12434                 new_triggers.disconnect = true;
12435                 regular = true;
12436         }
12437
12438         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12439                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12440                         return -EINVAL;
12441                 new_triggers.magic_pkt = true;
12442                 regular = true;
12443         }
12444
12445         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12446                 return -EINVAL;
12447
12448         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12449                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12450                         return -EINVAL;
12451                 new_triggers.gtk_rekey_failure = true;
12452                 regular = true;
12453         }
12454
12455         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12456                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12457                         return -EINVAL;
12458                 new_triggers.eap_identity_req = true;
12459                 regular = true;
12460         }
12461
12462         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12463                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12464                         return -EINVAL;
12465                 new_triggers.four_way_handshake = true;
12466                 regular = true;
12467         }
12468
12469         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12470                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12471                         return -EINVAL;
12472                 new_triggers.rfkill_release = true;
12473                 regular = true;
12474         }
12475
12476         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12477                 struct nlattr *pat;
12478                 int n_patterns = 0;
12479                 int rem, pat_len, mask_len, pkt_offset;
12480                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12481
12482                 regular = true;
12483
12484                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12485                                     rem)
12486                         n_patterns++;
12487                 if (n_patterns > wowlan->n_patterns)
12488                         return -EINVAL;
12489
12490                 new_triggers.patterns = kcalloc(n_patterns,
12491                                                 sizeof(new_triggers.patterns[0]),
12492                                                 GFP_KERNEL);
12493                 if (!new_triggers.patterns)
12494                         return -ENOMEM;
12495
12496                 new_triggers.n_patterns = n_patterns;
12497                 i = 0;
12498
12499                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12500                                     rem) {
12501                         u8 *mask_pat;
12502
12503                         err = nla_parse_nested_deprecated(pat_tb,
12504                                                           MAX_NL80211_PKTPAT,
12505                                                           pat,
12506                                                           nl80211_packet_pattern_policy,
12507                                                           info->extack);
12508                         if (err)
12509                                 goto error;
12510
12511                         err = -EINVAL;
12512                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
12513                             !pat_tb[NL80211_PKTPAT_PATTERN])
12514                                 goto error;
12515                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12516                         mask_len = DIV_ROUND_UP(pat_len, 8);
12517                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12518                                 goto error;
12519                         if (pat_len > wowlan->pattern_max_len ||
12520                             pat_len < wowlan->pattern_min_len)
12521                                 goto error;
12522
12523                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
12524                                 pkt_offset = 0;
12525                         else
12526                                 pkt_offset = nla_get_u32(
12527                                         pat_tb[NL80211_PKTPAT_OFFSET]);
12528                         if (pkt_offset > wowlan->max_pkt_offset)
12529                                 goto error;
12530                         new_triggers.patterns[i].pkt_offset = pkt_offset;
12531
12532                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12533                         if (!mask_pat) {
12534                                 err = -ENOMEM;
12535                                 goto error;
12536                         }
12537                         new_triggers.patterns[i].mask = mask_pat;
12538                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12539                                mask_len);
12540                         mask_pat += mask_len;
12541                         new_triggers.patterns[i].pattern = mask_pat;
12542                         new_triggers.patterns[i].pattern_len = pat_len;
12543                         memcpy(mask_pat,
12544                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12545                                pat_len);
12546                         i++;
12547                 }
12548         }
12549
12550         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
12551                 regular = true;
12552                 err = nl80211_parse_wowlan_tcp(
12553                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
12554                         &new_triggers);
12555                 if (err)
12556                         goto error;
12557         }
12558
12559         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
12560                 regular = true;
12561                 err = nl80211_parse_wowlan_nd(
12562                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
12563                         &new_triggers);
12564                 if (err)
12565                         goto error;
12566         }
12567
12568         /* The 'any' trigger means the device continues operating more or less
12569          * as in its normal operation mode and wakes up the host on most of the
12570          * normal interrupts (like packet RX, ...)
12571          * It therefore makes little sense to combine with the more constrained
12572          * wakeup trigger modes.
12573          */
12574         if (new_triggers.any && regular) {
12575                 err = -EINVAL;
12576                 goto error;
12577         }
12578
12579         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
12580         if (!ntrig) {
12581                 err = -ENOMEM;
12582                 goto error;
12583         }
12584         cfg80211_rdev_free_wowlan(rdev);
12585         rdev->wiphy.wowlan_config = ntrig;
12586
12587  set_wakeup:
12588         if (rdev->ops->set_wakeup &&
12589             prev_enabled != !!rdev->wiphy.wowlan_config)
12590                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
12591
12592         return 0;
12593  error:
12594         for (i = 0; i < new_triggers.n_patterns; i++)
12595                 kfree(new_triggers.patterns[i].mask);
12596         kfree(new_triggers.patterns);
12597         if (new_triggers.tcp && new_triggers.tcp->sock)
12598                 sock_release(new_triggers.tcp->sock);
12599         kfree(new_triggers.tcp);
12600         kfree(new_triggers.nd_config);
12601         return err;
12602 }
12603 #endif
12604
12605 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
12606                                        struct cfg80211_registered_device *rdev)
12607 {
12608         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
12609         int i, j, pat_len;
12610         struct cfg80211_coalesce_rules *rule;
12611
12612         if (!rdev->coalesce->n_rules)
12613                 return 0;
12614
12615         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
12616         if (!nl_rules)
12617                 return -ENOBUFS;
12618
12619         for (i = 0; i < rdev->coalesce->n_rules; i++) {
12620                 nl_rule = nla_nest_start_noflag(msg, i + 1);
12621                 if (!nl_rule)
12622                         return -ENOBUFS;
12623
12624                 rule = &rdev->coalesce->rules[i];
12625                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
12626                                 rule->delay))
12627                         return -ENOBUFS;
12628
12629                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
12630                                 rule->condition))
12631                         return -ENOBUFS;
12632
12633                 nl_pats = nla_nest_start_noflag(msg,
12634                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
12635                 if (!nl_pats)
12636                         return -ENOBUFS;
12637
12638                 for (j = 0; j < rule->n_patterns; j++) {
12639                         nl_pat = nla_nest_start_noflag(msg, j + 1);
12640                         if (!nl_pat)
12641                                 return -ENOBUFS;
12642                         pat_len = rule->patterns[j].pattern_len;
12643                         if (nla_put(msg, NL80211_PKTPAT_MASK,
12644                                     DIV_ROUND_UP(pat_len, 8),
12645                                     rule->patterns[j].mask) ||
12646                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12647                                     rule->patterns[j].pattern) ||
12648                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12649                                         rule->patterns[j].pkt_offset))
12650                                 return -ENOBUFS;
12651                         nla_nest_end(msg, nl_pat);
12652                 }
12653                 nla_nest_end(msg, nl_pats);
12654                 nla_nest_end(msg, nl_rule);
12655         }
12656         nla_nest_end(msg, nl_rules);
12657
12658         return 0;
12659 }
12660
12661 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12662 {
12663         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12664         struct sk_buff *msg;
12665         void *hdr;
12666
12667         if (!rdev->wiphy.coalesce)
12668                 return -EOPNOTSUPP;
12669
12670         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12671         if (!msg)
12672                 return -ENOMEM;
12673
12674         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12675                              NL80211_CMD_GET_COALESCE);
12676         if (!hdr)
12677                 goto nla_put_failure;
12678
12679         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12680                 goto nla_put_failure;
12681
12682         genlmsg_end(msg, hdr);
12683         return genlmsg_reply(msg, info);
12684
12685 nla_put_failure:
12686         nlmsg_free(msg);
12687         return -ENOBUFS;
12688 }
12689
12690 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12691 {
12692         struct cfg80211_coalesce *coalesce = rdev->coalesce;
12693         int i, j;
12694         struct cfg80211_coalesce_rules *rule;
12695
12696         if (!coalesce)
12697                 return;
12698
12699         for (i = 0; i < coalesce->n_rules; i++) {
12700                 rule = &coalesce->rules[i];
12701                 for (j = 0; j < rule->n_patterns; j++)
12702                         kfree(rule->patterns[j].mask);
12703                 kfree(rule->patterns);
12704         }
12705         kfree(coalesce->rules);
12706         kfree(coalesce);
12707         rdev->coalesce = NULL;
12708 }
12709
12710 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12711                                        struct nlattr *rule,
12712                                        struct cfg80211_coalesce_rules *new_rule)
12713 {
12714         int err, i;
12715         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12716         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12717         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12718         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12719
12720         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12721                                           rule, nl80211_coalesce_policy, NULL);
12722         if (err)
12723                 return err;
12724
12725         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12726                 new_rule->delay =
12727                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12728         if (new_rule->delay > coalesce->max_delay)
12729                 return -EINVAL;
12730
12731         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12732                 new_rule->condition =
12733                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12734
12735         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12736                 return -EINVAL;
12737
12738         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12739                             rem)
12740                 n_patterns++;
12741         if (n_patterns > coalesce->n_patterns)
12742                 return -EINVAL;
12743
12744         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12745                                      GFP_KERNEL);
12746         if (!new_rule->patterns)
12747                 return -ENOMEM;
12748
12749         new_rule->n_patterns = n_patterns;
12750         i = 0;
12751
12752         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12753                             rem) {
12754                 u8 *mask_pat;
12755
12756                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12757                                                   pat,
12758                                                   nl80211_packet_pattern_policy,
12759                                                   NULL);
12760                 if (err)
12761                         return err;
12762
12763                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12764                     !pat_tb[NL80211_PKTPAT_PATTERN])
12765                         return -EINVAL;
12766                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12767                 mask_len = DIV_ROUND_UP(pat_len, 8);
12768                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12769                         return -EINVAL;
12770                 if (pat_len > coalesce->pattern_max_len ||
12771                     pat_len < coalesce->pattern_min_len)
12772                         return -EINVAL;
12773
12774                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12775                         pkt_offset = 0;
12776                 else
12777                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12778                 if (pkt_offset > coalesce->max_pkt_offset)
12779                         return -EINVAL;
12780                 new_rule->patterns[i].pkt_offset = pkt_offset;
12781
12782                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12783                 if (!mask_pat)
12784                         return -ENOMEM;
12785
12786                 new_rule->patterns[i].mask = mask_pat;
12787                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12788                        mask_len);
12789
12790                 mask_pat += mask_len;
12791                 new_rule->patterns[i].pattern = mask_pat;
12792                 new_rule->patterns[i].pattern_len = pat_len;
12793                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12794                        pat_len);
12795                 i++;
12796         }
12797
12798         return 0;
12799 }
12800
12801 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12802 {
12803         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12804         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12805         struct cfg80211_coalesce new_coalesce = {};
12806         struct cfg80211_coalesce *n_coalesce;
12807         int err, rem_rule, n_rules = 0, i, j;
12808         struct nlattr *rule;
12809         struct cfg80211_coalesce_rules *tmp_rule;
12810
12811         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12812                 return -EOPNOTSUPP;
12813
12814         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12815                 cfg80211_rdev_free_coalesce(rdev);
12816                 rdev_set_coalesce(rdev, NULL);
12817                 return 0;
12818         }
12819
12820         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12821                             rem_rule)
12822                 n_rules++;
12823         if (n_rules > coalesce->n_rules)
12824                 return -EINVAL;
12825
12826         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12827                                      GFP_KERNEL);
12828         if (!new_coalesce.rules)
12829                 return -ENOMEM;
12830
12831         new_coalesce.n_rules = n_rules;
12832         i = 0;
12833
12834         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12835                             rem_rule) {
12836                 err = nl80211_parse_coalesce_rule(rdev, rule,
12837                                                   &new_coalesce.rules[i]);
12838                 if (err)
12839                         goto error;
12840
12841                 i++;
12842         }
12843
12844         err = rdev_set_coalesce(rdev, &new_coalesce);
12845         if (err)
12846                 goto error;
12847
12848         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12849         if (!n_coalesce) {
12850                 err = -ENOMEM;
12851                 goto error;
12852         }
12853         cfg80211_rdev_free_coalesce(rdev);
12854         rdev->coalesce = n_coalesce;
12855
12856         return 0;
12857 error:
12858         for (i = 0; i < new_coalesce.n_rules; i++) {
12859                 tmp_rule = &new_coalesce.rules[i];
12860                 for (j = 0; j < tmp_rule->n_patterns; j++)
12861                         kfree(tmp_rule->patterns[j].mask);
12862                 kfree(tmp_rule->patterns);
12863         }
12864         kfree(new_coalesce.rules);
12865
12866         return err;
12867 }
12868
12869 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12870 {
12871         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12872         struct net_device *dev = info->user_ptr[1];
12873         struct wireless_dev *wdev = dev->ieee80211_ptr;
12874         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12875         struct cfg80211_gtk_rekey_data rekey_data = {};
12876         int err;
12877
12878         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12879                 return -EINVAL;
12880
12881         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12882                                           info->attrs[NL80211_ATTR_REKEY_DATA],
12883                                           nl80211_rekey_policy, info->extack);
12884         if (err)
12885                 return err;
12886
12887         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12888             !tb[NL80211_REKEY_DATA_KCK])
12889                 return -EINVAL;
12890         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
12891             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12892               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
12893                 return -ERANGE;
12894         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
12895             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12896               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KCK_EXT_LEN))
12897                 return -ERANGE;
12898
12899         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12900         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12901         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12902         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
12903         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
12904         if (tb[NL80211_REKEY_DATA_AKM])
12905                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
12906
12907         wdev_lock(wdev);
12908         if (!wdev->current_bss) {
12909                 err = -ENOTCONN;
12910                 goto out;
12911         }
12912
12913         if (!rdev->ops->set_rekey_data) {
12914                 err = -EOPNOTSUPP;
12915                 goto out;
12916         }
12917
12918         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12919  out:
12920         wdev_unlock(wdev);
12921         return err;
12922 }
12923
12924 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12925                                              struct genl_info *info)
12926 {
12927         struct net_device *dev = info->user_ptr[1];
12928         struct wireless_dev *wdev = dev->ieee80211_ptr;
12929
12930         if (wdev->iftype != NL80211_IFTYPE_AP &&
12931             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12932                 return -EINVAL;
12933
12934         if (wdev->ap_unexpected_nlportid)
12935                 return -EBUSY;
12936
12937         wdev->ap_unexpected_nlportid = info->snd_portid;
12938         return 0;
12939 }
12940
12941 static int nl80211_probe_client(struct sk_buff *skb,
12942                                 struct genl_info *info)
12943 {
12944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12945         struct net_device *dev = info->user_ptr[1];
12946         struct wireless_dev *wdev = dev->ieee80211_ptr;
12947         struct sk_buff *msg;
12948         void *hdr;
12949         const u8 *addr;
12950         u64 cookie;
12951         int err;
12952
12953         if (wdev->iftype != NL80211_IFTYPE_AP &&
12954             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12955                 return -EOPNOTSUPP;
12956
12957         if (!info->attrs[NL80211_ATTR_MAC])
12958                 return -EINVAL;
12959
12960         if (!rdev->ops->probe_client)
12961                 return -EOPNOTSUPP;
12962
12963         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12964         if (!msg)
12965                 return -ENOMEM;
12966
12967         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12968                              NL80211_CMD_PROBE_CLIENT);
12969         if (!hdr) {
12970                 err = -ENOBUFS;
12971                 goto free_msg;
12972         }
12973
12974         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12975
12976         err = rdev_probe_client(rdev, dev, addr, &cookie);
12977         if (err)
12978                 goto free_msg;
12979
12980         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12981                               NL80211_ATTR_PAD))
12982                 goto nla_put_failure;
12983
12984         genlmsg_end(msg, hdr);
12985
12986         return genlmsg_reply(msg, info);
12987
12988  nla_put_failure:
12989         err = -ENOBUFS;
12990  free_msg:
12991         nlmsg_free(msg);
12992         return err;
12993 }
12994
12995 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
12996 {
12997         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12998         struct cfg80211_beacon_registration *reg, *nreg;
12999         int rv;
13000
13001         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
13002                 return -EOPNOTSUPP;
13003
13004         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
13005         if (!nreg)
13006                 return -ENOMEM;
13007
13008         /* First, check if already registered. */
13009         spin_lock_bh(&rdev->beacon_registrations_lock);
13010         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13011                 if (reg->nlportid == info->snd_portid) {
13012                         rv = -EALREADY;
13013                         goto out_err;
13014                 }
13015         }
13016         /* Add it to the list */
13017         nreg->nlportid = info->snd_portid;
13018         list_add(&nreg->list, &rdev->beacon_registrations);
13019
13020         spin_unlock_bh(&rdev->beacon_registrations_lock);
13021
13022         return 0;
13023 out_err:
13024         spin_unlock_bh(&rdev->beacon_registrations_lock);
13025         kfree(nreg);
13026         return rv;
13027 }
13028
13029 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
13030 {
13031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13032         struct wireless_dev *wdev = info->user_ptr[1];
13033         int err;
13034
13035         if (!rdev->ops->start_p2p_device)
13036                 return -EOPNOTSUPP;
13037
13038         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13039                 return -EOPNOTSUPP;
13040
13041         if (wdev_running(wdev))
13042                 return 0;
13043
13044         if (rfkill_blocked(rdev->rfkill))
13045                 return -ERFKILL;
13046
13047         err = rdev_start_p2p_device(rdev, wdev);
13048         if (err)
13049                 return err;
13050
13051         wdev->is_running = true;
13052         rdev->opencount++;
13053
13054         return 0;
13055 }
13056
13057 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
13058 {
13059         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13060         struct wireless_dev *wdev = info->user_ptr[1];
13061
13062         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13063                 return -EOPNOTSUPP;
13064
13065         if (!rdev->ops->stop_p2p_device)
13066                 return -EOPNOTSUPP;
13067
13068         cfg80211_stop_p2p_device(rdev, wdev);
13069
13070         return 0;
13071 }
13072
13073 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
13074 {
13075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13076         struct wireless_dev *wdev = info->user_ptr[1];
13077         struct cfg80211_nan_conf conf = {};
13078         int err;
13079
13080         if (wdev->iftype != NL80211_IFTYPE_NAN)
13081                 return -EOPNOTSUPP;
13082
13083         if (wdev_running(wdev))
13084                 return -EEXIST;
13085
13086         if (rfkill_blocked(rdev->rfkill))
13087                 return -ERFKILL;
13088
13089         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
13090                 return -EINVAL;
13091
13092         conf.master_pref =
13093                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13094
13095         if (info->attrs[NL80211_ATTR_BANDS]) {
13096                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13097
13098                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13099                         return -EOPNOTSUPP;
13100
13101                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13102                         return -EINVAL;
13103
13104                 conf.bands = bands;
13105         }
13106
13107         err = rdev_start_nan(rdev, wdev, &conf);
13108         if (err)
13109                 return err;
13110
13111         wdev->is_running = true;
13112         rdev->opencount++;
13113
13114         return 0;
13115 }
13116
13117 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
13118 {
13119         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13120         struct wireless_dev *wdev = info->user_ptr[1];
13121
13122         if (wdev->iftype != NL80211_IFTYPE_NAN)
13123                 return -EOPNOTSUPP;
13124
13125         cfg80211_stop_nan(rdev, wdev);
13126
13127         return 0;
13128 }
13129
13130 static int validate_nan_filter(struct nlattr *filter_attr)
13131 {
13132         struct nlattr *attr;
13133         int len = 0, n_entries = 0, rem;
13134
13135         nla_for_each_nested(attr, filter_attr, rem) {
13136                 len += nla_len(attr);
13137                 n_entries++;
13138         }
13139
13140         if (len >= U8_MAX)
13141                 return -EINVAL;
13142
13143         return n_entries;
13144 }
13145
13146 static int handle_nan_filter(struct nlattr *attr_filter,
13147                              struct cfg80211_nan_func *func,
13148                              bool tx)
13149 {
13150         struct nlattr *attr;
13151         int n_entries, rem, i;
13152         struct cfg80211_nan_func_filter *filter;
13153
13154         n_entries = validate_nan_filter(attr_filter);
13155         if (n_entries < 0)
13156                 return n_entries;
13157
13158         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
13159
13160         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
13161         if (!filter)
13162                 return -ENOMEM;
13163
