wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2022 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 static int validate_he_capa(const struct nlattr *attr,
 289                             struct netlink_ext_ack *extack)
 290 {
 291         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 292                 return -EINVAL;
 293
 294         return 0;
 295 }
 296
 297 /* policy for the attributes */
 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 299
 300 static const struct nla_policy
 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 302         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 303         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 304                                         .len = U8_MAX },
 305         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 306                                              .len = U8_MAX },
 307 };
 308
 309 static const struct nla_policy
 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 311         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 312         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 313         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 314                 NLA_POLICY_MAX(NLA_U8, 15),
 315         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 316         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 317                 NLA_POLICY_MAX(NLA_U8, 15),
 318         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 319                 NLA_POLICY_MAX(NLA_U8, 31),
 320         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 321         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 322         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 323         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 324         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 325         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 326         [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
 327 };
 328
 329 static const struct nla_policy
 330 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 331         [NL80211_PMSR_TYPE_FTM] =
 332                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 333 };
 334
 335 static const struct nla_policy
 336 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 337         [NL80211_PMSR_REQ_ATTR_DATA] =
 338                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 339         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 340 };
 341
 342 static const struct nla_policy
 343 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 344         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 345         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 346         [NL80211_PMSR_PEER_ATTR_REQ] =
 347                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 348         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 349 };
 350
 351 static const struct nla_policy
 352 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 353         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 354         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 355         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 356         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 357         [NL80211_PMSR_ATTR_PEERS] =
 358                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 359 };
 360
 361 static const struct nla_policy
 362 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 363         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 364                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 365         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 366                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 367         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 368                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 369         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 370                 NLA_POLICY_EXACT_LEN(8),
 371         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 372                 NLA_POLICY_EXACT_LEN(8),
 373         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 374 };
 375
 376 static const struct nla_policy
 377 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 378         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 379         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 380         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 381 };
 382
 383 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 384         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 385                                     .len = NL80211_MAX_SUPP_RATES },
 386         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 387                                 .len = NL80211_MAX_SUPP_HT_RATES },
 388         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 389         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 390         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 391         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 392                                                    NL80211_RATE_INFO_HE_GI_0_8,
 393                                                    NL80211_RATE_INFO_HE_GI_3_2),
 394         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 395                                                    NL80211_RATE_INFO_HE_1XLTF,
 396                                                    NL80211_RATE_INFO_HE_4XLTF),
 397 };
 398
 399 static const struct nla_policy
 400 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 401         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 402         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 403         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 404         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 405         [NL80211_TID_CONFIG_ATTR_NOACK] =
 406                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 407         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 408         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 409         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 410                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 411         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 412                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 413         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 414                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 415         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 416                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 417         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 418                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 419 };
 420
 421 static const struct nla_policy
 422 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 423         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 424         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 425         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 426                         NLA_POLICY_RANGE(NLA_BINARY,
 427                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 428                                          IEEE80211_MAX_DATA_LEN),
 429 };
 430
 431 static const struct nla_policy
 432 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 433         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 434         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 435                                                        .len = IEEE80211_MAX_DATA_LEN }
 436 };
 437
 438 static const struct nla_policy
 439 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 440         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 441         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 442 };
 443
 444 static const struct nla_policy
 445 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 446         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 447         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 448 };
 449
 450 static const struct nla_policy
 451 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 452         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 453         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 454                                                 NLA_POLICY_MIN(NLA_U8, 1),
 455         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 456         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 457         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 462         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 463         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 464 };
 465
 466 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 467         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 468         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 469         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 470                                       .len = 20-1 },
 471         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 472
 473         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 474         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 475         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 476                                                 NL80211_EDMG_CHANNELS_MIN,
 477                                                 NL80211_EDMG_CHANNELS_MAX),
 478         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 479                                                 NL80211_EDMG_BW_CONFIG_MIN,
 480                                                 NL80211_EDMG_BW_CONFIG_MAX),
 481
 482         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 483         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 484         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 485         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 486
 487         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 488         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 489         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 490         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 491         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 492         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 493
 494         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 495         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 496         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 497
 498         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 499         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 500
 501         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 502         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 503                                     .len = WLAN_MAX_KEY_LEN },
 504         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 505         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 506         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 507         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 508         [NL80211_ATTR_KEY_TYPE] =
 509                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 510
 511         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 512         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 513         [NL80211_ATTR_BEACON_HEAD] =
 514                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 515                                        IEEE80211_MAX_DATA_LEN),
 516         [NL80211_ATTR_BEACON_TAIL] =
 517                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 518                                        IEEE80211_MAX_DATA_LEN),
 519         [NL80211_ATTR_STA_AID] =
 520                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 521         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 522         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 523         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 524                                                .len = NL80211_MAX_SUPP_RATES },
 525         [NL80211_ATTR_STA_PLINK_ACTION] =
 526                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 527         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 528                 NLA_POLICY_RANGE(NLA_U8,
 529                                  NL80211_TX_POWER_AUTOMATIC,
 530                                  NL80211_TX_POWER_FIXED),
 531         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 532         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 533         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 534         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 535                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 536         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 537
 538         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 539         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 540         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 541
 542         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 543         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 544         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 545         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 546                                            .len = NL80211_MAX_SUPP_RATES },
 547         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 548
 549         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 550         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 551
 552         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 553
 554         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 555         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 556                                                    validate_ie_attr,
 557                                                    IEEE80211_MAX_DATA_LEN),
 558         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 559         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 560
 561         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 562                                 .len = IEEE80211_MAX_SSID_LEN },
 563         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 564         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 565         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 566         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 567         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 568                                                   NL80211_MFP_NO,
 569                                                   NL80211_MFP_OPTIONAL),
 570         [NL80211_ATTR_STA_FLAGS2] =
 571                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 572         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 573         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 574         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 575         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 576         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 577         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 578         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 579         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 580         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 581         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 582         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 583         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 584         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 585         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 586         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 587                                  .len = IEEE80211_MAX_DATA_LEN },
 588         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 589         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 590                                                    NL80211_PS_DISABLED,
 591                                                    NL80211_PS_ENABLED),
 592         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 593         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 594         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 595         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 596         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 597         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 598         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 599         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 600         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 601         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 602         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 603         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 604         [NL80211_ATTR_STA_PLINK_STATE] =
 605                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 606         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 607         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 608         [NL80211_ATTR_MESH_PEER_AID] =
 609                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 610         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 611         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 612         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 613         [NL80211_ATTR_HIDDEN_SSID] =
 614                 NLA_POLICY_RANGE(NLA_U32,
 615                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 616                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 617         [NL80211_ATTR_IE_PROBE_RESP] =
 618                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 619                                        IEEE80211_MAX_DATA_LEN),
 620         [NL80211_ATTR_IE_ASSOC_RESP] =
 621                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 622                                        IEEE80211_MAX_DATA_LEN),
 623         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 624         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 625         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 626         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 627         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 628         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 629         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 630         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 631         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 632         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 633         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 634         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 635                                       .len = IEEE80211_MAX_DATA_LEN },
 636         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 637         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 638         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 639                 .len = NL80211_HT_CAPABILITY_LEN
 640         },
 641         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 642         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 643         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 644         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 645         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 646
 647         /* need to include at least Auth Transaction and Status Code */
 648         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 649
 650         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 651         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 652         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 653         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 654         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 655                 NLA_POLICY_RANGE(NLA_U32,
 656                                  NL80211_MESH_POWER_UNKNOWN + 1,
 657                                  NL80211_MESH_POWER_MAX),
 658         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 659         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 660         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 661         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 662         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 663         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 664         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 665                 .len = NL80211_VHT_CAPABILITY_LEN,
 666         },
 667         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 668         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 669                                   .len = IEEE80211_MAX_DATA_LEN },
 670         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 671         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 672                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 673         [NL80211_ATTR_PEER_AID] =
 674                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 675         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 676         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 677         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 678         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 679         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 680         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 681         /*
 682          * The value of the Length field of the Supported Operating
 683          * Classes element is between 2 and 253.
 684          */
 685         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 686                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 687         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 688         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 689         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 690         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 691         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 692         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 693                                                   IEEE80211_QOS_MAP_LEN_MIN,
 694                                                   IEEE80211_QOS_MAP_LEN_MAX),
 695         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 696         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 697         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 698         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 699         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 700         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 701         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 702         [NL80211_ATTR_USER_PRIO] =
 703                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 704         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 705         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 706         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 707         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 708         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 709         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 710         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 711         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 712         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 713         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 714         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 715                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 716         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 717                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 718         },
 719         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 720         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 721         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 722         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 723         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 724                                     .len = FILS_MAX_KEK_LEN },
 725         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 726         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 727         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 728         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 729         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 730                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 731         },
 732         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 733         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 734                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 735         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 736                                           .len = FILS_ERP_MAX_REALM_LEN },
 737         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 738         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 739                                         .len = FILS_ERP_MAX_RRK_LEN },
 740         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 741         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 742         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 743         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 744         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 745
 746         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 747         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 748         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 749         [NL80211_ATTR_HE_CAPABILITY] =
 750                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 751                                        NL80211_HE_MAX_CAPABILITY_LEN),
 752         [NL80211_ATTR_FTM_RESPONDER] =
 753                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 754         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 755         [NL80211_ATTR_PEER_MEASUREMENTS] =
 756                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 757         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 758         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 759                                         .len = SAE_PASSWORD_MAX_LEN },
 760         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 761         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 762         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 763         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 764         [NL80211_ATTR_TID_CONFIG] =
 765                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 766         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 767         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 768         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 769         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 770         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 771         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 772         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 773                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 774         [NL80211_ATTR_FILS_DISCOVERY] =
 775                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 776         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 777                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 778         [NL80211_ATTR_S1G_CAPABILITY] =
 779                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 780         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 781                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 782         [NL80211_ATTR_SAE_PWE] =
 783                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 784                                  NL80211_SAE_PWE_BOTH),
 785         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 786         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 787         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 788         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 789         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 790         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 791         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 792         [NL80211_ATTR_MBSSID_CONFIG] =
 793                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 794         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 795         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 796         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 797         [NL80211_ATTR_EHT_CAPABILITY] =
 798                 NLA_POLICY_RANGE(NLA_BINARY,
 799                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 800                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 801         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 802         [NL80211_ATTR_MLO_LINKS] =
 803                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 804         [NL80211_ATTR_MLO_LINK_ID] =
 805                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
 806         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 807         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 808         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 809 };
 810
 811 /* policy for the key attributes */
 812 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 813         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 814         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 815         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 816         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 817         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 818         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 819         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 820         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 821         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 822 };
 823
 824 /* policy for the key default flags */
 825 static const struct nla_policy
 826 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 827         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 828         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 829 };
 830
 831 #ifdef CONFIG_PM
 832 /* policy for WoWLAN attributes */
 833 static const struct nla_policy
 834 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 835         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 836         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 837         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 838         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 839         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 840         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 841         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 842         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 843         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 844         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 845 };
 846
 847 static const struct nla_policy
 848 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 849         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 850         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 851         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 852         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 853         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 854         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 855         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 856                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 857         },
 858         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 859                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 860         },
 861         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 862         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 863         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 864 };
 865 #endif /* CONFIG_PM */
 866
 867 /* policy for coalesce rule attributes */
 868 static const struct nla_policy
 869 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 870         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 871         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 872                 NLA_POLICY_RANGE(NLA_U32,
 873                                  NL80211_COALESCE_CONDITION_MATCH,
 874                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 875         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 876 };
 877
 878 /* policy for GTK rekey offload attributes */
 879 static const struct nla_policy
 880 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 881         [NL80211_REKEY_DATA_KEK] = {
 882                 .type = NLA_BINARY,
 883                 .len = NL80211_KEK_EXT_LEN
 884         },
 885         [NL80211_REKEY_DATA_KCK] = {
 886                 .type = NLA_BINARY,
 887                 .len = NL80211_KCK_EXT_LEN
 888         },
 889         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 890         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 891 };
 892
 893 static const struct nla_policy
 894 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 895         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 896         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 897         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 898         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 899         [NL80211_BAND_LC]    = { .type = NLA_S32 },
 900 };
 901
 902 static const struct nla_policy
 903 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 904         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 905                                                  .len = IEEE80211_MAX_SSID_LEN },
 906         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 907         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 908         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 909                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 910 };
 911
 912 static const struct nla_policy
 913 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 914         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 915         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 916 };
 917
 918 static const struct nla_policy
 919 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 920         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 921         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 922         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 923                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 924         },
 925 };
 926
 927 /* policy for NAN function attributes */
 928 static const struct nla_policy
 929 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 930         [NL80211_NAN_FUNC_TYPE] =
 931                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 932         [NL80211_NAN_FUNC_SERVICE_ID] = {
 933                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 934         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 935         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 936         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 937         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 938         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 939         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 940         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 941         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 942         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 943                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 944         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 945         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 946         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 947         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 948         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 949 };
 950
 951 /* policy for Service Response Filter attributes */
 952 static const struct nla_policy
 953 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 954         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 955         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 956                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 957         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 958         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 959 };
 960
 961 /* policy for packet pattern attributes */
 962 static const struct nla_policy
 963 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 964         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 965         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 966         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 967 };
 968
 969 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 970                                      struct cfg80211_registered_device **rdev,
 971                                      struct wireless_dev **wdev,
 972                                      struct nlattr **attrbuf)
 973 {
 974         int err;
 975
 976         if (!cb->args[0]) {
 977                 struct nlattr **attrbuf_free = NULL;
 978
 979                 if (!attrbuf) {
 980                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 981                                           GFP_KERNEL);
 982                         if (!attrbuf)
 983                                 return -ENOMEM;
 984                         attrbuf_free = attrbuf;
 985                 }
 986
 987                 err = nlmsg_parse_deprecated(cb->nlh,
 988                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 989                                              attrbuf, nl80211_fam.maxattr,
 990                                              nl80211_policy, NULL);
 991                 if (err) {
 992                         kfree(attrbuf_free);
 993                         return err;
 994                 }
 995
 996                 rtnl_lock();
 997                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
 998                                                    attrbuf);
 999                 kfree(attrbuf_free);
1000                 if (IS_ERR(*wdev)) {
1001                         rtnl_unlock();
1002                         return PTR_ERR(*wdev);
1003                 }
1004                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1005                 mutex_lock(&(*rdev)->wiphy.mtx);
1006                 rtnl_unlock();
1007                 /* 0 is the first index - add 1 to parse only once */
1008                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1009                 cb->args[1] = (*wdev)->identifier;
1010         } else {
1011                 /* subtract the 1 again here */
1012                 struct wiphy *wiphy;
1013                 struct wireless_dev *tmp;
1014
1015                 rtnl_lock();
1016                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1017                 if (!wiphy) {
1018                         rtnl_unlock();
1019                         return -ENODEV;
1020                 }
1021                 *rdev = wiphy_to_rdev(wiphy);
1022                 *wdev = NULL;
1023
1024                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1025                         if (tmp->identifier == cb->args[1]) {
1026                                 *wdev = tmp;
1027                                 break;
1028                         }
1029                 }
1030
1031                 if (!*wdev) {
1032                         rtnl_unlock();
1033                         return -ENODEV;
1034                 }
1035                 mutex_lock(&(*rdev)->wiphy.mtx);
1036                 rtnl_unlock();
1037         }
1038
1039         return 0;
1040 }
1041
1042 /* message building helper */
1043 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1044                      int flags, u8 cmd)
1045 {
1046         /* since there is no private header just add the generic one */
1047         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1048 }
1049
1050 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1051                                      const struct ieee80211_reg_rule *rule)
1052 {
1053         int j;
1054         struct nlattr *nl_wmm_rules =
1055                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1056
1057         if (!nl_wmm_rules)
1058                 goto nla_put_failure;
1059
1060         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1061                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1062
1063                 if (!nl_wmm_rule)
1064                         goto nla_put_failure;
1065
1066                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1067                                 rule->wmm_rule.client[j].cw_min) ||
1068                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1069                                 rule->wmm_rule.client[j].cw_max) ||
1070                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1071                                rule->wmm_rule.client[j].aifsn) ||
1072                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1073                                 rule->wmm_rule.client[j].cot))
1074                         goto nla_put_failure;
1075
1076                 nla_nest_end(msg, nl_wmm_rule);
1077         }
1078         nla_nest_end(msg, nl_wmm_rules);
1079
1080         return 0;
1081
1082 nla_put_failure:
1083         return -ENOBUFS;
1084 }
1085
1086 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1087                                    struct ieee80211_channel *chan,
1088                                    bool large)
1089 {
1090         /* Some channels must be completely excluded from the
1091          * list to protect old user-space tools from breaking
1092          */
1093         if (!large && chan->flags &
1094             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1095                 return 0;
1096         if (!large && chan->freq_offset)
1097                 return 0;
1098
1099         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1100                         chan->center_freq))
1101                 goto nla_put_failure;
1102
1103         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1104                 goto nla_put_failure;
1105
1106         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1107             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1108                 goto nla_put_failure;
1109         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1110                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1111                         goto nla_put_failure;
1112                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1113                         goto nla_put_failure;
1114         }
1115         if (chan->flags & IEEE80211_CHAN_RADAR) {
1116                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1117                         goto nla_put_failure;
1118                 if (large) {
1119                         u32 time;
1120
1121                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1122
1123                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1124                                         chan->dfs_state))
1125                                 goto nla_put_failure;
1126                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1127                                         time))
1128                                 goto nla_put_failure;
1129                         if (nla_put_u32(msg,
1130                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1131                                         chan->dfs_cac_ms))
1132                                 goto nla_put_failure;
1133                 }
1134         }
1135
1136         if (large) {
1137                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1138                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1139                         goto nla_put_failure;
1140                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1141                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1142                         goto nla_put_failure;
1143                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1144                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1145                         goto nla_put_failure;
1146                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1147                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1148                         goto nla_put_failure;
1149                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1150                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1151                         goto nla_put_failure;
1152                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1153                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1154                         goto nla_put_failure;
1155                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1156                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1157                         goto nla_put_failure;
1158                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1159                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1160                         goto nla_put_failure;
1161                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1162                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1163                         goto nla_put_failure;
1164                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1165                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1166                         goto nla_put_failure;
1167                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1168                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1169                         goto nla_put_failure;
1170                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1171                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1172                         goto nla_put_failure;
1173                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1174                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1175                         goto nla_put_failure;
1176                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1177                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1178                         goto nla_put_failure;
1179                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1180                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1181                         goto nla_put_failure;
1182                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1183                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1184                         goto nla_put_failure;
1185         }
1186
1187         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1188                         DBM_TO_MBM(chan->max_power)))
1189                 goto nla_put_failure;
1190
1191         if (large) {
1192                 const struct ieee80211_reg_rule *rule =
1193                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1194
1195                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1196                         if (nl80211_msg_put_wmm_rules(msg, rule))
1197                                 goto nla_put_failure;
1198                 }
1199         }
1200
1201         return 0;
1202
1203  nla_put_failure:
1204         return -ENOBUFS;
1205 }
1206
1207 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1208                                   struct cfg80211_txq_stats *txqstats,
1209                                   int attrtype)
1210 {
1211         struct nlattr *txqattr;
1212
1213 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1214         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1215             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1216                 return false;                                             \
1217         } while (0)
1218
1219         txqattr = nla_nest_start_noflag(msg, attrtype);
1220         if (!txqattr)
1221                 return false;
1222
1223         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1224         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1225         PUT_TXQVAL_U32(FLOWS, flows);
1226         PUT_TXQVAL_U32(DROPS, drops);
1227         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1228         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1229         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1230         PUT_TXQVAL_U32(COLLISIONS, collisions);
1231         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1232         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1233         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1234         nla_nest_end(msg, txqattr);
1235
1236 #undef PUT_TXQVAL_U32
1237         return true;
1238 }
1239
1240 /* netlink command implementations */
1241
1242 /**
1243  * nl80211_link_id - return link ID
1244  * @attrs: attributes to look at
1245  *
1246  * Returns: the link ID or 0 if not given
1247  *
1248  * Note this function doesn't do any validation of the link
1249  * ID validity wrt. links that were actually added, so it must
1250  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1251  * or if additional validation is done.
1252  */
1253 static unsigned int nl80211_link_id(struct nlattr **attrs)
1254 {
1255         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1256
1257         if (!linkid)
1258                 return 0;
1259
1260         return nla_get_u8(linkid);
1261 }
1262
1263 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1264 {
1265         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1266
1267         if (!linkid)
1268                 return -1;
1269
1270         return nla_get_u8(linkid);
1271 }
1272
1273 struct key_parse {
1274         struct key_params p;
1275         int idx;
1276         int type;
1277         bool def, defmgmt, defbeacon;
1278         bool def_uni, def_multi;
1279 };
1280
1281 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1282                                  struct key_parse *k)
1283 {
1284         struct nlattr *tb[NL80211_KEY_MAX + 1];
1285         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1286                                               nl80211_key_policy,
1287                                               info->extack);
1288         if (err)
1289                 return err;
1290
1291         k->def = !!tb[NL80211_KEY_DEFAULT];
1292         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1293         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1294
1295         if (k->def) {
1296                 k->def_uni = true;
1297                 k->def_multi = true;
1298         }
1299         if (k->defmgmt || k->defbeacon)
1300                 k->def_multi = true;
1301
1302         if (tb[NL80211_KEY_IDX])
1303                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1304
1305         if (tb[NL80211_KEY_DATA]) {
1306                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1307                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1308         }
1309
1310         if (tb[NL80211_KEY_SEQ]) {
1311                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1312                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1313         }
1314
1315         if (tb[NL80211_KEY_CIPHER])
1316                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1317
1318         if (tb[NL80211_KEY_TYPE])
1319                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1320
1321         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1322                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1323
1324                 err = nla_parse_nested_deprecated(kdt,
1325                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1326                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1327                                                   nl80211_key_default_policy,
1328                                                   info->extack);
1329                 if (err)
1330                         return err;
1331
1332                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1333                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1334         }
1335
1336         if (tb[NL80211_KEY_MODE])
1337                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1338
1339         return 0;
1340 }
1341
1342 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1343 {
1344         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1345                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1346                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1347         }
1348
1349         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1350                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1351                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1352         }
1353
1354         if (info->attrs[NL80211_ATTR_KEY_IDX])
1355                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1356
1357         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1358                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1359
1360         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1361         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1362
1363         if (k->def) {
1364                 k->def_uni = true;
1365                 k->def_multi = true;
1366         }
1367         if (k->defmgmt)
1368                 k->def_multi = true;
1369
1370         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1371                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1372
1373         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1374                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1375                 int err = nla_parse_nested_deprecated(kdt,
1376                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1377                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1378                                                       nl80211_key_default_policy,
1379                                                       info->extack);
1380                 if (err)
1381                         return err;
1382
1383                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1384                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1385         }
1386
1387         return 0;
1388 }
1389
1390 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1391 {
1392         int err;
1393
1394         memset(k, 0, sizeof(*k));
1395         k->idx = -1;
1396         k->type = -1;
1397
1398         if (info->attrs[NL80211_ATTR_KEY])
1399                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1400         else
1401                 err = nl80211_parse_key_old(info, k);
1402
1403         if (err)
1404                 return err;
1405
1406         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1407             (k->defbeacon ? 1 : 0) > 1) {
1408                 GENL_SET_ERR_MSG(info,
1409                                  "key with multiple default flags is invalid");
1410                 return -EINVAL;
1411         }
1412
1413         if (k->defmgmt || k->defbeacon) {
1414                 if (k->def_uni || !k->def_multi) {
1415                         GENL_SET_ERR_MSG(info,
1416                                          "defmgmt/defbeacon key must be mcast");
1417                         return -EINVAL;
1418                 }
1419         }
1420
1421         if (k->idx != -1) {
1422                 if (k->defmgmt) {
1423                         if (k->idx < 4 || k->idx > 5) {
1424                                 GENL_SET_ERR_MSG(info,
1425                                                  "defmgmt key idx not 4 or 5");
1426                                 return -EINVAL;
1427                         }
1428                 } else if (k->defbeacon) {
1429                         if (k->idx < 6 || k->idx > 7) {
1430                                 GENL_SET_ERR_MSG(info,
1431                                                  "defbeacon key idx not 6 or 7");
1432                                 return -EINVAL;
1433                         }
1434                 } else if (k->def) {
1435                         if (k->idx < 0 || k->idx > 3) {
1436                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1437                                 return -EINVAL;
1438                         }
1439                 } else {
1440                         if (k->idx < 0 || k->idx > 7) {
1441                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1442                                 return -EINVAL;
1443                         }
1444                 }
1445         }
1446
1447         return 0;
1448 }
1449
1450 static struct cfg80211_cached_keys *
1451 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1452                        struct genl_info *info, bool *no_ht)
1453 {
1454         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1455         struct key_parse parse;
1456         struct nlattr *key;
1457         struct cfg80211_cached_keys *result;
1458         int rem, err, def = 0;
1459         bool have_key = false;
1460
1461         nla_for_each_nested(key, keys, rem) {
1462                 have_key = true;
1463                 break;
1464         }
1465
1466         if (!have_key)
1467                 return NULL;
1468
1469         result = kzalloc(sizeof(*result), GFP_KERNEL);
1470         if (!result)
1471                 return ERR_PTR(-ENOMEM);
1472
1473         result->def = -1;
1474
1475         nla_for_each_nested(key, keys, rem) {
1476                 memset(&parse, 0, sizeof(parse));
1477                 parse.idx = -1;
1478
1479                 err = nl80211_parse_key_new(info, key, &parse);
1480                 if (err)
1481                         goto error;
1482                 err = -EINVAL;
1483                 if (!parse.p.key)
1484                         goto error;
1485                 if (parse.idx < 0 || parse.idx > 3) {
1486                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1487                         goto error;
1488                 }
1489                 if (parse.def) {
1490                         if (def) {
1491                                 GENL_SET_ERR_MSG(info,
1492                                                  "only one key can be default");
1493                                 goto error;
1494                         }
1495                         def = 1;
1496                         result->def = parse.idx;
1497                         if (!parse.def_uni || !parse.def_multi)
1498                                 goto error;
1499                 } else if (parse.defmgmt)
1500                         goto error;
1501                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1502                                                      parse.idx, false, NULL);
1503                 if (err)
1504                         goto error;
1505                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1506                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1507                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1508                         err = -EINVAL;
1509                         goto error;
1510                 }
1511                 result->params[parse.idx].cipher = parse.p.cipher;
1512                 result->params[parse.idx].key_len = parse.p.key_len;
1513                 result->params[parse.idx].key = result->data[parse.idx];
1514                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1515
1516                 /* must be WEP key if we got here */
1517                 if (no_ht)
1518                         *no_ht = true;
1519         }
1520
1521         if (result->def < 0) {
1522                 err = -EINVAL;
1523                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1524                 goto error;
1525         }
1526
1527         return result;
1528  error:
1529         kfree(result);
1530         return ERR_PTR(err);
1531 }
1532
1533 static int nl80211_key_allowed(struct wireless_dev *wdev)
1534 {
1535         ASSERT_WDEV_LOCK(wdev);
1536
1537         switch (wdev->iftype) {
1538         case NL80211_IFTYPE_AP:
1539         case NL80211_IFTYPE_AP_VLAN:
1540         case NL80211_IFTYPE_P2P_GO:
1541         case NL80211_IFTYPE_MESH_POINT:
1542                 break;
1543         case NL80211_IFTYPE_ADHOC:
1544                 if (wdev->u.ibss.current_bss)
1545                         return 0;
1546                 return -ENOLINK;
1547         case NL80211_IFTYPE_STATION:
1548         case NL80211_IFTYPE_P2P_CLIENT:
1549                 if (wdev->connected)
1550                         return 0;
1551                 return -ENOLINK;
1552         case NL80211_IFTYPE_UNSPECIFIED:
1553         case NL80211_IFTYPE_OCB:
1554         case NL80211_IFTYPE_MONITOR:
1555         case NL80211_IFTYPE_NAN:
1556         case NL80211_IFTYPE_P2P_DEVICE:
1557         case NL80211_IFTYPE_WDS:
1558         case NUM_NL80211_IFTYPES:
1559                 return -EINVAL;
1560         }
1561
1562         return 0;
1563 }
1564
1565 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1566                                                         u32 freq)
1567 {
1568         struct ieee80211_channel *chan;
1569
1570         chan = ieee80211_get_channel_khz(wiphy, freq);
1571         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1572                 return NULL;
1573         return chan;
1574 }
1575
1576 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1577 {
1578         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1579         int i;
1580
1581         if (!nl_modes)
1582                 goto nla_put_failure;
1583
1584         i = 0;
1585         while (ifmodes) {
1586                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1587                         goto nla_put_failure;
1588                 ifmodes >>= 1;
1589                 i++;
1590         }
1591
1592         nla_nest_end(msg, nl_modes);
1593         return 0;
1594
1595 nla_put_failure:
1596         return -ENOBUFS;
1597 }
1598
1599 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1600                                           struct sk_buff *msg,
1601                                           bool large)
1602 {
1603         struct nlattr *nl_combis;
1604         int i, j;
1605
1606         nl_combis = nla_nest_start_noflag(msg,
1607                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1608         if (!nl_combis)
1609                 goto nla_put_failure;
1610
1611         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1612                 const struct ieee80211_iface_combination *c;
1613                 struct nlattr *nl_combi, *nl_limits;
1614
1615                 c = &wiphy->iface_combinations[i];
1616
1617                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1618                 if (!nl_combi)
1619                         goto nla_put_failure;
1620
1621                 nl_limits = nla_nest_start_noflag(msg,
1622                                                   NL80211_IFACE_COMB_LIMITS);
1623                 if (!nl_limits)
1624                         goto nla_put_failure;
1625
1626                 for (j = 0; j < c->n_limits; j++) {
1627                         struct nlattr *nl_limit;
1628
1629                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1630                         if (!nl_limit)
1631                                 goto nla_put_failure;
1632                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1633                                         c->limits[j].max))
1634                                 goto nla_put_failure;
1635                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1636                                                 c->limits[j].types))
1637                                 goto nla_put_failure;
1638                         nla_nest_end(msg, nl_limit);
1639                 }
1640
1641                 nla_nest_end(msg, nl_limits);
1642
1643                 if (c->beacon_int_infra_match &&
1644                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1645                         goto nla_put_failure;
1646                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1647                                 c->num_different_channels) ||
1648                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1649                                 c->max_interfaces))
1650                         goto nla_put_failure;
1651                 if (large &&
1652                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1653                                 c->radar_detect_widths) ||
1654                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1655                                 c->radar_detect_regions)))
1656                         goto nla_put_failure;
1657                 if (c->beacon_int_min_gcd &&
1658                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1659                                 c->beacon_int_min_gcd))
1660                         goto nla_put_failure;
1661
1662                 nla_nest_end(msg, nl_combi);
1663         }
1664
1665         nla_nest_end(msg, nl_combis);
1666
1667         return 0;
1668 nla_put_failure:
1669         return -ENOBUFS;
1670 }
1671
1672 #ifdef CONFIG_PM
1673 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1674                                         struct sk_buff *msg)
1675 {
1676         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1677         struct nlattr *nl_tcp;
1678
1679         if (!tcp)
1680                 return 0;
1681
1682         nl_tcp = nla_nest_start_noflag(msg,
1683                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1684         if (!nl_tcp)
1685                 return -ENOBUFS;
1686
1687         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1688                         tcp->data_payload_max))
1689                 return -ENOBUFS;
1690
1691         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1692                         tcp->data_payload_max))
1693                 return -ENOBUFS;
1694
1695         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1696                 return -ENOBUFS;
1697
1698         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1699                                 sizeof(*tcp->tok), tcp->tok))
1700                 return -ENOBUFS;
1701
1702         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1703                         tcp->data_interval_max))
1704                 return -ENOBUFS;
1705
1706         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1707                         tcp->wake_payload_max))
1708                 return -ENOBUFS;
1709
1710         nla_nest_end(msg, nl_tcp);
1711         return 0;
1712 }
1713
1714 static int nl80211_send_wowlan(struct sk_buff *msg,
1715                                struct cfg80211_registered_device *rdev,
1716                                bool large)
1717 {
1718         struct nlattr *nl_wowlan;
1719
1720         if (!rdev->wiphy.wowlan)
1721                 return 0;
1722
1723         nl_wowlan = nla_nest_start_noflag(msg,
1724                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1725         if (!nl_wowlan)
1726                 return -ENOBUFS;
1727
1728         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1729              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1730             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1731              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1732             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1733              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1734             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1735              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1736             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1737              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1738             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1739              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1740             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1741              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1742             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1743              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1744                 return -ENOBUFS;
1745
1746         if (rdev->wiphy.wowlan->n_patterns) {
1747                 struct nl80211_pattern_support pat = {
1748                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1749                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1750                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1751                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1752                 };
1753
1754                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1755                             sizeof(pat), &pat))
1756                         return -ENOBUFS;
1757         }
1758
1759         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1760             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1761                         rdev->wiphy.wowlan->max_nd_match_sets))
1762                 return -ENOBUFS;
1763
1764         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1765                 return -ENOBUFS;
1766
1767         nla_nest_end(msg, nl_wowlan);
1768
1769         return 0;
1770 }
1771 #endif
1772
1773 static int nl80211_send_coalesce(struct sk_buff *msg,
1774                                  struct cfg80211_registered_device *rdev)
1775 {
1776         struct nl80211_coalesce_rule_support rule;
1777
1778         if (!rdev->wiphy.coalesce)
1779                 return 0;
1780
1781         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1782         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1783         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1784         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1785         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1786         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1787
1788         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1789                 return -ENOBUFS;
1790
1791         return 0;
1792 }
1793
1794 static int
1795 nl80211_send_iftype_data(struct sk_buff *msg,
1796                          const struct ieee80211_supported_band *sband,
1797                          const struct ieee80211_sband_iftype_data *iftdata)
1798 {
1799         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1800         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1801
1802         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1803                                 iftdata->types_mask))
1804                 return -ENOBUFS;
1805
1806         if (he_cap->has_he) {
1807                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1808                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1809                             he_cap->he_cap_elem.mac_cap_info) ||
1810                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1811                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1812                             he_cap->he_cap_elem.phy_cap_info) ||
1813                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1814                             sizeof(he_cap->he_mcs_nss_supp),
1815                             &he_cap->he_mcs_nss_supp) ||
1816                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1817                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1818                         return -ENOBUFS;
1819         }
1820
1821         if (eht_cap->has_eht && he_cap->has_he) {
1822                 u8 mcs_nss_size, ppe_thresh_size;
1823                 u16 ppe_thres_hdr;
1824                 bool is_ap;
1825
1826                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1827                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1828
1829                 mcs_nss_size =
1830                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1831                                                    &eht_cap->eht_cap_elem,
1832                                                    is_ap);
1833
1834                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1835                 ppe_thresh_size =
1836                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1837                                                eht_cap->eht_cap_elem.phy_cap_info);
1838
1839                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1840                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1841                             eht_cap->eht_cap_elem.mac_cap_info) ||
1842                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1843                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1844                             eht_cap->eht_cap_elem.phy_cap_info) ||
1845                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1846                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1847                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1848                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1849                         return -ENOBUFS;
1850         }
1851
1852         if (sband->band == NL80211_BAND_6GHZ &&
1853             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1854                     sizeof(iftdata->he_6ghz_capa),
1855                     &iftdata->he_6ghz_capa))
1856                 return -ENOBUFS;
1857
1858         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1859             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1860                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1861                 return -ENOBUFS;
1862
1863         return 0;
1864 }
1865
1866 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1867                                       struct ieee80211_supported_band *sband,
1868                                       bool large)
1869 {
1870         struct nlattr *nl_rates, *nl_rate;
1871         struct ieee80211_rate *rate;
1872         int i;
1873
1874         /* add HT info */
1875         if (sband->ht_cap.ht_supported &&
1876             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1877                      sizeof(sband->ht_cap.mcs),
1878                      &sband->ht_cap.mcs) ||
1879              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1880                          sband->ht_cap.cap) ||
1881              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1882                         sband->ht_cap.ampdu_factor) ||
1883              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1884                         sband->ht_cap.ampdu_density)))
1885                 return -ENOBUFS;
1886
1887         /* add VHT info */
1888         if (sband->vht_cap.vht_supported &&
1889             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1890                      sizeof(sband->vht_cap.vht_mcs),
1891                      &sband->vht_cap.vht_mcs) ||
1892              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1893                          sband->vht_cap.cap)))
1894                 return -ENOBUFS;
1895
1896         if (large && sband->n_iftype_data) {
1897                 struct nlattr *nl_iftype_data =
1898                         nla_nest_start_noflag(msg,
1899                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1900                 int err;
1901
1902                 if (!nl_iftype_data)
1903                         return -ENOBUFS;
1904
1905                 for (i = 0; i < sband->n_iftype_data; i++) {
1906                         struct nlattr *iftdata;
1907
1908                         iftdata = nla_nest_start_noflag(msg, i + 1);
1909                         if (!iftdata)
1910                                 return -ENOBUFS;
1911
1912                         err = nl80211_send_iftype_data(msg, sband,
1913                                                        &sband->iftype_data[i]);
1914                         if (err)
1915                                 return err;
1916
1917                         nla_nest_end(msg, iftdata);
1918                 }
1919
1920                 nla_nest_end(msg, nl_iftype_data);
1921         }
1922
1923         /* add EDMG info */
1924         if (large && sband->edmg_cap.channels &&
1925             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1926                        sband->edmg_cap.channels) ||
1927             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1928                        sband->edmg_cap.bw_config)))
1929
1930                 return -ENOBUFS;
1931
1932         /* add bitrates */
1933         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1934         if (!nl_rates)
1935                 return -ENOBUFS;
1936
1937         for (i = 0; i < sband->n_bitrates; i++) {
1938                 nl_rate = nla_nest_start_noflag(msg, i);
1939                 if (!nl_rate)
1940                         return -ENOBUFS;
1941
1942                 rate = &sband->bitrates[i];
1943                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1944                                 rate->bitrate))
1945                         return -ENOBUFS;
1946                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1947                     nla_put_flag(msg,
1948                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1949                         return -ENOBUFS;
1950
1951                 nla_nest_end(msg, nl_rate);
1952         }
1953
1954         nla_nest_end(msg, nl_rates);
1955
1956         return 0;
1957 }
1958
1959 static int
1960 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1961                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1962 {
1963         u16 stypes;
1964         struct nlattr *nl_ftypes, *nl_ifs;
1965         enum nl80211_iftype ift;
1966         int i;
1967
1968         if (!mgmt_stypes)
1969                 return 0;
1970
1971         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1972         if (!nl_ifs)
1973                 return -ENOBUFS;
1974
1975         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1976                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1977                 if (!nl_ftypes)
1978                         return -ENOBUFS;
1979                 i = 0;
1980                 stypes = mgmt_stypes[ift].tx;
1981                 while (stypes) {
1982                         if ((stypes & 1) &&
1983                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1984                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1985                                 return -ENOBUFS;
1986                         stypes >>= 1;
1987                         i++;
1988                 }
1989                 nla_nest_end(msg, nl_ftypes);
1990         }
1991
1992         nla_nest_end(msg, nl_ifs);
1993
1994         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1995         if (!nl_ifs)
1996                 return -ENOBUFS;
1997
1998         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1999                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2000                 if (!nl_ftypes)
2001                         return -ENOBUFS;
2002                 i = 0;
2003                 stypes = mgmt_stypes[ift].rx;
2004                 while (stypes) {
2005                         if ((stypes & 1) &&
2006                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2007                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2008                                 return -ENOBUFS;
2009                         stypes >>= 1;
2010                         i++;
2011                 }
2012                 nla_nest_end(msg, nl_ftypes);
2013         }
2014         nla_nest_end(msg, nl_ifs);
2015
2016         return 0;
2017 }
2018
2019 #define CMD(op, n)                                                      \
2020          do {                                                           \
2021                 if (rdev->ops->op) {                                    \
2022                         i++;                                            \
2023                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2024                                 goto nla_put_failure;                   \
2025                 }                                                       \
2026         } while (0)
2027
2028 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2029                                         struct sk_buff *msg)
2030 {
2031         int i = 0;
2032
2033         /*
2034          * do *NOT* add anything into this function, new things need to be
2035          * advertised only to new versions of userspace that can deal with
2036          * the split (and they can't possibly care about new features...
2037          */
2038         CMD(add_virtual_intf, NEW_INTERFACE);
2039         CMD(change_virtual_intf, SET_INTERFACE);
2040         CMD(add_key, NEW_KEY);
2041         CMD(start_ap, START_AP);
2042         CMD(add_station, NEW_STATION);
2043         CMD(add_mpath, NEW_MPATH);
2044         CMD(update_mesh_config, SET_MESH_CONFIG);
2045         CMD(change_bss, SET_BSS);
2046         CMD(auth, AUTHENTICATE);
2047         CMD(assoc, ASSOCIATE);
2048         CMD(deauth, DEAUTHENTICATE);
2049         CMD(disassoc, DISASSOCIATE);
2050         CMD(join_ibss, JOIN_IBSS);
2051         CMD(join_mesh, JOIN_MESH);
2052         CMD(set_pmksa, SET_PMKSA);
2053         CMD(del_pmksa, DEL_PMKSA);
2054         CMD(flush_pmksa, FLUSH_PMKSA);
2055         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2056                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2057         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2058         CMD(mgmt_tx, FRAME);
2059         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2060         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2061                 i++;
2062                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2063                         goto nla_put_failure;
2064         }
2065         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2066             rdev->ops->join_mesh) {
2067                 i++;
2068                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2069                         goto nla_put_failure;
2070         }
2071         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2072                 CMD(tdls_mgmt, TDLS_MGMT);
2073                 CMD(tdls_oper, TDLS_OPER);
2074         }
2075         if (rdev->wiphy.max_sched_scan_reqs)
2076                 CMD(sched_scan_start, START_SCHED_SCAN);
2077         CMD(probe_client, PROBE_CLIENT);
2078         CMD(set_noack_map, SET_NOACK_MAP);
2079         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2080                 i++;
2081                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2082                         goto nla_put_failure;
2083         }
2084         CMD(start_p2p_device, START_P2P_DEVICE);
2085         CMD(set_mcast_rate, SET_MCAST_RATE);
2086 #ifdef CONFIG_NL80211_TESTMODE
2087         CMD(testmode_cmd, TESTMODE);
2088 #endif
2089
2090         if (rdev->ops->connect || rdev->ops->auth) {
2091                 i++;
2092                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2093                         goto nla_put_failure;
2094         }
2095
2096         if (rdev->ops->disconnect || rdev->ops->deauth) {
2097                 i++;
2098                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2099                         goto nla_put_failure;
2100         }
2101
2102         return i;
2103  nla_put_failure:
2104         return -ENOBUFS;
2105 }
2106
2107 static int
2108 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2109                            struct sk_buff *msg)
2110 {
2111         struct nlattr *ftm;
2112
2113         if (!cap->ftm.supported)
2114                 return 0;
2115
2116         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2117         if (!ftm)
2118                 return -ENOBUFS;
2119
2120         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2121                 return -ENOBUFS;
2122         if (cap->ftm.non_asap &&
2123             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2124                 return -ENOBUFS;
2125         if (cap->ftm.request_lci &&
2126             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2127                 return -ENOBUFS;
2128         if (cap->ftm.request_civicloc &&
2129             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2130                 return -ENOBUFS;
2131         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2132                         cap->ftm.preambles))
2133                 return -ENOBUFS;
2134         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2135                         cap->ftm.bandwidths))
2136                 return -ENOBUFS;
2137         if (cap->ftm.max_bursts_exponent >= 0 &&
2138             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2139                         cap->ftm.max_bursts_exponent))
2140                 return -ENOBUFS;
2141         if (cap->ftm.max_ftms_per_burst &&
2142             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2143                         cap->ftm.max_ftms_per_burst))
2144                 return -ENOBUFS;
2145         if (cap->ftm.trigger_based &&
2146             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2147                 return -ENOBUFS;
2148         if (cap->ftm.non_trigger_based &&
2149             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2150                 return -ENOBUFS;
2151
2152         nla_nest_end(msg, ftm);
2153         return 0;
2154 }
2155
2156 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2157                                   struct sk_buff *msg)
2158 {
2159         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2160         struct nlattr *pmsr, *caps;
2161
2162         if (!cap)
2163                 return 0;
2164
2165         /*
2166          * we don't need to clean up anything here since the caller
2167          * will genlmsg_cancel() if we fail
2168          */
2169
2170         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2171         if (!pmsr)
2172                 return -ENOBUFS;
2173
2174         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2175                 return -ENOBUFS;
2176
2177         if (cap->report_ap_tsf &&
2178             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2179                 return -ENOBUFS;
2180
2181         if (cap->randomize_mac_addr &&
2182             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2183                 return -ENOBUFS;
2184
2185         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2186         if (!caps)
2187                 return -ENOBUFS;
2188
2189         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2190                 return -ENOBUFS;
2191
2192         nla_nest_end(msg, caps);
2193         nla_nest_end(msg, pmsr);
2194
2195         return 0;
2196 }
2197
2198 static int
2199 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2200                               struct sk_buff *msg)
2201 {
2202         int i;
2203         struct nlattr *nested, *nested_akms;
2204         const struct wiphy_iftype_akm_suites *iftype_akms;
2205
2206         if (!rdev->wiphy.num_iftype_akm_suites ||
2207             !rdev->wiphy.iftype_akm_suites)
2208                 return 0;
2209
2210         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2211         if (!nested)
2212                 return -ENOBUFS;
2213
2214         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2215                 nested_akms = nla_nest_start(msg, i + 1);
2216                 if (!nested_akms)
2217                         return -ENOBUFS;
2218
2219                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2220
2221                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2222                                         iftype_akms->iftypes_mask))
2223                         return -ENOBUFS;
2224
2225                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2226                             sizeof(u32) * iftype_akms->n_akm_suites,
2227                             iftype_akms->akm_suites)) {
2228                         return -ENOBUFS;
2229                 }
2230                 nla_nest_end(msg, nested_akms);
2231         }
2232
2233         nla_nest_end(msg, nested);
2234
2235         return 0;
2236 }
2237
2238 static int
2239 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2240                                struct sk_buff *msg)
2241 {
2242         struct nlattr *supp;
2243
2244         if (!rdev->wiphy.tid_config_support.vif &&
2245             !rdev->wiphy.tid_config_support.peer)
2246                 return 0;
2247
2248         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2249         if (!supp)
2250                 return -ENOSPC;
2251
2252         if (rdev->wiphy.tid_config_support.vif &&
2253             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2254                               rdev->wiphy.tid_config_support.vif,
2255                               NL80211_TID_CONFIG_ATTR_PAD))
2256                 goto fail;
2257
2258         if (rdev->wiphy.tid_config_support.peer &&
2259             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2260                               rdev->wiphy.tid_config_support.peer,
2261                               NL80211_TID_CONFIG_ATTR_PAD))
2262                 goto fail;
2263
2264         /* for now we just use the same value ... makes more sense */
2265         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2266                        rdev->wiphy.tid_config_support.max_retry))
2267                 goto fail;
2268         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2269                        rdev->wiphy.tid_config_support.max_retry))
2270                 goto fail;
2271
2272         nla_nest_end(msg, supp);
2273
2274         return 0;
2275 fail:
2276         nla_nest_cancel(msg, supp);
2277         return -ENOBUFS;
2278 }
2279
2280 static int
2281 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2282                       struct sk_buff *msg)
2283 {
2284         struct nlattr *sar_capa, *specs, *sub_freq_range;
2285         u8 num_freq_ranges;
2286         int i;
2287
2288         if (!rdev->wiphy.sar_capa)
2289                 return 0;
2290
2291         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2292
2293         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2294         if (!sar_capa)
2295                 return -ENOSPC;
2296
2297         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2298                 goto fail;
2299
2300         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2301         if (!specs)
2302                 goto fail;
2303
2304         /* report supported freq_ranges */
2305         for (i = 0; i < num_freq_ranges; i++) {
2306                 sub_freq_range = nla_nest_start(msg, i + 1);
2307                 if (!sub_freq_range)
2308                         goto fail;
2309
2310                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2311                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2312                         goto fail;
2313
2314                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2315                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2316                         goto fail;
2317
2318                 nla_nest_end(msg, sub_freq_range);
2319         }
2320
2321         nla_nest_end(msg, specs);
2322         nla_nest_end(msg, sar_capa);
2323
2324         return 0;
2325 fail:
2326         nla_nest_cancel(msg, sar_capa);
2327         return -ENOBUFS;
2328 }
2329
2330 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2331 {
2332         struct nlattr *config;
2333
2334         if (!wiphy->mbssid_max_interfaces)
2335                 return 0;
2336
2337         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2338         if (!config)
2339                 return -ENOBUFS;
2340
2341         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2342                        wiphy->mbssid_max_interfaces))
2343                 goto fail;
2344
2345         if (wiphy->ema_max_profile_periodicity &&
2346             nla_put_u8(msg,
2347                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2348                        wiphy->ema_max_profile_periodicity))
2349                 goto fail;
2350
2351         nla_nest_end(msg, config);
2352         return 0;
2353
2354 fail:
2355         nla_nest_cancel(msg, config);
2356         return -ENOBUFS;
2357 }
2358
2359 struct nl80211_dump_wiphy_state {
2360         s64 filter_wiphy;
2361         long start;
2362         long split_start, band_start, chan_start, capa_start;
2363         bool split;
2364 };
2365
2366 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2367                               enum nl80211_commands cmd,
2368                               struct sk_buff *msg, u32 portid, u32 seq,
2369                               int flags, struct nl80211_dump_wiphy_state *state)
2370 {
2371         void *hdr;
2372         struct nlattr *nl_bands, *nl_band;
2373         struct nlattr *nl_freqs, *nl_freq;
2374         struct nlattr *nl_cmds;
2375         enum nl80211_band band;
2376         struct ieee80211_channel *chan;
2377         int i;
2378         const struct ieee80211_txrx_stypes *mgmt_stypes =
2379                                 rdev->wiphy.mgmt_stypes;
2380         u32 features;
2381
2382         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2383         if (!hdr)
2384                 return -ENOBUFS;
2385
2386         if (WARN_ON(!state))
2387                 return -EINVAL;
2388
2389         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2390             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2391                            wiphy_name(&rdev->wiphy)) ||
2392             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2393                         cfg80211_rdev_list_generation))
2394                 goto nla_put_failure;
2395
2396         if (cmd != NL80211_CMD_NEW_WIPHY)
2397                 goto finish;
2398
2399         switch (state->split_start) {
2400         case 0:
2401                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2402                                rdev->wiphy.retry_short) ||
2403                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2404                                rdev->wiphy.retry_long) ||
2405                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2406                                 rdev->wiphy.frag_threshold) ||
2407                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2408                                 rdev->wiphy.rts_threshold) ||
2409                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2410                                rdev->wiphy.coverage_class) ||
2411                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2412                                rdev->wiphy.max_scan_ssids) ||
2413                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2414                                rdev->wiphy.max_sched_scan_ssids) ||
2415                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2416                                 rdev->wiphy.max_scan_ie_len) ||
2417                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2418                                 rdev->wiphy.max_sched_scan_ie_len) ||
2419                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2420                                rdev->wiphy.max_match_sets))
2421                         goto nla_put_failure;
2422
2423                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2424                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2425                         goto nla_put_failure;
2426                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2427                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2428                         goto nla_put_failure;
2429                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2430                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2431                         goto nla_put_failure;
2432                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2433                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2434                         goto nla_put_failure;
2435                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2436                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2437                         goto nla_put_failure;
2438                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2439                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2440                         goto nla_put_failure;
2441                 state->split_start++;
2442                 if (state->split)
2443                         break;
2444                 fallthrough;
2445         case 1:
2446                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2447                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2448                             rdev->wiphy.cipher_suites))
2449                         goto nla_put_failure;
2450
2451                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2452                                rdev->wiphy.max_num_pmkids))
2453                         goto nla_put_failure;
2454
2455                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2456                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2457                         goto nla_put_failure;
2458
2459                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2460                                 rdev->wiphy.available_antennas_tx) ||
2461                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2462                                 rdev->wiphy.available_antennas_rx))
2463                         goto nla_put_failure;
2464
2465                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2466                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2467                                 rdev->wiphy.probe_resp_offload))
2468                         goto nla_put_failure;
2469
2470                 if ((rdev->wiphy.available_antennas_tx ||
2471                      rdev->wiphy.available_antennas_rx) &&
2472                     rdev->ops->get_antenna) {
2473                         u32 tx_ant = 0, rx_ant = 0;
2474                         int res;
2475
2476                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2477                         if (!res) {
2478                                 if (nla_put_u32(msg,
2479                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2480                                                 tx_ant) ||
2481                                     nla_put_u32(msg,
2482                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2483                                                 rx_ant))
2484                                         goto nla_put_failure;
2485                         }
2486                 }
2487
2488                 state->split_start++;
2489                 if (state->split)
2490                         break;
2491                 fallthrough;
2492         case 2:
2493                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2494                                         rdev->wiphy.interface_modes))
2495                                 goto nla_put_failure;
2496                 state->split_start++;
2497                 if (state->split)
2498                         break;
2499                 fallthrough;
2500         case 3:
2501                 nl_bands = nla_nest_start_noflag(msg,
2502                                                  NL80211_ATTR_WIPHY_BANDS);
2503                 if (!nl_bands)
2504                         goto nla_put_failure;
2505
2506                 for (band = state->band_start;
2507                      band < (state->split ?