13164         i = 0;
13165         nla_for_each_nested(attr, attr_filter, rem) {
13166                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
13167                 filter[i].len = nla_len(attr);
13168                 i++;
13169         }
13170         if (tx) {
13171                 func->num_tx_filters = n_entries;
13172                 func->tx_filters = filter;
13173         } else {
13174                 func->num_rx_filters = n_entries;
13175                 func->rx_filters = filter;
13176         }
13177
13178         return 0;
13179 }
13180
13181 static int nl80211_nan_add_func(struct sk_buff *skb,
13182                                 struct genl_info *info)
13183 {
13184         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13185         struct wireless_dev *wdev = info->user_ptr[1];
13186         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
13187         struct cfg80211_nan_func *func;
13188         struct sk_buff *msg = NULL;
13189         void *hdr = NULL;
13190         int err = 0;
13191
13192         if (wdev->iftype != NL80211_IFTYPE_NAN)
13193                 return -EOPNOTSUPP;
13194
13195         if (!wdev_running(wdev))
13196                 return -ENOTCONN;
13197
13198         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
13199                 return -EINVAL;
13200
13201         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
13202                                           info->attrs[NL80211_ATTR_NAN_FUNC],
13203                                           nl80211_nan_func_policy,
13204                                           info->extack);
13205         if (err)
13206                 return err;
13207
13208         func = kzalloc(sizeof(*func), GFP_KERNEL);
13209         if (!func)
13210                 return -ENOMEM;
13211
13212         func->cookie = cfg80211_assign_cookie(rdev);
13213
13214         if (!tb[NL80211_NAN_FUNC_TYPE]) {
13215                 err = -EINVAL;
13216                 goto out;
13217         }
13218
13219
13220         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
13221
13222         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
13223                 err = -EINVAL;
13224                 goto out;
13225         }
13226
13227         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
13228                sizeof(func->service_id));
13229
13230         func->close_range =
13231                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
13232
13233         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
13234                 func->serv_spec_info_len =
13235                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
13236                 func->serv_spec_info =
13237                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13238                                 func->serv_spec_info_len,
13239                                 GFP_KERNEL);
13240                 if (!func->serv_spec_info) {
13241                         err = -ENOMEM;
13242                         goto out;
13243                 }
13244         }
13245
13246         if (tb[NL80211_NAN_FUNC_TTL])
13247                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13248
13249         switch (func->type) {
13250         case NL80211_NAN_FUNC_PUBLISH:
13251                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13252                         err = -EINVAL;
13253                         goto out;
13254                 }
13255
13256                 func->publish_type =
13257                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13258                 func->publish_bcast =
13259                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13260
13261                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13262                         func->publish_bcast) {
13263                         err = -EINVAL;
13264                         goto out;
13265                 }
13266                 break;
13267         case NL80211_NAN_FUNC_SUBSCRIBE:
13268                 func->subscribe_active =
13269                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13270                 break;
13271         case NL80211_NAN_FUNC_FOLLOW_UP:
13272                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13273                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13274                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13275                         err = -EINVAL;
13276                         goto out;
13277                 }
13278
13279                 func->followup_id =
13280                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13281                 func->followup_reqid =
13282                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13283                 memcpy(func->followup_dest.addr,
13284                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13285                        sizeof(func->followup_dest.addr));
13286                 if (func->ttl) {
13287                         err = -EINVAL;
13288                         goto out;
13289                 }
13290                 break;
13291         default:
13292                 err = -EINVAL;
13293                 goto out;
13294         }
13295
13296         if (tb[NL80211_NAN_FUNC_SRF]) {
13297                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13298
13299                 err = nla_parse_nested_deprecated(srf_tb,
13300                                                   NL80211_NAN_SRF_ATTR_MAX,
13301                                                   tb[NL80211_NAN_FUNC_SRF],
13302                                                   nl80211_nan_srf_policy,
13303                                                   info->extack);
13304                 if (err)
13305                         goto out;
13306
13307                 func->srf_include =
13308                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13309
13310                 if (srf_tb[NL80211_NAN_SRF_BF]) {
13311                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13312                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13313                                 err = -EINVAL;
13314                                 goto out;
13315                         }
13316
13317                         func->srf_bf_len =
13318                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13319                         func->srf_bf =
13320                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13321                                         func->srf_bf_len, GFP_KERNEL);
13322                         if (!func->srf_bf) {
13323                                 err = -ENOMEM;
13324                                 goto out;
13325                         }
13326
13327                         func->srf_bf_idx =
13328                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13329                 } else {
13330                         struct nlattr *attr, *mac_attr =
13331                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13332                         int n_entries, rem, i = 0;
13333
13334                         if (!mac_attr) {
13335                                 err = -EINVAL;
13336                                 goto out;
13337                         }
13338
13339                         n_entries = validate_acl_mac_addrs(mac_attr);
13340                         if (n_entries <= 0) {
13341                                 err = -EINVAL;
13342                                 goto out;
13343                         }
13344
13345                         func->srf_num_macs = n_entries;
13346                         func->srf_macs =
13347                                 kcalloc(n_entries, sizeof(*func->srf_macs),
13348                                         GFP_KERNEL);
13349                         if (!func->srf_macs) {
13350                                 err = -ENOMEM;
13351                                 goto out;
13352                         }
13353
13354                         nla_for_each_nested(attr, mac_attr, rem)
13355                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13356                                        sizeof(*func->srf_macs));
13357                 }
13358         }
13359
13360         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13361                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13362                                         func, true);
13363                 if (err)
13364                         goto out;
13365         }
13366
13367         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13368                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13369                                         func, false);
13370                 if (err)
13371                         goto out;
13372         }
13373
13374         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13375         if (!msg) {
13376                 err = -ENOMEM;
13377                 goto out;
13378         }
13379
13380         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13381                              NL80211_CMD_ADD_NAN_FUNCTION);
13382         /* This can't really happen - we just allocated 4KB */
13383         if (WARN_ON(!hdr)) {
13384                 err = -ENOMEM;
13385                 goto out;
13386         }
13387
13388         err = rdev_add_nan_func(rdev, wdev, func);
13389 out:
13390         if (err < 0) {
13391                 cfg80211_free_nan_func(func);
13392                 nlmsg_free(msg);
13393                 return err;
13394         }
13395
13396         /* propagate the instance id and cookie to userspace  */
13397         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13398                               NL80211_ATTR_PAD))
13399                 goto nla_put_failure;
13400
13401         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13402         if (!func_attr)
13403                 goto nla_put_failure;
13404
13405         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13406                        func->instance_id))
13407                 goto nla_put_failure;
13408
13409         nla_nest_end(msg, func_attr);
13410
13411         genlmsg_end(msg, hdr);
13412         return genlmsg_reply(msg, info);
13413
13414 nla_put_failure:
13415         nlmsg_free(msg);
13416         return -ENOBUFS;
13417 }
13418
13419 static int nl80211_nan_del_func(struct sk_buff *skb,
13420                                struct genl_info *info)
13421 {
13422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13423         struct wireless_dev *wdev = info->user_ptr[1];
13424         u64 cookie;
13425
13426         if (wdev->iftype != NL80211_IFTYPE_NAN)
13427                 return -EOPNOTSUPP;
13428
13429         if (!wdev_running(wdev))
13430                 return -ENOTCONN;
13431
13432         if (!info->attrs[NL80211_ATTR_COOKIE])
13433                 return -EINVAL;
13434
13435         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13436
13437         rdev_del_nan_func(rdev, wdev, cookie);
13438
13439         return 0;
13440 }
13441
13442 static int nl80211_nan_change_config(struct sk_buff *skb,
13443                                      struct genl_info *info)
13444 {
13445         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13446         struct wireless_dev *wdev = info->user_ptr[1];
13447         struct cfg80211_nan_conf conf = {};
13448         u32 changed = 0;
13449
13450         if (wdev->iftype != NL80211_IFTYPE_NAN)
13451                 return -EOPNOTSUPP;
13452
13453         if (!wdev_running(wdev))
13454                 return -ENOTCONN;
13455
13456         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13457                 conf.master_pref =
13458                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13459                 if (conf.master_pref <= 1 || conf.master_pref == 255)
13460                         return -EINVAL;
13461
13462                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13463         }
13464
13465         if (info->attrs[NL80211_ATTR_BANDS]) {
13466                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13467
13468                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13469                         return -EOPNOTSUPP;
13470
13471                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13472                         return -EINVAL;
13473
13474                 conf.bands = bands;
13475                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13476         }
13477
13478         if (!changed)
13479                 return -EINVAL;
13480
13481         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13482 }
13483
13484 void cfg80211_nan_match(struct wireless_dev *wdev,
13485                         struct cfg80211_nan_match_params *match, gfp_t gfp)
13486 {
13487         struct wiphy *wiphy = wdev->wiphy;
13488         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13489         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13490         struct sk_buff *msg;
13491         void *hdr;
13492
13493         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
13494                 return;
13495
13496         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13497         if (!msg)
13498                 return;
13499
13500         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
13501         if (!hdr) {
13502                 nlmsg_free(msg);
13503                 return;
13504         }
13505
13506         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13507             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13508                                          wdev->netdev->ifindex)) ||
13509             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13510                               NL80211_ATTR_PAD))
13511                 goto nla_put_failure;
13512
13513         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
13514                               NL80211_ATTR_PAD) ||
13515             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
13516                 goto nla_put_failure;
13517
13518         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
13519         if (!match_attr)
13520                 goto nla_put_failure;
13521
13522         local_func_attr = nla_nest_start_noflag(msg,
13523                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
13524         if (!local_func_attr)
13525                 goto nla_put_failure;
13526
13527         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
13528                 goto nla_put_failure;
13529
13530         nla_nest_end(msg, local_func_attr);
13531
13532         peer_func_attr = nla_nest_start_noflag(msg,
13533                                                NL80211_NAN_MATCH_FUNC_PEER);
13534         if (!peer_func_attr)
13535                 goto nla_put_failure;
13536
13537         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
13538             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
13539                 goto nla_put_failure;
13540
13541         if (match->info && match->info_len &&
13542             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
13543                     match->info))
13544                 goto nla_put_failure;
13545
13546         nla_nest_end(msg, peer_func_attr);
13547         nla_nest_end(msg, match_attr);
13548         genlmsg_end(msg, hdr);
13549
13550         if (!wdev->owner_nlportid)
13551                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13552                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13553         else
13554                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13555                                 wdev->owner_nlportid);
13556
13557         return;
13558
13559 nla_put_failure:
13560         nlmsg_free(msg);
13561 }
13562 EXPORT_SYMBOL(cfg80211_nan_match);
13563
13564 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
13565                                   u8 inst_id,
13566                                   enum nl80211_nan_func_term_reason reason,
13567                                   u64 cookie, gfp_t gfp)
13568 {
13569         struct wiphy *wiphy = wdev->wiphy;
13570         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13571         struct sk_buff *msg;
13572         struct nlattr *func_attr;
13573         void *hdr;
13574
13575         if (WARN_ON(!inst_id))
13576                 return;
13577
13578         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13579         if (!msg)
13580                 return;
13581
13582         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
13583         if (!hdr) {
13584                 nlmsg_free(msg);
13585                 return;
13586         }
13587
13588         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13589             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13590                                          wdev->netdev->ifindex)) ||
13591             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13592                               NL80211_ATTR_PAD))
13593                 goto nla_put_failure;
13594
13595         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13596                               NL80211_ATTR_PAD))
13597                 goto nla_put_failure;
13598
13599         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13600         if (!func_attr)
13601                 goto nla_put_failure;
13602
13603         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
13604             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
13605                 goto nla_put_failure;
13606
13607         nla_nest_end(msg, func_attr);
13608         genlmsg_end(msg, hdr);
13609
13610         if (!wdev->owner_nlportid)
13611                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13612                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13613         else
13614                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13615                                 wdev->owner_nlportid);
13616
13617         return;
13618
13619 nla_put_failure:
13620         nlmsg_free(msg);
13621 }
13622 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
13623
13624 static int nl80211_get_protocol_features(struct sk_buff *skb,
13625                                          struct genl_info *info)
13626 {
13627         void *hdr;
13628         struct sk_buff *msg;
13629
13630         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13631         if (!msg)
13632                 return -ENOMEM;
13633
13634         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13635                              NL80211_CMD_GET_PROTOCOL_FEATURES);
13636         if (!hdr)
13637                 goto nla_put_failure;
13638
13639         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
13640                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
13641                 goto nla_put_failure;
13642
13643         genlmsg_end(msg, hdr);
13644         return genlmsg_reply(msg, info);
13645
13646  nla_put_failure:
13647         kfree_skb(msg);
13648         return -ENOBUFS;
13649 }
13650
13651 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13652 {
13653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13654         struct cfg80211_update_ft_ies_params ft_params;
13655         struct net_device *dev = info->user_ptr[1];
13656
13657         if (!rdev->ops->update_ft_ies)
13658                 return -EOPNOTSUPP;
13659
13660         if (!info->attrs[NL80211_ATTR_MDID] ||
13661             !info->attrs[NL80211_ATTR_IE])
13662                 return -EINVAL;
13663
13664         memset(&ft_params, 0, sizeof(ft_params));
13665         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13666         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13667         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13668
13669         return rdev_update_ft_ies(rdev, dev, &ft_params);
13670 }
13671
13672 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13673                                        struct genl_info *info)
13674 {
13675         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13676         struct wireless_dev *wdev = info->user_ptr[1];
13677         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13678         u16 duration;
13679         int ret;
13680
13681         if (!rdev->ops->crit_proto_start)
13682                 return -EOPNOTSUPP;
13683
13684         if (WARN_ON(!rdev->ops->crit_proto_stop))
13685                 return -EINVAL;
13686
13687         if (rdev->crit_proto_nlportid)
13688                 return -EBUSY;
13689
13690         /* determine protocol if provided */
13691         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13692                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13693
13694         if (proto >= NUM_NL80211_CRIT_PROTO)
13695                 return -EINVAL;
13696
13697         /* timeout must be provided */
13698         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13699                 return -EINVAL;
13700
13701         duration =
13702                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13703
13704         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13705         if (!ret)
13706                 rdev->crit_proto_nlportid = info->snd_portid;
13707
13708         return ret;
13709 }
13710
13711 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13712                                       struct genl_info *info)
13713 {
13714         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13715         struct wireless_dev *wdev = info->user_ptr[1];
13716
13717         if (!rdev->ops->crit_proto_stop)
13718                 return -EOPNOTSUPP;
13719
13720         if (rdev->crit_proto_nlportid) {
13721                 rdev->crit_proto_nlportid = 0;
13722                 rdev_crit_proto_stop(rdev, wdev);
13723         }
13724         return 0;
13725 }
13726
13727 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13728                                        struct nlattr *attr,
13729                                        struct netlink_ext_ack *extack)
13730 {
13731         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13732                 if (attr->nla_type & NLA_F_NESTED) {
13733                         NL_SET_ERR_MSG_ATTR(extack, attr,
13734                                             "unexpected nested data");
13735                         return -EINVAL;
13736                 }
13737
13738                 return 0;
13739         }
13740
13741         if (!(attr->nla_type & NLA_F_NESTED)) {
13742                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13743                 return -EINVAL;
13744         }
13745
13746         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13747 }
13748
13749 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13750 {
13751         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13752         struct wireless_dev *wdev =
13753                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
13754                                            info->attrs);
13755         int i, err;
13756         u32 vid, subcmd;
13757
13758         if (!rdev->wiphy.vendor_commands)
13759                 return -EOPNOTSUPP;
13760
13761         if (IS_ERR(wdev)) {
13762                 err = PTR_ERR(wdev);
13763                 if (err != -EINVAL)
13764                         return err;
13765                 wdev = NULL;
13766         } else if (wdev->wiphy != &rdev->wiphy) {
13767                 return -EINVAL;
13768         }
13769
13770         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13771             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13772                 return -EINVAL;
13773
13774         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13775         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13776         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13777                 const struct wiphy_vendor_command *vcmd;
13778                 void *data = NULL;
13779                 int len = 0;
13780
13781                 vcmd = &rdev->wiphy.vendor_commands[i];
13782
13783                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13784                         continue;
13785
13786                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13787                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13788                         if (!wdev)
13789                                 return -EINVAL;
13790                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13791                             !wdev->netdev)
13792                                 return -EINVAL;
13793
13794                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13795                                 if (!wdev_running(wdev))
13796                                         return -ENETDOWN;
13797                         }
13798                 } else {
13799                         wdev = NULL;
13800                 }
13801
13802                 if (!vcmd->doit)
13803                         return -EOPNOTSUPP;
13804
13805                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13806                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13807                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13808
13809                         err = nl80211_vendor_check_policy(vcmd,
13810                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
13811                                         info->extack);
13812                         if (err)
13813                                 return err;
13814                 }
13815
13816                 rdev->cur_cmd_info = info;
13817                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13818                 rdev->cur_cmd_info = NULL;
13819                 return err;
13820         }
13821
13822         return -EOPNOTSUPP;
13823 }
13824
13825 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13826                                        struct netlink_callback *cb,
13827                                        struct cfg80211_registered_device **rdev,
13828                                        struct wireless_dev **wdev)
13829 {
13830         struct nlattr **attrbuf;
13831         u32 vid, subcmd;
13832         unsigned int i;
13833         int vcmd_idx = -1;
13834         int err;
13835         void *data = NULL;
13836         unsigned int data_len = 0;
13837
13838         if (cb->args[0]) {
13839                 /* subtract the 1 again here */
13840                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13841                 struct wireless_dev *tmp;
13842
13843                 if (!wiphy)
13844                         return -ENODEV;
13845                 *rdev = wiphy_to_rdev(wiphy);
13846                 *wdev = NULL;
13847
13848                 if (cb->args[1]) {
13849                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13850                                 if (tmp->identifier == cb->args[1] - 1) {
13851                                         *wdev = tmp;
13852                                         break;
13853                                 }
13854                         }
13855                 }
13856
13857                 /* keep rtnl locked in successful case */
13858                 return 0;
13859         }
13860
13861         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13862         if (!attrbuf)
13863                 return -ENOMEM;
13864
13865         err = nlmsg_parse_deprecated(cb->nlh,
13866                                      GENL_HDRLEN + nl80211_fam.hdrsize,
13867                                      attrbuf, nl80211_fam.maxattr,
13868                                      nl80211_policy, NULL);
13869         if (err)
13870                 goto out;
13871
13872         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13873             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13874                 err = -EINVAL;
13875                 goto out;
13876         }
13877
13878         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
13879         if (IS_ERR(*wdev))
13880                 *wdev = NULL;
13881
13882         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13883         if (IS_ERR(*rdev)) {
13884                 err = PTR_ERR(*rdev);
13885                 goto out;
13886         }
13887
13888         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13889         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13890