2508                                 NUM_NL80211_BANDS :
2509                                 NL80211_BAND_60GHZ + 1);
2510                      band++) {
2511                         struct ieee80211_supported_band *sband;
2512
2513                         /* omit higher bands for ancient software */
2514                         if (band > NL80211_BAND_5GHZ && !state->split)
2515                                 break;
2516
2517                         sband = rdev->wiphy.bands[band];
2518
2519                         if (!sband)
2520                                 continue;
2521
2522                         nl_band = nla_nest_start_noflag(msg, band);
2523                         if (!nl_band)
2524                                 goto nla_put_failure;
2525
2526                         switch (state->chan_start) {
2527                         case 0:
2528                                 if (nl80211_send_band_rateinfo(msg, sband,
2529                                                                state->split))
2530                                         goto nla_put_failure;
2531                                 state->chan_start++;
2532                                 if (state->split)
2533                                         break;
2534                                 fallthrough;
2535                         default:
2536                                 /* add frequencies */
2537                                 nl_freqs = nla_nest_start_noflag(msg,
2538                                                                  NL80211_BAND_ATTR_FREQS);
2539                                 if (!nl_freqs)
2540                                         goto nla_put_failure;
2541
2542                                 for (i = state->chan_start - 1;
2543                                      i < sband->n_channels;
2544                                      i++) {
2545                                         nl_freq = nla_nest_start_noflag(msg,
2546                                                                         i);
2547                                         if (!nl_freq)
2548                                                 goto nla_put_failure;
2549
2550                                         chan = &sband->channels[i];
2551
2552                                         if (nl80211_msg_put_channel(
2553                                                         msg, &rdev->wiphy, chan,
2554                                                         state->split))
2555                                                 goto nla_put_failure;
2556
2557                                         nla_nest_end(msg, nl_freq);
2558                                         if (state->split)
2559                                                 break;
2560                                 }
2561                                 if (i < sband->n_channels)
2562                                         state->chan_start = i + 2;
2563                                 else
2564                                         state->chan_start = 0;
2565                                 nla_nest_end(msg, nl_freqs);
2566                         }
2567
2568                         nla_nest_end(msg, nl_band);
2569
2570                         if (state->split) {
2571                                 /* start again here */
2572                                 if (state->chan_start)
2573                                         band--;
2574                                 break;
2575                         }
2576                 }
2577                 nla_nest_end(msg, nl_bands);
2578
2579                 if (band < NUM_NL80211_BANDS)
2580                         state->band_start = band + 1;
2581                 else
2582                         state->band_start = 0;
2583
2584                 /* if bands & channels are done, continue outside */
2585                 if (state->band_start == 0 && state->chan_start == 0)
2586                         state->split_start++;
2587                 if (state->split)
2588                         break;
2589                 fallthrough;
2590         case 4:
2591                 nl_cmds = nla_nest_start_noflag(msg,
2592                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2593                 if (!nl_cmds)
2594                         goto nla_put_failure;
2595
2596                 i = nl80211_add_commands_unsplit(rdev, msg);
2597                 if (i < 0)
2598                         goto nla_put_failure;
2599                 if (state->split) {
2600                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2601                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2602                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2603                                 CMD(channel_switch, CHANNEL_SWITCH);
2604                         CMD(set_qos_map, SET_QOS_MAP);
2605                         if (rdev->wiphy.features &
2606                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2607                                 CMD(add_tx_ts, ADD_TX_TS);
2608                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2609                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2610                         CMD(update_ft_ies, UPDATE_FT_IES);
2611                         if (rdev->wiphy.sar_capa)
2612                                 CMD(set_sar_specs, SET_SAR_SPECS);
2613                 }
2614 #undef CMD
2615
2616                 nla_nest_end(msg, nl_cmds);
2617                 state->split_start++;
2618                 if (state->split)
2619                         break;
2620                 fallthrough;
2621         case 5:
2622                 if (rdev->ops->remain_on_channel &&
2623                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2624                     nla_put_u32(msg,
2625                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2626                                 rdev->wiphy.max_remain_on_channel_duration))
2627                         goto nla_put_failure;
2628
2629                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2630                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2631                         goto nla_put_failure;
2632
2633                 state->split_start++;
2634                 if (state->split)
2635                         break;
2636                 fallthrough;
2637         case 6:
2638 #ifdef CONFIG_PM
2639                 if (nl80211_send_wowlan(msg, rdev, state->split))
2640                         goto nla_put_failure;
2641                 state->split_start++;
2642                 if (state->split)
2643                         break;
2644 #else
2645                 state->split_start++;
2646 #endif
2647                 fallthrough;
2648         case 7:
2649                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2650                                         rdev->wiphy.software_iftypes))
2651                         goto nla_put_failure;
2652
2653                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2654                                                    state->split))
2655                         goto nla_put_failure;
2656
2657                 state->split_start++;
2658                 if (state->split)
2659                         break;
2660                 fallthrough;
2661         case 8:
2662                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2663                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2664                                 rdev->wiphy.ap_sme_capa))
2665                         goto nla_put_failure;
2666
2667                 features = rdev->wiphy.features;
2668                 /*
2669                  * We can only add the per-channel limit information if the
2670                  * dump is split, otherwise it makes it too big. Therefore
2671                  * only advertise it in that case.
2672                  */
2673                 if (state->split)
2674                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2675                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2676                         goto nla_put_failure;
2677
2678                 if (rdev->wiphy.ht_capa_mod_mask &&
2679                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2680                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2681                             rdev->wiphy.ht_capa_mod_mask))
2682                         goto nla_put_failure;
2683
2684                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2685                     rdev->wiphy.max_acl_mac_addrs &&
2686                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2687                                 rdev->wiphy.max_acl_mac_addrs))
2688                         goto nla_put_failure;
2689
2690                 /*
2691                  * Any information below this point is only available to
2692                  * applications that can deal with it being split. This
2693                  * helps ensure that newly added capabilities don't break
2694                  * older tools by overrunning their buffers.
2695                  *
2696                  * We still increment split_start so that in the split
2697                  * case we'll continue with more data in the next round,
2698                  * but break unconditionally so unsplit data stops here.
2699                  */
2700                 if (state->split)
2701                         state->split_start++;
2702                 else
2703                         state->split_start = 0;
2704                 break;
2705         case 9:
2706                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2707                         goto nla_put_failure;
2708
2709                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2710                                 rdev->wiphy.max_sched_scan_plans) ||
2711                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2712                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2713                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2714                                 rdev->wiphy.max_sched_scan_plan_iterations))
2715                         goto nla_put_failure;
2716
2717                 if (rdev->wiphy.extended_capabilities &&
2718                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2719                              rdev->wiphy.extended_capabilities_len,
2720                              rdev->wiphy.extended_capabilities) ||
2721                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2722                              rdev->wiphy.extended_capabilities_len,
2723                              rdev->wiphy.extended_capabilities_mask)))
2724                         goto nla_put_failure;
2725
2726                 if (rdev->wiphy.vht_capa_mod_mask &&
2727                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2728                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2729                             rdev->wiphy.vht_capa_mod_mask))
2730                         goto nla_put_failure;
2731
2732                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2733                             rdev->wiphy.perm_addr))
2734                         goto nla_put_failure;
2735
2736                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2737                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2738                             rdev->wiphy.addr_mask))
2739                         goto nla_put_failure;
2740
2741                 if (rdev->wiphy.n_addresses > 1) {
2742                         void *attr;
2743
2744                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2745                         if (!attr)
2746                                 goto nla_put_failure;
2747
2748                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2749                                 if (nla_put(msg, i + 1, ETH_ALEN,
2750                                             rdev->wiphy.addresses[i].addr))
2751                                         goto nla_put_failure;
2752
2753                         nla_nest_end(msg, attr);
2754                 }
2755
2756                 state->split_start++;
2757                 break;
2758         case 10:
2759                 if (nl80211_send_coalesce(msg, rdev))
2760                         goto nla_put_failure;
2761
2762                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2763                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2764                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2765                         goto nla_put_failure;
2766
2767                 if (rdev->wiphy.max_ap_assoc_sta &&
2768                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2769                                 rdev->wiphy.max_ap_assoc_sta))
2770                         goto nla_put_failure;
2771
2772                 state->split_start++;
2773                 break;
2774         case 11:
2775                 if (rdev->wiphy.n_vendor_commands) {
2776                         const struct nl80211_vendor_cmd_info *info;
2777                         struct nlattr *nested;
2778
2779                         nested = nla_nest_start_noflag(msg,
2780                                                        NL80211_ATTR_VENDOR_DATA);
2781                         if (!nested)
2782                                 goto nla_put_failure;
2783
2784                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2785                                 info = &rdev->wiphy.vendor_commands[i].info;
2786                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2787                                         goto nla_put_failure;
2788                         }
2789                         nla_nest_end(msg, nested);
2790                 }
2791
2792                 if (rdev->wiphy.n_vendor_events) {
2793                         const struct nl80211_vendor_cmd_info *info;
2794                         struct nlattr *nested;
2795
2796                         nested = nla_nest_start_noflag(msg,
2797                                                        NL80211_ATTR_VENDOR_EVENTS);
2798                         if (!nested)
2799                                 goto nla_put_failure;
2800
2801                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2802                                 info = &rdev->wiphy.vendor_events[i];
2803                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2804                                         goto nla_put_failure;
2805                         }
2806                         nla_nest_end(msg, nested);
2807                 }
2808                 state->split_start++;
2809                 break;
2810         case 12:
2811                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2812                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2813                                rdev->wiphy.max_num_csa_counters))
2814                         goto nla_put_failure;
2815
2816                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2817                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2818                         goto nla_put_failure;
2819
2820                 if (rdev->wiphy.max_sched_scan_reqs &&
2821                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2822                                 rdev->wiphy.max_sched_scan_reqs))
2823                         goto nla_put_failure;
2824
2825                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2826                             sizeof(rdev->wiphy.ext_features),
2827                             rdev->wiphy.ext_features))
2828                         goto nla_put_failure;
2829
2830                 if (rdev->wiphy.bss_select_support) {
2831                         struct nlattr *nested;
2832                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2833
2834                         nested = nla_nest_start_noflag(msg,
2835                                                        NL80211_ATTR_BSS_SELECT);
2836                         if (!nested)
2837                                 goto nla_put_failure;
2838
2839                         i = 0;
2840                         while (bss_select_support) {
2841                                 if ((bss_select_support & 1) &&
2842                                     nla_put_flag(msg, i))
2843                                         goto nla_put_failure;
2844                                 i++;
2845                                 bss_select_support >>= 1;
2846                         }
2847                         nla_nest_end(msg, nested);
2848                 }
2849
2850                 state->split_start++;
2851                 break;
2852         case 13:
2853                 if (rdev->wiphy.num_iftype_ext_capab &&
2854                     rdev->wiphy.iftype_ext_capab) {
2855                         struct nlattr *nested_ext_capab, *nested;
2856
2857                         nested = nla_nest_start_noflag(msg,
2858                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2859                         if (!nested)
2860                                 goto nla_put_failure;
2861
2862                         for (i = state->capa_start;
2863                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2864                                 const struct wiphy_iftype_ext_capab *capab;
2865
2866                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2867
2868                                 nested_ext_capab = nla_nest_start_noflag(msg,
2869                                                                          i);
2870                                 if (!nested_ext_capab ||
2871                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2872                                                 capab->iftype) ||
2873                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2874                                             capab->extended_capabilities_len,
2875                                             capab->extended_capabilities) ||
2876                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2877                                             capab->extended_capabilities_len,
2878                                             capab->extended_capabilities_mask))
2879                                         goto nla_put_failure;
2880
2881                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2882                                     (nla_put_u16(msg,
2883                                                  NL80211_ATTR_EML_CAPABILITY,
2884                                                  capab->eml_capabilities) ||
2885                                      nla_put_u16(msg,
2886                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
2887                                                  capab->mld_capa_and_ops)))
2888                                         goto nla_put_failure;
2889
2890                                 nla_nest_end(msg, nested_ext_capab);
2891                                 if (state->split)
2892                                         break;
2893                         }
2894                         nla_nest_end(msg, nested);
2895                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2896                                 state->capa_start = i + 1;
2897                                 break;
2898                         }
2899                 }
2900
2901                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2902                                 rdev->wiphy.nan_supported_bands))
2903                         goto nla_put_failure;
2904
2905                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2906                                             NL80211_EXT_FEATURE_TXQS)) {
2907                         struct cfg80211_txq_stats txqstats = {};
2908                         int res;
2909
2910                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2911                         if (!res &&
2912                             !nl80211_put_txq_stats(msg, &txqstats,
2913                                                    NL80211_ATTR_TXQ_STATS))
2914                                 goto nla_put_failure;
2915
2916                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2917                                         rdev->wiphy.txq_limit))
2918                                 goto nla_put_failure;
2919                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2920                                         rdev->wiphy.txq_memory_limit))
2921                                 goto nla_put_failure;
2922                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2923                                         rdev->wiphy.txq_quantum))
2924                                 goto nla_put_failure;
2925                 }
2926
2927                 state->split_start++;
2928                 break;
2929         case 14:
2930                 if (nl80211_send_pmsr_capa(rdev, msg))
2931                         goto nla_put_failure;
2932
2933                 state->split_start++;
2934                 break;
2935         case 15:
2936                 if (rdev->wiphy.akm_suites &&
2937                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2938                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2939                             rdev->wiphy.akm_suites))
2940                         goto nla_put_failure;
2941
2942                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2943                         goto nla_put_failure;
2944
2945                 if (nl80211_put_tid_config_support(rdev, msg))
2946                         goto nla_put_failure;
2947                 state->split_start++;
2948                 break;
2949         case 16:
2950                 if (nl80211_put_sar_specs(rdev, msg))
2951                         goto nla_put_failure;
2952
2953                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2954                         goto nla_put_failure;
2955
2956                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2957                                 rdev->wiphy.max_num_akm_suites))
2958                         goto nla_put_failure;
2959
2960                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2961                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2962
2963                 /* done */
2964                 state->split_start = 0;
2965                 break;
2966         }
2967  finish:
2968         genlmsg_end(msg, hdr);
2969         return 0;
2970
2971  nla_put_failure:
2972         genlmsg_cancel(msg, hdr);
2973         return -EMSGSIZE;
2974 }
2975
2976 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2977                                     struct netlink_callback *cb,
2978                                     struct nl80211_dump_wiphy_state *state)
2979 {
2980         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2981         int ret;
2982
2983         if (!tb)
2984                 return -ENOMEM;
2985
2986         ret = nlmsg_parse_deprecated(cb->nlh,
2987                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2988                                      tb, nl80211_fam.maxattr,
2989                                      nl80211_policy, NULL);
2990         /* ignore parse errors for backward compatibility */
2991         if (ret) {
2992                 ret = 0;
2993                 goto out;
2994         }
2995
2996         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2997         if (tb[NL80211_ATTR_WIPHY])
2998                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2999         if (tb[NL80211_ATTR_WDEV])
3000                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3001         if (tb[NL80211_ATTR_IFINDEX]) {
3002                 struct net_device *netdev;
3003                 struct cfg80211_registered_device *rdev;
3004                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3005
3006                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3007                 if (!netdev) {
3008                         ret = -ENODEV;
3009                         goto out;
3010                 }
3011                 if (netdev->ieee80211_ptr) {
3012                         rdev = wiphy_to_rdev(
3013                                 netdev->ieee80211_ptr->wiphy);
3014                         state->filter_wiphy = rdev->wiphy_idx;
3015                 }
3016         }
3017
3018         ret = 0;
3019 out:
3020         kfree(tb);
3021         return ret;
3022 }
3023
3024 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3025 {
3026         int idx = 0, ret;
3027         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3028         struct cfg80211_registered_device *rdev;
3029
3030         rtnl_lock();
3031         if (!state) {
3032                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3033                 if (!state) {
3034                         rtnl_unlock();
3035                         return -ENOMEM;
3036                 }
3037                 state->filter_wiphy = -1;
3038                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3039                 if (ret) {
3040                         kfree(state);
3041                         rtnl_unlock();
3042                         return ret;
3043                 }
3044                 cb->args[0] = (long)state;
3045         }
3046
3047         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3048                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3049                         continue;
3050                 if (++idx <= state->start)
3051                         continue;
3052                 if (state->filter_wiphy != -1 &&
3053                     state->filter_wiphy != rdev->wiphy_idx)
3054                         continue;
3055                 /* attempt to fit multiple wiphy data chunks into the skb */
3056                 do {
3057                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3058                                                  skb,
3059                                                  NETLINK_CB(cb->skb).portid,
3060                                                  cb->nlh->nlmsg_seq,
3061                                                  NLM_F_MULTI, state);
3062                         if (ret < 0) {
3063                                 /*
3064                                  * If sending the wiphy data didn't fit (ENOBUFS
3065                                  * or EMSGSIZE returned), this SKB is still
3066                                  * empty (so it's not too big because another
3067                                  * wiphy dataset is already in the skb) and
3068                                  * we've not tried to adjust the dump allocation
3069                                  * yet ... then adjust the alloc size to be
3070                                  * bigger, and return 1 but with the empty skb.
3071                                  * This results in an empty message being RX'ed
3072                                  * in userspace, but that is ignored.
3073                                  *
3074                                  * We can then retry with the larger buffer.
3075                                  */
3076                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3077                                     !skb->len && !state->split &&
3078                                     cb->min_dump_alloc < 4096) {
3079                                         cb->min_dump_alloc = 4096;
3080                                         state->split_start = 0;
3081                                         rtnl_unlock();
3082                                         return 1;
3083                                 }
3084                                 idx--;
3085                                 break;
3086                         }
3087                 } while (state->split_start > 0);
3088                 break;
3089         }
3090         rtnl_unlock();
3091
3092         state->start = idx;
3093
3094         return skb->len;
3095 }
3096
3097 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3098 {
3099         kfree((void *)cb->args[0]);
3100         return 0;
3101 }
3102
3103 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3104 {
3105         struct sk_buff *msg;
3106         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3107         struct nl80211_dump_wiphy_state state = {};
3108
3109         msg = nlmsg_new(4096, GFP_KERNEL);
3110         if (!msg)
3111                 return -ENOMEM;
3112
3113         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3114                                info->snd_portid, info->snd_seq, 0,
3115                                &state) < 0) {
3116                 nlmsg_free(msg);
3117                 return -ENOBUFS;
3118         }
3119
3120         return genlmsg_reply(msg, info);
3121 }
3122
3123 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3124         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3125         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3126         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3127         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3128         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3129 };
3130
3131 static int parse_txq_params(struct nlattr *tb[],
3132                             struct ieee80211_txq_params *txq_params)
3133 {
3134         u8 ac;
3135
3136         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3137             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3138             !tb[NL80211_TXQ_ATTR_AIFS])
3139                 return -EINVAL;
3140
3141         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3142         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3143         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3144         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3145         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3146
3147         if (ac >= NL80211_NUM_ACS)
3148                 return -EINVAL;
3149         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3150         return 0;
3151 }
3152
3153 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3154 {
3155         /*
3156          * You can only set the channel explicitly for some interfaces,
3157          * most have their channel managed via their respective
3158          * "establish a connection" command (connect, join, ...)
3159          *
3160          * For AP/GO and mesh mode, the channel can be set with the
3161          * channel userspace API, but is only stored and passed to the
3162          * low-level driver when the AP starts or the mesh is joined.
3163          * This is for backward compatibility, userspace can also give
3164          * the channel in the start-ap or join-mesh commands instead.
3165          *
3166          * Monitors are special as they are normally slaved to
3167          * whatever else is going on, so they have their own special
3168          * operation to set the monitor channel if possible.
3169          */
3170         return !wdev ||
3171                 wdev->iftype == NL80211_IFTYPE_AP ||
3172                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3173                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3174                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3175 }
3176
3177 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3178                           struct genl_info *info,
3179                           struct cfg80211_chan_def *chandef)
3180 {
3181         struct netlink_ext_ack *extack = info->extack;
3182         struct nlattr **attrs = info->attrs;
3183         u32 control_freq;
3184
3185         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
3186                 return -EINVAL;
3187
3188         control_freq = MHZ_TO_KHZ(
3189                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3190         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3191                 control_freq +=
3192                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3193
3194         memset(chandef, 0, sizeof(*chandef));
3195         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3196         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3197         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3198         chandef->freq1_offset = control_freq % 1000;
3199         chandef->center_freq2 = 0;
3200
3201         /* Primary channel not allowed */
3202         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3203                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3204                                     "Channel is disabled");
3205                 return -EINVAL;
3206         }
3207
3208         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3209                 enum nl80211_channel_type chantype;
3210
3211                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3212
3213                 switch (chantype) {
3214                 case NL80211_CHAN_NO_HT:
3215                 case NL80211_CHAN_HT20:
3216                 case NL80211_CHAN_HT40PLUS:
3217                 case NL80211_CHAN_HT40MINUS:
3218                         cfg80211_chandef_create(chandef, chandef->chan,
3219                                                 chantype);
3220                         /* user input for center_freq is incorrect */
3221                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3222                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3223                                 NL_SET_ERR_MSG_ATTR(extack,
3224                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3225                                                     "bad center frequency 1");
3226                                 return -EINVAL;
3227                         }
3228                         /* center_freq2 must be zero */
3229                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3230                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3231                                 NL_SET_ERR_MSG_ATTR(extack,
3232                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3233                                                     "center frequency 2 can't be used");
3234                                 return -EINVAL;
3235                         }
3236                         break;
3237                 default:
3238                         NL_SET_ERR_MSG_ATTR(extack,
3239                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3240                                             "invalid channel type");
3241                         return -EINVAL;
3242                 }
3243         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3244                 chandef->width =
3245                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3246                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3247                         /* User input error for channel width doesn't match channel  */
3248                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3249                                 NL_SET_ERR_MSG_ATTR(extack,
3250                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3251                                                     "bad channel width");
3252                                 return -EINVAL;
3253                         }
3254                 }
3255                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3256                         chandef->center_freq1 =
3257                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3258                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3259                                 chandef->freq1_offset = nla_get_u32(
3260                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3261                         else
3262                                 chandef->freq1_offset = 0;
3263                 }
3264                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3265                         chandef->center_freq2 =
3266                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3267         }
3268
3269         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3270                 chandef->edmg.channels =
3271                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3272
3273                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3274                         chandef->edmg.bw_config =
3275                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3276         } else {
3277                 chandef->edmg.bw_config = 0;
3278                 chandef->edmg.channels = 0;
3279         }
3280
3281         if (!cfg80211_chandef_valid(chandef)) {
3282                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3283                 return -EINVAL;
3284         }
3285
3286         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3287                                      IEEE80211_CHAN_DISABLED)) {
3288                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3289                 return -EINVAL;
3290         }
3291
3292         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3293              chandef->width == NL80211_CHAN_WIDTH_10) &&
3294             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3295                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3296                 return -EINVAL;
3297         }
3298
3299         return 0;
3300 }
3301
3302 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3303                                  struct net_device *dev,
3304                                  struct genl_info *info,
3305                                  int _link_id)
3306 {
3307         struct cfg80211_chan_def chandef;
3308         int result;
3309         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3310         struct wireless_dev *wdev = NULL;
3311         int link_id = _link_id;
3312
3313         if (dev)
3314                 wdev = dev->ieee80211_ptr;
3315         if (!nl80211_can_set_dev_channel(wdev))
3316                 return -EOPNOTSUPP;
3317         if (wdev)
3318                 iftype = wdev->iftype;
3319
3320         if (link_id < 0) {
3321                 if (wdev && wdev->valid_links)
3322                         return -EINVAL;
3323                 link_id = 0;
3324         }
3325
3326         result = nl80211_parse_chandef(rdev, info, &chandef);
3327         if (result)
3328                 return result;
3329
3330         switch (iftype) {
3331         case NL80211_IFTYPE_AP:
3332         case NL80211_IFTYPE_P2P_GO:
3333                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3334                                                    iftype))
3335                         return -EINVAL;
3336                 if (wdev->links[link_id].ap.beacon_interval) {
3337                         struct ieee80211_channel *cur_chan;
3338
3339                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3340                             !(rdev->wiphy.features &
3341                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3342                                 return -EBUSY;
3343
3344                         /* Only allow dynamic channel width changes */
3345                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3346                         if (chandef.chan != cur_chan)
3347                                 return -EBUSY;
3348
3349                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3350                                                        &chandef);
3351                         if (result)
3352                                 return result;
3353                         wdev->links[link_id].ap.chandef = chandef;
3354                 } else {
3355                         wdev->u.ap.preset_chandef = chandef;
3356                 }
3357                 return 0;
3358         case NL80211_IFTYPE_MESH_POINT:
3359                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3360         case NL80211_IFTYPE_MONITOR:
3361                 return cfg80211_set_monitor_channel(rdev, &chandef);
3362         default:
3363                 break;
3364         }
3365
3366         return -EINVAL;
3367 }
3368
3369 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3370 {
3371         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3372         int link_id = nl80211_link_id_or_invalid(info->attrs);
3373         struct net_device *netdev = info->user_ptr[1];
3374         int ret;
3375
3376         wdev_lock(netdev->ieee80211_ptr);
3377         ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3378         wdev_unlock(netdev->ieee80211_ptr);
3379
3380         return ret;
3381 }
3382
3383 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3384 {
3385         struct cfg80211_registered_device *rdev = NULL;
3386         struct net_device *netdev = NULL;
3387         struct wireless_dev *wdev;
3388         int result = 0, rem_txq_params = 0;
3389         struct nlattr *nl_txq_params;
3390         u32 changed;
3391         u8 retry_short = 0, retry_long = 0;
3392         u32 frag_threshold = 0, rts_threshold = 0;
3393         u8 coverage_class = 0;
3394         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3395
3396         rtnl_lock();
3397         /*
3398          * Try to find the wiphy and netdev. Normally this
3399          * function shouldn't need the netdev, but this is
3400          * done for backward compatibility -- previously
3401          * setting the channel was done per wiphy, but now
3402          * it is per netdev. Previous userland like hostapd
3403          * also passed a netdev to set_wiphy, so that it is
3404          * possible to let that go to the right netdev!
3405          */
3406
3407         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3408                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3409
3410                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3411                 if (netdev && netdev->ieee80211_ptr)
3412                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3413                 else
3414                         netdev = NULL;
3415         }
3416
3417         if (!netdev) {
3418                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3419                                                   info->attrs);
3420                 if (IS_ERR(rdev)) {
3421                         rtnl_unlock();
3422                         return PTR_ERR(rdev);
3423                 }
3424                 wdev = NULL;
3425                 netdev = NULL;
3426                 result = 0;
3427         } else
3428                 wdev = netdev->ieee80211_ptr;
3429
3430         wiphy_lock(&rdev->wiphy);
3431
3432         /*
3433          * end workaround code, by now the rdev is available
3434          * and locked, and wdev may or may not be NULL.
3435          */
3436
3437         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3438                 result = cfg80211_dev_rename(
3439                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3440         rtnl_unlock();
3441
3442         if (result)
3443                 goto out;
3444
3445         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3446                 struct ieee80211_txq_params txq_params;
3447                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3448
3449                 if (!rdev->ops->set_txq_params) {
3450                         result = -EOPNOTSUPP;
3451                         goto out;
3452                 }
3453
3454                 if (!netdev) {
3455                         result = -EINVAL;
3456                         goto out;
3457                 }
3458
3459                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3460                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3461                         result = -EINVAL;
3462                         goto out;
3463                 }
3464
3465                 if (!netif_running(netdev)) {
3466                         result = -ENETDOWN;
3467                         goto out;
3468                 }
3469
3470                 nla_for_each_nested(nl_txq_params,
3471                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3472                                     rem_txq_params) {
3473                         result = nla_parse_nested_deprecated(tb,
3474                                                              NL80211_TXQ_ATTR_MAX,
3475                                                              nl_txq_params,
3476                                                              txq_params_policy,
3477                                                              info->extack);
3478                         if (result)
3479                                 goto out;
3480                         result = parse_txq_params(tb, &txq_params);
3481                         if (result)
3482                                 goto out;
3483
3484                         txq_params.link_id =
3485                                 nl80211_link_id_or_invalid(info->attrs);
3486
3487                         wdev_lock(netdev->ieee80211_ptr);
3488                         if (txq_params.link_id >= 0 &&
3489                             !(netdev->ieee80211_ptr->valid_links &
3490                               BIT(txq_params.link_id)))
3491                                 result = -ENOLINK;
3492                         else if (txq_params.link_id >= 0 &&
3493                                  !netdev->ieee80211_ptr->valid_links)
3494                                 result = -EINVAL;
3495                         else
3496                                 result = rdev_set_txq_params(rdev, netdev,
3497                                                              &txq_params);
3498                         wdev_unlock(netdev->ieee80211_ptr);
3499                         if (result)
3500                                 goto out;
3501                 }
3502         }
3503
3504         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3505                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3506
3507                 if (wdev) {
3508                         wdev_lock(wdev);
3509                         result = __nl80211_set_channel(
3510                                 rdev,
3511                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3512                                 info, link_id);
3513                         wdev_unlock(wdev);
3514                 } else {
3515                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3516                 }
3517
3518                 if (result)
3519                         goto out;
3520         }
3521
3522         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3523                 struct wireless_dev *txp_wdev = wdev;
3524                 enum nl80211_tx_power_setting type;
3525                 int idx, mbm = 0;
3526
3527                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3528                         txp_wdev = NULL;
3529
3530                 if (!rdev->ops->set_tx_power) {
3531                         result = -EOPNOTSUPP;
3532                         goto out;
3533                 }
3534
3535                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3536                 type = nla_get_u32(info->attrs[idx]);
3537
3538                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3539                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3540                         result = -EINVAL;
3541                         goto out;
3542                 }
3543
3544                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3545                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3546                         mbm = nla_get_u32(info->attrs[idx]);
3547                 }
3548
3549                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3550                 if (result)
3551                         goto out;
3552         }
3553
3554         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3555             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3556                 u32 tx_ant, rx_ant;
3557
3558                 if ((!rdev->wiphy.available_antennas_tx &&
3559                      !rdev->wiphy.available_antennas_rx) ||
3560                     !rdev->ops->set_antenna) {
3561                         result = -EOPNOTSUPP;
3562                         goto out;
3563                 }
3564
3565                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3566                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3567
3568                 /* reject antenna configurations which don't match the
3569                  * available antenna masks, except for the "all" mask */
3570                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3571                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3572                         result = -EINVAL;
3573                         goto out;
3574                 }
3575
3576                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3577                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3578
3579                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3580                 if (result)
3581                         goto out;
3582         }
3583
3584         changed = 0;
3585
3586         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3587                 retry_short = nla_get_u8(
3588                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3589
3590                 changed |= WIPHY_PARAM_RETRY_SHORT;
3591         }
3592
3593         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3594                 retry_long = nla_get_u8(
3595                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3596
3597                 changed |= WIPHY_PARAM_RETRY_LONG;
3598         }
3599
3600         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3601                 frag_threshold = nla_get_u32(
3602                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3603                 if (frag_threshold < 256) {
3604                         result = -EINVAL;
3605                         goto out;
3606                 }
3607
3608                 if (frag_threshold != (u32) -1) {
3609                         /*
3610                          * Fragments (apart from the last one) are required to
3611                          * have even length. Make the fragmentation code
3612                          * simpler by stripping LSB should someone try to use
3613                          * odd threshold value.
3614                          */
3615                         frag_threshold &= ~0x1;
3616                 }
3617                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3618         }
3619
3620         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3621                 rts_threshold = nla_get_u32(
3622                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3623                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3624         }
3625
3626         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3627                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3628                         result = -EINVAL;
3629                         goto out;
3630                 }
3631
3632                 coverage_class = nla_get_u8(
3633                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3634                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3635         }
3636
3637         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3638                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3639                         result = -EOPNOTSUPP;
3640                         goto out;
3641                 }
3642
3643                 changed |= WIPHY_PARAM_DYN_ACK;
3644         }
3645
3646         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3647                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3648                                              NL80211_EXT_FEATURE_TXQS)) {
3649                         result = -EOPNOTSUPP;
3650                         goto out;
3651                 }
3652                 txq_limit = nla_get_u32(
3653                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3654                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3655         }
3656
3657         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3658                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3659                                              NL80211_EXT_FEATURE_TXQS)) {
3660                         result = -EOPNOTSUPP;
3661                         goto out;
3662                 }
3663                 txq_memory_limit = nla_get_u32(
3664                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3665                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3666         }
3667
3668         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3669                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3670                                              NL80211_EXT_FEATURE_TXQS)) {
3671                         result = -EOPNOTSUPP;
3672                         goto out;
3673                 }
3674                 txq_quantum = nla_get_u32(
3675                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3676                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3677         }
3678
3679         if (changed) {
3680                 u8 old_retry_short, old_retry_long;
3681                 u32 old_frag_threshold, old_rts_threshold;
3682                 u8 old_coverage_class;
3683                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3684
3685                 if (!rdev->ops->set_wiphy_params) {
3686                         result = -EOPNOTSUPP;
3687                         goto out;
3688                 }
3689
3690                 old_retry_short = rdev->wiphy.retry_short;
3691                 old_retry_long = rdev->wiphy.retry_long;
3692                 old_frag_threshold = rdev->wiphy.frag_threshold;
3693                 old_rts_threshold = rdev->wiphy.rts_threshold;
3694                 old_coverage_class = rdev->wiphy.coverage_class;
3695                 old_txq_limit = rdev->wiphy.txq_limit;
3696                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3697                 old_txq_quantum = rdev->wiphy.txq_quantum;
3698
3699                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3700                         rdev->wiphy.retry_short = retry_short;
3701                 if (changed & WIPHY_PARAM_RETRY_LONG)
3702                         rdev->wiphy.retry_long = retry_long;
3703                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3704                         rdev->wiphy.frag_threshold = frag_threshold;
3705                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3706                         rdev->wiphy.rts_threshold = rts_threshold;
3707                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3708                         rdev->wiphy.coverage_class = coverage_class;
3709                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3710                         rdev->wiphy.txq_limit = txq_limit;
3711                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3712                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3713                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3714                         rdev->wiphy.txq_quantum = txq_quantum;
3715
3716                 result = rdev_set_wiphy_params(rdev, changed);
3717                 if (result) {
3718                         rdev->wiphy.retry_short = old_retry_short;
3719                         rdev->wiphy.retry_long = old_retry_long;
3720                         rdev->wiphy.frag_threshold = old_frag_threshold;
3721                         rdev->wiphy.rts_threshold = old_rts_threshold;
3722                         rdev->wiphy.coverage_class = old_coverage_class;
3723                         rdev->wiphy.txq_limit = old_txq_limit;
3724                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3725                         rdev->wiphy.txq_quantum = old_txq_quantum;
3726                         goto out;
3727                 }
3728         }
3729
3730         result = 0;
3731
3732 out:
3733         wiphy_unlock(&rdev->wiphy);
3734         return result;
3735 }
3736
3737 static int nl80211_send_chandef(struct sk_buff *msg,
3738                                 const struct cfg80211_chan_def *chandef)
3739 {
3740         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3741                 return -EINVAL;
3742
3743         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3744                         chandef->chan->center_freq))
3745                 return -ENOBUFS;
3746         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3747                         chandef->chan->freq_offset))
3748                 return -ENOBUFS;
3749         switch (chandef->width) {
3750         case NL80211_CHAN_WIDTH_20_NOHT:
3751         case NL80211_CHAN_WIDTH_20:
3752         case NL80211_CHAN_WIDTH_40:
3753                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3754                                 cfg80211_get_chandef_type(chandef)))
3755                         return -ENOBUFS;
3756                 break;
3757         default:
3758                 break;
3759         }
3760         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3761                 return -ENOBUFS;
3762         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3763                 return -ENOBUFS;
3764         if (chandef->center_freq2 &&
3765             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3766                 return -ENOBUFS;
3767         return 0;
3768 }
3769
3770 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3771                               struct cfg80211_registered_device *rdev,
3772                               struct wireless_dev *wdev,
3773                               enum nl80211_commands cmd)
3774 {
3775         struct net_device *dev = wdev->netdev;
3776         void *hdr;
3777
3778         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3779                 cmd != NL80211_CMD_DEL_INTERFACE &&
3780                 cmd != NL80211_CMD_SET_INTERFACE);
3781
3782         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3783         if (!hdr)
3784                 return -1;
3785
3786         if (dev &&
3787             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3788              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3789                 goto nla_put_failure;
3790
3791         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3792             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3793             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3794                               NL80211_ATTR_PAD) ||
3795             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3796             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3797                         rdev->devlist_generation ^
3798                         (cfg80211_rdev_list_generation << 2)) ||
3799             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3800                 goto nla_put_failure;
3801
3802         if (rdev->ops->get_channel && !wdev->valid_links) {
3803                 struct cfg80211_chan_def chandef = {};
3804                 int ret;
3805
3806                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3807                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3808                         goto nla_put_failure;
3809         }
3810
3811         if (rdev->ops->get_tx_power) {
3812                 int dbm, ret;
3813
3814                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3815                 if (ret == 0 &&
3816                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3817                                 DBM_TO_MBM(dbm)))
3818                         goto nla_put_failure;
3819         }
3820
3821         wdev_lock(wdev);
3822         switch (wdev->iftype) {
3823         case NL80211_IFTYPE_AP:
3824         case NL80211_IFTYPE_P2P_GO:
3825                 if (wdev->u.ap.ssid_len &&
3826                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3827                             wdev->u.ap.ssid))
3828                         goto nla_put_failure_locked;
3829                 break;
3830         case NL80211_IFTYPE_STATION:
3831         case NL80211_IFTYPE_P2P_CLIENT:
3832                 if (wdev->u.client.ssid_len &&
3833                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3834                             wdev->u.client.ssid))
3835                         goto nla_put_failure_locked;
3836                 break;
3837         case NL80211_IFTYPE_ADHOC:
3838                 if (wdev->u.ibss.ssid_len &&
3839                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3840                             wdev->u.ibss.ssid))
3841                         goto nla_put_failure_locked;
3842                 break;
3843         default:
3844                 /* nothing */
3845                 break;
3846         }
3847         wdev_unlock(wdev);
3848
3849         if (rdev->ops->get_txq_stats) {
3850                 struct cfg80211_txq_stats txqstats = {};
3851                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3852
3853                 if (ret == 0 &&
3854                     !nl80211_put_txq_stats(msg, &txqstats,
3855                                            NL80211_ATTR_TXQ_STATS))
3856                         goto nla_put_failure;
3857         }
3858
3859         if (wdev->valid_links) {
3860                 unsigned int link_id;
3861                 struct nlattr *links = nla_nest_start(msg,
3862                                                       NL80211_ATTR_MLO_LINKS);
3863
3864                 if (!links)
3865                         goto nla_put_failure;
3866
3867                 for_each_valid_link(wdev, link_id) {
3868                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
3869                         struct cfg80211_chan_def chandef = {};
3870                         int ret;
3871
3872                         if (!link)
3873                                 goto nla_put_failure;
3874
3875                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3876                                 goto nla_put_failure;
3877                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3878                                     wdev->links[link_id].addr))
3879                                 goto nla_put_failure;
3880
3881                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3882                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3883                                 goto nla_put_failure;
3884
3885                         nla_nest_end(msg, link);
3886                 }
3887
3888                 nla_nest_end(msg, links);
3889         }
3890
3891         genlmsg_end(msg, hdr);
3892         return 0;
3893
3894  nla_put_failure_locked:
3895         wdev_unlock(wdev);
3896  nla_put_failure:
3897         genlmsg_cancel(msg, hdr);
3898         return -EMSGSIZE;
3899 }
3900
3901 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3902 {
3903         int wp_idx = 0;
3904         int if_idx = 0;
3905         int wp_start = cb->args[0];
3906         int if_start = cb->args[1];
3907         int filter_wiphy = -1;
3908         struct cfg80211_registered_device *rdev;
3909         struct wireless_dev *wdev;
3910         int ret;
3911
3912         rtnl_lock();
3913         if (!cb->args[2]) {
3914                 struct nl80211_dump_wiphy_state state = {
3915                         .filter_wiphy = -1,
3916                 };
3917
3918                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3919                 if (ret)
3920                         goto out_unlock;
3921
3922                 filter_wiphy = state.filter_wiphy;
3923
3924                 /*
3925                  * if filtering, set cb->args[2] to +1 since 0 is the default
3926                  * value needed to determine that parsing is necessary.