13891         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13892                 const struct wiphy_vendor_command *vcmd;
13893
13894                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13895
13896                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13897                         continue;
13898
13899                 if (!vcmd->dumpit) {
13900                         err = -EOPNOTSUPP;
13901                         goto out;
13902                 }
13903
13904                 vcmd_idx = i;
13905                 break;
13906         }
13907
13908         if (vcmd_idx < 0) {
13909                 err = -EOPNOTSUPP;
13910                 goto out;
13911         }
13912
13913         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13914                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13915                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13916
13917                 err = nl80211_vendor_check_policy(
13918                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13919                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
13920                                 cb->extack);
13921                 if (err)
13922                         goto out;
13923         }
13924
13925         /* 0 is the first index - add 1 to parse only once */
13926         cb->args[0] = (*rdev)->wiphy_idx + 1;
13927         /* add 1 to know if it was NULL */
13928         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13929         cb->args[2] = vcmd_idx;
13930         cb->args[3] = (unsigned long)data;
13931         cb->args[4] = data_len;
13932
13933         /* keep rtnl locked in successful case */
13934         err = 0;
13935 out:
13936         kfree(attrbuf);
13937         return err;
13938 }
13939
13940 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13941                                    struct netlink_callback *cb)
13942 {
13943         struct cfg80211_registered_device *rdev;
13944         struct wireless_dev *wdev;
13945         unsigned int vcmd_idx;
13946         const struct wiphy_vendor_command *vcmd;
13947         void *data;
13948         int data_len;
13949         int err;
13950         struct nlattr *vendor_data;
13951
13952         rtnl_lock();
13953         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13954         if (err)
13955                 goto out;
13956
13957         vcmd_idx = cb->args[2];
13958         data = (void *)cb->args[3];
13959         data_len = cb->args[4];
13960         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
13961
13962         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13963                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13964                 if (!wdev) {
13965                         err = -EINVAL;
13966                         goto out;
13967                 }
13968                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13969                     !wdev->netdev) {
13970                         err = -EINVAL;
13971                         goto out;
13972                 }
13973
13974                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13975                         if (!wdev_running(wdev)) {
13976                                 err = -ENETDOWN;
13977                                 goto out;
13978                         }
13979                 }
13980         }
13981
13982         while (1) {
13983                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
13984                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
13985                                            NL80211_CMD_VENDOR);
13986                 if (!hdr)
13987                         break;
13988
13989                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13990                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
13991                                                wdev_id(wdev),
13992                                                NL80211_ATTR_PAD))) {
13993                         genlmsg_cancel(skb, hdr);
13994                         break;
13995                 }
13996
13997                 vendor_data = nla_nest_start_noflag(skb,
13998                                                     NL80211_ATTR_VENDOR_DATA);
13999                 if (!vendor_data) {
14000                         genlmsg_cancel(skb, hdr);
14001                         break;
14002                 }
14003
14004                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
14005                                    (unsigned long *)&cb->args[5]);
14006                 nla_nest_end(skb, vendor_data);
14007
14008                 if (err == -ENOBUFS || err == -ENOENT) {
14009                         genlmsg_cancel(skb, hdr);
14010                         break;
14011                 } else if (err <= 0) {
14012                         genlmsg_cancel(skb, hdr);
14013                         goto out;
14014                 }
14015
14016                 genlmsg_end(skb, hdr);
14017         }
14018
14019         err = skb->len;
14020  out:
14021         rtnl_unlock();
14022         return err;
14023 }
14024
14025 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
14026                                            enum nl80211_commands cmd,
14027                                            enum nl80211_attrs attr,
14028                                            int approxlen)
14029 {
14030         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14031
14032         if (WARN_ON(!rdev->cur_cmd_info))
14033                 return NULL;
14034
14035         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
14036                                            rdev->cur_cmd_info->snd_portid,
14037                                            rdev->cur_cmd_info->snd_seq,
14038                                            cmd, attr, NULL, GFP_KERNEL);
14039 }
14040 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
14041
14042 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
14043 {
14044         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
14045         void *hdr = ((void **)skb->cb)[1];
14046         struct nlattr *data = ((void **)skb->cb)[2];
14047
14048         /* clear CB data for netlink core to own from now on */
14049         memset(skb->cb, 0, sizeof(skb->cb));
14050
14051         if (WARN_ON(!rdev->cur_cmd_info)) {
14052                 kfree_skb(skb);
14053                 return -EINVAL;
14054         }
14055
14056         nla_nest_end(skb, data);
14057         genlmsg_end(skb, hdr);
14058         return genlmsg_reply(skb, rdev->cur_cmd_info);
14059 }
14060 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
14061
14062 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
14063 {
14064         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14065
14066         if (WARN_ON(!rdev->cur_cmd_info))
14067                 return 0;
14068
14069         return rdev->cur_cmd_info->snd_portid;
14070 }
14071 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
14072
14073 static int nl80211_set_qos_map(struct sk_buff *skb,
14074                                struct genl_info *info)
14075 {
14076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14077         struct cfg80211_qos_map *qos_map = NULL;
14078         struct net_device *dev = info->user_ptr[1];
14079         u8 *pos, len, num_des, des_len, des;
14080         int ret;
14081
14082         if (!rdev->ops->set_qos_map)
14083                 return -EOPNOTSUPP;
14084
14085         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
14086                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
14087                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
14088
14089                 if (len % 2)
14090                         return -EINVAL;
14091
14092                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
14093                 if (!qos_map)
14094                         return -ENOMEM;
14095
14096                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
14097                 if (num_des) {
14098                         des_len = num_des *
14099                                 sizeof(struct cfg80211_dscp_exception);
14100                         memcpy(qos_map->dscp_exception, pos, des_len);
14101                         qos_map->num_des = num_des;
14102                         for (des = 0; des < num_des; des++) {
14103                                 if (qos_map->dscp_exception[des].up > 7) {
14104                                         kfree(qos_map);
14105                                         return -EINVAL;
14106                                 }
14107                         }
14108                         pos += des_len;
14109                 }
14110                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
14111         }
14112
14113         wdev_lock(dev->ieee80211_ptr);
14114         ret = nl80211_key_allowed(dev->ieee80211_ptr);
14115         if (!ret)
14116                 ret = rdev_set_qos_map(rdev, dev, qos_map);
14117         wdev_unlock(dev->ieee80211_ptr);
14118
14119         kfree(qos_map);
14120         return ret;
14121 }
14122
14123 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
14124 {
14125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14126         struct net_device *dev = info->user_ptr[1];
14127         struct wireless_dev *wdev = dev->ieee80211_ptr;
14128         const u8 *peer;
14129         u8 tsid, up;
14130         u16 admitted_time = 0;
14131         int err;
14132
14133         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
14134                 return -EOPNOTSUPP;
14135
14136         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
14137             !info->attrs[NL80211_ATTR_USER_PRIO])
14138                 return -EINVAL;
14139
14140         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14141         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
14142
14143         /* WMM uses TIDs 0-7 even for TSPEC */
14144         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
14145                 /* TODO: handle 802.11 TSPEC/admission control
14146                  * need more attributes for that (e.g. BA session requirement);
14147                  * change the WMM adminssion test above to allow both then
14148                  */
14149                 return -EINVAL;
14150         }
14151
14152         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14153
14154         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
14155                 admitted_time =
14156                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
14157                 if (!admitted_time)
14158                         return -EINVAL;
14159         }
14160
14161         wdev_lock(wdev);
14162         switch (wdev->iftype) {
14163         case NL80211_IFTYPE_STATION:
14164         case NL80211_IFTYPE_P2P_CLIENT:
14165                 if (wdev->current_bss)
14166                         break;
14167                 err = -ENOTCONN;
14168                 goto out;
14169         default:
14170                 err = -EOPNOTSUPP;
14171                 goto out;
14172         }
14173
14174         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
14175
14176  out:
14177         wdev_unlock(wdev);
14178         return err;
14179 }
14180
14181 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
14182 {
14183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14184         struct net_device *dev = info->user_ptr[1];
14185         struct wireless_dev *wdev = dev->ieee80211_ptr;
14186         const u8 *peer;
14187         u8 tsid;
14188         int err;
14189
14190         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
14191                 return -EINVAL;
14192
14193         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14194         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14195
14196         wdev_lock(wdev);
14197         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
14198         wdev_unlock(wdev);
14199
14200         return err;
14201 }
14202
14203 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
14204                                        struct genl_info *info)
14205 {
14206         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14207         struct net_device *dev = info->user_ptr[1];
14208         struct wireless_dev *wdev = dev->ieee80211_ptr;
14209         struct cfg80211_chan_def chandef = {};
14210         const u8 *addr;
14211         u8 oper_class;
14212         int err;
14213
14214         if (!rdev->ops->tdls_channel_switch ||
14215             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14216                 return -EOPNOTSUPP;
14217
14218         switch (dev->ieee80211_ptr->iftype) {
14219         case NL80211_IFTYPE_STATION:
14220         case NL80211_IFTYPE_P2P_CLIENT:
14221                 break;
14222         default:
14223                 return -EOPNOTSUPP;
14224         }
14225
14226         if (!info->attrs[NL80211_ATTR_MAC] ||
14227             !info->attrs[NL80211_ATTR_OPER_CLASS])
14228                 return -EINVAL;
14229
14230         err = nl80211_parse_chandef(rdev, info, &chandef);
14231         if (err)
14232                 return err;
14233
14234         /*
14235          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
14236          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
14237          * specification is not defined for them.
14238          */
14239         if (chandef.chan->band == NL80211_BAND_2GHZ &&
14240             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14241             chandef.width != NL80211_CHAN_WIDTH_20)
14242                 return -EINVAL;
14243
14244         /* we will be active on the TDLS link */
14245         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14246                                            wdev->iftype))
14247                 return -EINVAL;
14248
14249         /* don't allow switching to DFS channels */
14250         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14251                 return -EINVAL;
14252
14253         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14254         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14255
14256         wdev_lock(wdev);
14257         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14258         wdev_unlock(wdev);
14259
14260         return err;
14261 }
14262
14263 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14264                                               struct genl_info *info)
14265 {
14266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14267         struct net_device *dev = info->user_ptr[1];
14268         struct wireless_dev *wdev = dev->ieee80211_ptr;
14269         const u8 *addr;
14270
14271         if (!rdev->ops->tdls_channel_switch ||
14272             !rdev->ops->tdls_cancel_channel_switch ||
14273             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14274                 return -EOPNOTSUPP;
14275
14276         switch (dev->ieee80211_ptr->iftype) {
14277         case NL80211_IFTYPE_STATION:
14278         case NL80211_IFTYPE_P2P_CLIENT:
14279                 break;
14280         default:
14281                 return -EOPNOTSUPP;
14282         }
14283
14284         if (!info->attrs[NL80211_ATTR_MAC])
14285                 return -EINVAL;
14286
14287         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14288
14289         wdev_lock(wdev);
14290         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14291         wdev_unlock(wdev);
14292
14293         return 0;
14294 }
14295
14296 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14297                                             struct genl_info *info)
14298 {
14299         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14300         struct net_device *dev = info->user_ptr[1];
14301         struct wireless_dev *wdev = dev->ieee80211_ptr;
14302         const struct nlattr *nla;
14303         bool enabled;
14304
14305         if (!rdev->ops->set_multicast_to_unicast)
14306                 return -EOPNOTSUPP;
14307
14308         if (wdev->iftype != NL80211_IFTYPE_AP &&
14309             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14310                 return -EOPNOTSUPP;
14311
14312         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14313         enabled = nla_get_flag(nla);
14314
14315         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14316 }
14317
14318 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14319 {
14320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14321         struct net_device *dev = info->user_ptr[1];
14322         struct wireless_dev *wdev = dev->ieee80211_ptr;
14323         struct cfg80211_pmk_conf pmk_conf = {};
14324         int ret;
14325
14326         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14327             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14328                 return -EOPNOTSUPP;
14329
14330         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14331                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14332                 return -EOPNOTSUPP;
14333
14334         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14335                 return -EINVAL;
14336
14337         wdev_lock(wdev);
14338         if (!wdev->current_bss) {
14339                 ret = -ENOTCONN;
14340                 goto out;
14341         }
14342
14343         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14344         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
14345                 ret = -EINVAL;
14346                 goto out;
14347         }
14348
14349         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14350         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14351         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14352             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14353                 ret = -EINVAL;
14354                 goto out;
14355         }
14356
14357         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14358                 pmk_conf.pmk_r0_name =
14359                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14360
14361         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14362 out:
14363         wdev_unlock(wdev);
14364         return ret;
14365 }
14366
14367 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14368 {
14369         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14370         struct net_device *dev = info->user_ptr[1];
14371         struct wireless_dev *wdev = dev->ieee80211_ptr;
14372         const u8 *aa;
14373         int ret;
14374
14375         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14376             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14377                 return -EOPNOTSUPP;
14378
14379         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14380                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14381                 return -EOPNOTSUPP;
14382
14383         if (!info->attrs[NL80211_ATTR_MAC])
14384                 return -EINVAL;
14385
14386         wdev_lock(wdev);
14387         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14388         ret = rdev_del_pmk(rdev, dev, aa);
14389         wdev_unlock(wdev);
14390
14391         return ret;
14392 }
14393
14394 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14395 {
14396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14397         struct net_device *dev = info->user_ptr[1];
14398         struct cfg80211_external_auth_params params;
14399
14400         if (!rdev->ops->external_auth)
14401                 return -EOPNOTSUPP;
14402
14403         if (!info->attrs[NL80211_ATTR_SSID] &&
14404             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14405             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14406                 return -EINVAL;
14407
14408         if (!info->attrs[NL80211_ATTR_BSSID])
14409                 return -EINVAL;
14410
14411         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14412                 return -EINVAL;
14413
14414         memset(&params, 0, sizeof(params));
14415
14416         if (info->attrs[NL80211_ATTR_SSID]) {
14417                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14418                 if (params.ssid.ssid_len == 0)
14419                         return -EINVAL;
14420                 memcpy(params.ssid.ssid,
14421                        nla_data(info->attrs[NL80211_ATTR_SSID]),
14422                        params.ssid.ssid_len);
14423         }
14424
14425         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14426                ETH_ALEN);
14427
14428         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14429
14430         if (info->attrs[NL80211_ATTR_PMKID])
14431                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14432
14433         return rdev_external_auth(rdev, dev, &params);
14434 }
14435
14436 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14437 {
14438         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14439         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14440         struct net_device *dev = info->user_ptr[1];
14441         struct wireless_dev *wdev = dev->ieee80211_ptr;
14442         const u8 *buf;
14443         size_t len;
14444         u8 *dest;
14445         u16 proto;
14446         bool noencrypt;
14447         u64 cookie = 0;
14448         int err;
14449
14450         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14451                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14452                 return -EOPNOTSUPP;
14453
14454         if (!rdev->ops->tx_control_port)
14455                 return -EOPNOTSUPP;
14456
14457         if (!info->attrs[NL80211_ATTR_FRAME] ||
14458             !info->attrs[NL80211_ATTR_MAC] ||
14459             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14460                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14461                 return -EINVAL;
14462         }
14463
14464         wdev_lock(wdev);
14465
14466         switch (wdev->iftype) {
14467         case NL80211_IFTYPE_AP:
14468         case NL80211_IFTYPE_P2P_GO:
14469         case NL80211_IFTYPE_MESH_POINT:
14470                 break;
14471         case NL80211_IFTYPE_ADHOC:
14472         case NL80211_IFTYPE_STATION:
14473         case NL80211_IFTYPE_P2P_CLIENT:
14474                 if (wdev->current_bss)
14475                         break;
14476                 err = -ENOTCONN;
14477                 goto out;
14478         default:
14479                 err = -EOPNOTSUPP;
14480                 goto out;
14481         }
14482
14483         wdev_unlock(wdev);
14484
14485         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14486         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14487         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14488         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
14489         noencrypt =
14490                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
14491
14492         err = rdev_tx_control_port(rdev, dev, buf, len,
14493                                    dest, cpu_to_be16(proto), noencrypt,
14494                                    dont_wait_for_ack ? NULL : &cookie);
14495         if (!err && !dont_wait_for_ack)
14496                 nl_set_extack_cookie_u64(info->extack, cookie);
14497         return err;
14498  out:
14499         wdev_unlock(wdev);
14500         return err;
14501 }
14502
14503 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
14504                                            struct genl_info *info)
14505 {
14506         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14507         struct net_device *dev = info->user_ptr[1];
14508         struct wireless_dev *wdev = dev->ieee80211_ptr;
14509         struct cfg80211_ftm_responder_stats ftm_stats = {};
14510         struct sk_buff *msg;
14511         void *hdr;
14512         struct nlattr *ftm_stats_attr;
14513         int err;
14514
14515         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
14516                 return -EOPNOTSUPP;
14517
14518         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
14519         if (err)
14520                 return err;
14521
14522         if (!ftm_stats.filled)
14523                 return -ENODATA;
14524
14525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14526         if (!msg)
14527                 return -ENOMEM;
14528
14529         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14530                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
14531         if (!hdr)
14532                 goto nla_put_failure;
14533
14534         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14535                 goto nla_put_failure;
14536
14537         ftm_stats_attr = nla_nest_start_noflag(msg,
14538                                                NL80211_ATTR_FTM_RESPONDER_STATS);
14539         if (!ftm_stats_attr)
14540                 goto nla_put_failure;
14541
14542 #define SET_FTM(field, name, type)                                       \
14543         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14544             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
14545                              ftm_stats.field))                           \
14546                 goto nla_put_failure; } while (0)
14547 #define SET_FTM_U64(field, name)                                         \
14548         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14549             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
14550                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
14551                 goto nla_put_failure; } while (0)
14552
14553         SET_FTM(success_num, SUCCESS_NUM, u32);
14554         SET_FTM(partial_num, PARTIAL_NUM, u32);
14555         SET_FTM(failed_num, FAILED_NUM, u32);
14556         SET_FTM(asap_num, ASAP_NUM, u32);
14557         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
14558         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
14559         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
14560         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
14561         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
14562 #undef SET_FTM
14563
14564         nla_nest_end(msg, ftm_stats_attr);
14565
14566         genlmsg_end(msg, hdr);
14567         return genlmsg_reply(msg, info);
14568
14569 nla_put_failure:
14570         nlmsg_free(msg);
14571         return -ENOBUFS;
14572 }
14573
14574 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
14575 {
14576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14577         struct cfg80211_update_owe_info owe_info;
14578         struct net_device *dev = info->user_ptr[1];
14579
14580         if (!rdev->ops->update_owe_info)
14581                 return -EOPNOTSUPP;
14582
14583         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
14584             !info->attrs[NL80211_ATTR_MAC])
14585                 return -EINVAL;
14586
14587         memset(&owe_info, 0, sizeof(owe_info));
14588         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14589         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
14590
14591         if (info->attrs[NL80211_ATTR_IE]) {
14592                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14593                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14594         }
14595
14596         return rdev_update_owe_info(rdev, dev, &owe_info);
14597 }
14598
14599 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
14600 {
14601         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14602         struct net_device *dev = info->user_ptr[1];
14603         struct wireless_dev *wdev = dev->ieee80211_ptr;
14604         struct station_info sinfo = {};
14605         const u8 *buf;
14606         size_t len;
14607         u8 *dest;
14608         int err;
14609
14610         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
14611                 return -EOPNOTSUPP;
14612
14613         if (!info->attrs[NL80211_ATTR_MAC] ||
14614             !info->attrs[NL80211_ATTR_FRAME]) {
14615                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
14616                 return -EINVAL;
14617         }
14618
14619         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
14620                 return -EOPNOTSUPP;
14621
14622         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14623         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14624         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14625
14626         if (len < sizeof(struct ethhdr))
14627                 return -EINVAL;
14628
14629         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