3927                  */
3928                 if (filter_wiphy >= 0)
3929                         cb->args[2] = filter_wiphy + 1;
3930                 else
3931                         cb->args[2] = -1;
3932         } else if (cb->args[2] > 0) {
3933                 filter_wiphy = cb->args[2] - 1;
3934         }
3935
3936         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3937                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3938                         continue;
3939                 if (wp_idx < wp_start) {
3940                         wp_idx++;
3941                         continue;
3942                 }
3943
3944                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3945                         continue;
3946
3947                 if_idx = 0;
3948
3949                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3950                         if (if_idx < if_start) {
3951                                 if_idx++;
3952                                 continue;
3953                         }
3954                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3955                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3956                                                rdev, wdev,
3957                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3958                                 goto out;
3959                         }
3960                         if_idx++;
3961                 }
3962
3963                 if_start = 0;
3964                 wp_idx++;
3965         }
3966  out:
3967         cb->args[0] = wp_idx;
3968         cb->args[1] = if_idx;
3969
3970         ret = skb->len;
3971  out_unlock:
3972         rtnl_unlock();
3973
3974         return ret;
3975 }
3976
3977 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3978 {
3979         struct sk_buff *msg;
3980         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3981         struct wireless_dev *wdev = info->user_ptr[1];
3982
3983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3984         if (!msg)
3985                 return -ENOMEM;
3986
3987         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3988                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3989                 nlmsg_free(msg);
3990                 return -ENOBUFS;
3991         }
3992
3993         return genlmsg_reply(msg, info);
3994 }
3995
3996 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3997         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3998         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3999         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4000         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4001         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4002         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4003 };
4004
4005 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4006 {
4007         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4008         int flag;
4009
4010         *mntrflags = 0;
4011
4012         if (!nla)
4013                 return -EINVAL;
4014
4015         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4016                 return -EINVAL;
4017
4018         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4019                 if (flags[flag])
4020                         *mntrflags |= (1<<flag);
4021
4022         *mntrflags |= MONITOR_FLAG_CHANGED;
4023
4024         return 0;
4025 }
4026
4027 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4028                                      enum nl80211_iftype type,
4029                                      struct genl_info *info,
4030                                      struct vif_params *params)
4031 {
4032         bool change = false;
4033         int err;
4034
4035         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4036                 if (type != NL80211_IFTYPE_MONITOR)
4037                         return -EINVAL;
4038
4039                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4040                                           &params->flags);
4041                 if (err)
4042                         return err;
4043
4044                 change = true;
4045         }
4046
4047         if (params->flags & MONITOR_FLAG_ACTIVE &&
4048             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4049                 return -EOPNOTSUPP;
4050
4051         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4052                 const u8 *mumimo_groups;
4053                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4054
4055                 if (type != NL80211_IFTYPE_MONITOR)
4056                         return -EINVAL;
4057
4058                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4059                         return -EOPNOTSUPP;
4060
4061                 mumimo_groups =
4062                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4063
4064                 /* bits 0 and 63 are reserved and must be zero */
4065                 if ((mumimo_groups[0] & BIT(0)) ||
4066                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4067                         return -EINVAL;
4068
4069                 params->vht_mumimo_groups = mumimo_groups;
4070                 change = true;
4071         }
4072
4073         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4074                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4075
4076                 if (type != NL80211_IFTYPE_MONITOR)
4077                         return -EINVAL;
4078
4079                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4080                         return -EOPNOTSUPP;
4081
4082                 params->vht_mumimo_follow_addr =
4083                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4084                 change = true;
4085         }
4086
4087         return change ? 1 : 0;
4088 }
4089
4090 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4091                                struct net_device *netdev, u8 use_4addr,
4092                                enum nl80211_iftype iftype)
4093 {
4094         if (!use_4addr) {
4095                 if (netdev && netif_is_bridge_port(netdev))
4096                         return -EBUSY;
4097                 return 0;
4098         }
4099
4100         switch (iftype) {
4101         case NL80211_IFTYPE_AP_VLAN:
4102                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4103                         return 0;
4104                 break;
4105         case NL80211_IFTYPE_STATION:
4106                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4107                         return 0;
4108                 break;
4109         default:
4110                 break;
4111         }
4112
4113         return -EOPNOTSUPP;
4114 }
4115
4116 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4117 {
4118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4119         struct vif_params params;
4120         int err;
4121         enum nl80211_iftype otype, ntype;
4122         struct net_device *dev = info->user_ptr[1];
4123         bool change = false;
4124
4125         memset(&params, 0, sizeof(params));
4126
4127         otype = ntype = dev->ieee80211_ptr->iftype;
4128
4129         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4130                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4131                 if (otype != ntype)
4132                         change = true;
4133         }
4134
4135         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4136                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4137
4138                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4139                         return -EINVAL;
4140                 if (otype != NL80211_IFTYPE_MESH_POINT)
4141                         return -EINVAL;
4142                 if (netif_running(dev))
4143                         return -EBUSY;
4144
4145                 wdev_lock(wdev);
4146                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4147                              IEEE80211_MAX_MESH_ID_LEN);
4148                 wdev->u.mesh.id_up_len =
4149                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4150                 memcpy(wdev->u.mesh.id,
4151                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4152                        wdev->u.mesh.id_up_len);
4153                 wdev_unlock(wdev);
4154         }
4155
4156         if (info->attrs[NL80211_ATTR_4ADDR]) {
4157                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4158                 change = true;
4159                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4160                 if (err)
4161                         return err;
4162         } else {
4163                 params.use_4addr = -1;
4164         }
4165
4166         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4167         if (err < 0)
4168                 return err;
4169         if (err > 0)
4170                 change = true;
4171
4172         if (change)
4173                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4174         else
4175                 err = 0;
4176
4177         if (!err && params.use_4addr != -1)
4178                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4179
4180         if (change && !err) {
4181                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4182
4183                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4184         }
4185
4186         return err;
4187 }
4188
4189 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4190 {
4191         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4192         struct vif_params params;
4193         struct wireless_dev *wdev;
4194         struct sk_buff *msg;
4195         int err;
4196         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4197
4198         memset(&params, 0, sizeof(params));
4199
4200         if (!info->attrs[NL80211_ATTR_IFNAME])
4201                 return -EINVAL;
4202
4203         if (info->attrs[NL80211_ATTR_IFTYPE])
4204                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4205
4206         if (!rdev->ops->add_virtual_intf)
4207                 return -EOPNOTSUPP;
4208
4209         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4210              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4211             info->attrs[NL80211_ATTR_MAC]) {
4212                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4213                            ETH_ALEN);
4214                 if (!is_valid_ether_addr(params.macaddr))
4215                         return -EADDRNOTAVAIL;
4216         }
4217
4218         if (info->attrs[NL80211_ATTR_4ADDR]) {
4219                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4220                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4221                 if (err)
4222                         return err;
4223         }
4224
4225         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4226                 return -EOPNOTSUPP;
4227
4228         err = nl80211_parse_mon_options(rdev, type, info, &params);
4229         if (err < 0)
4230                 return err;
4231
4232         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4233         if (!msg)
4234                 return -ENOMEM;
4235
4236         wdev = rdev_add_virtual_intf(rdev,
4237                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4238                                 NET_NAME_USER, type, &params);
4239         if (WARN_ON(!wdev)) {
4240                 nlmsg_free(msg);
4241                 return -EPROTO;
4242         } else if (IS_ERR(wdev)) {
4243                 nlmsg_free(msg);
4244                 return PTR_ERR(wdev);
4245         }
4246
4247         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4248                 wdev->owner_nlportid = info->snd_portid;
4249
4250         switch (type) {
4251         case NL80211_IFTYPE_MESH_POINT:
4252                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4253                         break;
4254                 wdev_lock(wdev);
4255                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4256                              IEEE80211_MAX_MESH_ID_LEN);
4257                 wdev->u.mesh.id_up_len =
4258                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4259                 memcpy(wdev->u.mesh.id,
4260                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4261                        wdev->u.mesh.id_up_len);
4262                 wdev_unlock(wdev);
4263                 break;
4264         case NL80211_IFTYPE_NAN:
4265         case NL80211_IFTYPE_P2P_DEVICE:
4266                 /*
4267                  * P2P Device and NAN do not have a netdev, so don't go
4268                  * through the netdev notifier and must be added here
4269                  */
4270                 cfg80211_init_wdev(wdev);
4271                 cfg80211_register_wdev(rdev, wdev);
4272                 break;
4273         default:
4274                 break;
4275         }
4276
4277         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4278                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4279                 nlmsg_free(msg);
4280                 return -ENOBUFS;
4281         }
4282
4283         return genlmsg_reply(msg, info);
4284 }
4285
4286 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4287 {
4288         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4289         int ret;
4290
4291         /* to avoid failing a new interface creation due to pending removal */
4292         cfg80211_destroy_ifaces(rdev);
4293
4294         wiphy_lock(&rdev->wiphy);
4295         ret = _nl80211_new_interface(skb, info);
4296         wiphy_unlock(&rdev->wiphy);
4297
4298         return ret;
4299 }
4300
4301 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4302 {
4303         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4304         struct wireless_dev *wdev = info->user_ptr[1];
4305
4306         if (!rdev->ops->del_virtual_intf)
4307                 return -EOPNOTSUPP;
4308
4309         /*
4310          * We hold RTNL, so this is safe, without RTNL opencount cannot
4311          * reach 0, and thus the rdev cannot be deleted.
4312          *
4313          * We need to do it for the dev_close(), since that will call
4314          * the netdev notifiers, and we need to acquire the mutex there
4315          * but don't know if we get there from here or from some other
4316          * place (e.g. "ip link set ... down").
4317          */
4318         mutex_unlock(&rdev->wiphy.mtx);
4319
4320         /*
4321          * If we remove a wireless device without a netdev then clear
4322          * user_ptr[1] so that nl80211_post_doit won't dereference it
4323          * to check if it needs to do dev_put(). Otherwise it crashes
4324          * since the wdev has been freed, unlike with a netdev where
4325          * we need the dev_put() for the netdev to really be freed.
4326          */
4327         if (!wdev->netdev)
4328                 info->user_ptr[1] = NULL;
4329         else
4330                 dev_close(wdev->netdev);
4331
4332         mutex_lock(&rdev->wiphy.mtx);
4333
4334         return cfg80211_remove_virtual_intf(rdev, wdev);
4335 }
4336
4337 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4338 {
4339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4340         struct net_device *dev = info->user_ptr[1];
4341         u16 noack_map;
4342
4343         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4344                 return -EINVAL;
4345
4346         if (!rdev->ops->set_noack_map)
4347                 return -EOPNOTSUPP;
4348
4349         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4350
4351         return rdev_set_noack_map(rdev, dev, noack_map);
4352 }
4353
4354 static int nl80211_validate_key_link_id(struct genl_info *info,
4355                                         struct wireless_dev *wdev,
4356                                         int link_id, bool pairwise)
4357 {
4358         if (pairwise) {
4359                 if (link_id != -1) {
4360                         GENL_SET_ERR_MSG(info,
4361                                          "link ID not allowed for pairwise key");
4362                         return -EINVAL;
4363                 }
4364
4365                 return 0;
4366         }
4367
4368         if (wdev->valid_links) {
4369                 if (link_id == -1) {
4370                         GENL_SET_ERR_MSG(info,
4371                                          "link ID must for MLO group key");
4372                         return -EINVAL;
4373                 }
4374                 if (!(wdev->valid_links & BIT(link_id))) {
4375                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4376                         return -EINVAL;
4377                 }
4378         } else if (link_id != -1) {
4379                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4380                 return -EINVAL;
4381         }
4382
4383         return 0;
4384 }
4385
4386 struct get_key_cookie {
4387         struct sk_buff *msg;
4388         int error;
4389         int idx;
4390 };
4391
4392 static void get_key_callback(void *c, struct key_params *params)
4393 {
4394         struct nlattr *key;
4395         struct get_key_cookie *cookie = c;
4396
4397         if ((params->key &&
4398              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4399                      params->key_len, params->key)) ||
4400             (params->seq &&
4401              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4402                      params->seq_len, params->seq)) ||
4403             (params->cipher &&
4404              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4405                          params->cipher)))
4406                 goto nla_put_failure;
4407
4408         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4409         if (!key)
4410                 goto nla_put_failure;
4411
4412         if ((params->key &&
4413              nla_put(cookie->msg, NL80211_KEY_DATA,
4414                      params->key_len, params->key)) ||
4415             (params->seq &&
4416              nla_put(cookie->msg, NL80211_KEY_SEQ,
4417                      params->seq_len, params->seq)) ||
4418             (params->cipher &&
4419              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4420                          params->cipher)))
4421                 goto nla_put_failure;
4422
4423         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4424                 goto nla_put_failure;
4425
4426         nla_nest_end(cookie->msg, key);
4427
4428         return;
4429  nla_put_failure:
4430         cookie->error = 1;
4431 }
4432
4433 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4434 {
4435         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4436         int err;
4437         struct net_device *dev = info->user_ptr[1];
4438         u8 key_idx = 0;
4439         const u8 *mac_addr = NULL;
4440         bool pairwise;
4441         struct get_key_cookie cookie = {
4442                 .error = 0,
4443         };
4444         void *hdr;
4445         struct sk_buff *msg;
4446         bool bigtk_support = false;
4447         int link_id = nl80211_link_id_or_invalid(info->attrs);
4448         struct wireless_dev *wdev = dev->ieee80211_ptr;
4449
4450         if (wiphy_ext_feature_isset(&rdev->wiphy,
4451                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4452                 bigtk_support = true;
4453
4454         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4455              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4456             wiphy_ext_feature_isset(&rdev->wiphy,
4457                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4458                 bigtk_support = true;
4459
4460         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4461                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4462
4463                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4464                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4465                         return -EINVAL;
4466                 }
4467         }
4468
4469         if (info->attrs[NL80211_ATTR_MAC])
4470                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4471
4472         pairwise = !!mac_addr;
4473         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4474                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4475
4476                 if (kt != NL80211_KEYTYPE_GROUP &&
4477                     kt != NL80211_KEYTYPE_PAIRWISE)
4478                         return -EINVAL;
4479                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4480         }
4481
4482         if (!rdev->ops->get_key)
4483                 return -EOPNOTSUPP;
4484
4485         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4486                 return -ENOENT;
4487
4488         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4489         if (!msg)
4490                 return -ENOMEM;
4491
4492         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4493                              NL80211_CMD_NEW_KEY);
4494         if (!hdr)
4495                 goto nla_put_failure;
4496
4497         cookie.msg = msg;
4498         cookie.idx = key_idx;
4499
4500         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4501             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4502                 goto nla_put_failure;
4503         if (mac_addr &&
4504             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4505                 goto nla_put_failure;
4506
4507         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4508         if (err)
4509                 goto free_msg;
4510
4511         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4512                            &cookie, get_key_callback);
4513
4514         if (err)
4515                 goto free_msg;
4516
4517         if (cookie.error)
4518                 goto nla_put_failure;
4519
4520         genlmsg_end(msg, hdr);
4521         return genlmsg_reply(msg, info);
4522
4523  nla_put_failure:
4524         err = -ENOBUFS;
4525  free_msg:
4526         nlmsg_free(msg);
4527         return err;
4528 }
4529
4530 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4531 {
4532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4533         struct key_parse key;
4534         int err;
4535         struct net_device *dev = info->user_ptr[1];
4536         int link_id = nl80211_link_id_or_invalid(info->attrs);
4537         struct wireless_dev *wdev = dev->ieee80211_ptr;
4538
4539         err = nl80211_parse_key(info, &key);
4540         if (err)
4541                 return err;
4542
4543         if (key.idx < 0)
4544                 return -EINVAL;
4545
4546         /* Only support setting default key and
4547          * Extended Key ID action NL80211_KEY_SET_TX.
4548          */
4549         if (!key.def && !key.defmgmt && !key.defbeacon &&
4550             !(key.p.mode == NL80211_KEY_SET_TX))
4551                 return -EINVAL;
4552
4553         wdev_lock(wdev);
4554
4555         if (key.def) {
4556                 if (!rdev->ops->set_default_key) {
4557                         err = -EOPNOTSUPP;
4558                         goto out;
4559                 }
4560
4561                 err = nl80211_key_allowed(wdev);
4562                 if (err)
4563                         goto out;
4564
4565                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4566                 if (err)
4567                         goto out;
4568
4569                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4570                                            key.def_uni, key.def_multi);
4571
4572                 if (err)
4573                         goto out;
4574
4575 #ifdef CONFIG_CFG80211_WEXT
4576                 wdev->wext.default_key = key.idx;
4577 #endif
4578         } else if (key.defmgmt) {
4579                 if (key.def_uni || !key.def_multi) {
4580                         err = -EINVAL;
4581                         goto out;
4582                 }
4583
4584                 if (!rdev->ops->set_default_mgmt_key) {
4585                         err = -EOPNOTSUPP;
4586                         goto out;
4587                 }
4588
4589                 err = nl80211_key_allowed(wdev);
4590                 if (err)
4591                         goto out;
4592
4593                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4594                 if (err)
4595                         goto out;
4596
4597                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4598                 if (err)
4599                         goto out;
4600
4601 #ifdef CONFIG_CFG80211_WEXT
4602                 wdev->wext.default_mgmt_key = key.idx;
4603 #endif
4604         } else if (key.defbeacon) {
4605                 if (key.def_uni || !key.def_multi) {
4606                         err = -EINVAL;
4607                         goto out;
4608                 }
4609
4610                 if (!rdev->ops->set_default_beacon_key) {
4611                         err = -EOPNOTSUPP;
4612                         goto out;
4613                 }
4614
4615                 err = nl80211_key_allowed(wdev);
4616                 if (err)
4617                         goto out;
4618
4619                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4620                 if (err)
4621                         goto out;
4622
4623                 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4624                 if (err)
4625                         goto out;
4626         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4627                    wiphy_ext_feature_isset(&rdev->wiphy,
4628                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4629                 u8 *mac_addr = NULL;
4630
4631                 if (info->attrs[NL80211_ATTR_MAC])
4632                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4633
4634                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4635                         err = -EINVAL;
4636                         goto out;
4637                 }
4638
4639                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4640                 if (err)
4641                         goto out;
4642
4643                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4644                                    NL80211_KEYTYPE_PAIRWISE,
4645                                    mac_addr, &key.p);
4646         } else {
4647                 err = -EINVAL;
4648         }
4649  out:
4650         wdev_unlock(wdev);
4651
4652         return err;
4653 }
4654
4655 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4656 {
4657         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4658         int err;
4659         struct net_device *dev = info->user_ptr[1];
4660         struct key_parse key;
4661         const u8 *mac_addr = NULL;
4662         int link_id = nl80211_link_id_or_invalid(info->attrs);
4663         struct wireless_dev *wdev = dev->ieee80211_ptr;
4664
4665         err = nl80211_parse_key(info, &key);
4666         if (err)
4667                 return err;
4668
4669         if (!key.p.key) {
4670                 GENL_SET_ERR_MSG(info, "no key");
4671                 return -EINVAL;
4672         }
4673
4674         if (info->attrs[NL80211_ATTR_MAC])
4675                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4676
4677         if (key.type == -1) {
4678                 if (mac_addr)
4679                         key.type = NL80211_KEYTYPE_PAIRWISE;
4680                 else
4681                         key.type = NL80211_KEYTYPE_GROUP;
4682         }
4683
4684         /* for now */
4685         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4686             key.type != NL80211_KEYTYPE_GROUP) {
4687                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4688                 return -EINVAL;
4689         }
4690
4691         if (key.type == NL80211_KEYTYPE_GROUP &&
4692             info->attrs[NL80211_ATTR_VLAN_ID])
4693                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4694
4695         if (!rdev->ops->add_key)
4696                 return -EOPNOTSUPP;
4697
4698         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4699                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4700                                            mac_addr)) {
4701                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4702                 return -EINVAL;
4703         }
4704
4705         wdev_lock(wdev);
4706         err = nl80211_key_allowed(wdev);
4707         if (err)
4708                 GENL_SET_ERR_MSG(info, "key not allowed");
4709
4710         if (!err)
4711                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4712                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4713
4714         if (!err) {
4715                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4716                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4717                                     mac_addr, &key.p);
4718                 if (err)
4719                         GENL_SET_ERR_MSG(info, "key addition failed");
4720         }
4721         wdev_unlock(wdev);
4722
4723         return err;
4724 }
4725
4726 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4727 {
4728         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4729         int err;
4730         struct net_device *dev = info->user_ptr[1];
4731         u8 *mac_addr = NULL;
4732         struct key_parse key;
4733         int link_id = nl80211_link_id_or_invalid(info->attrs);
4734         struct wireless_dev *wdev = dev->ieee80211_ptr;
4735
4736         err = nl80211_parse_key(info, &key);
4737         if (err)
4738                 return err;
4739
4740         if (info->attrs[NL80211_ATTR_MAC])
4741                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4742
4743         if (key.type == -1) {
4744                 if (mac_addr)
4745                         key.type = NL80211_KEYTYPE_PAIRWISE;
4746                 else
4747                         key.type = NL80211_KEYTYPE_GROUP;
4748         }
4749
4750         /* for now */
4751         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4752             key.type != NL80211_KEYTYPE_GROUP)
4753                 return -EINVAL;
4754
4755         if (!cfg80211_valid_key_idx(rdev, key.idx,
4756                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4757                 return -EINVAL;
4758
4759         if (!rdev->ops->del_key)
4760                 return -EOPNOTSUPP;
4761
4762         wdev_lock(wdev);
4763         err = nl80211_key_allowed(wdev);
4764
4765         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4766             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4767                 err = -ENOENT;
4768
4769         if (!err)
4770                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4771                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4772
4773         if (!err)
4774                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4775                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4776                                    mac_addr);
4777
4778 #ifdef CONFIG_CFG80211_WEXT
4779         if (!err) {
4780                 if (key.idx == wdev->wext.default_key)
4781                         wdev->wext.default_key = -1;
4782                 else if (key.idx == wdev->wext.default_mgmt_key)
4783                         wdev->wext.default_mgmt_key = -1;
4784         }
4785 #endif
4786         wdev_unlock(wdev);
4787
4788         return err;
4789 }
4790
4791 /* This function returns an error or the number of nested attributes */
4792 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4793 {
4794         struct nlattr *attr;
4795         int n_entries = 0, tmp;
4796
4797         nla_for_each_nested(attr, nl_attr, tmp) {
4798                 if (nla_len(attr) != ETH_ALEN)
4799                         return -EINVAL;
4800
4801                 n_entries++;
4802         }
4803
4804         return n_entries;
4805 }
4806
4807 /*
4808  * This function parses ACL information and allocates memory for ACL data.
4809  * On successful return, the calling function is responsible to free the
4810  * ACL buffer returned by this function.