14630             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
14631                 return -EINVAL;
14632
14633         err = rdev_get_station(rdev, dev, dest, &sinfo);
14634         if (err)
14635                 return err;
14636
14637         cfg80211_sinfo_release_content(&sinfo);
14638
14639         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
14640 }
14641
14642 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14643                           struct nlattr *attrs[], struct net_device *dev,
14644                           struct cfg80211_tid_cfg *tid_conf,
14645                           struct genl_info *info, const u8 *peer)
14646 {
14647         struct netlink_ext_ack *extack = info->extack;
14648         u64 mask;
14649         int err;
14650
14651         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14652                 return -EINVAL;
14653
14654         tid_conf->config_override =
14655                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14656         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14657
14658         if (tid_conf->config_override) {
14659                 if (rdev->ops->reset_tid_config) {
14660                         err = rdev_reset_tid_config(rdev, dev, peer,
14661                                                     tid_conf->tids);
14662                         if (err)
14663                                 return err;
14664                 } else {
14665                         return -EINVAL;
14666                 }
14667         }
14668
14669         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14670                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14671                 tid_conf->noack =
14672                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14673         }
14674
14675         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14676                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14677                 tid_conf->retry_short =
14678                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14679
14680                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14681                         return -EINVAL;
14682         }
14683
14684         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14685                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14686                 tid_conf->retry_long =
14687                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14688
14689                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14690                         return -EINVAL;
14691         }
14692
14693         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14694                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14695                 tid_conf->ampdu =
14696                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14697         }
14698
14699         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14700                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14701                 tid_conf->rtscts =
14702                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14703         }
14704
14705         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
14706                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
14707                 tid_conf->amsdu =
14708                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
14709         }
14710
14711         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
14712                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
14713
14714                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
14715
14716                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
14717                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
14718                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
14719                                                     &tid_conf->txrate_mask, dev,
14720                                                     true);
14721                         if (err)
14722                                 return err;
14723
14724                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
14725                 }
14726                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
14727         }
14728
14729         if (peer)
14730                 mask = rdev->wiphy.tid_config_support.peer;
14731         else
14732                 mask = rdev->wiphy.tid_config_support.vif;
14733
14734         if (tid_conf->mask & ~mask) {
14735                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14736                 return -ENOTSUPP;
14737         }
14738
14739         return 0;
14740 }
14741
14742 static int nl80211_set_tid_config(struct sk_buff *skb,
14743                                   struct genl_info *info)
14744 {
14745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14746         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14747         struct net_device *dev = info->user_ptr[1];
14748         struct cfg80211_tid_config *tid_config;
14749         struct nlattr *tid;
14750         int conf_idx = 0, rem_conf;
14751         int ret = -EINVAL;
14752         u32 num_conf = 0;
14753
14754         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14755                 return -EINVAL;
14756
14757         if (!rdev->ops->set_tid_config)
14758                 return -EOPNOTSUPP;
14759
14760         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14761                             rem_conf)
14762                 num_conf++;
14763
14764         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14765                              GFP_KERNEL);
14766         if (!tid_config)
14767                 return -ENOMEM;
14768
14769         tid_config->n_tid_conf = num_conf;
14770
14771         if (info->attrs[NL80211_ATTR_MAC])
14772                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14773
14774         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14775                             rem_conf) {
14776                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14777                                        tid, NULL, NULL);
14778
14779                 if (ret)
14780                         goto bad_tid_conf;
14781
14782                 ret = parse_tid_conf(rdev, attrs, dev,
14783                                      &tid_config->tid_conf[conf_idx],
14784                                      info, tid_config->peer);
14785                 if (ret)
14786                         goto bad_tid_conf;
14787
14788                 conf_idx++;
14789         }
14790
14791         ret = rdev_set_tid_config(rdev, dev, tid_config);
14792
14793 bad_tid_conf:
14794         kfree(tid_config);
14795         return ret;
14796 }
14797
14798 #define NL80211_FLAG_NEED_WIPHY         0x01
14799 #define NL80211_FLAG_NEED_NETDEV        0x02
14800 #define NL80211_FLAG_NEED_RTNL          0x04
14801 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
14802 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
14803                                          NL80211_FLAG_CHECK_NETDEV_UP)
14804 #define NL80211_FLAG_NEED_WDEV          0x10
14805 /* If a netdev is associated, it must be UP, P2P must be started */
14806 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
14807                                          NL80211_FLAG_CHECK_NETDEV_UP)
14808 #define NL80211_FLAG_CLEAR_SKB          0x20
14809 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
14810
14811 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14812                             struct genl_info *info)
14813 {
14814         struct cfg80211_registered_device *rdev = NULL;
14815         struct wireless_dev *wdev;
14816         struct net_device *dev;
14817
14818         rtnl_lock();
14819         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14820                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14821                 if (IS_ERR(rdev)) {
14822                         rtnl_unlock();
14823                         return PTR_ERR(rdev);
14824                 }
14825                 info->user_ptr[0] = rdev;
14826         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14827                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14828                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
14829                                                   info->attrs);
14830                 if (IS_ERR(wdev)) {
14831                         rtnl_unlock();
14832                         return PTR_ERR(wdev);
14833                 }
14834
14835                 dev = wdev->netdev;
14836                 rdev = wiphy_to_rdev(wdev->wiphy);
14837
14838                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14839                         if (!dev) {
14840                                 rtnl_unlock();
14841                                 return -EINVAL;
14842                         }
14843
14844                         info->user_ptr[1] = dev;
14845                 } else {
14846                         info->user_ptr[1] = wdev;
14847                 }
14848
14849                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14850                     !wdev_running(wdev)) {
14851                         rtnl_unlock();
14852                         return -ENETDOWN;
14853                 }
14854
14855                 if (dev)
14856                         dev_hold(dev);
14857
14858                 info->user_ptr[0] = rdev;
14859         }
14860
14861         if (rdev && !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
14862                 wiphy_lock(&rdev->wiphy);
14863                 /* we keep the mutex locked until post_doit */
14864                 __release(&rdev->wiphy.mtx);
14865         }
14866         if (!(ops->internal_flags & NL80211_FLAG_NEED_RTNL))
14867                 rtnl_unlock();
14868
14869         return 0;
14870 }
14871
14872 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
14873                               struct genl_info *info)
14874 {
14875         if (info->user_ptr[1]) {
14876                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14877                         struct wireless_dev *wdev = info->user_ptr[1];
14878
14879                         if (wdev->netdev)
14880                                 dev_put(wdev->netdev);
14881                 } else {
14882                         dev_put(info->user_ptr[1]);
14883                 }
14884         }
14885
14886         if (info->user_ptr[0] &&
14887             !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
14888                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
14889
14890                 /* we kept the mutex locked since pre_doit */
14891                 __acquire(&rdev->wiphy.mtx);
14892                 wiphy_unlock(&rdev->wiphy);
14893         }
14894
14895         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
14896                 rtnl_unlock();
14897
14898         /* If needed, clear the netlink message payload from the SKB
14899          * as it might contain key data that shouldn't stick around on
14900          * the heap after the SKB is freed. The netlink message header
14901          * is still needed for further processing, so leave it intact.
14902          */
14903         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
14904                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
14905
14906                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
14907         }
14908 }
14909
14910 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
14911                                      struct cfg80211_sar_specs *sar_specs,
14912                                      struct nlattr *spec[], int index)
14913 {
14914         u32 range_index, i;
14915
14916         if (!sar_specs || !spec)
14917                 return -EINVAL;
14918
14919         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
14920             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
14921                 return -EINVAL;
14922
14923         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
14924
14925         /* check if range_index exceeds num_freq_ranges */
14926         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
14927                 return -EINVAL;
14928
14929         /* check if range_index duplicates */
14930         for (i = 0; i < index; i++) {
14931                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
14932                         return -EINVAL;
14933         }
14934
14935         sar_specs->sub_specs[index].power =
14936                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
14937
14938         sar_specs->sub_specs[index].freq_range_index = range_index;
14939
14940         return 0;
14941 }
14942
14943 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
14944 {
14945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14946         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
14947         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
14948         struct cfg80211_sar_specs *sar_spec;
14949         enum nl80211_sar_type type;
14950         struct nlattr *spec_list;
14951         u32 specs;
14952         int rem, err;
14953
14954         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
14955                 return -EOPNOTSUPP;
14956
14957         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
14958                 return -EINVAL;
14959
14960         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
14961                          info->attrs[NL80211_ATTR_SAR_SPEC],
14962                          NULL, NULL);
14963
14964         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
14965                 return -EINVAL;
14966
14967         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
14968         if (type != rdev->wiphy.sar_capa->type)
14969                 return -EINVAL;
14970
14971         specs = 0;
14972         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
14973                 specs++;
14974
14975         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
14976                 return -EINVAL;
14977
14978         sar_spec = kzalloc(sizeof(*sar_spec) +
14979                            specs * sizeof(struct cfg80211_sar_sub_specs),
14980                            GFP_KERNEL);
14981         if (!sar_spec)
14982                 return -ENOMEM;
14983
14984         sar_spec->type = type;
14985         specs = 0;
14986         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
14987                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
14988                                  spec_list, NULL, NULL);
14989
14990                 switch (type) {
14991                 case NL80211_SAR_TYPE_POWER:
14992                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
14993                                                       spec, specs)) {
14994                                 err = -EINVAL;
14995                                 goto error;
14996                         }
14997                         break;
14998                 default:
14999                         err = -EINVAL;
15000                         goto error;
15001                 }
15002                 specs++;
15003         }
15004
15005         sar_spec->num_sub_specs = specs;
15006
15007         rdev->cur_cmd_info = info;
15008         err = rdev_set_sar_specs(rdev, sar_spec);
15009         rdev->cur_cmd_info = NULL;
15010 error:
15011         kfree(sar_spec);
15012         return err;
15013 }
15014
15015 static const struct genl_ops nl80211_ops[] = {
15016         {
15017                 .cmd = NL80211_CMD_GET_WIPHY,
15018                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15019                 .doit = nl80211_get_wiphy,
15020                 .dumpit = nl80211_dump_wiphy,
15021                 .done = nl80211_dump_wiphy_done,
15022                 /* can be retrieved by unprivileged users */
15023                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15024         },
15025 };
15026
15027 static const struct genl_small_ops nl80211_small_ops[] = {
15028         {
15029                 .cmd = NL80211_CMD_SET_WIPHY,
15030                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15031                 .doit = nl80211_set_wiphy,
15032                 .flags = GENL_UNS_ADMIN_PERM,
15033         },
15034         {
15035                 .cmd = NL80211_CMD_GET_INTERFACE,
15036                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15037                 .doit = nl80211_get_interface,
15038                 .dumpit = nl80211_dump_interface,
15039                 /* can be retrieved by unprivileged users */
15040                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15041         },
15042         {
15043                 .cmd = NL80211_CMD_SET_INTERFACE,
15044                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15045                 .doit = nl80211_set_interface,
15046                 .flags = GENL_UNS_ADMIN_PERM,
15047                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15048                                   NL80211_FLAG_NEED_RTNL,
15049         },
15050         {
15051                 .cmd = NL80211_CMD_NEW_INTERFACE,
15052                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15053                 .doit = nl80211_new_interface,
15054                 .flags = GENL_UNS_ADMIN_PERM,
15055                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15056                                   NL80211_FLAG_NEED_RTNL |
15057                                   /* we take the wiphy mutex later ourselves */
15058                                   NL80211_FLAG_NO_WIPHY_MTX,
15059         },
15060         {
15061                 .cmd = NL80211_CMD_DEL_INTERFACE,
15062                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15063                 .doit = nl80211_del_interface,
15064                 .flags = GENL_UNS_ADMIN_PERM,
15065                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15066                                   NL80211_FLAG_NEED_RTNL,
15067         },
15068         {
15069                 .cmd = NL80211_CMD_GET_KEY,
15070                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15071                 .doit = nl80211_get_key,
15072                 .flags = GENL_UNS_ADMIN_PERM,
15073                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15074         },
15075         {
15076                 .cmd = NL80211_CMD_SET_KEY,
15077                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15078                 .doit = nl80211_set_key,
15079                 .flags = GENL_UNS_ADMIN_PERM,
15080                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15081                                   NL80211_FLAG_CLEAR_SKB,
15082         },
15083         {
15084                 .cmd = NL80211_CMD_NEW_KEY,
15085                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15086                 .doit = nl80211_new_key,
15087                 .flags = GENL_UNS_ADMIN_PERM,
15088                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15089                                   NL80211_FLAG_CLEAR_SKB,
15090         },
15091         {
15092                 .cmd = NL80211_CMD_DEL_KEY,
15093                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15094                 .doit = nl80211_del_key,
15095                 .flags = GENL_UNS_ADMIN_PERM,
15096                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15097         },
15098         {
15099                 .cmd = NL80211_CMD_SET_BEACON,
15100                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15101                 .flags = GENL_UNS_ADMIN_PERM,
15102                 .doit = nl80211_set_beacon,
15103                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15104         },
15105         {
15106                 .cmd = NL80211_CMD_START_AP,
15107                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15108                 .flags = GENL_UNS_ADMIN_PERM,
15109                 .doit = nl80211_start_ap,
15110                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15111         },
15112         {
15113                 .cmd = NL80211_CMD_STOP_AP,
15114                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15115                 .flags = GENL_UNS_ADMIN_PERM,
15116                 .doit = nl80211_stop_ap,
15117                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15118         },
15119         {
15120                 .cmd = NL80211_CMD_GET_STATION,
15121                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15122                 .doit = nl80211_get_station,
15123                 .dumpit = nl80211_dump_station,
15124                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15125         },
15126         {
15127                 .cmd = NL80211_CMD_SET_STATION,
15128                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15129                 .doit = nl80211_set_station,
15130                 .flags = GENL_UNS_ADMIN_PERM,
15131                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15132         },
15133         {
15134                 .cmd = NL80211_CMD_NEW_STATION,
15135                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15136                 .doit = nl80211_new_station,
15137                 .flags = GENL_UNS_ADMIN_PERM,
15138                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15139         },
15140         {
15141                 .cmd = NL80211_CMD_DEL_STATION,
15142                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15143                 .doit = nl80211_del_station,
15144                 .flags = GENL_UNS_ADMIN_PERM,
15145                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15146         },
15147         {
15148                 .cmd = NL80211_CMD_GET_MPATH,
15149                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15150                 .doit = nl80211_get_mpath,
15151                 .dumpit = nl80211_dump_mpath,
15152                 .flags = GENL_UNS_ADMIN_PERM,
15153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15154         },
15155         {
15156                 .cmd = NL80211_CMD_GET_MPP,
15157                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15158                 .doit = nl80211_get_mpp,
15159                 .dumpit = nl80211_dump_mpp,
15160                 .flags = GENL_UNS_ADMIN_PERM,
15161                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15162         },
15163         {
15164                 .cmd = NL80211_CMD_SET_MPATH,
15165                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15166                 .doit = nl80211_set_mpath,
15167                 .flags = GENL_UNS_ADMIN_PERM,
15168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15169         },
15170         {
15171                 .cmd = NL80211_CMD_NEW_MPATH,
15172                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15173                 .doit = nl80211_new_mpath,
15174                 .flags = GENL_UNS_ADMIN_PERM,
15175                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15176         },
15177         {
15178                 .cmd = NL80211_CMD_DEL_MPATH,
15179                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15180                 .doit = nl80211_del_mpath,
15181                 .flags = GENL_UNS_ADMIN_PERM,
15182                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15183         },
15184         {
15185                 .cmd = NL80211_CMD_SET_BSS,
15186                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15187                 .doit = nl80211_set_bss,
15188                 .flags = GENL_UNS_ADMIN_PERM,
15189                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15190         },
15191         {
15192                 .cmd = NL80211_CMD_GET_REG,
15193                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15194                 .doit = nl80211_get_reg_do,
15195                 .dumpit = nl80211_get_reg_dump,
15196                 .internal_flags = 0,
15197                 /* can be retrieved by unprivileged users */
15198         },
15199 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
15200         {
15201                 .cmd = NL80211_CMD_SET_REG,
15202                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15203                 .doit = nl80211_set_reg,
15204                 .flags = GENL_ADMIN_PERM,
15205                 .internal_flags = 0,
15206         },
15207 #endif
15208         {
15209                 .cmd = NL80211_CMD_REQ_SET_REG,
15210                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15211                 .doit = nl80211_req_set_reg,
15212                 .flags = GENL_ADMIN_PERM,
15213         },
15214         {
15215                 .cmd = NL80211_CMD_RELOAD_REGDB,
15216                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15217                 .doit = nl80211_reload_regdb,
15218                 .flags = GENL_ADMIN_PERM,
15219         },
15220         {
15221                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
15222                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15223                 .doit = nl80211_get_mesh_config,
15224                 /* can be retrieved by unprivileged users */
15225                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15226         },
15227         {
15228                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
15229                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15230                 .doit = nl80211_update_mesh_config,
15231                 .flags = GENL_UNS_ADMIN_PERM,
15232                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15233         },
15234         {
15235                 .cmd = NL80211_CMD_TRIGGER_SCAN,
15236                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15237                 .doit = nl80211_trigger_scan,
15238                 .flags = GENL_UNS_ADMIN_PERM,
15239                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15240         },
15241         {
15242                 .cmd = NL80211_CMD_ABORT_SCAN,
15243                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15244                 .doit = nl80211_abort_scan,
15245                 .flags = GENL_UNS_ADMIN_PERM,
15246                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15247         },
15248         {
15249                 .cmd = NL80211_CMD_GET_SCAN,
15250                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15251                 .dumpit = nl80211_dump_scan,
15252         },
15253         {
15254                 .cmd = NL80211_CMD_START_SCHED_SCAN,
15255                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15256                 .doit = nl80211_start_sched_scan,
15257                 .flags = GENL_UNS_ADMIN_PERM,
15258                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15259         },
15260         {
15261                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
15262                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15263                 .doit = nl80211_stop_sched_scan,
15264                 .flags = GENL_UNS_ADMIN_PERM,
15265                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15266         },
15267         {
15268                 .cmd = NL80211_CMD_AUTHENTICATE,
15269                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15270                 .doit = nl80211_authenticate,
15271                 .flags = GENL_UNS_ADMIN_PERM,
15272                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15273                                   0 |
15274                                   NL80211_FLAG_CLEAR_SKB,
15275         },
15276         {
15277                 .cmd = NL80211_CMD_ASSOCIATE,
15278                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15279                 .doit = nl80211_associate,
15280                 .flags = GENL_UNS_ADMIN_PERM,
15281                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15282                                   0 |
15283                                   NL80211_FLAG_CLEAR_SKB,
15284         },
15285         {
15286                 .cmd = NL80211_CMD_DEAUTHENTICATE,
15287                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15288                 .doit = nl80211_deauthenticate,