4811  */
4812 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4813                                                 struct genl_info *info)
4814 {
4815         enum nl80211_acl_policy acl_policy;
4816         struct nlattr *attr;
4817         struct cfg80211_acl_data *acl;
4818         int i = 0, n_entries, tmp;
4819
4820         if (!wiphy->max_acl_mac_addrs)
4821                 return ERR_PTR(-EOPNOTSUPP);
4822
4823         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4824                 return ERR_PTR(-EINVAL);
4825
4826         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4827         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4828             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4829                 return ERR_PTR(-EINVAL);
4830
4831         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4832                 return ERR_PTR(-EINVAL);
4833
4834         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4835         if (n_entries < 0)
4836                 return ERR_PTR(n_entries);
4837
4838         if (n_entries > wiphy->max_acl_mac_addrs)
4839                 return ERR_PTR(-ENOTSUPP);
4840
4841         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4842         if (!acl)
4843                 return ERR_PTR(-ENOMEM);
4844
4845         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4846                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4847                 i++;
4848         }
4849
4850         acl->n_acl_entries = n_entries;
4851         acl->acl_policy = acl_policy;
4852
4853         return acl;
4854 }
4855
4856 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4857 {
4858         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4859         struct net_device *dev = info->user_ptr[1];
4860         struct cfg80211_acl_data *acl;
4861         int err;
4862
4863         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4864             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4865                 return -EOPNOTSUPP;
4866
4867         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4868                 return -EINVAL;
4869
4870         acl = parse_acl_data(&rdev->wiphy, info);
4871         if (IS_ERR(acl))
4872                 return PTR_ERR(acl);
4873
4874         err = rdev_set_mac_acl(rdev, dev, acl);
4875
4876         kfree(acl);
4877
4878         return err;
4879 }
4880
4881 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4882                            u8 *rates, u8 rates_len)
4883 {
4884         u8 i;
4885         u32 mask = 0;
4886
4887         for (i = 0; i < rates_len; i++) {
4888                 int rate = (rates[i] & 0x7f) * 5;
4889                 int ridx;
4890
4891                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4892                         struct ieee80211_rate *srate =
4893                                 &sband->bitrates[ridx];
4894                         if (rate == srate->bitrate) {
4895                                 mask |= 1 << ridx;
4896                                 break;
4897                         }
4898                 }
4899                 if (ridx == sband->n_bitrates)
4900                         return 0; /* rate not found */
4901         }
4902
4903         return mask;
4904 }
4905
4906 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4907                                u8 *rates, u8 rates_len,
4908                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4909 {
4910         u8 i;
4911
4912         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4913
4914         for (i = 0; i < rates_len; i++) {
4915                 int ridx, rbit;
4916
4917                 ridx = rates[i] / 8;
4918                 rbit = BIT(rates[i] % 8);
4919
4920                 /* check validity */
4921                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4922                         return false;
4923
4924                 /* check availability */
4925                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4926                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4927                         mcs[ridx] |= rbit;
4928                 else
4929                         return false;
4930         }
4931
4932         return true;
4933 }
4934
4935 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4936 {
4937         u16 mcs_mask = 0;
4938
4939         switch (vht_mcs_map) {
4940         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4941                 break;
4942         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4943                 mcs_mask = 0x00FF;
4944                 break;
4945         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4946                 mcs_mask = 0x01FF;
4947                 break;
4948         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4949                 mcs_mask = 0x03FF;
4950                 break;
4951         default:
4952                 break;
4953         }
4954
4955         return mcs_mask;
4956 }
4957
4958 static void vht_build_mcs_mask(u16 vht_mcs_map,
4959                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4960 {
4961         u8 nss;
4962
4963         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4964                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4965                 vht_mcs_map >>= 2;
4966         }
4967 }
4968
4969 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4970                              struct nl80211_txrate_vht *txrate,
4971                              u16 mcs[NL80211_VHT_NSS_MAX])
4972 {
4973         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4974         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4975         u8 i;
4976
4977         if (!sband->vht_cap.vht_supported)
4978                 return false;
4979
4980         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4981
4982         /* Build vht_mcs_mask from VHT capabilities */
4983         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4984
4985         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4986                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4987                         mcs[i] = txrate->mcs[i];
4988                 else
4989                         return false;
4990         }
4991
4992         return true;
4993 }
4994
4995 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4996 {
4997         switch (he_mcs_map) {
4998         case IEEE80211_HE_MCS_NOT_SUPPORTED:
4999                 return 0;
5000         case IEEE80211_HE_MCS_SUPPORT_0_7:
5001                 return 0x00FF;
5002         case IEEE80211_HE_MCS_SUPPORT_0_9:
5003                 return 0x03FF;
5004         case IEEE80211_HE_MCS_SUPPORT_0_11:
5005                 return 0xFFF;
5006         default:
5007                 break;
5008         }
5009         return 0;
5010 }
5011
5012 static void he_build_mcs_mask(u16 he_mcs_map,
5013                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5014 {
5015         u8 nss;
5016
5017         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5018                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5019                 he_mcs_map >>= 2;
5020         }
5021 }
5022
5023 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5024                            const struct ieee80211_sta_he_cap *he_cap)
5025 {
5026         struct net_device *dev = info->user_ptr[1];
5027         struct wireless_dev *wdev = dev->ieee80211_ptr;
5028         struct cfg80211_chan_def *chandef;
5029         __le16 tx_mcs;
5030
5031         chandef = wdev_chandef(wdev, link_id);
5032         if (!chandef) {
5033                 /*
5034                  * This is probably broken, but we never maintained
5035                  * a chandef in these cases, so it always was.
5036                  */
5037                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5038         }
5039
5040         switch (chandef->width) {
5041         case NL80211_CHAN_WIDTH_80P80:
5042                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5043                 break;
5044         case NL80211_CHAN_WIDTH_160:
5045                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5046                 break;
5047         default:
5048                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5049                 break;
5050         }
5051
5052         return le16_to_cpu(tx_mcs);
5053 }
5054
5055 static bool he_set_mcs_mask(struct genl_info *info,
5056                             struct wireless_dev *wdev,
5057                             struct ieee80211_supported_band *sband,
5058                             struct nl80211_txrate_he *txrate,
5059                             u16 mcs[NL80211_HE_NSS_MAX],
5060                             unsigned int link_id)
5061 {
5062         const struct ieee80211_sta_he_cap *he_cap;
5063         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5064         u16 tx_mcs_map = 0;
5065         u8 i;
5066
5067         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5068         if (!he_cap)
5069                 return false;
5070
5071         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5072
5073         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5074
5075         /* Build he_mcs_mask from HE capabilities */
5076         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5077
5078         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5079                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5080                         mcs[i] = txrate->mcs[i];
5081                 else
5082                         return false;
5083         }
5084
5085         return true;
5086 }
5087
5088 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5089                                          struct nlattr *attrs[],
5090                                          enum nl80211_attrs attr,
5091                                          struct cfg80211_bitrate_mask *mask,
5092                                          struct net_device *dev,
5093                                          bool default_all_enabled,
5094                                          unsigned int link_id)
5095 {
5096         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5097         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5098         struct wireless_dev *wdev = dev->ieee80211_ptr;
5099         int rem, i;
5100         struct nlattr *tx_rates;
5101         struct ieee80211_supported_band *sband;
5102         u16 vht_tx_mcs_map, he_tx_mcs_map;
5103
5104         memset(mask, 0, sizeof(*mask));
5105         /* Default to all rates enabled */
5106         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5107                 const struct ieee80211_sta_he_cap *he_cap;
5108
5109                 if (!default_all_enabled)
5110                         break;
5111
5112                 sband = rdev->wiphy.bands[i];
5113
5114                 if (!sband)
5115                         continue;
5116
5117                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5118                 memcpy(mask->control[i].ht_mcs,
5119                        sband->ht_cap.mcs.rx_mask,
5120                        sizeof(mask->control[i].ht_mcs));
5121
5122                 if (sband->vht_cap.vht_supported) {
5123                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5124                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5125                 }
5126
5127                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5128                 if (!he_cap)
5129                         continue;
5130
5131                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5132                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5133
5134                 mask->control[i].he_gi = 0xFF;
5135                 mask->control[i].he_ltf = 0xFF;
5136         }
5137
5138         /* if no rates are given set it back to the defaults */
5139         if (!attrs[attr])
5140                 goto out;
5141
5142         /* The nested attribute uses enum nl80211_band as the index. This maps
5143          * directly to the enum nl80211_band values used in cfg80211.
5144          */
5145         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5146         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5147                 enum nl80211_band band = nla_type(tx_rates);
5148                 int err;
5149
5150                 if (band < 0 || band >= NUM_NL80211_BANDS)
5151                         return -EINVAL;
5152                 sband = rdev->wiphy.bands[band];
5153                 if (sband == NULL)
5154                         return -EINVAL;
5155                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5156                                                   tx_rates,
5157                                                   nl80211_txattr_policy,
5158                                                   info->extack);
5159                 if (err)
5160                         return err;
5161                 if (tb[NL80211_TXRATE_LEGACY]) {
5162                         mask->control[band].legacy = rateset_to_mask(
5163                                 sband,
5164                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5165                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5166                         if ((mask->control[band].legacy == 0) &&
5167                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5168                                 return -EINVAL;
5169                 }
5170                 if (tb[NL80211_TXRATE_HT]) {
5171                         if (!ht_rateset_to_mask(
5172                                         sband,
5173                                         nla_data(tb[NL80211_TXRATE_HT]),
5174                                         nla_len(tb[NL80211_TXRATE_HT]),
5175                                         mask->control[band].ht_mcs))
5176                                 return -EINVAL;
5177                 }
5178
5179                 if (tb[NL80211_TXRATE_VHT]) {
5180                         if (!vht_set_mcs_mask(
5181                                         sband,
5182                                         nla_data(tb[NL80211_TXRATE_VHT]),
5183                                         mask->control[band].vht_mcs))
5184                                 return -EINVAL;
5185                 }
5186
5187                 if (tb[NL80211_TXRATE_GI]) {
5188                         mask->control[band].gi =
5189                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5190                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5191                                 return -EINVAL;
5192                 }
5193                 if (tb[NL80211_TXRATE_HE] &&
5194                     !he_set_mcs_mask(info, wdev, sband,
5195                                      nla_data(tb[NL80211_TXRATE_HE]),
5196                                      mask->control[band].he_mcs,
5197                                      link_id))
5198                         return -EINVAL;
5199
5200                 if (tb[NL80211_TXRATE_HE_GI])
5201                         mask->control[band].he_gi =
5202                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5203                 if (tb[NL80211_TXRATE_HE_LTF])
5204                         mask->control[band].he_ltf =
5205                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5206
5207                 if (mask->control[band].legacy == 0) {
5208                         /* don't allow empty legacy rates if HT, VHT or HE
5209                          * are not even supported.
5210                          */
5211                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5212                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5213                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5214                                 return -EINVAL;
5215
5216                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5217                                 if (mask->control[band].ht_mcs[i])
5218                                         goto out;
5219
5220                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5221                                 if (mask->control[band].vht_mcs[i])
5222                                         goto out;
5223
5224                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5225                                 if (mask->control[band].he_mcs[i])
5226                                         goto out;
5227
5228                         /* legacy and mcs rates may not be both empty */
5229                         return -EINVAL;
5230                 }
5231         }
5232
5233 out:
5234         return 0;
5235 }
5236
5237 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5238                                    enum nl80211_band band,
5239                                    struct cfg80211_bitrate_mask *beacon_rate)
5240 {
5241         u32 count_ht, count_vht, count_he, i;
5242         u32 rate = beacon_rate->control[band].legacy;
5243
5244         /* Allow only one rate */
5245         if (hweight32(rate) > 1)
5246                 return -EINVAL;
5247
5248         count_ht = 0;
5249         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5250                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5251                         return -EINVAL;
5252                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5253                         count_ht++;
5254                         if (count_ht > 1)
5255                                 return -EINVAL;
5256                 }
5257                 if (count_ht && rate)
5258                         return -EINVAL;
5259         }
5260
5261         count_vht = 0;
5262         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5263                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5264                         return -EINVAL;
5265                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5266                         count_vht++;
5267                         if (count_vht > 1)
5268                                 return -EINVAL;
5269                 }
5270                 if (count_vht && rate)
5271                         return -EINVAL;
5272         }
5273
5274         count_he = 0;
5275         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5276                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5277                         return -EINVAL;
5278                 } else if (beacon_rate->control[band].he_mcs[i]) {
5279                         count_he++;
5280                         if (count_he > 1)
5281                                 return -EINVAL;
5282                 }
5283                 if (count_he && rate)
5284                         return -EINVAL;
5285         }
5286
5287         if ((count_ht && count_vht && count_he) ||
5288             (!rate && !count_ht && !count_vht && !count_he))
5289                 return -EINVAL;
5290
5291         if (rate &&
5292             !wiphy_ext_feature_isset(&rdev->wiphy,
5293                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5294                 return -EINVAL;
5295         if (count_ht &&
5296             !wiphy_ext_feature_isset(&rdev->wiphy,
5297                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5298                 return -EINVAL;
5299         if (count_vht &&
5300             !wiphy_ext_feature_isset(&rdev->wiphy,
5301                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5302                 return -EINVAL;
5303         if (count_he &&
5304             !wiphy_ext_feature_isset(&rdev->wiphy,
5305                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5306                 return -EINVAL;
5307
5308         return 0;
5309 }
5310
5311 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5312                                        struct net_device *dev,
5313                                        struct nlattr *attrs,
5314                                        struct cfg80211_mbssid_config *config,
5315                                        u8 num_elems)
5316 {
5317         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5318
5319         if (!wiphy->mbssid_max_interfaces)
5320                 return -EOPNOTSUPP;
5321
5322         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5323                              NULL) ||
5324             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5325                 return -EINVAL;
5326
5327         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5328         if (config->ema) {
5329                 if (!wiphy->ema_max_profile_periodicity)
5330                         return -EOPNOTSUPP;
5331
5332                 if (num_elems > wiphy->ema_max_profile_periodicity)
5333                         return -EINVAL;
5334         }
5335
5336         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5337         if (config->index >= wiphy->mbssid_max_interfaces ||
5338             (!config->index && !num_elems))
5339                 return -EINVAL;
5340
5341         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5342                 u32 tx_ifindex =
5343                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5344
5345                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5346                     (config->index && tx_ifindex == dev->ifindex))
5347                         return -EINVAL;
5348
5349                 if (tx_ifindex != dev->ifindex) {
5350                         struct net_device *tx_netdev =
5351                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5352
5353                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5354                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5355                             tx_netdev->ieee80211_ptr->iftype !=
5356                                                         NL80211_IFTYPE_AP) {
5357                                 dev_put(tx_netdev);
5358                                 return -EINVAL;
5359                         }
5360
5361                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5362                 } else {
5363                         config->tx_wdev = dev->ieee80211_ptr;
5364                 }
5365         } else if (!config->index) {
5366                 config->tx_wdev = dev->ieee80211_ptr;
5367         } else {
5368                 return -EINVAL;
5369         }
5370
5371         return 0;
5372 }
5373
5374 static struct cfg80211_mbssid_elems *
5375 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5376 {
5377         struct nlattr *nl_elems;
5378         struct cfg80211_mbssid_elems *elems;
5379         int rem_elems;
5380         u8 i = 0, num_elems = 0;
5381
5382         if (!wiphy->mbssid_max_interfaces)
5383                 return ERR_PTR(-EINVAL);
5384
5385         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5386                 if (num_elems >= 255)
5387                         return ERR_PTR(-EINVAL);
5388                 num_elems++;
5389         }
5390
5391         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5392         if (!elems)
5393                 return ERR_PTR(-ENOMEM);
5394
5395         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5396                 elems->elem[i].data = nla_data(nl_elems);
5397                 elems->elem[i].len = nla_len(nl_elems);
5398                 i++;
5399         }
5400         elems->cnt = num_elems;
5401         return elems;
5402 }
5403
5404 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5405                                       struct cfg80211_he_bss_color *he_bss_color)
5406 {
5407         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5408         int err;
5409
5410         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5411                                he_bss_color_policy, NULL);
5412         if (err)
5413                 return err;
5414
5415         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5416                 return -EINVAL;
5417
5418         he_bss_color->color =
5419                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5420         he_bss_color->enabled =
5421                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5422         he_bss_color->partial =
5423                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5424
5425         return 0;
5426 }
5427
5428 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5429                                 struct nlattr *attrs[],
5430                                 struct cfg80211_beacon_data *bcn)
5431 {
5432         bool haveinfo = false;
5433         int err;
5434
5435         memset(bcn, 0, sizeof(*bcn));
5436
5437         bcn->link_id = nl80211_link_id(attrs);
5438
5439         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5440                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5441                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5442                 if (!bcn->head_len)
5443                         return -EINVAL;
5444                 haveinfo = true;
5445         }
5446
5447         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5448                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5449                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5450                 haveinfo = true;
5451         }
5452
5453         if (!haveinfo)
5454                 return -EINVAL;
5455
5456         if (attrs[NL80211_ATTR_IE]) {
5457                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5458                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5459         }
5460
5461         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5462                 bcn->proberesp_ies =
5463                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5464                 bcn->proberesp_ies_len =
5465                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5466         }
5467
5468         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5469                 bcn->assocresp_ies =
5470                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5471                 bcn->assocresp_ies_len =
5472                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5473         }
5474
5475         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5476                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5477                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5478         }
5479
5480         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5481                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5482
5483                 err = nla_parse_nested_deprecated(tb,
5484                                                   NL80211_FTM_RESP_ATTR_MAX,
5485                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5486                                                   NULL, NULL);
5487                 if (err)
5488                         return err;
5489
5490                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5491                     wiphy_ext_feature_isset(&rdev->wiphy,
5492                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5493                         bcn->ftm_responder = 1;
5494                 else
5495                         return -EOPNOTSUPP;
5496
5497                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5498                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5499                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5500                 }
5501
5502                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5503                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5504                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5505                 }
5506         } else {
5507                 bcn->ftm_responder = -1;
5508         }
5509
5510         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5511                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5512                                                  &bcn->he_bss_color);
5513                 if (err)
5514                         return err;
5515                 bcn->he_bss_color_valid = true;
5516         }
5517
5518         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5519                 struct cfg80211_mbssid_elems *mbssid =
5520                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5521                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5522
5523                 if (IS_ERR(mbssid))
5524                         return PTR_ERR(mbssid);
5525
5526                 bcn->mbssid_ies = mbssid;
5527         }
5528
5529         return 0;
5530 }
5531
5532 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5533                                     struct ieee80211_he_obss_pd *he_obss_pd)
5534 {
5535         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5536         int err;
5537
5538         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5539                                he_obss_pd_policy, NULL);
5540         if (err)
5541                 return err;
5542
5543         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5544                 return -EINVAL;
5545
5546         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5547
5548         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5549                 he_obss_pd->min_offset =
5550                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5551         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5552                 he_obss_pd->max_offset =
5553                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5554         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5555                 he_obss_pd->non_srg_max_offset =
5556                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5557
5558         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5559                 return -EINVAL;
5560
5561         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5562                 memcpy(he_obss_pd->bss_color_bitmap,
5563                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5564                        sizeof(he_obss_pd->bss_color_bitmap));
5565
5566         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5567                 memcpy(he_obss_pd->partial_bssid_bitmap,
5568                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5569                        sizeof(he_obss_pd->partial_bssid_bitmap));
5570
5571         he_obss_pd->enable = true;
5572
5573         return 0;
5574 }
5575
5576 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5577                                         struct nlattr *attrs,
5578                                         struct cfg80211_ap_settings *params)
5579 {
5580         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5581         int ret;
5582         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5583
5584         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5585                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5586                 return -EINVAL;
5587
5588         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5589                                NULL, NULL);
5590         if (ret)
5591                 return ret;
5592
5593         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5594             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5595             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5596                 return -EINVAL;
5597
5598         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5599         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5600         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5601         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5602
5603         return 0;
5604 }
5605
5606 static int
5607 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5608                                      struct nlattr *attrs,
5609                                      struct cfg80211_ap_settings *params)
5610 {
5611         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5612         int ret;
5613         struct cfg80211_unsol_bcast_probe_resp *presp =
5614                                         &params->unsol_bcast_probe_resp;
5615
5616         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5617                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5618                 return -EINVAL;
5619
5620         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5621                                attrs, NULL, NULL);
5622         if (ret)
5623                 return ret;
5624
5625         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5626             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5627                 return -EINVAL;
5628
5629         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5630         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5631         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5632         return 0;
5633 }
5634
5635 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5636                                             const struct element *rates)
5637 {
5638         int i;
5639
5640         if (!rates)
5641                 return;
5642
5643         for (i = 0; i < rates->datalen; i++) {
5644                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5645                         params->ht_required = true;
5646                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5647                         params->vht_required = true;
5648                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5649                         params->he_required = true;
5650                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5651                         params->sae_h2e_required = true;
5652         }
5653 }
5654
5655 /*
5656  * Since the nl80211 API didn't include, from the beginning, attributes about
5657  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5658  * benefit of drivers that rebuild IEs in the firmware.
5659  */
5660 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5661 {
5662         const struct cfg80211_beacon_data *bcn = &params->beacon;
5663         size_t ies_len = bcn->tail_len;
5664         const u8 *ies = bcn->tail;
5665         const struct element *rates;
5666         const struct element *cap;
5667
5668         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5669         nl80211_check_ap_rate_selectors(params, rates);
5670
5671         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5672         nl80211_check_ap_rate_selectors(params, rates);
5673
5674         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5675         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5676                 params->ht_cap = (void *)cap->data;
5677         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5678         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5679                 params->vht_cap = (void *)cap->data;
5680         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5681         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5682                 params->he_cap = (void *)(cap->data + 1);
5683         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5684         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5685                 params->he_oper = (void *)(cap->data + 1);
5686         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5687         if (cap) {
5688                 if (!cap->datalen)
5689                         return -EINVAL;
5690                 params->eht_cap = (void *)(cap->data + 1);
5691                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5692                                                 (const u8 *)params->eht_cap,
5693                                                 cap->datalen - 1, true))
5694                         return -EINVAL;
5695         }
5696         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5697         if (cap) {
5698                 if (!cap->datalen)
5699                         return -EINVAL;
5700                 params->eht_oper = (void *)(cap->data + 1);
5701                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5702                                                 cap->datalen - 1))
5703                         return -EINVAL;
5704         }
5705         return 0;
5706 }
5707
5708 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5709                                    struct cfg80211_ap_settings *params)
5710 {
5711         struct wireless_dev *wdev;
5712
5713         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5714                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5715                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5716                         continue;
5717
5718                 if (!wdev->u.ap.preset_chandef.chan)
5719                         continue;
5720
5721                 params->chandef = wdev->u.ap.preset_chandef;
5722                 return true;
5723         }
5724
5725         return false;
5726 }
5727
5728 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5729                                     enum nl80211_auth_type auth_type,
5730                                     enum nl80211_commands cmd)
5731 {
5732         if (auth_type > NL80211_AUTHTYPE_MAX)
5733                 return false;
5734
5735         switch (cmd) {
5736         case NL80211_CMD_AUTHENTICATE:
5737                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5738                     auth_type == NL80211_AUTHTYPE_SAE)
5739                         return false;
5740                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5741                                              NL80211_EXT_FEATURE_FILS_STA) &&
5742                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5743                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5744                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5745                         return false;
5746                 return true;
5747         case NL80211_CMD_CONNECT:
5748                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5749                     !wiphy_ext_feature_isset(&rdev->wiphy,
5750                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5751                     auth_type == NL80211_AUTHTYPE_SAE)
5752                         return false;
5753
5754                 /* FILS with SK PFS or PK not supported yet */
5755                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5756                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5757                         return false;
5758                 if (!wiphy_ext_feature_isset(
5759                             &rdev->wiphy,
5760                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5761                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5762                         return false;
5763                 return true;
5764         case NL80211_CMD_START_AP:
5765                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5766                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5767                     auth_type == NL80211_AUTHTYPE_SAE)
5768                         return false;
5769                 /* FILS not supported yet */
5770                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5771                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5772                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5773                         return false;
5774                 return true;
5775         default:
5776                 return false;
5777         }
5778 }
5779
5780 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5781 {
5782         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5783         unsigned int link_id = nl80211_link_id(info->attrs);
5784         struct net_device *dev = info->user_ptr[1];
5785         struct wireless_dev *wdev = dev->ieee80211_ptr;
5786         struct cfg80211_ap_settings *params;
5787         int err;
5788
5789         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5790             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5791                 return -EOPNOTSUPP;
5792
5793         if (!rdev->ops->start_ap)
5794                 return -EOPNOTSUPP;
5795
5796         if (wdev->links[link_id].ap.beacon_interval)
5797                 return -EALREADY;
5798
5799         /* these are required for START_AP */
5800         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5801             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5802             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5803                 return -EINVAL;
5804
5805         params = kzalloc(sizeof(*params), GFP_KERNEL);
5806         if (!params)
5807                 return -ENOMEM;
5808
5809         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon);
5810         if (err)
5811                 goto out;
5812
5813         params->beacon_interval =
5814                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5815         params->dtim_period =
5816                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5817
5818         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5819                                            params->beacon_interval);
5820         if (err)
5821                 goto out;
5822
5823         /*
5824          * In theory, some of these attributes should be required here
5825          * but since they were not used when the command was originally
5826          * added, keep them optional for old user space programs to let
5827          * them continue to work with drivers that do not need the
5828          * additional information -- drivers must check!