15289                 .flags = GENL_UNS_ADMIN_PERM,
15290                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15291         },
15292         {
15293                 .cmd = NL80211_CMD_DISASSOCIATE,
15294                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15295                 .doit = nl80211_disassociate,
15296                 .flags = GENL_UNS_ADMIN_PERM,
15297                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15298         },
15299         {
15300                 .cmd = NL80211_CMD_JOIN_IBSS,
15301                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15302                 .doit = nl80211_join_ibss,
15303                 .flags = GENL_UNS_ADMIN_PERM,
15304                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15305         },
15306         {
15307                 .cmd = NL80211_CMD_LEAVE_IBSS,
15308                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15309                 .doit = nl80211_leave_ibss,
15310                 .flags = GENL_UNS_ADMIN_PERM,
15311                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15312         },
15313 #ifdef CONFIG_NL80211_TESTMODE
15314         {
15315                 .cmd = NL80211_CMD_TESTMODE,
15316                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15317                 .doit = nl80211_testmode_do,
15318                 .dumpit = nl80211_testmode_dump,
15319                 .flags = GENL_UNS_ADMIN_PERM,
15320                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15321         },
15322 #endif
15323         {
15324                 .cmd = NL80211_CMD_CONNECT,
15325                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15326                 .doit = nl80211_connect,
15327                 .flags = GENL_UNS_ADMIN_PERM,
15328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15329                                   0 |
15330                                   NL80211_FLAG_CLEAR_SKB,
15331         },
15332         {
15333                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
15334                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15335                 .doit = nl80211_update_connect_params,
15336                 .flags = GENL_ADMIN_PERM,
15337                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15338                                   0 |
15339                                   NL80211_FLAG_CLEAR_SKB,
15340         },
15341         {
15342                 .cmd = NL80211_CMD_DISCONNECT,
15343                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15344                 .doit = nl80211_disconnect,
15345                 .flags = GENL_UNS_ADMIN_PERM,
15346                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15347         },
15348         {
15349                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
15350                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15351                 .doit = nl80211_wiphy_netns,
15352                 .flags = GENL_UNS_ADMIN_PERM,
15353                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15354                                   NL80211_FLAG_NEED_RTNL |
15355                                   NL80211_FLAG_NO_WIPHY_MTX,
15356         },
15357         {
15358                 .cmd = NL80211_CMD_GET_SURVEY,
15359                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15360                 .dumpit = nl80211_dump_survey,
15361         },
15362         {
15363                 .cmd = NL80211_CMD_SET_PMKSA,
15364                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15365                 .doit = nl80211_setdel_pmksa,
15366                 .flags = GENL_UNS_ADMIN_PERM,
15367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15368                                   0 |
15369                                   NL80211_FLAG_CLEAR_SKB,
15370         },
15371         {
15372                 .cmd = NL80211_CMD_DEL_PMKSA,
15373                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15374                 .doit = nl80211_setdel_pmksa,
15375                 .flags = GENL_UNS_ADMIN_PERM,
15376                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15377         },
15378         {
15379                 .cmd = NL80211_CMD_FLUSH_PMKSA,
15380                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15381                 .doit = nl80211_flush_pmksa,
15382                 .flags = GENL_UNS_ADMIN_PERM,
15383                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15384         },
15385         {
15386                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
15387                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15388                 .doit = nl80211_remain_on_channel,
15389                 .flags = GENL_UNS_ADMIN_PERM,
15390                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15391         },
15392         {
15393                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15394                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15395                 .doit = nl80211_cancel_remain_on_channel,
15396                 .flags = GENL_UNS_ADMIN_PERM,
15397                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15398         },
15399         {
15400                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
15401                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15402                 .doit = nl80211_set_tx_bitrate_mask,
15403                 .flags = GENL_UNS_ADMIN_PERM,
15404                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15405         },
15406         {
15407                 .cmd = NL80211_CMD_REGISTER_FRAME,
15408                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15409                 .doit = nl80211_register_mgmt,
15410                 .flags = GENL_UNS_ADMIN_PERM,
15411                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15412         },
15413         {
15414                 .cmd = NL80211_CMD_FRAME,
15415                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15416                 .doit = nl80211_tx_mgmt,
15417                 .flags = GENL_UNS_ADMIN_PERM,
15418                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15419         },
15420         {
15421                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
15422                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15423                 .doit = nl80211_tx_mgmt_cancel_wait,
15424                 .flags = GENL_UNS_ADMIN_PERM,
15425                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15426         },
15427         {
15428                 .cmd = NL80211_CMD_SET_POWER_SAVE,
15429                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15430                 .doit = nl80211_set_power_save,
15431                 .flags = GENL_UNS_ADMIN_PERM,
15432                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15433         },
15434         {
15435                 .cmd = NL80211_CMD_GET_POWER_SAVE,
15436                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15437                 .doit = nl80211_get_power_save,
15438                 /* can be retrieved by unprivileged users */
15439                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15440         },
15441         {
15442                 .cmd = NL80211_CMD_SET_CQM,
15443                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15444                 .doit = nl80211_set_cqm,
15445                 .flags = GENL_UNS_ADMIN_PERM,
15446                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15447         },
15448         {
15449                 .cmd = NL80211_CMD_SET_CHANNEL,
15450                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15451                 .doit = nl80211_set_channel,
15452                 .flags = GENL_UNS_ADMIN_PERM,
15453                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15454         },
15455         {
15456                 .cmd = NL80211_CMD_JOIN_MESH,
15457                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15458                 .doit = nl80211_join_mesh,
15459                 .flags = GENL_UNS_ADMIN_PERM,
15460                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15461         },
15462         {
15463                 .cmd = NL80211_CMD_LEAVE_MESH,
15464                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15465                 .doit = nl80211_leave_mesh,
15466                 .flags = GENL_UNS_ADMIN_PERM,
15467                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15468         },
15469         {
15470                 .cmd = NL80211_CMD_JOIN_OCB,
15471                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15472                 .doit = nl80211_join_ocb,
15473                 .flags = GENL_UNS_ADMIN_PERM,
15474                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15475         },
15476         {
15477                 .cmd = NL80211_CMD_LEAVE_OCB,
15478                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15479                 .doit = nl80211_leave_ocb,
15480                 .flags = GENL_UNS_ADMIN_PERM,
15481                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15482         },
15483 #ifdef CONFIG_PM
15484         {
15485                 .cmd = NL80211_CMD_GET_WOWLAN,
15486                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15487                 .doit = nl80211_get_wowlan,
15488                 /* can be retrieved by unprivileged users */
15489                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15490         },
15491         {
15492                 .cmd = NL80211_CMD_SET_WOWLAN,
15493                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15494                 .doit = nl80211_set_wowlan,
15495                 .flags = GENL_UNS_ADMIN_PERM,
15496                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15497         },
15498 #endif
15499         {
15500                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
15501                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15502                 .doit = nl80211_set_rekey_data,
15503                 .flags = GENL_UNS_ADMIN_PERM,
15504                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15505                                   0 |
15506                                   NL80211_FLAG_CLEAR_SKB,
15507         },
15508         {
15509                 .cmd = NL80211_CMD_TDLS_MGMT,
15510                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15511                 .doit = nl80211_tdls_mgmt,
15512                 .flags = GENL_UNS_ADMIN_PERM,
15513                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15514         },
15515         {
15516                 .cmd = NL80211_CMD_TDLS_OPER,
15517                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15518                 .doit = nl80211_tdls_oper,
15519                 .flags = GENL_UNS_ADMIN_PERM,
15520                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15521         },
15522         {
15523                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
15524                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15525                 .doit = nl80211_register_unexpected_frame,
15526                 .flags = GENL_UNS_ADMIN_PERM,
15527                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15528         },
15529         {
15530                 .cmd = NL80211_CMD_PROBE_CLIENT,
15531                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15532                 .doit = nl80211_probe_client,
15533                 .flags = GENL_UNS_ADMIN_PERM,
15534                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15535         },
15536         {
15537                 .cmd = NL80211_CMD_REGISTER_BEACONS,
15538                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15539                 .doit = nl80211_register_beacons,
15540                 .flags = GENL_UNS_ADMIN_PERM,
15541                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15542         },
15543         {
15544                 .cmd = NL80211_CMD_SET_NOACK_MAP,
15545                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15546                 .doit = nl80211_set_noack_map,
15547                 .flags = GENL_UNS_ADMIN_PERM,
15548                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15549         },
15550         {
15551                 .cmd = NL80211_CMD_START_P2P_DEVICE,
15552                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15553                 .doit = nl80211_start_p2p_device,
15554                 .flags = GENL_UNS_ADMIN_PERM,
15555                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15556                                   NL80211_FLAG_NEED_RTNL,
15557         },
15558         {
15559                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
15560                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15561                 .doit = nl80211_stop_p2p_device,
15562                 .flags = GENL_UNS_ADMIN_PERM,
15563                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15564                                   NL80211_FLAG_NEED_RTNL,
15565         },
15566         {
15567                 .cmd = NL80211_CMD_START_NAN,
15568                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15569                 .doit = nl80211_start_nan,
15570                 .flags = GENL_ADMIN_PERM,
15571                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15572                                   NL80211_FLAG_NEED_RTNL,
15573         },
15574         {
15575                 .cmd = NL80211_CMD_STOP_NAN,
15576                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15577                 .doit = nl80211_stop_nan,
15578                 .flags = GENL_ADMIN_PERM,
15579                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15580                                   NL80211_FLAG_NEED_RTNL,
15581         },
15582         {
15583                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
15584                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15585                 .doit = nl80211_nan_add_func,
15586                 .flags = GENL_ADMIN_PERM,
15587                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15588         },
15589         {
15590                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
15591                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15592                 .doit = nl80211_nan_del_func,
15593                 .flags = GENL_ADMIN_PERM,
15594                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15595         },
15596         {
15597                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
15598                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15599                 .doit = nl80211_nan_change_config,
15600                 .flags = GENL_ADMIN_PERM,
15601                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15602         },
15603         {
15604                 .cmd = NL80211_CMD_SET_MCAST_RATE,
15605                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15606                 .doit = nl80211_set_mcast_rate,
15607                 .flags = GENL_UNS_ADMIN_PERM,
15608                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15609         },
15610         {
15611                 .cmd = NL80211_CMD_SET_MAC_ACL,
15612                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15613                 .doit = nl80211_set_mac_acl,
15614                 .flags = GENL_UNS_ADMIN_PERM,
15615                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15616         },
15617         {
15618                 .cmd = NL80211_CMD_RADAR_DETECT,
15619                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15620                 .doit = nl80211_start_radar_detection,
15621                 .flags = GENL_UNS_ADMIN_PERM,
15622                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15623         },
15624         {
15625                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
15626                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15627                 .doit = nl80211_get_protocol_features,
15628         },
15629         {
15630                 .cmd = NL80211_CMD_UPDATE_FT_IES,
15631                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15632                 .doit = nl80211_update_ft_ies,
15633                 .flags = GENL_UNS_ADMIN_PERM,
15634                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15635         },
15636         {
15637                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
15638                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15639                 .doit = nl80211_crit_protocol_start,
15640                 .flags = GENL_UNS_ADMIN_PERM,
15641                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15642         },
15643         {
15644                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
15645                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15646                 .doit = nl80211_crit_protocol_stop,
15647                 .flags = GENL_UNS_ADMIN_PERM,
15648                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15649         },
15650         {
15651                 .cmd = NL80211_CMD_GET_COALESCE,
15652                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15653                 .doit = nl80211_get_coalesce,
15654                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15655         },
15656         {
15657                 .cmd = NL80211_CMD_SET_COALESCE,
15658                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15659                 .doit = nl80211_set_coalesce,
15660                 .flags = GENL_UNS_ADMIN_PERM,
15661                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15662         },
15663         {
15664                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
15665                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15666                 .doit = nl80211_channel_switch,
15667                 .flags = GENL_UNS_ADMIN_PERM,
15668                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15669         },
15670         {
15671                 .cmd = NL80211_CMD_VENDOR,
15672                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15673                 .doit = nl80211_vendor_cmd,
15674                 .dumpit = nl80211_vendor_cmd_dump,
15675                 .flags = GENL_UNS_ADMIN_PERM,
15676                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15677                                   0 |
15678                                   NL80211_FLAG_CLEAR_SKB,
15679         },
15680         {
15681                 .cmd = NL80211_CMD_SET_QOS_MAP,
15682                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15683                 .doit = nl80211_set_qos_map,
15684                 .flags = GENL_UNS_ADMIN_PERM,
15685                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15686         },
15687         {
15688                 .cmd = NL80211_CMD_ADD_TX_TS,
15689                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15690                 .doit = nl80211_add_tx_ts,
15691                 .flags = GENL_UNS_ADMIN_PERM,
15692                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15693         },
15694         {
15695                 .cmd = NL80211_CMD_DEL_TX_TS,
15696                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15697                 .doit = nl80211_del_tx_ts,
15698                 .flags = GENL_UNS_ADMIN_PERM,
15699                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15700         },
15701         {
15702                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15703                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15704                 .doit = nl80211_tdls_channel_switch,
15705                 .flags = GENL_UNS_ADMIN_PERM,
15706                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15707         },
15708         {
15709                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15710                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15711                 .doit = nl80211_tdls_cancel_channel_switch,
15712                 .flags = GENL_UNS_ADMIN_PERM,
15713                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15714         },
15715         {
15716                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15717                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15718                 .doit = nl80211_set_multicast_to_unicast,
15719                 .flags = GENL_UNS_ADMIN_PERM,
15720                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15721         },
15722         {
15723                 .cmd = NL80211_CMD_SET_PMK,
15724                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15725                 .doit = nl80211_set_pmk,
15726                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15727                                   0 |
15728                                   NL80211_FLAG_CLEAR_SKB,
15729         },
15730         {
15731                 .cmd = NL80211_CMD_DEL_PMK,
15732                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15733                 .doit = nl80211_del_pmk,
15734                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15735         },
15736         {
15737                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
15738                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15739                 .doit = nl80211_external_auth,
15740                 .flags = GENL_ADMIN_PERM,
15741                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15742         },
15743         {
15744                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15745                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15746                 .doit = nl80211_tx_control_port,
15747                 .flags = GENL_UNS_ADMIN_PERM,
15748                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15749         },
15750         {
15751                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15752                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15753                 .doit = nl80211_get_ftm_responder_stats,
15754                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15755         },
15756         {
15757                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15758                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15759                 .doit = nl80211_pmsr_start,
15760                 .flags = GENL_UNS_ADMIN_PERM,
15761                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15762         },
15763         {
15764                 .cmd = NL80211_CMD_NOTIFY_RADAR,
15765                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15766                 .doit = nl80211_notify_radar_detection,
15767                 .flags = GENL_UNS_ADMIN_PERM,
15768                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15769         },
15770         {
15771                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
15772                 .doit = nl80211_update_owe_info,
15773                 .flags = GENL_ADMIN_PERM,
15774                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15775         },
15776         {
15777                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
15778                 .doit = nl80211_probe_mesh_link,
15779                 .flags = GENL_UNS_ADMIN_PERM,
15780                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15781         },
15782         {
15783                 .cmd = NL80211_CMD_SET_TID_CONFIG,
15784                 .doit = nl80211_set_tid_config,
15785                 .flags = GENL_UNS_ADMIN_PERM,
15786                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15787         },
15788         {
15789                 .cmd = NL80211_CMD_SET_SAR_SPECS,
15790                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15791                 .doit = nl80211_set_sar_specs,
15792                 .flags = GENL_UNS_ADMIN_PERM,
15793                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15794                                   NL80211_FLAG_NEED_RTNL,
15795         },
15796 };
15797
15798 static struct genl_family nl80211_fam __ro_after_init = {
15799         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
15800         .hdrsize = 0,                   /* no private header */
15801         .version = 1,                   /* no particular meaning now */
15802         .maxattr = NL80211_ATTR_MAX,
15803         .policy = nl80211_policy,
15804         .netnsok = true,
15805         .pre_doit = nl80211_pre_doit,
15806         .post_doit = nl80211_post_doit,
15807         .module = THIS_MODULE,
15808         .ops = nl80211_ops,
15809         .n_ops = ARRAY_SIZE(nl80211_ops),
15810         .small_ops = nl80211_small_ops,
15811         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
15812         .mcgrps = nl80211_mcgrps,
15813         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15814         .parallel_ops = true,
15815 };
15816
15817 /* notification functions */
15818
15819 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15820                           enum nl80211_commands cmd)
15821 {
15822         struct sk_buff *msg;
15823         struct nl80211_dump_wiphy_state state = {};
15824
15825         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15826                 cmd != NL80211_CMD_DEL_WIPHY);
15827
15828         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15829         if (!msg)
15830                 return;
15831
15832         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15833                 nlmsg_free(msg);
15834                 return;
15835         }
15836
15837         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15838                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15839 }
15840
15841 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15842                                 struct wireless_dev *wdev,
15843                                 enum nl80211_commands cmd)
15844 {
15845         struct sk_buff *msg;
15846
15847         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15848         if (!msg)
15849                 return;
15850
15851         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15852                 nlmsg_free(msg);
15853                 return;
15854         }
15855
15856         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15857                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15858 }
15859
15860 static int nl80211_add_scan_req(struct sk_buff *msg,
15861                                 struct cfg80211_registered_device *rdev)
15862 {
15863         struct cfg80211_scan_request *req = rdev->scan_req;
15864         struct nlattr *nest;
15865         int i;
15866         struct cfg80211_scan_info *info;
15867
15868         if (WARN_ON(!req))
15869                 return 0;
15870
15871         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
15872         if (!nest)
15873                 goto nla_put_failure;
15874         for (i = 0; i < req->n_ssids; i++) {
15875                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
15876                         goto nla_put_failure;
15877         }
15878         nla_nest_end(msg, nest);
15879
15880         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
15881                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
15882                 if (!nest)
15883                         goto nla_put_failure;
15884                 for (i = 0; i < req->n_channels; i++) {
15885                         if (nla_put_u32(msg, i,
15886                                    ieee80211_channel_to_khz(req->channels[i])))
15887                                 goto nla_put_failure;
15888                 }
15889                 nla_nest_end(msg, nest);
15890         } else {
15891                 nest = nla_nest_start_noflag(msg,
15892                                              NL80211_ATTR_SCAN_FREQUENCIES);
15893                 if (!nest)
15894                         goto nla_put_failure;
15895                 for (i = 0; i < req->n_channels; i++) {
15896                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
15897                                 goto nla_put_failure;
15898                 }
15899                 nla_nest_end(msg, nest);
15900         }
15901
15902         if (req->ie &&
15903             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
15904                 goto nla_put_failure;
15905
15906         if (req->flags &&
15907             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
15908                 goto nla_put_failure;
15909
15910         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
15911                 &rdev->scan_req->info;
15912         if (info->scan_start_tsf &&
15913             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
15914                                info->scan_start_tsf, NL80211_BSS_PAD) ||
15915              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
15916                      info->tsf_bssid)))
15917                 goto nla_put_failure;
15918
15919         return 0;
15920  nla_put_failure:
15921         return -ENOBUFS;
15922 }
15923
15924 static int nl80211_prep_scan_msg(struct sk_buff *msg,
15925                                  struct cfg80211_registered_device *rdev,
15926                                  struct wireless_dev *wdev,
15927                                  u32 portid, u32 seq, int flags,
15928                                  u32 cmd)
15929 {
15930         void *hdr;
15931
15932         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
15933         if (!hdr)
15934                 return -1;
15935
15936         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15937             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15938                                          wdev->netdev->ifindex)) ||
15939             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15940                               NL80211_ATTR_PAD))
15941                 goto nla_put_failure;
15942
15943         /* ignore errors and send incomplete event anyway */
15944         nl80211_add_scan_req(msg, rdev);
15945
15946         genlmsg_end(msg, hdr);
15947         return 0;
15948
15949  nla_put_failure:
15950         genlmsg_cancel(msg, hdr);
15951         return -EMSGSIZE;
15952 }
15953
15954 static int
15955 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
15956                             struct cfg80211_sched_scan_request *req, u32 cmd)
15957 {
15958         void *hdr;
15959
15960         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
15961         if (!hdr)
15962                 return -1;
15963
15964         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
15965                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
15966             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
15967             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
15968                               NL80211_ATTR_PAD))
15969                 goto nla_put_failure;
15970
15971         genlmsg_end(msg, hdr);
15972         return 0;
15973
15974  nla_put_failure:
15975         genlmsg_cancel(msg, hdr);
15976         return -EMSGSIZE;
15977 }
15978
15979 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
15980                              struct wireless_dev *wdev)
15981 {
15982         struct sk_buff *msg;
15983
15984         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15985         if (!msg)
15986                 return;
15987
15988         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
15989                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
15990                 nlmsg_free(msg);
15991                 return;
15992         }
15993
15994         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15995                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
15996 }
15997
15998 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
15999                                        struct wireless_dev *wdev, bool aborted)
16000 {
16001         struct sk_buff *msg;
16002
16003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16004         if (!msg)
16005                 return NULL;
16006
16007         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
16008                                   aborted ? NL80211_CMD_SCAN_ABORTED :
16009                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
16010                 nlmsg_free(msg);
16011                 return NULL;
16012         }
16013
16014         return msg;
16015 }
16016
16017 /* send message created by nl80211_build_scan_msg() */
16018 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
16019                            struct sk_buff *msg)
16020 {
16021         if (!msg)
16022                 return;
16023
16024         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16025                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16026 }
16027
16028 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
16029 {
16030         struct sk_buff *msg;
16031
16032         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16033         if (!msg)
16034                 return;
16035
16036         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
16037                 nlmsg_free(msg);
16038                 return;
16039         }
16040
16041         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
16042                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16043 }
16044
16045 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
16046                                           struct regulatory_request *request)
16047 {
16048         /* Userspace can always count this one always being set */
16049         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
16050                 goto nla_put_failure;
16051
16052         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
16053                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16054                                NL80211_REGDOM_TYPE_WORLD))
16055                         goto nla_put_failure;
16056         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
16057                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16058                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
16059                         goto nla_put_failure;
16060         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
16061                    request->intersect) {
16062                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16063                                NL80211_REGDOM_TYPE_INTERSECTION))
16064                         goto nla_put_failure;
16065         } else {
16066                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16067                                NL80211_REGDOM_TYPE_COUNTRY) ||
16068                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
16069                                    request->alpha2))
16070                         goto nla_put_failure;
16071         }
16072
16073         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
16074                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
16075
16076                 if (wiphy &&
16077                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
16078                         goto nla_put_failure;
16079
16080                 if (wiphy &&
16081                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
16082                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
16083                         goto nla_put_failure;
16084         }
16085
16086         return true;
16087
16088 nla_put_failure:
16089         return false;
16090 }
16091
16092 /*
16093  * This can happen on global regulatory changes or device specific settings
16094  * based on custom regulatory domains.
16095  */
16096 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
16097                                      struct regulatory_request *request)
16098 {
16099         struct sk_buff *msg;
16100         void *hdr;
16101
16102         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16103         if (!msg)
16104                 return;
16105
16106         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
16107         if (!hdr)
16108                 goto nla_put_failure;
16109
16110         if (!nl80211_reg_change_event_fill(msg, request))
16111                 goto nla_put_failure;
16112
16113         genlmsg_end(msg, hdr);
16114
16115         rcu_read_lock();
16116         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16117                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16118         rcu_read_unlock();
16119
16120         return;
16121
16122 nla_put_failure:
16123         nlmsg_free(msg);
16124 }
16125
16126 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
16127                                     struct net_device *netdev,
16128                                     const u8 *buf, size_t len,
16129                                     enum nl80211_commands cmd, gfp_t gfp,
16130                                     int uapsd_queues, const u8 *req_ies,
16131                                     size_t req_ies_len, bool reconnect)
16132 {
16133         struct sk_buff *msg;
16134         void *hdr;
16135
16136         msg = nlmsg_new(100 + len + req_ies_len, gfp);
16137         if (!msg)
16138                 return;
16139
16140         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16141         if (!hdr) {
16142                 nlmsg_free(msg);
16143                 return;
16144         }
16145
16146         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16147             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16148             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16149             (req_ies &&
16150              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
16151                 goto nla_put_failure;
16152
16153         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
16154                 goto nla_put_failure;
16155
16156         if (uapsd_queues >= 0) {
16157                 struct nlattr *nla_wmm =
16158                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
16159                 if (!nla_wmm)
16160                         goto nla_put_failure;
16161
16162                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
16163                                uapsd_queues))
16164                         goto nla_put_failure;
16165
16166                 nla_nest_end(msg, nla_wmm);
16167         }
16168
16169         genlmsg_end(msg, hdr);
16170
16171         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16172                                 NL80211_MCGRP_MLME, gfp);
16173         return;
16174
16175  nla_put_failure:
16176         nlmsg_free(msg);
16177 }
16178
16179 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
16180                           struct net_device *netdev, const u8 *buf,
16181                           size_t len, gfp_t gfp)
16182 {
16183         nl80211_send_mlme_event(rdev, netdev, buf, len,
16184                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
16185                                 false);
16186 }
16187
16188 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
16189                            struct net_device *netdev, const u8 *buf,
16190                            size_t len, gfp_t gfp, int uapsd_queues,
16191                            const u8 *req_ies, size_t req_ies_len)
16192 {
16193         nl80211_send_mlme_event(rdev, netdev, buf, len,
16194                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
16195                                 req_ies, req_ies_len, false);
16196 }
16197
16198 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
16199                          struct net_device *netdev, const u8 *buf,
16200                          size_t len, bool reconnect, gfp_t gfp)
16201 {
16202         nl80211_send_mlme_event(rdev, netdev, buf, len,
16203                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
16204                                 reconnect);
16205 }
16206
16207 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
16208                            struct net_device *netdev, const u8 *buf,
16209                            size_t len, bool reconnect, gfp_t gfp)
16210 {
16211         nl80211_send_mlme_event(rdev, netdev, buf, len,
16212                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
16213                                 reconnect);
16214 }
16215
16216 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
16217                                   size_t len)
16218 {
16219         struct wireless_dev *wdev = dev->ieee80211_ptr;
16220         struct wiphy *wiphy = wdev->wiphy;
16221         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16222         const struct ieee80211_mgmt *mgmt = (void *)buf;
16223         u32 cmd;
16224
16225         if (WARN_ON(len < 2))
16226                 return;
16227
16228         if (ieee80211_is_deauth(mgmt->frame_control)) {
16229                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
16230         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
16231                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
16232         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
16233                 if (wdev->unprot_beacon_reported &&
16234                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
16235                         return;
16236                 cmd = NL80211_CMD_UNPROT_BEACON;
16237                 wdev->unprot_beacon_reported = jiffies;
16238         } else {
16239                 return;
16240         }
16241
16242         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
16243         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
16244                                 NULL, 0, false);
16245 }
16246 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
16247
16248 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
16249                                       struct net_device *netdev, int cmd,
16250                                       const u8 *addr, gfp_t gfp)
16251 {
16252         struct sk_buff *msg;
16253         void *hdr;
16254
16255         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16256         if (!msg)
16257                 return;
16258
16259         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16260         if (!hdr) {
16261                 nlmsg_free(msg);
16262                 return;
16263         }
16264
16265         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16266             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16267             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16268             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16269                 goto nla_put_failure;
16270
16271         genlmsg_end(msg, hdr);
16272
16273         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16274                                 NL80211_MCGRP_MLME, gfp);
16275         return;
16276
16277  nla_put_failure:
16278         nlmsg_free(msg);
16279 }
16280
16281 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
16282                                struct net_device *netdev, const u8 *addr,
16283                                gfp_t gfp)
16284 {
16285         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
16286                                   addr, gfp);
16287 }
16288
16289 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
16290                                 struct net_device *netdev, const u8 *addr,
16291                                 gfp_t gfp)
16292 {
16293         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
16294                                   addr, gfp);
16295 }
16296
16297 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
16298                                  struct net_device *netdev,
16299                                  struct cfg80211_connect_resp_params *cr,
16300                                  gfp_t gfp)
16301 {
16302         struct sk_buff *msg;
16303         void *hdr;
16304
16305         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
16306                         cr->fils.kek_len + cr->fils.pmk_len +
16307                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16308         if (!msg)
16309                 return;
16310
16311         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
16312         if (!hdr) {
16313                 nlmsg_free(msg);
16314                 return;
16315         }
16316
16317         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16318             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16319             (cr->bssid &&
16320              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
16321             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
16322                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
16323                         cr->status) ||
16324             (cr->status < 0 &&
16325              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16326               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
16327                           cr->timeout_reason))) ||
16328             (cr->req_ie &&
16329              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
16330             (cr->resp_ie &&
16331              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
16332                      cr->resp_ie)) ||
16333             (cr->fils.update_erp_next_seq_num &&
16334              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16335                          cr->fils.erp_next_seq_num)) ||
16336             (cr->status == WLAN_STATUS_SUCCESS &&
16337              ((cr->fils.kek &&
16338                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
16339                        cr->fils.kek)) ||
16340               (cr->fils.pmk &&
16341                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
16342               (cr->fils.pmkid &&
16343                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
16344                 goto nla_put_failure;
16345
16346         genlmsg_end(msg, hdr);
16347
16348         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16349                                 NL80211_MCGRP_MLME, gfp);
16350         return;
16351
16352  nla_put_failure:
16353         nlmsg_free(msg);
16354 }
16355
16356 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
16357                          struct net_device *netdev,
16358                          struct cfg80211_roam_info *info, gfp_t gfp)
16359 {
16360         struct sk_buff *msg;
16361         void *hdr;
16362         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
16363
16364         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
16365                         info->fils.kek_len + info->fils.pmk_len +
16366                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16367         if (!msg)
16368                 return;
16369
16370         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
16371         if (!hdr) {
16372                 nlmsg_free(msg);
16373                 return;
16374         }
16375
16376         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16377             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16378             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
16379             (info->req_ie &&
16380              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
16381                      info->req_ie)) ||
16382             (info->resp_ie &&
16383              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
16384                      info->resp_ie)) ||
16385             (info->fils.update_erp_next_seq_num &&
16386              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16387                          info->fils.erp_next_seq_num)) ||
16388             (info->fils.kek &&
16389              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
16390                      info->fils.kek)) ||
16391             (info->fils.pmk &&
16392              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
16393             (info->fils.pmkid &&
16394              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
16395                 goto nla_put_failure;
16396
16397         genlmsg_end(msg, hdr);
16398
16399         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16400                                 NL80211_MCGRP_MLME, gfp);
16401         return;
16402
16403  nla_put_failure:
16404         nlmsg_free(msg);
16405 }
16406
16407 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
16408                                   struct net_device *netdev, const u8 *bssid)
16409 {
16410         struct sk_buff *msg;
16411         void *hdr;
16412
16413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16414         if (!msg)
16415                 return;
16416
16417         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
16418         if (!hdr) {
16419                 nlmsg_free(msg);
16420                 return;
16421         }
16422
16423         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16424             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16425             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16426                 goto nla_put_failure;
16427
16428         genlmsg_end(msg, hdr);
16429
16430         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16431                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16432         return;
16433
16434  nla_put_failure:
16435         nlmsg_free(msg);
16436 }
16437
16438 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
16439                                struct net_device *netdev, u16 reason,
16440                                const u8 *ie, size_t ie_len, bool from_ap)
16441 {
16442         struct sk_buff *msg;
16443         void *hdr;
16444
16445         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
16446         if (!msg)
16447                 return;
16448
16449         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
16450         if (!hdr) {
16451                 nlmsg_free(msg);
16452                 return;
16453         }
16454
16455         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16456             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16457             (reason &&
16458              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
16459             (from_ap &&
16460              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
16461             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
16462                 goto nla_put_failure;
16463
16464         genlmsg_end(msg, hdr);
16465
16466         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16467                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16468         return;
16469
16470  nla_put_failure:
16471         nlmsg_free(msg);
16472 }
16473
16474 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
16475                              struct net_device *netdev, const u8 *bssid,
16476                              gfp_t gfp)
16477 {
16478         struct sk_buff *msg;
16479         void *hdr;
16480
16481         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16482         if (!msg)
16483                 return;
16484
16485         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
16486         if (!hdr) {
16487                 nlmsg_free(msg);
16488                 return;
16489         }
16490
16491         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16492             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16493             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16494                 goto nla_put_failure;
16495
16496         genlmsg_end(msg, hdr);
16497
16498         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16499                                 NL80211_MCGRP_MLME, gfp);
16500         return;
16501
16502  nla_put_failure:
16503         nlmsg_free(msg);
16504 }
16505
16506 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
16507                                         const u8 *ie, u8 ie_len,
16508                                         int sig_dbm, gfp_t gfp)
16509 {
16510         struct wireless_dev *wdev = dev->ieee80211_ptr;
16511         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16512         struct sk_buff *msg;
16513         void *hdr;
16514
16515         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
16516                 return;
16517
16518         trace_cfg80211_notify_new_peer_candidate(dev, addr);
16519
16520         msg = nlmsg_new(100 + ie_len, gfp);
16521         if (!msg)
16522                 return;
16523
16524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
16525         if (!hdr) {
16526                 nlmsg_free(msg);
16527                 return;
16528         }
16529
16530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16531             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16532             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16533             (ie_len && ie &&
16534              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
16535             (sig_dbm &&
16536              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
16537                 goto nla_put_failure;
16538
16539         genlmsg_end(msg, hdr);
16540
16541         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16542                                 NL80211_MCGRP_MLME, gfp);
16543         return;
16544
16545  nla_put_failure:
16546         nlmsg_free(msg);
16547 }
16548 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
16549
16550 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
16551                                  struct net_device *netdev, const u8 *addr,
16552                                  enum nl80211_key_type key_type, int key_id,
16553                                  const u8 *tsc, gfp_t gfp)
16554 {
16555         struct sk_buff *msg;
16556         void *hdr;
16557
16558         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16559         if (!msg)
16560                 return;
16561
16562         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
16563         if (!hdr) {
16564                 nlmsg_free(msg);
16565                 return;
16566         }
16567
16568         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16569             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16570             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
16571             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
16572             (key_id != -1 &&
16573              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
16574             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
16575                 goto nla_put_failure;
16576
16577         genlmsg_end(msg, hdr);
16578
16579         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16580                                 NL80211_MCGRP_MLME, gfp);
16581         return;
16582
16583  nla_put_failure:
16584         nlmsg_free(msg);
16585 }
16586
16587 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
16588                                     struct ieee80211_channel *channel_before,
16589                                     struct ieee80211_channel *channel_after)
16590 {
16591         struct sk_buff *msg;
16592         void *hdr;
16593         struct nlattr *nl_freq;
16594
16595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
16596         if (!msg)
16597                 return;
16598
16599         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
16600         if (!hdr) {
16601                 nlmsg_free(msg);
16602                 return;
16603         }
16604
16605         /*
16606          * Since we are applying the beacon hint to a wiphy we know its
16607          * wiphy_idx is valid
16608          */
16609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
16610                 goto nla_put_failure;
16611
16612         /* Before */
16613         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
16614         if (!nl_freq)
16615                 goto nla_put_failure;
16616
16617         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
16618                 goto nla_put_failure;
16619         nla_nest_end(msg, nl_freq);
16620
16621         /* After */
16622         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
16623         if (!nl_freq)
16624                 goto nla_put_failure;
16625
16626         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
16627                 goto nla_put_failure;
16628         nla_nest_end(msg, nl_freq);