5829          */
5830         if (info->attrs[NL80211_ATTR_SSID]) {
5831                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5832                 params->ssid_len =
5833                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5834                 if (params->ssid_len == 0) {
5835                         err = -EINVAL;
5836                         goto out;
5837                 }
5838
5839                 if (wdev->u.ap.ssid_len &&
5840                     (wdev->u.ap.ssid_len != params->ssid_len ||
5841                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5842                         /* require identical SSID for MLO */
5843                         err = -EINVAL;
5844                         goto out;
5845                 }
5846         } else if (wdev->valid_links) {
5847                 /* require SSID for MLO */
5848                 err = -EINVAL;
5849                 goto out;
5850         }
5851
5852         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5853                 params->hidden_ssid = nla_get_u32(
5854                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5855
5856         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5857
5858         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5859                 params->auth_type = nla_get_u32(
5860                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5861                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5862                                              NL80211_CMD_START_AP)) {
5863                         err = -EINVAL;
5864                         goto out;
5865                 }
5866         } else
5867                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5868
5869         err = nl80211_crypto_settings(rdev, info, &params->crypto,
5870                                       NL80211_MAX_NR_CIPHER_SUITES);
5871         if (err)
5872                 goto out;
5873
5874         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5875                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
5876                         err = -EOPNOTSUPP;
5877                         goto out;
5878                 }
5879                 params->inactivity_timeout = nla_get_u16(
5880                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5881         }
5882
5883         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5884                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5885                         err = -EINVAL;
5886                         goto out;
5887                 }
5888                 params->p2p_ctwindow =
5889                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5890                 if (params->p2p_ctwindow != 0 &&
5891                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
5892                         err = -EINVAL;
5893                         goto out;
5894                 }
5895         }
5896
5897         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5898                 u8 tmp;
5899
5900                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5901                         err = -EINVAL;
5902                         goto out;
5903                 }
5904                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5905                 params->p2p_opp_ps = tmp;
5906                 if (params->p2p_opp_ps != 0 &&
5907                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
5908                         err = -EINVAL;
5909                         goto out;
5910                 }
5911         }
5912
5913         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5914                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
5915                 if (err)
5916                         goto out;
5917         } else if (wdev->valid_links) {
5918                 /* with MLD need to specify the channel configuration */
5919                 err = -EINVAL;
5920                 goto out;
5921         } else if (wdev->u.ap.preset_chandef.chan) {
5922                 params->chandef = wdev->u.ap.preset_chandef;
5923         } else if (!nl80211_get_ap_channel(rdev, params)) {
5924                 err = -EINVAL;
5925                 goto out;
5926         }
5927
5928         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
5929                                            wdev->iftype)) {
5930                 err = -EINVAL;
5931                 goto out;
5932         }
5933
5934         wdev_lock(wdev);
5935
5936         if (info->attrs[NL80211_ATTR_TX_RATES]) {
5937                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5938                                                     NL80211_ATTR_TX_RATES,
5939                                                     &params->beacon_rate,
5940                                                     dev, false, link_id);
5941                 if (err)
5942                         goto out_unlock;
5943
5944                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
5945                                               &params->beacon_rate);
5946                 if (err)
5947                         goto out_unlock;
5948         }
5949
5950         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5951                 params->smps_mode =
5952                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5953                 switch (params->smps_mode) {
5954                 case NL80211_SMPS_OFF:
5955                         break;
5956                 case NL80211_SMPS_STATIC:
5957                         if (!(rdev->wiphy.features &
5958                               NL80211_FEATURE_STATIC_SMPS)) {
5959                                 err = -EINVAL;
5960                                 goto out_unlock;
5961                         }
5962                         break;
5963                 case NL80211_SMPS_DYNAMIC:
5964                         if (!(rdev->wiphy.features &
5965                               NL80211_FEATURE_DYNAMIC_SMPS)) {
5966                                 err = -EINVAL;
5967                                 goto out_unlock;
5968                         }
5969                         break;
5970                 default:
5971                         err = -EINVAL;
5972                         goto out_unlock;
5973                 }
5974         } else {
5975                 params->smps_mode = NL80211_SMPS_OFF;
5976         }
5977
5978         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5979         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
5980                 err = -EOPNOTSUPP;
5981                 goto out_unlock;
5982         }
5983
5984         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5985                 params->acl = parse_acl_data(&rdev->wiphy, info);
5986                 if (IS_ERR(params->acl)) {
5987                         err = PTR_ERR(params->acl);
5988                         params->acl = NULL;
5989                         goto out_unlock;
5990                 }
5991         }
5992
5993         params->twt_responder =
5994                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5995
5996         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5997                 err = nl80211_parse_he_obss_pd(
5998                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
5999                                         &params->he_obss_pd);
6000                 if (err)
6001                         goto out_unlock;
6002         }
6003
6004         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6005                 err = nl80211_parse_fils_discovery(rdev,
6006                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6007                                                    params);
6008                 if (err)
6009                         goto out_unlock;
6010         }
6011
6012         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6013                 err = nl80211_parse_unsol_bcast_probe_resp(
6014                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6015                         params);
6016                 if (err)
6017                         goto out_unlock;
6018         }
6019
6020         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6021                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6022                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6023                                                   &params->mbssid_config,
6024                                                   params->beacon.mbssid_ies ?
6025                                                         params->beacon.mbssid_ies->cnt :
6026                                                         0);
6027                 if (err)
6028                         goto out_unlock;
6029         }
6030
6031         err = nl80211_calculate_ap_params(params);
6032         if (err)
6033                 goto out_unlock;
6034
6035         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6036                 params->flags = nla_get_u32(
6037                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6038         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6039                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6040
6041         if (wdev->conn_owner_nlportid &&
6042             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6043             wdev->conn_owner_nlportid != info->snd_portid) {
6044                 err = -EINVAL;
6045                 goto out_unlock;
6046         }
6047
6048         /* FIXME: validate MLO/link-id against driver capabilities */
6049
6050         err = rdev_start_ap(rdev, dev, params);
6051         if (!err) {
6052                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6053                 wdev->links[link_id].ap.chandef = params->chandef;
6054                 wdev->u.ap.ssid_len = params->ssid_len;
6055                 memcpy(wdev->u.ap.ssid, params->ssid,
6056                        params->ssid_len);
6057
6058                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6059                         wdev->conn_owner_nlportid = info->snd_portid;
6060         }
6061 out_unlock:
6062         wdev_unlock(wdev);
6063 out:
6064         kfree(params->acl);
6065         kfree(params->beacon.mbssid_ies);
6066         if (params->mbssid_config.tx_wdev &&
6067             params->mbssid_config.tx_wdev->netdev &&
6068             params->mbssid_config.tx_wdev->netdev != dev)
6069                 dev_put(params->mbssid_config.tx_wdev->netdev);
6070         kfree(params);
6071
6072         return err;
6073 }
6074
6075 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6076 {
6077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6078         unsigned int link_id = nl80211_link_id(info->attrs);
6079         struct net_device *dev = info->user_ptr[1];
6080         struct wireless_dev *wdev = dev->ieee80211_ptr;
6081         struct cfg80211_beacon_data params;
6082         int err;
6083
6084         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6085             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6086                 return -EOPNOTSUPP;
6087
6088         if (!rdev->ops->change_beacon)
6089                 return -EOPNOTSUPP;
6090
6091         if (!wdev->links[link_id].ap.beacon_interval)
6092                 return -EINVAL;
6093
6094         err = nl80211_parse_beacon(rdev, info->attrs, &params);
6095         if (err)
6096                 goto out;
6097
6098         wdev_lock(wdev);
6099         err = rdev_change_beacon(rdev, dev, &params);
6100         wdev_unlock(wdev);
6101
6102 out:
6103         kfree(params.mbssid_ies);
6104         return err;
6105 }
6106
6107 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6108 {
6109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6110         unsigned int link_id = nl80211_link_id(info->attrs);
6111         struct net_device *dev = info->user_ptr[1];
6112
6113         return cfg80211_stop_ap(rdev, dev, link_id, false);
6114 }
6115
6116 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6117         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6118         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6119         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6120         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6121         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6122         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6123 };
6124
6125 static int parse_station_flags(struct genl_info *info,
6126                                enum nl80211_iftype iftype,
6127                                struct station_parameters *params)
6128 {
6129         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6130         struct nlattr *nla;
6131         int flag;
6132
6133         /*
6134          * Try parsing the new attribute first so userspace
6135          * can specify both for older kernels.
6136          */
6137         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6138         if (nla) {
6139                 struct nl80211_sta_flag_update *sta_flags;
6140
6141                 sta_flags = nla_data(nla);
6142                 params->sta_flags_mask = sta_flags->mask;
6143                 params->sta_flags_set = sta_flags->set;
6144                 params->sta_flags_set &= params->sta_flags_mask;
6145                 if ((params->sta_flags_mask |
6146                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6147                         return -EINVAL;
6148                 return 0;
6149         }
6150
6151         /* if present, parse the old attribute */
6152
6153         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6154         if (!nla)
6155                 return 0;
6156
6157         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6158                 return -EINVAL;
6159
6160         /*
6161          * Only allow certain flags for interface types so that
6162          * other attributes are silently ignored. Remember that
6163          * this is backward compatibility code with old userspace
6164          * and shouldn't be hit in other cases anyway.
6165          */
6166         switch (iftype) {
6167         case NL80211_IFTYPE_AP:
6168         case NL80211_IFTYPE_AP_VLAN:
6169         case NL80211_IFTYPE_P2P_GO:
6170                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6171                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6172                                          BIT(NL80211_STA_FLAG_WME) |
6173                                          BIT(NL80211_STA_FLAG_MFP);
6174                 break;
6175         case NL80211_IFTYPE_P2P_CLIENT:
6176         case NL80211_IFTYPE_STATION:
6177                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6178                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6179                 break;
6180         case NL80211_IFTYPE_MESH_POINT:
6181                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6182                                          BIT(NL80211_STA_FLAG_MFP) |
6183                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6184                 break;
6185         default:
6186                 return -EINVAL;
6187         }
6188
6189         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6190                 if (flags[flag]) {
6191                         params->sta_flags_set |= (1<<flag);
6192
6193                         /* no longer support new API additions in old API */
6194                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6195                                 return -EINVAL;
6196                 }
6197         }
6198
6199         return 0;
6200 }
6201
6202 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6203 {
6204         struct nlattr *rate;
6205         u32 bitrate;
6206         u16 bitrate_compat;
6207         enum nl80211_rate_info rate_flg;
6208
6209         rate = nla_nest_start_noflag(msg, attr);
6210         if (!rate)
6211                 return false;
6212
6213         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6214         bitrate = cfg80211_calculate_bitrate(info);
6215         /* report 16-bit bitrate only if we can */
6216         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6217         if (bitrate > 0 &&
6218             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6219                 return false;
6220         if (bitrate_compat > 0 &&
6221             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6222                 return false;
6223
6224         switch (info->bw) {
6225         case RATE_INFO_BW_5:
6226                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6227                 break;
6228         case RATE_INFO_BW_10:
6229                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6230                 break;
6231         default:
6232                 WARN_ON(1);
6233                 fallthrough;
6234         case RATE_INFO_BW_20:
6235                 rate_flg = 0;
6236                 break;
6237         case RATE_INFO_BW_40:
6238                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6239                 break;
6240         case RATE_INFO_BW_80:
6241                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6242                 break;
6243         case RATE_INFO_BW_160:
6244                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6245                 break;
6246         case RATE_INFO_BW_HE_RU:
6247                 rate_flg = 0;
6248                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6249                 break;
6250         case RATE_INFO_BW_320:
6251                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6252                 break;
6253         case RATE_INFO_BW_EHT_RU:
6254                 rate_flg = 0;
6255                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6256                 break;
6257         }
6258
6259         if (rate_flg && nla_put_flag(msg, rate_flg))
6260                 return false;
6261
6262         if (info->flags & RATE_INFO_FLAGS_MCS) {
6263                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6264                         return false;
6265                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6266                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6267                         return false;
6268         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6269                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6270                         return false;
6271                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6272                         return false;
6273                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6274                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6275                         return false;
6276         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6277                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6278                         return false;
6279                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6280                         return false;
6281                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6282                         return false;
6283                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6284                         return false;
6285                 if (info->bw == RATE_INFO_BW_HE_RU &&
6286                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6287                                info->he_ru_alloc))
6288                         return false;
6289         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6290                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6291                         return false;
6292                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6293                         return false;
6294                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6295                         return false;
6296                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6297                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6298                                info->eht_ru_alloc))
6299                         return false;
6300         }
6301
6302         nla_nest_end(msg, rate);
6303         return true;
6304 }
6305
6306 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6307                                int id)
6308 {
6309         void *attr;
6310         int i = 0;
6311
6312         if (!mask)
6313                 return true;
6314
6315         attr = nla_nest_start_noflag(msg, id);
6316         if (!attr)
6317                 return false;
6318
6319         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6320                 if (!(mask & BIT(i)))
6321                         continue;
6322
6323                 if (nla_put_u8(msg, i, signal[i]))
6324                         return false;
6325         }
6326
6327         nla_nest_end(msg, attr);
6328
6329         return true;
6330 }
6331
6332 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6333                                 u32 seq, int flags,
6334                                 struct cfg80211_registered_device *rdev,
6335                                 struct net_device *dev,
6336                                 const u8 *mac_addr, struct station_info *sinfo)
6337 {
6338         void *hdr;
6339         struct nlattr *sinfoattr, *bss_param;
6340
6341         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6342         if (!hdr) {
6343                 cfg80211_sinfo_release_content(sinfo);
6344                 return -1;
6345         }
6346
6347         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6348             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6349             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6350                 goto nla_put_failure;
6351
6352         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6353         if (!sinfoattr)
6354                 goto nla_put_failure;
6355
6356 #define PUT_SINFO(attr, memb, type) do {                                \
6357         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6358         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6359             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6360                              sinfo->memb))                              \
6361                 goto nla_put_failure;                                   \
6362         } while (0)
6363 #define PUT_SINFO_U64(attr, memb) do {                                  \
6364         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6365             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6366                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6367                 goto nla_put_failure;                                   \
6368         } while (0)
6369
6370         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6371         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6372         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6373
6374         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6375                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6376             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6377                         (u32)sinfo->rx_bytes))
6378                 goto nla_put_failure;
6379
6380         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6381                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6382             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6383                         (u32)sinfo->tx_bytes))
6384                 goto nla_put_failure;
6385
6386         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6387         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6388         PUT_SINFO(LLID, llid, u16);
6389         PUT_SINFO(PLID, plid, u16);
6390         PUT_SINFO(PLINK_STATE, plink_state, u8);
6391         PUT_SINFO_U64(RX_DURATION, rx_duration);
6392         PUT_SINFO_U64(TX_DURATION, tx_duration);
6393
6394         if (wiphy_ext_feature_isset(&rdev->wiphy,
6395                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6396                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6397
6398         switch (rdev->wiphy.signal_type) {
6399         case CFG80211_SIGNAL_TYPE_MBM:
6400                 PUT_SINFO(SIGNAL, signal, u8);
6401                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6402                 break;
6403         default:
6404                 break;
6405         }
6406         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6407                 if (!nl80211_put_signal(msg, sinfo->chains,
6408                                         sinfo->chain_signal,
6409                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6410                         goto nla_put_failure;
6411         }
6412         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6413                 if (!nl80211_put_signal(msg, sinfo->chains,
6414                                         sinfo->chain_signal_avg,
6415                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6416                         goto nla_put_failure;
6417         }
6418         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6419                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6420                                           NL80211_STA_INFO_TX_BITRATE))
6421                         goto nla_put_failure;
6422         }
6423         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6424                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6425                                           NL80211_STA_INFO_RX_BITRATE))
6426                         goto nla_put_failure;
6427         }
6428
6429         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6430         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6431         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6432         PUT_SINFO(TX_FAILED, tx_failed, u32);
6433         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6434         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6435         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6436         PUT_SINFO(LOCAL_PM, local_pm, u32);
6437         PUT_SINFO(PEER_PM, peer_pm, u32);
6438         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6439         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6440         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6441
6442         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6443                 bss_param = nla_nest_start_noflag(msg,
6444                                                   NL80211_STA_INFO_BSS_PARAM);
6445                 if (!bss_param)
6446                         goto nla_put_failure;
6447
6448                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6449                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6450                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6451                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6452                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6453                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6454                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6455                                sinfo->bss_param.dtim_period) ||
6456                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6457                                 sinfo->bss_param.beacon_interval))
6458                         goto nla_put_failure;
6459
6460                 nla_nest_end(msg, bss_param);
6461         }
6462         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6463             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6464                     sizeof(struct nl80211_sta_flag_update),
6465                     &sinfo->sta_flags))
6466                 goto nla_put_failure;
6467
6468         PUT_SINFO_U64(T_OFFSET, t_offset);
6469         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6470         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6471         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6472         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6473         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6474         if (wiphy_ext_feature_isset(&rdev->wiphy,
6475                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6476                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6477                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6478         }
6479
6480 #undef PUT_SINFO
6481 #undef PUT_SINFO_U64
6482
6483         if (sinfo->pertid) {
6484                 struct nlattr *tidsattr;
6485                 int tid;
6486
6487                 tidsattr = nla_nest_start_noflag(msg,
6488                                                  NL80211_STA_INFO_TID_STATS);
6489                 if (!tidsattr)
6490                         goto nla_put_failure;
6491
6492                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6493                         struct cfg80211_tid_stats *tidstats;
6494                         struct nlattr *tidattr;
6495
6496                         tidstats = &sinfo->pertid[tid];
6497
6498                         if (!tidstats->filled)
6499                                 continue;
6500
6501                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6502                         if (!tidattr)
6503                                 goto nla_put_failure;
6504
6505 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6506         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6507             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6508                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6509                 goto nla_put_failure;                                   \
6510         } while (0)
6511
6512                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6513                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6514                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6515                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6516
6517 #undef PUT_TIDVAL_U64
6518                         if ((tidstats->filled &
6519                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6520                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6521                                                    NL80211_TID_STATS_TXQ_STATS))
6522                                 goto nla_put_failure;
6523
6524                         nla_nest_end(msg, tidattr);
6525                 }
6526
6527                 nla_nest_end(msg, tidsattr);
6528         }
6529
6530         nla_nest_end(msg, sinfoattr);
6531
6532         if (sinfo->assoc_req_ies_len &&
6533             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6534                     sinfo->assoc_req_ies))
6535                 goto nla_put_failure;
6536
6537         cfg80211_sinfo_release_content(sinfo);
6538         genlmsg_end(msg, hdr);
6539         return 0;
6540
6541  nla_put_failure:
6542         cfg80211_sinfo_release_content(sinfo);
6543         genlmsg_cancel(msg, hdr);
6544         return -EMSGSIZE;
6545 }
6546
6547 static int nl80211_dump_station(struct sk_buff *skb,
6548                                 struct netlink_callback *cb)
6549 {
6550         struct station_info sinfo;
6551         struct cfg80211_registered_device *rdev;
6552         struct wireless_dev *wdev;
6553         u8 mac_addr[ETH_ALEN];
6554         int sta_idx = cb->args[2];
6555         int err;
6556
6557         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6558         if (err)
6559                 return err;
6560         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6561         __acquire(&rdev->wiphy.mtx);
6562
6563         if (!wdev->netdev) {
6564                 err = -EINVAL;
6565                 goto out_err;
6566         }
6567
6568         if (!rdev->ops->dump_station) {
6569                 err = -EOPNOTSUPP;
6570                 goto out_err;
6571         }
6572
6573         while (1) {
6574                 memset(&sinfo, 0, sizeof(sinfo));
6575                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6576                                         mac_addr, &sinfo);
6577                 if (err == -ENOENT)
6578                         break;
6579                 if (err)
6580                         goto out_err;
6581
6582                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6583                                 NETLINK_CB(cb->skb).portid,
6584                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6585                                 rdev, wdev->netdev, mac_addr,
6586                                 &sinfo) < 0)
6587                         goto out;
6588
6589                 sta_idx++;
6590         }
6591
6592  out:
6593         cb->args[2] = sta_idx;
6594         err = skb->len;
6595  out_err:
6596         wiphy_unlock(&rdev->wiphy);
6597
6598         return err;
6599 }
6600
6601 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6602 {
6603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6604         struct net_device *dev = info->user_ptr[1];
6605         struct station_info sinfo;
6606         struct sk_buff *msg;
6607         u8 *mac_addr = NULL;
6608         int err;
6609
6610         memset(&sinfo, 0, sizeof(sinfo));
6611
6612         if (!info->attrs[NL80211_ATTR_MAC])
6613                 return -EINVAL;
6614
6615         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6616
6617         if (!rdev->ops->get_station)
6618                 return -EOPNOTSUPP;
6619
6620         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6621         if (err)
6622                 return err;
6623
6624         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6625         if (!msg) {
6626                 cfg80211_sinfo_release_content(&sinfo);
6627                 return -ENOMEM;
6628         }
6629
6630         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6631                                  info->snd_portid, info->snd_seq, 0,
6632                                  rdev, dev, mac_addr, &sinfo) < 0) {
6633                 nlmsg_free(msg);
6634                 return -ENOBUFS;
6635         }
6636
6637         return genlmsg_reply(msg, info);
6638 }
6639
6640 int cfg80211_check_station_change(struct wiphy *wiphy,
6641                                   struct station_parameters *params,
6642                                   enum cfg80211_station_type statype)
6643 {
6644         if (params->listen_interval != -1 &&
6645             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6646                 return -EINVAL;
6647
6648         if (params->support_p2p_ps != -1 &&
6649             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6650                 return -EINVAL;
6651
6652         if (params->aid &&
6653             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6654             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6655                 return -EINVAL;
6656
6657         /* When you run into this, adjust the code below for the new flag */
6658         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6659
6660         switch (statype) {
6661         case CFG80211_STA_MESH_PEER_KERNEL:
6662         case CFG80211_STA_MESH_PEER_USER:
6663                 /*
6664                  * No ignoring the TDLS flag here -- the userspace mesh
6665                  * code doesn't have the bug of including TDLS in the
6666                  * mask everywhere.
6667                  */
6668                 if (params->sta_flags_mask &
6669                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6670                                   BIT(NL80211_STA_FLAG_MFP) |
6671                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6672                         return -EINVAL;
6673                 break;
6674         case CFG80211_STA_TDLS_PEER_SETUP:
6675         case CFG80211_STA_TDLS_PEER_ACTIVE:
6676                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6677                         return -EINVAL;
6678                 /* ignore since it can't change */
6679                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6680                 break;
6681         default:
6682                 /* disallow mesh-specific things */
6683                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6684                         return -EINVAL;
6685                 if (params->local_pm)
6686                         return -EINVAL;
6687                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6688                         return -EINVAL;
6689         }
6690
6691         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6692             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6693                 /* TDLS can't be set, ... */
6694                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6695                         return -EINVAL;
6696                 /*
6697                  * ... but don't bother the driver with it. This works around
6698                  * a hostapd/wpa_supplicant issue -- it always includes the
6699                  * TLDS_PEER flag in the mask even for AP mode.