16629
16630         genlmsg_end(msg, hdr);
16631
16632         rcu_read_lock();
16633         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16634                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16635         rcu_read_unlock();
16636
16637         return;
16638
16639 nla_put_failure:
16640         nlmsg_free(msg);
16641 }
16642
16643 static void nl80211_send_remain_on_chan_event(
16644         int cmd, struct cfg80211_registered_device *rdev,
16645         struct wireless_dev *wdev, u64 cookie,
16646         struct ieee80211_channel *chan,
16647         unsigned int duration, gfp_t gfp)
16648 {
16649         struct sk_buff *msg;
16650         void *hdr;
16651
16652         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16653         if (!msg)
16654                 return;
16655
16656         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16657         if (!hdr) {
16658                 nlmsg_free(msg);
16659                 return;
16660         }
16661
16662         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16663             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16664                                          wdev->netdev->ifindex)) ||
16665             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16666                               NL80211_ATTR_PAD) ||
16667             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
16668             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
16669                         NL80211_CHAN_NO_HT) ||
16670             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16671                               NL80211_ATTR_PAD))
16672                 goto nla_put_failure;
16673
16674         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
16675             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
16676                 goto nla_put_failure;
16677
16678         genlmsg_end(msg, hdr);
16679
16680         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16681                                 NL80211_MCGRP_MLME, gfp);
16682         return;
16683
16684  nla_put_failure:
16685         nlmsg_free(msg);
16686 }
16687
16688 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
16689                                struct ieee80211_channel *chan,
16690                                unsigned int duration, gfp_t gfp)
16691 {
16692         struct wiphy *wiphy = wdev->wiphy;
16693         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16694
16695         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
16696         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
16697                                           rdev, wdev, cookie, chan,
16698                                           duration, gfp);
16699 }
16700 EXPORT_SYMBOL(cfg80211_ready_on_channel);
16701
16702 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
16703                                         struct ieee80211_channel *chan,
16704                                         gfp_t gfp)
16705 {
16706         struct wiphy *wiphy = wdev->wiphy;
16707         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16708
16709         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
16710         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16711                                           rdev, wdev, cookie, chan, 0, gfp);
16712 }
16713 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
16714
16715 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
16716                                         struct ieee80211_channel *chan,
16717                                         gfp_t gfp)
16718 {
16719         struct wiphy *wiphy = wdev->wiphy;
16720         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16721
16722         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
16723         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
16724                                           rdev, wdev, cookie, chan, 0, gfp);
16725 }
16726 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
16727
16728 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
16729                       struct station_info *sinfo, gfp_t gfp)
16730 {
16731         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16732         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16733         struct sk_buff *msg;
16734
16735         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16736
16737         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16738         if (!msg)
16739                 return;
16740
16741         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16742                                  rdev, dev, mac_addr, sinfo) < 0) {
16743                 nlmsg_free(msg);
16744                 return;
16745         }
16746
16747         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16748                                 NL80211_MCGRP_MLME, gfp);
16749 }
16750 EXPORT_SYMBOL(cfg80211_new_sta);
16751
16752 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16753                             struct station_info *sinfo, gfp_t gfp)
16754 {
16755         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16756         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16757         struct sk_buff *msg;
16758         struct station_info empty_sinfo = {};
16759
16760         if (!sinfo)
16761                 sinfo = &empty_sinfo;
16762
16763         trace_cfg80211_del_sta(dev, mac_addr);
16764
16765         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16766         if (!msg) {
16767                 cfg80211_sinfo_release_content(sinfo);
16768                 return;
16769         }
16770
16771         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16772                                  rdev, dev, mac_addr, sinfo) < 0) {
16773                 nlmsg_free(msg);
16774                 return;
16775         }
16776
16777         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16778                                 NL80211_MCGRP_MLME, gfp);
16779 }
16780 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16781
16782 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16783                           enum nl80211_connect_failed_reason reason,
16784                           gfp_t gfp)
16785 {
16786         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16787         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16788         struct sk_buff *msg;
16789         void *hdr;
16790
16791         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16792         if (!msg)
16793                 return;
16794
16795         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16796         if (!hdr) {
16797                 nlmsg_free(msg);
16798                 return;
16799         }
16800
16801         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16802             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16803             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16804                 goto nla_put_failure;
16805
16806         genlmsg_end(msg, hdr);
16807
16808         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16809                                 NL80211_MCGRP_MLME, gfp);
16810         return;
16811
16812  nla_put_failure:
16813         nlmsg_free(msg);
16814 }
16815 EXPORT_SYMBOL(cfg80211_conn_failed);
16816
16817 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16818                                        const u8 *addr, gfp_t gfp)
16819 {
16820         struct wireless_dev *wdev = dev->ieee80211_ptr;
16821         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16822         struct sk_buff *msg;
16823         void *hdr;
16824         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16825
16826         if (!nlportid)
16827                 return false;
16828
16829         msg = nlmsg_new(100, gfp);
16830         if (!msg)
16831                 return true;
16832
16833         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16834         if (!hdr) {
16835                 nlmsg_free(msg);
16836                 return true;
16837         }
16838
16839         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16840             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16841             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16842                 goto nla_put_failure;
16843
16844         genlmsg_end(msg, hdr);
16845         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16846         return true;
16847
16848  nla_put_failure:
16849         nlmsg_free(msg);
16850         return true;
16851 }
16852
16853 bool cfg80211_rx_spurious_frame(struct net_device *dev,
16854                                 const u8 *addr, gfp_t gfp)
16855 {
16856         struct wireless_dev *wdev = dev->ieee80211_ptr;
16857         bool ret;
16858
16859         trace_cfg80211_rx_spurious_frame(dev, addr);
16860
16861         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16862                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
16863                 trace_cfg80211_return_bool(false);
16864                 return false;
16865         }
16866         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
16867                                          addr, gfp);
16868         trace_cfg80211_return_bool(ret);
16869         return ret;
16870 }
16871 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
16872
16873 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
16874                                         const u8 *addr, gfp_t gfp)
16875 {
16876         struct wireless_dev *wdev = dev->ieee80211_ptr;
16877         bool ret;
16878
16879         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
16880
16881         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
16882                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
16883                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
16884                 trace_cfg80211_return_bool(false);
16885                 return false;
16886         }
16887         ret = __nl80211_unexpected_frame(dev,
16888                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
16889                                          addr, gfp);
16890         trace_cfg80211_return_bool(ret);
16891         return ret;
16892 }
16893 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
16894
16895 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
16896                       struct wireless_dev *wdev, u32 nlportid,
16897                       int freq, int sig_dbm,
16898                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
16899 {
16900         struct net_device *netdev = wdev->netdev;
16901         struct sk_buff *msg;
16902         void *hdr;
16903
16904         msg = nlmsg_new(100 + len, gfp);
16905         if (!msg)
16906                 return -ENOMEM;
16907
16908         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
16909         if (!hdr) {
16910                 nlmsg_free(msg);
16911                 return -ENOMEM;
16912         }
16913
16914         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16915             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16916                                         netdev->ifindex)) ||
16917             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16918                               NL80211_ATTR_PAD) ||
16919             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
16920             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
16921             (sig_dbm &&
16922              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
16923             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16924             (flags &&
16925              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
16926                 goto nla_put_failure;
16927
16928         genlmsg_end(msg, hdr);
16929
16930         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16931
16932  nla_put_failure:
16933         nlmsg_free(msg);
16934         return -ENOBUFS;
16935 }
16936
16937 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
16938                                     const u8 *buf, size_t len, bool ack,
16939                                     gfp_t gfp, enum nl80211_commands command)
16940 {
16941         struct wiphy *wiphy = wdev->wiphy;
16942         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16943         struct net_device *netdev = wdev->netdev;
16944         struct sk_buff *msg;
16945         void *hdr;
16946
16947         if (command == NL80211_CMD_FRAME_TX_STATUS)
16948                 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
16949         else
16950                 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
16951
16952         msg = nlmsg_new(100 + len, gfp);
16953         if (!msg)
16954                 return;
16955
16956         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
16957         if (!hdr) {
16958                 nlmsg_free(msg);
16959                 return;
16960         }
16961
16962         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16963             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16964                                    netdev->ifindex)) ||
16965             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16966                               NL80211_ATTR_PAD) ||
16967             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16968             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16969                               NL80211_ATTR_PAD) ||
16970             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
16971                 goto nla_put_failure;
16972
16973         genlmsg_end(msg, hdr);
16974
16975         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16976                                 NL80211_MCGRP_MLME, gfp);
16977         return;
16978
16979 nla_put_failure:
16980         nlmsg_free(msg);
16981 }
16982
16983 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
16984                                      const u8 *buf, size_t len, bool ack,
16985                                      gfp_t gfp)
16986 {
16987         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16988                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
16989 }
16990 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
16991
16992 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
16993                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
16994 {
16995         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
16996                                 NL80211_CMD_FRAME_TX_STATUS);
16997 }
16998 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
16999
17000 static int __nl80211_rx_control_port(struct net_device *dev,
17001                                      struct sk_buff *skb,
17002                                      bool unencrypted, gfp_t gfp)
17003 {
17004         struct wireless_dev *wdev = dev->ieee80211_ptr;
17005         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17006         struct ethhdr *ehdr = eth_hdr(skb);
17007         const u8 *addr = ehdr->h_source;
17008         u16 proto = be16_to_cpu(skb->protocol);
17009         struct sk_buff *msg;
17010         void *hdr;
17011         struct nlattr *frame;
17012
17013         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
17014
17015         if (!nlportid)
17016                 return -ENOENT;
17017
17018         msg = nlmsg_new(100 + skb->len, gfp);
17019         if (!msg)
17020                 return -ENOMEM;
17021
17022         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
17023         if (!hdr) {
17024                 nlmsg_free(msg);
17025                 return -ENOBUFS;
17026         }
17027
17028         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17029             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17030             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17031                               NL80211_ATTR_PAD) ||
17032             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17033             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
17034             (unencrypted && nla_put_flag(msg,
17035                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
17036                 goto nla_put_failure;
17037
17038         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
17039         if (!frame)
17040                 goto nla_put_failure;
17041
17042         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
17043         genlmsg_end(msg, hdr);
17044
17045         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17046
17047  nla_put_failure:
17048         nlmsg_free(msg);
17049         return -ENOBUFS;
17050 }
17051
17052 bool cfg80211_rx_control_port(struct net_device *dev,
17053                               struct sk_buff *skb, bool unencrypted)
17054 {
17055         int ret;
17056
17057         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
17058         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
17059         trace_cfg80211_return_bool(ret == 0);
17060         return ret == 0;
17061 }
17062 EXPORT_SYMBOL(cfg80211_rx_control_port);
17063
17064 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
17065                                             const char *mac, gfp_t gfp)
17066 {
17067         struct wireless_dev *wdev = dev->ieee80211_ptr;
17068         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17069         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17070         void **cb;
17071
17072         if (!msg)
17073                 return NULL;
17074
17075         cb = (void **)msg->cb;
17076
17077         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
17078         if (!cb[0]) {
17079                 nlmsg_free(msg);
17080                 return NULL;
17081         }
17082
17083         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17084             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17085                 goto nla_put_failure;
17086
17087         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17088                 goto nla_put_failure;
17089
17090         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
17091         if (!cb[1])
17092                 goto nla_put_failure;
17093
17094         cb[2] = rdev;
17095
17096         return msg;
17097  nla_put_failure:
17098         nlmsg_free(msg);
17099         return NULL;
17100 }
17101
17102 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
17103 {
17104         void **cb = (void **)msg->cb;
17105         struct cfg80211_registered_device *rdev = cb[2];
17106
17107         nla_nest_end(msg, cb[1]);
17108         genlmsg_end(msg, cb[0]);
17109
17110         memset(msg->cb, 0, sizeof(msg->cb));
17111
17112         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17113                                 NL80211_MCGRP_MLME, gfp);
17114 }
17115
17116 void cfg80211_cqm_rssi_notify(struct net_device *dev,
17117                               enum nl80211_cqm_rssi_threshold_event rssi_event,
17118                               s32 rssi_level, gfp_t gfp)
17119 {
17120         struct sk_buff *msg;
17121         struct wireless_dev *wdev = dev->ieee80211_ptr;
17122         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17123
17124         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
17125
17126         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
17127                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
17128                 return;
17129
17130         if (wdev->cqm_config) {
17131                 wdev->cqm_config->last_rssi_event_value = rssi_level;
17132
17133                 cfg80211_cqm_rssi_update(rdev, dev);
17134
17135                 if (rssi_level == 0)
17136                         rssi_level = wdev->cqm_config->last_rssi_event_value;
17137         }
17138
17139         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17140         if (!msg)
17141                 return;
17142
17143         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
17144                         rssi_event))
17145                 goto nla_put_failure;
17146
17147         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
17148                                       rssi_level))
17149                 goto nla_put_failure;
17150
17151         cfg80211_send_cqm(msg, gfp);
17152
17153         return;
17154
17155  nla_put_failure:
17156         nlmsg_free(msg);
17157 }
17158 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
17159
17160 void cfg80211_cqm_txe_notify(struct net_device *dev,
17161                              const u8 *peer, u32 num_packets,
17162                              u32 rate, u32 intvl, gfp_t gfp)
17163 {
17164         struct sk_buff *msg;
17165
17166         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17167         if (!msg)
17168                 return;
17169
17170         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
17171                 goto nla_put_failure;
17172
17173         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
17174                 goto nla_put_failure;
17175
17176         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
17177                 goto nla_put_failure;
17178
17179         cfg80211_send_cqm(msg, gfp);
17180         return;
17181
17182  nla_put_failure:
17183         nlmsg_free(msg);
17184 }
17185 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
17186
17187 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
17188                                  const u8 *peer, u32 num_packets, gfp_t gfp)
17189 {
17190         struct sk_buff *msg;
17191
17192         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
17193
17194         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17195         if (!msg)
17196                 return;
17197
17198         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
17199                 goto nla_put_failure;
17200
17201         cfg80211_send_cqm(msg, gfp);
17202         return;
17203
17204  nla_put_failure:
17205         nlmsg_free(msg);
17206 }
17207 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
17208
17209 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
17210 {
17211         struct sk_buff *msg;
17212
17213         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17214         if (!msg)
17215                 return;
17216
17217         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
17218                 goto nla_put_failure;
17219
17220         cfg80211_send_cqm(msg, gfp);
17221         return;
17222
17223  nla_put_failure:
17224         nlmsg_free(msg);
17225 }
17226 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
17227
17228 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
17229                                      struct net_device *netdev, const u8 *bssid,
17230                                      const u8 *replay_ctr, gfp_t gfp)
17231 {
17232         struct sk_buff *msg;
17233         struct nlattr *rekey_attr;
17234         void *hdr;
17235
17236         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17237         if (!msg)
17238                 return;
17239
17240         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
17241         if (!hdr) {
17242                 nlmsg_free(msg);
17243                 return;
17244         }
17245
17246         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17247             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17248             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17249                 goto nla_put_failure;
17250
17251         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
17252         if (!rekey_attr)
17253                 goto nla_put_failure;
17254
17255         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
17256                     NL80211_REPLAY_CTR_LEN, replay_ctr))
17257                 goto nla_put_failure;
17258
17259         nla_nest_end(msg, rekey_attr);
17260
17261         genlmsg_end(msg, hdr);
17262
17263         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17264                                 NL80211_MCGRP_MLME, gfp);
17265         return;
17266
17267  nla_put_failure:
17268         nlmsg_free(msg);
17269 }
17270
17271 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
17272                                const u8 *replay_ctr, gfp_t gfp)
17273 {
17274         struct wireless_dev *wdev = dev->ieee80211_ptr;
17275         struct wiphy *wiphy = wdev->wiphy;
17276         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17277
17278         trace_cfg80211_gtk_rekey_notify(dev, bssid);
17279         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
17280 }
17281 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
17282
17283 static void
17284 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
17285                                struct net_device *netdev, int index,
17286                                const u8 *bssid, bool preauth, gfp_t gfp)
17287 {
17288         struct sk_buff *msg;
17289         struct nlattr *attr;
17290         void *hdr;
17291
17292         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17293         if (!msg)
17294                 return;
17295
17296         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
17297         if (!hdr) {
17298                 nlmsg_free(msg);
17299                 return;
17300         }
17301
17302         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17303             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17304                 goto nla_put_failure;
17305
17306         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
17307         if (!attr)
17308                 goto nla_put_failure;
17309
17310         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
17311             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
17312             (preauth &&
17313              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
17314                 goto nla_put_failure;
17315
17316         nla_nest_end(msg, attr);
17317
17318         genlmsg_end(msg, hdr);
17319
17320         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17321                                 NL80211_MCGRP_MLME, gfp);
17322         return;
17323
17324  nla_put_failure:
17325         nlmsg_free(msg);
17326 }
17327
17328 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
17329                                      const u8 *bssid, bool preauth, gfp_t gfp)
17330 {
17331         struct wireless_dev *wdev = dev->ieee80211_ptr;
17332         struct wiphy *wiphy = wdev->wiphy;
17333         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17334
17335         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
17336         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
17337 }
17338 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
17339
17340 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
17341                                      struct net_device *netdev,
17342                                      struct cfg80211_chan_def *chandef,
17343                                      gfp_t gfp,
17344                                      enum nl80211_commands notif,
17345                                      u8 count, bool quiet)
17346 {
17347         struct sk_buff *msg;
17348         void *hdr;
17349
17350         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17351         if (!msg)
17352                 return;
17353
17354         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
17355         if (!hdr) {
17356                 nlmsg_free(msg);
17357                 return;
17358         }
17359
17360         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17361                 goto nla_put_failure;
17362
17363         if (nl80211_send_chandef(msg, chandef))
17364                 goto nla_put_failure;
17365
17366         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
17367                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
17368                         goto nla_put_failure;
17369                 if (quiet &&
17370                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
17371                         goto nla_put_failure;
17372         }
17373
17374         genlmsg_end(msg, hdr);
17375
17376         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17377                                 NL80211_MCGRP_MLME, gfp);
17378         return;
17379
17380  nla_put_failure:
17381         nlmsg_free(msg);
17382 }
17383
17384 void cfg80211_ch_switch_notify(struct net_device *dev,
17385                                struct cfg80211_chan_def *chandef)
17386 {
17387         struct wireless_dev *wdev = dev->ieee80211_ptr;
17388         struct wiphy *wiphy = wdev->wiphy;
17389         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17390
17391         ASSERT_WDEV_LOCK(wdev);
17392
17393         trace_cfg80211_ch_switch_notify(dev, chandef);
17394
17395         wdev->chandef = *chandef;
17396         wdev->preset_chandef = *chandef;
17397
17398         if (wdev->iftype == NL80211_IFTYPE_STATION &&
17399             !WARN_ON(!wdev->current_bss))
17400                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
17401
17402         cfg80211_sched_dfs_chan_update(rdev);
17403
17404         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17405                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
17406 }
17407 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
17408
17409 void cfg80211_ch_switch_started_notify(struct net_device *dev,
17410                                        struct cfg80211_chan_def *chandef,
17411                                        u8 count, bool quiet)
17412 {
17413         struct wireless_dev *wdev = dev->ieee80211_ptr;
17414         struct wiphy *wiphy = wdev->wiphy;
17415         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17416
17417         trace_cfg80211_ch_switch_started_notify(dev, chandef);
17418
17419         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17420                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
17421                                  count, quiet);
17422 }
17423 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
17424
17425 void
17426 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
17427                      const struct cfg80211_chan_def *chandef,
17428                      enum nl80211_radar_event event,
17429                      struct net_device *netdev, gfp_t gfp)
17430 {
17431         struct sk_buff *msg;
17432         void *hdr;
17433
17434         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17435         if (!msg)
17436                 return;
17437
17438         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
17439         if (!hdr) {
17440                 nlmsg_free(msg);
17441                 return;
17442         }
17443
17444         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17445                 goto nla_put_failure;
17446
17447         /* NOP and radar events don't need a netdev parameter */
17448         if (netdev) {
17449                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17450
17451                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17452                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17453                                       NL80211_ATTR_PAD))
17454                         goto nla_put_failure;
17455         }
17456
17457         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
17458                 goto nla_put_failure;
17459
17460         if (nl80211_send_chandef(msg, chandef))
17461                 goto nla_put_failure;
17462
17463         genlmsg_end(msg, hdr);
17464
17465         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17466                                 NL80211_MCGRP_MLME, gfp);
17467         return;
17468
17469  nla_put_failure:
17470         nlmsg_free(msg);
17471 }
17472
17473 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
17474                                        struct sta_opmode_info *sta_opmode,
17475                                        gfp_t gfp)
17476 {
17477         struct sk_buff *msg;
17478         struct wireless_dev *wdev = dev->ieee80211_ptr;
17479         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17480         void *hdr;
17481
17482         if (WARN_ON(!mac))
17483                 return;
17484
17485         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17486         if (!msg)
17487                 return;
17488
17489         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
17490         if (!hdr) {
17491                 nlmsg_free(msg);
17492                 return;
17493         }
17494
17495         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17496                 goto nla_put_failure;
17497
17498         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17499                 goto nla_put_failure;
17500
17501         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17502                 goto nla_put_failure;
17503
17504         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
17505             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
17506                 goto nla_put_failure;
17507
17508         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
17509             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
17510                 goto nla_put_failure;
17511
17512         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
17513             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
17514                 goto nla_put_failure;
17515
17516         genlmsg_end(msg, hdr);
17517
17518         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17519                                 NL80211_MCGRP_MLME, gfp);
17520
17521         return;
17522
17523 nla_put_failure:
17524         nlmsg_free(msg);
17525 }
17526 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
17527
17528 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
17529                            u64 cookie, bool acked, s32 ack_signal,
17530                            bool is_valid_ack_signal, gfp_t gfp)
17531 {
17532         struct wireless_dev *wdev = dev->ieee80211_ptr;
17533         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17534         struct sk_buff *msg;
17535         void *hdr;
17536
17537         trace_cfg80211_probe_status(dev, addr, cookie, acked);
17538
17539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17540
17541         if (!msg)
17542                 return;
17543
17544         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
17545         if (!hdr) {
17546                 nlmsg_free(msg);
17547                 return;
17548         }
17549
17550         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17551             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17552             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17553             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17554                               NL80211_ATTR_PAD) ||
17555             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
17556             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
17557                                                 ack_signal)))
17558                 goto nla_put_failure;
17559
17560         genlmsg_end(msg, hdr);
17561
17562         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17563                                 NL80211_MCGRP_MLME, gfp);
17564         return;
17565
17566  nla_put_failure:
17567         nlmsg_free(msg);
17568 }
17569 EXPORT_SYMBOL(cfg80211_probe_status);
17570
17571 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
17572                                      size_t len, int freq, int sig_dbm)
17573 {
17574         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17575         struct sk_buff *msg;
17576         void *hdr;
17577         struct cfg80211_beacon_registration *reg;
17578
17579         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
17580
17581         spin_lock_bh(&rdev->beacon_registrations_lock);
17582         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
17583                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
17584                 if (!msg) {
17585                         spin_unlock_bh(&rdev->beacon_registrations_lock);
17586                         return;
17587                 }
17588
17589                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17590                 if (!hdr)
17591                         goto nla_put_failure;
17592
17593                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17594                     (freq &&
17595                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
17596                                   KHZ_TO_MHZ(freq)) ||
17597                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
17598                                   freq % 1000))) ||
17599                     (sig_dbm &&
17600                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17601                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
17602                         goto nla_put_failure;
17603
17604                 genlmsg_end(msg, hdr);
17605
17606                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
17607         }
17608         spin_unlock_bh(&rdev->beacon_registrations_lock);
17609         return;
17610
17611  nla_put_failure:
17612         spin_unlock_bh(&rdev->beacon_registrations_lock);
17613         nlmsg_free(msg);
17614 }
17615 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
17616
17617 #ifdef CONFIG_PM
17618 static int cfg80211_net_detect_results(struct sk_buff *msg,
17619                                        struct cfg80211_wowlan_wakeup *wakeup)
17620 {
17621         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
17622         struct nlattr *nl_results, *nl_match, *nl_freqs;
17623         int i, j;
17624
17625         nl_results = nla_nest_start_noflag(msg,
17626                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
17627         if (!nl_results)
17628                 return -EMSGSIZE;
17629
17630         for (i = 0; i < nd->n_matches; i++) {
17631                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
17632
17633                 nl_match = nla_nest_start_noflag(msg, i);
17634                 if (!nl_match)
17635                         break;
17636
17637                 /* The SSID attribute is optional in nl80211, but for
17638                  * simplicity reasons it's always present in the
17639                  * cfg80211 structure.  If a driver can't pass the
17640                  * SSID, that needs to be changed.  A zero length SSID
17641                  * is still a valid SSID (wildcard), so it cannot be
17642                  * used for this purpose.
17643                  */
17644                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
17645                             match->ssid.ssid)) {
17646                         nla_nest_cancel(msg, nl_match);
17647                         goto out;
17648                 }
17649
17650                 if (match->n_channels) {
17651                         nl_freqs = nla_nest_start_noflag(msg,
17652                                                          NL80211_ATTR_SCAN_FREQUENCIES);
17653                         if (!nl_freqs) {
17654                                 nla_nest_cancel(msg, nl_match);
17655                                 goto out;
17656                         }
17657
17658                         for (j = 0; j < match->n_channels; j++) {
17659                                 if (nla_put_u32(msg, j, match->channels[j])) {
17660                                         nla_nest_cancel(msg, nl_freqs);
17661                                         nla_nest_cancel(msg, nl_match);
17662                                         goto out;
17663                                 }
17664                         }
17665
17666                         nla_nest_end(msg, nl_freqs);
17667                 }
17668
17669                 nla_nest_end(msg, nl_match);
17670         }
17671
17672 out:
17673         nla_nest_end(msg, nl_results);
17674         return 0;
17675 }
17676
17677 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
17678                                    struct cfg80211_wowlan_wakeup *wakeup,
17679                                    gfp_t gfp)
17680 {
17681         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17682         struct sk_buff *msg;
17683         void *hdr;
17684         int size = 200;
17685
17686         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
17687
17688         if (wakeup)
17689                 size += wakeup->packet_present_len;
17690
17691         msg = nlmsg_new(size, gfp);
17692         if (!msg)
17693                 return;
17694
17695         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
17696         if (!hdr)
17697                 goto free_msg;
17698
17699         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17700             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17701                               NL80211_ATTR_PAD))
17702                 goto free_msg;
17703
17704         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17705                                         wdev->netdev->ifindex))
17706                 goto free_msg;
17707
17708         if (wakeup) {
17709                 struct nlattr *reasons;
17710
17711                 reasons = nla_nest_start_noflag(msg,
17712                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
17713                 if (!reasons)
17714                         goto free_msg;
17715
17716                 if (wakeup->disconnect &&
17717                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
17718                         goto free_msg;
17719                 if (wakeup->magic_pkt &&
17720                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
17721                         goto free_msg;
17722                 if (wakeup->gtk_rekey_failure &&
17723                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
17724                         goto free_msg;
17725                 if (wakeup->eap_identity_req &&
17726                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
17727                         goto free_msg;
17728                 if (wakeup->four_way_handshake &&
17729                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
17730                         goto free_msg;
17731                 if (wakeup->rfkill_release &&
17732                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
17733                         goto free_msg;
17734
17735                 if (wakeup->pattern_idx >= 0 &&
17736                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
17737                                 wakeup->pattern_idx))
17738                         goto free_msg;
17739
17740                 if (wakeup->tcp_match &&
17741                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
17742                         goto free_msg;
17743
17744                 if (wakeup->tcp_connlost &&
17745                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
17746                         goto free_msg;
17747
17748                 if (wakeup->tcp_nomoretokens &&
17749                     nla_put_flag(msg,
17750                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
17751                         goto free_msg;
17752
17753                 if (wakeup->packet) {
17754                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
17755                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
17756
17757                         if (!wakeup->packet_80211) {
17758                                 pkt_attr =
17759                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17760                                 len_attr =
17761                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17762                         }
17763
17764                         if (wakeup->packet_len &&
17765                             nla_put_u32(msg, len_attr, wakeup->packet_len))
17766                                 goto free_msg;
17767
17768                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17769                                     wakeup->packet))
17770                                 goto free_msg;
17771                 }
17772
17773                 if (wakeup->net_detect &&
17774                     cfg80211_net_detect_results(msg, wakeup))
17775                                 goto free_msg;
17776
17777                 nla_nest_end(msg, reasons);
17778         }
17779
17780         genlmsg_end(msg, hdr);
17781
17782         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17783                                 NL80211_MCGRP_MLME, gfp);
17784         return;
17785
17786  free_msg:
17787         nlmsg_free(msg);
17788 }
17789 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17790 #endif
17791
17792 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17793                                 enum nl80211_tdls_operation oper,
17794                                 u16 reason_code, gfp_t gfp)
17795 {
17796         struct wireless_dev *wdev = dev->ieee80211_ptr;
17797         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17798         struct sk_buff *msg;
17799         void *hdr;
17800
17801         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17802                                          reason_code);
17803
17804         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17805         if (!msg)
17806                 return;
17807
17808         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
17809         if (!hdr) {
17810                 nlmsg_free(msg);
17811                 return;
17812         }
17813
17814         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17815             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17816             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
17817             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
17818             (reason_code > 0 &&
17819              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
17820                 goto nla_put_failure;
17821
17822         genlmsg_end(msg, hdr);
17823
17824         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17825                                 NL80211_MCGRP_MLME, gfp);
17826         return;
17827
17828  nla_put_failure:
17829         nlmsg_free(msg);
17830 }
17831 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
17832
17833 static int nl80211_netlink_notify(struct notifier_block * nb,
17834                                   unsigned long state,
17835                                   void *_notify)
17836 {
17837         struct netlink_notify *notify = _notify;
17838         struct cfg80211_registered_device *rdev;
17839         struct wireless_dev *wdev;
17840         struct cfg80211_beacon_registration *reg, *tmp;
17841
17842         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
17843                 return NOTIFY_DONE;
17844
17845         rcu_read_lock();
17846
17847         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
17848                 struct cfg80211_sched_scan_request *sched_scan_req;
17849
17850                 list_for_each_entry_rcu(sched_scan_req,
17851                                         &rdev->sched_scan_req_list,
17852                                         list) {
17853                         if (sched_scan_req->owner_nlportid == notify->portid) {
17854                                 sched_scan_req->nl_owner_dead = true;
17855                                 schedule_work(&rdev->sched_scan_stop_wk);
17856                         }
17857                 }
17858
17859                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
17860                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
17861
17862                         if (wdev->owner_nlportid == notify->portid) {
17863                                 wdev->nl_owner_dead = true;
17864                                 schedule_work(&rdev->destroy_work);
17865                         } else if (wdev->conn_owner_nlportid == notify->portid) {
17866                                 schedule_work(&wdev->disconnect_wk);
17867                         }
17868
17869                         cfg80211_release_pmsr(wdev, notify->portid);
17870                 }
17871
17872                 spin_lock_bh(&rdev->beacon_registrations_lock);
17873                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
17874                                          list) {
17875                         if (reg->nlportid == notify->portid) {
17876                                 list_del(&reg->list);
17877                                 kfree(reg);
17878                                 break;
17879                         }
17880                 }
17881                 spin_unlock_bh(&rdev->beacon_registrations_lock);
17882         }
17883
17884         rcu_read_unlock();
17885
17886         /*
17887          * It is possible that the user space process that is controlling the
17888          * indoor setting disappeared, so notify the regulatory core.
17889          */
17890         regulatory_netlink_notify(notify->portid);
17891         return NOTIFY_OK;
17892 }
17893
17894 static struct notifier_block nl80211_netlink_notifier = {
17895         .notifier_call = nl80211_netlink_notify,
17896 };
17897
17898 void cfg80211_ft_event(struct net_device *netdev,
17899                        struct cfg80211_ft_event_params *ft_event)
17900 {
17901         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
17902         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17903         struct sk_buff *msg;
17904         void *hdr;
17905
17906         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
17907
17908         if (!ft_event->target_ap)
17909                 return;
17910
17911         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
17912                         GFP_KERNEL);
17913         if (!msg)
17914                 return;
17915
17916         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
17917         if (!hdr)
17918                 goto out;
17919
17920         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17921             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17922             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
17923                 goto out;
17924
17925         if (ft_event->ies &&
17926             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
17927                 goto out;
17928         if (ft_event->ric_ies &&
17929             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
17930                     ft_event->ric_ies))
17931                 goto out;
17932
17933         genlmsg_end(msg, hdr);
17934
17935         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17936                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17937         return;
17938  out:
17939         nlmsg_free(msg);
17940 }
17941 EXPORT_SYMBOL(cfg80211_ft_event);
17942
17943 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
17944 {
17945         struct cfg80211_registered_device *rdev;
17946         struct sk_buff *msg;
17947         void *hdr;
17948         u32 nlportid;
17949
17950         rdev = wiphy_to_rdev(wdev->wiphy);
17951         if (!rdev->crit_proto_nlportid)
17952                 return;
17953
17954         nlportid = rdev->crit_proto_nlportid;
17955         rdev->crit_proto_nlportid = 0;
17956
17957         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17958         if (!msg)
17959                 return;
17960
17961         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
17962         if (!hdr)
17963                 goto nla_put_failure;
17964
17965         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17966             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17967                               NL80211_ATTR_PAD))
17968                 goto nla_put_failure;
17969
17970         genlmsg_end(msg, hdr);
17971
17972         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17973         return;
17974
17975  nla_put_failure:
17976         nlmsg_free(msg);
17977 }
17978 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
17979
17980 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
17981 {
17982         struct wiphy *wiphy = wdev->wiphy;
17983         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17984         struct sk_buff *msg;
17985         void *hdr;
17986
17987         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17988         if (!msg)
17989                 return;
17990
17991         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
17992         if (!hdr)
17993                 goto out;
17994
17995         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17996             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
17997             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17998                               NL80211_ATTR_PAD))
17999                 goto out;
18000
18001         genlmsg_end(msg, hdr);
18002
18003         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
18004                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18005         return;
18006  out:
18007         nlmsg_free(msg);
18008 }
18009
18010 int cfg80211_external_auth_request(struct net_device *dev,
18011                                    struct cfg80211_external_auth_params *params,
18012                                    gfp_t gfp)
18013 {
18014         struct wireless_dev *wdev = dev->ieee80211_ptr;
18015         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18016         struct sk_buff *msg;
18017         void *hdr;
18018
18019         if (!wdev->conn_owner_nlportid)
18020                 return -EINVAL;
18021
18022         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18023         if (!msg)
18024                 return -ENOMEM;
18025
18026         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
18027         if (!hdr)
18028                 goto nla_put_failure;
18029
18030         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18031             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18032             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
18033             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
18034                         params->action) ||
18035             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
18036             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
18037                     params->ssid.ssid))
18038                 goto nla_put_failure;
18039
18040         genlmsg_end(msg, hdr);
18041         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
18042                         wdev->conn_owner_nlportid);
18043         return 0;
18044
18045  nla_put_failure:
18046         nlmsg_free(msg);
18047         return -ENOBUFS;
18048 }
18049 EXPORT_SYMBOL(cfg80211_external_auth_request);
18050
18051 void cfg80211_update_owe_info_event(struct net_device *netdev,
18052                                     struct cfg80211_update_owe_info *owe_info,
18053                                     gfp_t gfp)
18054 {
18055         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
18056         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18057         struct sk_buff *msg;
18058         void *hdr;
18059
18060         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
18061
18062         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18063         if (!msg)
18064                 return;
18065
18066         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
18067         if (!hdr)
18068                 goto nla_put_failure;
18069
18070         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18071             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18072             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
18073                 goto nla_put_failure;
18074
18075         if (!owe_info->ie_len ||
18076             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
18077                 goto nla_put_failure;
18078
18079         genlmsg_end(msg, hdr);
18080
18081         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18082                                 NL80211_MCGRP_MLME, gfp);
18083         return;
18084
18085 nla_put_failure:
18086         genlmsg_cancel(msg, hdr);
18087         nlmsg_free(msg);
18088 }
18089 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
18090
18091 /* initialisation/exit functions */
18092
18093 int __init nl80211_init(void)
18094 {
18095         int err;
18096
18097         err = genl_register_family(&nl80211_fam);
18098         if (err)
18099                 return err;
18100
18101         err = netlink_register_notifier(&nl80211_netlink_notifier);
18102         if (err)
18103                 goto err_out;
18104
18105         return 0;
18106  err_out:
18107         genl_unregister_family(&nl80211_fam);
18108         return err;
18109 }
18110
18111 void nl80211_exit(void)
18112 {
18113         netlink_unregister_notifier(&nl80211_netlink_notifier);
18114         genl_unregister_family(&nl80211_fam);
18115 }