6700                  */
6701                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6702         }
6703
6704         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6705             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6706                 /* reject other things that can't change */
6707                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6708                         return -EINVAL;
6709                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6710                         return -EINVAL;
6711                 if (params->link_sta_params.supported_rates)
6712                         return -EINVAL;
6713                 if (params->ext_capab || params->link_sta_params.ht_capa ||
6714                     params->link_sta_params.vht_capa ||
6715                     params->link_sta_params.he_capa ||
6716                     params->link_sta_params.eht_capa)
6717                         return -EINVAL;
6718         }
6719
6720         if (statype != CFG80211_STA_AP_CLIENT &&
6721             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6722                 if (params->vlan)
6723                         return -EINVAL;
6724         }
6725
6726         switch (statype) {
6727         case CFG80211_STA_AP_MLME_CLIENT:
6728                 /* Use this only for authorizing/unauthorizing a station */
6729                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6730                         return -EOPNOTSUPP;
6731                 break;
6732         case CFG80211_STA_AP_CLIENT:
6733         case CFG80211_STA_AP_CLIENT_UNASSOC:
6734                 /* accept only the listed bits */
6735                 if (params->sta_flags_mask &
6736                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6737                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6738                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6739                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6740                                   BIT(NL80211_STA_FLAG_WME) |
6741                                   BIT(NL80211_STA_FLAG_MFP)))
6742                         return -EINVAL;
6743
6744                 /* but authenticated/associated only if driver handles it */
6745                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6746                     params->sta_flags_mask &
6747                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6748                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6749                         return -EINVAL;
6750                 break;
6751         case CFG80211_STA_IBSS:
6752         case CFG80211_STA_AP_STA:
6753                 /* reject any changes other than AUTHORIZED */
6754                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6755                         return -EINVAL;
6756                 break;
6757         case CFG80211_STA_TDLS_PEER_SETUP:
6758                 /* reject any changes other than AUTHORIZED or WME */
6759                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6760                                                BIT(NL80211_STA_FLAG_WME)))
6761                         return -EINVAL;
6762                 /* force (at least) rates when authorizing */
6763                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6764                     !params->link_sta_params.supported_rates)
6765                         return -EINVAL;
6766                 break;
6767         case CFG80211_STA_TDLS_PEER_ACTIVE:
6768                 /* reject any changes */
6769                 return -EINVAL;
6770         case CFG80211_STA_MESH_PEER_KERNEL:
6771                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6772                         return -EINVAL;
6773                 break;
6774         case CFG80211_STA_MESH_PEER_USER:
6775                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6776                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6777                         return -EINVAL;
6778                 break;
6779         }
6780
6781         /*
6782          * Older kernel versions ignored this attribute entirely, so don't
6783          * reject attempts to update it but mark it as unused instead so the
6784          * driver won't look at the data.
6785          */
6786         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6787             statype != CFG80211_STA_TDLS_PEER_SETUP)
6788                 params->link_sta_params.opmode_notif_used = false;
6789
6790         return 0;
6791 }
6792 EXPORT_SYMBOL(cfg80211_check_station_change);
6793
6794 /*
6795  * Get vlan interface making sure it is running and on the right wiphy.
6796  */
6797 static struct net_device *get_vlan(struct genl_info *info,
6798                                    struct cfg80211_registered_device *rdev)
6799 {
6800         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6801         struct net_device *v;
6802         int ret;
6803
6804         if (!vlanattr)
6805                 return NULL;
6806
6807         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6808         if (!v)
6809                 return ERR_PTR(-ENODEV);
6810
6811         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6812                 ret = -EINVAL;
6813                 goto error;
6814         }
6815
6816         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6817             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6818             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6819                 ret = -EINVAL;
6820                 goto error;
6821         }
6822
6823         if (!netif_running(v)) {
6824                 ret = -ENETDOWN;
6825                 goto error;
6826         }
6827
6828         return v;
6829  error:
6830         dev_put(v);
6831         return ERR_PTR(ret);
6832 }
6833
6834 static int nl80211_parse_sta_wme(struct genl_info *info,
6835                                  struct station_parameters *params)
6836 {
6837         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6838         struct nlattr *nla;
6839         int err;
6840
6841         /* parse WME attributes if present */
6842         if (!info->attrs[NL80211_ATTR_STA_WME])
6843                 return 0;
6844
6845         nla = info->attrs[NL80211_ATTR_STA_WME];
6846         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6847                                           nl80211_sta_wme_policy,
6848                                           info->extack);
6849         if (err)
6850                 return err;
6851
6852         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6853                 params->uapsd_queues = nla_get_u8(
6854                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
6855         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6856                 return -EINVAL;
6857
6858         if (tb[NL80211_STA_WME_MAX_SP])
6859                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6860
6861         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6862                 return -EINVAL;
6863
6864         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6865
6866         return 0;
6867 }
6868
6869 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6870                                       struct station_parameters *params)
6871 {
6872         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6873                 params->supported_channels =
6874                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6875                 params->supported_channels_len =
6876                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6877                 /*
6878                  * Need to include at least one (first channel, number of
6879                  * channels) tuple for each subband (checked in policy),
6880                  * and must have proper tuples for the rest of the data as well.
6881                  */
6882                 if (params->supported_channels_len % 2)
6883                         return -EINVAL;
6884         }
6885
6886         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6887                 params->supported_oper_classes =
6888                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6889                 params->supported_oper_classes_len =
6890                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6891         }
6892         return 0;
6893 }
6894
6895 static int nl80211_set_station_tdls(struct genl_info *info,
6896                                     struct station_parameters *params)
6897 {
6898         int err;
6899         /* Dummy STA entry gets updated once the peer capabilities are known */
6900         if (info->attrs[NL80211_ATTR_PEER_AID])
6901                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6902         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6903                 params->link_sta_params.ht_capa =
6904                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6905         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6906                 params->link_sta_params.vht_capa =
6907                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6908         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6909                 params->link_sta_params.he_capa =
6910                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6911                 params->link_sta_params.he_capa_len =
6912                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6913
6914                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
6915                         params->link_sta_params.eht_capa =
6916                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
6917                         params->link_sta_params.eht_capa_len =
6918                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
6919
6920                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
6921                                                         (const u8 *)params->link_sta_params.eht_capa,
6922                                                         params->link_sta_params.eht_capa_len,
6923                                                         false))
6924                                 return -EINVAL;
6925                 }
6926         }
6927
6928         err = nl80211_parse_sta_channel_info(info, params);
6929         if (err)
6930                 return err;
6931
6932         return nl80211_parse_sta_wme(info, params);
6933 }
6934
6935 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6936                                              struct sta_txpwr *txpwr,
6937                                              bool *txpwr_set)
6938 {
6939         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6940         int idx;
6941
6942         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6943                 if (!rdev->ops->set_tx_power ||
6944                     !wiphy_ext_feature_isset(&rdev->wiphy,
6945                                          NL80211_EXT_FEATURE_STA_TX_PWR))
6946                         return -EOPNOTSUPP;
6947
6948                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6949                 txpwr->type = nla_get_u8(info->attrs[idx]);
6950
6951                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
6952                         idx = NL80211_ATTR_STA_TX_POWER;
6953
6954                         if (info->attrs[idx])
6955                                 txpwr->power = nla_get_s16(info->attrs[idx]);
6956                         else
6957                                 return -EINVAL;
6958                 }
6959
6960                 *txpwr_set = true;
6961         } else {
6962                 *txpwr_set = false;
6963         }
6964
6965         return 0;
6966 }
6967
6968 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6969 {
6970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6971         struct net_device *dev = info->user_ptr[1];
6972         struct station_parameters params;
6973         u8 *mac_addr;
6974         int err;
6975
6976         memset(&params, 0, sizeof(params));
6977
6978         if (!rdev->ops->change_station)
6979                 return -EOPNOTSUPP;
6980
6981         /*
6982          * AID and listen_interval properties can be set only for unassociated
6983          * station. Include these parameters here and will check them in
6984          * cfg80211_check_station_change().
6985          */
6986         if (info->attrs[NL80211_ATTR_STA_AID])
6987                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6988
6989         if (info->attrs[NL80211_ATTR_VLAN_ID])
6990                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6991
6992         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6993                 params.listen_interval =
6994                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6995         else
6996                 params.listen_interval = -1;
6997
6998         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6999                 params.support_p2p_ps =
7000                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7001         else
7002                 params.support_p2p_ps = -1;
7003
7004         if (!info->attrs[NL80211_ATTR_MAC])
7005                 return -EINVAL;
7006
7007         params.link_sta_params.link_id =
7008                 nl80211_link_id_or_invalid(info->attrs);
7009
7010         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7011                 /* If MLD_ADDR attribute is set then this is an MLD station
7012                  * and the MLD_ADDR attribute holds the MLD address and the
7013                  * MAC attribute holds for the LINK address.
7014                  * In that case, the link_id is also expected to be valid.
7015                  */
7016                 if (params.link_sta_params.link_id < 0)
7017                         return -EINVAL;
7018
7019                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7020                 params.link_sta_params.mld_mac = mac_addr;
7021                 params.link_sta_params.link_mac =
7022                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7023                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7024                         return -EINVAL;
7025         } else {
7026                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7027         }
7028
7029
7030         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7031                 params.link_sta_params.supported_rates =
7032                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7033                 params.link_sta_params.supported_rates_len =
7034                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7035         }
7036
7037         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7038                 params.capability =
7039                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7040                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7041         }
7042
7043         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7044                 params.ext_capab =
7045                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7046                 params.ext_capab_len =
7047                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7048         }
7049
7050         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7051                 return -EINVAL;
7052
7053         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7054                 params.plink_action =
7055                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7056
7057         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7058                 params.plink_state =
7059                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7060                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7061                         params.peer_aid = nla_get_u16(
7062                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7063                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7064         }
7065
7066         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7067                 params.local_pm = nla_get_u32(
7068                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7069
7070         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7071                 params.link_sta_params.opmode_notif_used = true;
7072                 params.link_sta_params.opmode_notif =
7073                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7074         }
7075
7076         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7077                 params.link_sta_params.he_6ghz_capa =
7078                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7079
7080         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7081                 params.airtime_weight =
7082                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7083
7084         if (params.airtime_weight &&
7085             !wiphy_ext_feature_isset(&rdev->wiphy,
7086                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7087                 return -EOPNOTSUPP;
7088
7089         err = nl80211_parse_sta_txpower_setting(info,
7090                                                 &params.link_sta_params.txpwr,
7091                                                 &params.link_sta_params.txpwr_set);
7092         if (err)
7093                 return err;
7094
7095         /* Include parameters for TDLS peer (will check later) */
7096         err = nl80211_set_station_tdls(info, &params);
7097         if (err)
7098                 return err;
7099
7100         params.vlan = get_vlan(info, rdev);
7101         if (IS_ERR(params.vlan))
7102                 return PTR_ERR(params.vlan);
7103
7104         switch (dev->ieee80211_ptr->iftype) {
7105         case NL80211_IFTYPE_AP:
7106         case NL80211_IFTYPE_AP_VLAN:
7107         case NL80211_IFTYPE_P2P_GO:
7108         case NL80211_IFTYPE_P2P_CLIENT:
7109         case NL80211_IFTYPE_STATION:
7110         case NL80211_IFTYPE_ADHOC:
7111         case NL80211_IFTYPE_MESH_POINT:
7112                 break;
7113         default:
7114                 err = -EOPNOTSUPP;
7115                 goto out_put_vlan;
7116         }
7117
7118         /* driver will call cfg80211_check_station_change() */
7119         wdev_lock(dev->ieee80211_ptr);
7120         err = rdev_change_station(rdev, dev, mac_addr, &params);
7121         wdev_unlock(dev->ieee80211_ptr);
7122
7123  out_put_vlan:
7124         dev_put(params.vlan);
7125
7126         return err;
7127 }
7128
7129 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7130 {
7131         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7132         int err;
7133         struct net_device *dev = info->user_ptr[1];
7134         struct wireless_dev *wdev = dev->ieee80211_ptr;
7135         struct station_parameters params;
7136         u8 *mac_addr = NULL;
7137         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7138                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7139
7140         memset(&params, 0, sizeof(params));
7141
7142         if (!rdev->ops->add_station)
7143                 return -EOPNOTSUPP;
7144
7145         if (!info->attrs[NL80211_ATTR_MAC])
7146                 return -EINVAL;
7147
7148         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7149                 return -EINVAL;
7150
7151         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7152                 return -EINVAL;
7153
7154         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7155             !info->attrs[NL80211_ATTR_PEER_AID])
7156                 return -EINVAL;
7157
7158         params.link_sta_params.link_id =
7159                 nl80211_link_id_or_invalid(info->attrs);
7160
7161         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7162                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7163                 params.link_sta_params.mld_mac = mac_addr;
7164                 params.link_sta_params.link_mac =
7165                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7166                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7167                         return -EINVAL;
7168         } else {
7169                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7170         }
7171
7172         params.link_sta_params.supported_rates =
7173                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7174         params.link_sta_params.supported_rates_len =
7175                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7176         params.listen_interval =
7177                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7178
7179         if (info->attrs[NL80211_ATTR_VLAN_ID])
7180                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7181
7182         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7183                 params.support_p2p_ps =
7184                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7185         } else {
7186                 /*
7187                  * if not specified, assume it's supported for P2P GO interface,
7188                  * and is NOT supported for AP interface
7189                  */
7190                 params.support_p2p_ps =
7191                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7192         }
7193
7194         if (info->attrs[NL80211_ATTR_PEER_AID])
7195                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7196         else
7197                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7198
7199         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7200                 params.capability =
7201                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7202                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7203         }
7204
7205         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7206                 params.ext_capab =
7207                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7208                 params.ext_capab_len =
7209                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7210         }
7211
7212         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7213                 params.link_sta_params.ht_capa =
7214                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7215
7216         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7217                 params.link_sta_params.vht_capa =
7218                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7219
7220         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7221                 params.link_sta_params.he_capa =
7222                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7223                 params.link_sta_params.he_capa_len =
7224                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7225
7226                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7227                         params.link_sta_params.eht_capa =
7228                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7229                         params.link_sta_params.eht_capa_len =
7230                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7231
7232                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7233                                                         (const u8 *)params.link_sta_params.eht_capa,
7234                                                         params.link_sta_params.eht_capa_len,
7235                                                         false))
7236                                 return -EINVAL;
7237                 }
7238         }
7239
7240         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7241                 params.link_sta_params.he_6ghz_capa =
7242                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7243
7244         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7245                 params.link_sta_params.opmode_notif_used = true;
7246                 params.link_sta_params.opmode_notif =
7247                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7248         }
7249
7250         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7251                 params.plink_action =
7252                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7253
7254         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7255                 params.airtime_weight =
7256                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7257
7258         if (params.airtime_weight &&
7259             !wiphy_ext_feature_isset(&rdev->wiphy,
7260                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7261                 return -EOPNOTSUPP;
7262
7263         err = nl80211_parse_sta_txpower_setting(info,
7264                                                 &params.link_sta_params.txpwr,
7265                                                 &params.link_sta_params.txpwr_set);
7266         if (err)
7267                 return err;
7268
7269         err = nl80211_parse_sta_channel_info(info, &params);
7270         if (err)
7271                 return err;
7272
7273         err = nl80211_parse_sta_wme(info, &params);
7274         if (err)
7275                 return err;
7276
7277         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7278                 return -EINVAL;
7279
7280         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7281          * as userspace might just pass through the capabilities from the IEs
7282          * directly, rather than enforcing this restriction and returning an
7283          * error in this case.
7284          */
7285         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7286                 params.link_sta_params.ht_capa = NULL;
7287                 params.link_sta_params.vht_capa = NULL;
7288
7289                 /* HE and EHT require WME */
7290                 if (params.link_sta_params.he_capa_len ||
7291                     params.link_sta_params.he_6ghz_capa ||
7292                     params.link_sta_params.eht_capa_len)
7293                         return -EINVAL;
7294         }
7295
7296         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7297         if (params.link_sta_params.he_6ghz_capa &&
7298             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7299                 return -EINVAL;
7300
7301         /* When you run into this, adjust the code below for the new flag */
7302         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7303
7304         switch (dev->ieee80211_ptr->iftype) {
7305         case NL80211_IFTYPE_AP:
7306         case NL80211_IFTYPE_AP_VLAN:
7307         case NL80211_IFTYPE_P2P_GO:
7308                 /* ignore WME attributes if iface/sta is not capable */
7309                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7310                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7311                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7312
7313                 /* TDLS peers cannot be added */
7314                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7315                     info->attrs[NL80211_ATTR_PEER_AID])
7316                         return -EINVAL;
7317                 /* but don't bother the driver with it */
7318                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7319
7320                 /* allow authenticated/associated only if driver handles it */
7321                 if (!(rdev->wiphy.features &
7322                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7323                     params.sta_flags_mask & auth_assoc)
7324                         return -EINVAL;
7325
7326                 /* Older userspace, or userspace wanting to be compatible with
7327                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7328                  * and assoc flags in the mask, but assumes the station will be
7329                  * added as associated anyway since this was the required driver
7330                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7331                  * introduced.
7332                  * In order to not bother drivers with this quirk in the API
7333                  * set the flags in both the mask and set for new stations in
7334                  * this case.
7335                  */
7336                 if (!(params.sta_flags_mask & auth_assoc)) {
7337                         params.sta_flags_mask |= auth_assoc;
7338                         params.sta_flags_set |= auth_assoc;
7339                 }
7340
7341                 /* must be last in here for error handling */
7342                 params.vlan = get_vlan(info, rdev);
7343                 if (IS_ERR(params.vlan))
7344                         return PTR_ERR(params.vlan);
7345                 break;
7346         case NL80211_IFTYPE_MESH_POINT:
7347                 /* ignore uAPSD data */
7348                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7349
7350                 /* associated is disallowed */
7351                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7352                         return -EINVAL;
7353                 /* TDLS peers cannot be added */
7354                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7355                     info->attrs[NL80211_ATTR_PEER_AID])
7356                         return -EINVAL;
7357                 break;
7358         case NL80211_IFTYPE_STATION:
7359         case NL80211_IFTYPE_P2P_CLIENT:
7360                 /* ignore uAPSD data */
7361                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7362
7363                 /* these are disallowed */
7364                 if (params.sta_flags_mask &
7365                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7366                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7367                         return -EINVAL;
7368                 /* Only TDLS peers can be added */
7369                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7370                         return -EINVAL;
7371                 /* Can only add if TDLS ... */
7372                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7373                         return -EOPNOTSUPP;
7374                 /* ... with external setup is supported */
7375                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7376                         return -EOPNOTSUPP;
7377                 /*
7378                  * Older wpa_supplicant versions always mark the TDLS peer
7379                  * as authorized, but it shouldn't yet be.
7380                  */
7381                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7382                 break;
7383         default:
7384                 return -EOPNOTSUPP;
7385         }
7386
7387         /* be aware of params.vlan when changing code here */
7388
7389         wdev_lock(dev->ieee80211_ptr);
7390         if (wdev->valid_links) {
7391                 if (params.link_sta_params.link_id < 0) {
7392                         err = -EINVAL;
7393                         goto out;
7394                 }
7395                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7396                         err = -ENOLINK;
7397                         goto out;
7398                 }
7399         } else {
7400                 if (params.link_sta_params.link_id >= 0) {
7401                         err = -EINVAL;
7402                         goto out;
7403                 }
7404         }
7405         err = rdev_add_station(rdev, dev, mac_addr, &params);
7406 out:
7407         wdev_unlock(dev->ieee80211_ptr);
7408         dev_put(params.vlan);
7409         return err;
7410 }
7411
7412 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7413 {
7414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7415         struct net_device *dev = info->user_ptr[1];
7416         struct station_del_parameters params;
7417         int ret;
7418
7419         memset(&params, 0, sizeof(params));
7420
7421         if (info->attrs[NL80211_ATTR_MAC])
7422                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7423
7424         switch (dev->ieee80211_ptr->iftype) {
7425         case NL80211_IFTYPE_AP:
7426         case NL80211_IFTYPE_AP_VLAN:
7427         case NL80211_IFTYPE_MESH_POINT:
7428         case NL80211_IFTYPE_P2P_GO:
7429                 /* always accept these */
7430                 break;
7431         case NL80211_IFTYPE_ADHOC:
7432                 /* conditionally accept */
7433                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7434                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7435                         break;
7436                 return -EINVAL;
7437         default:
7438                 return -EINVAL;
7439         }
7440
7441         if (!rdev->ops->del_station)
7442                 return -EOPNOTSUPP;
7443
7444         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7445                 params.subtype =
7446                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7447                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7448                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7449                         return -EINVAL;
7450         } else {
7451                 /* Default to Deauthentication frame */
7452                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7453         }
7454
7455         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7456                 params.reason_code =
7457                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7458                 if (params.reason_code == 0)
7459                         return -EINVAL; /* 0 is reserved */
7460         } else {
7461                 /* Default to reason code 2 */
7462                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7463         }
7464
7465         wdev_lock(dev->ieee80211_ptr);
7466         ret = rdev_del_station(rdev, dev, &params);
7467         wdev_unlock(dev->ieee80211_ptr);
7468
7469         return ret;
7470 }
7471
7472 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7473                                 int flags, struct net_device *dev,
7474                                 u8 *dst, u8 *next_hop,
7475                                 struct mpath_info *pinfo)
7476 {
7477         void *hdr;
7478         struct nlattr *pinfoattr;
7479
7480         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7481         if (!hdr)
7482                 return -1;
7483
7484         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7485             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7486             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7487             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7488                 goto nla_put_failure;
7489
7490         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7491         if (!pinfoattr)
7492                 goto nla_put_failure;
7493         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7494             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7495                         pinfo->frame_qlen))
7496                 goto nla_put_failure;
7497         if (((pinfo->filled & MPATH_INFO_SN) &&
7498              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7499             ((pinfo->filled & MPATH_INFO_METRIC) &&
7500              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7501                          pinfo->metric)) ||
7502             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7503              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7504                          pinfo->exptime)) ||
7505             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7506              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7507                         pinfo->flags)) ||
7508             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7509              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7510                          pinfo->discovery_timeout)) ||
7511             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7512              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7513                         pinfo->discovery_retries)) ||
7514             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7515              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7516                         pinfo->hop_count)) ||
7517             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7518              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7519                          pinfo->path_change_count)))
7520                 goto nla_put_failure;
7521
7522         nla_nest_end(msg, pinfoattr);
7523
7524         genlmsg_end(msg, hdr);
7525         return 0;
7526
7527  nla_put_failure:
7528         genlmsg_cancel(msg, hdr);
7529         return -EMSGSIZE;
7530 }
7531
7532 static int nl80211_dump_mpath(struct sk_buff *skb,
7533                               struct netlink_callback *cb)
7534 {
7535         struct mpath_info pinfo;
7536         struct cfg80211_registered_device *rdev;
7537         struct wireless_dev *wdev;
7538         u8 dst[ETH_ALEN];
7539         u8 next_hop[ETH_ALEN];
7540         int path_idx = cb->args[2];
7541         int err;
7542
7543         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7544         if (err)
7545                 return err;
7546         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7547         __acquire(&rdev->wiphy.mtx);
7548
7549         if (!rdev->ops->dump_mpath) {
7550                 err = -EOPNOTSUPP;
7551                 goto out_err;
7552         }
7553
7554         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7555                 err = -EOPNOTSUPP;
7556                 goto out_err;
7557         }
7558
7559         while (1) {
7560                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7561                                       next_hop, &pinfo);
7562                 if (err == -ENOENT)
7563                         break;
7564                 if (err)
7565                         goto out_err;
7566
7567                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7568                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7569                                        wdev->netdev, dst, next_hop,
7570                                        &pinfo) < 0)
7571                         goto out;
7572
7573                 path_idx++;
7574         }
7575
7576  out:
7577         cb->args[2] = path_idx;
7578         err = skb->len;
7579  out_err:
7580         wiphy_unlock(&rdev->wiphy);
7581         return err;
7582 }
7583
7584 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7585 {
7586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7587         int err;
7588         struct net_device *dev = info->user_ptr[1];
7589         struct mpath_info pinfo;
7590         struct sk_buff *msg;
7591         u8 *dst = NULL;
7592         u8 next_hop[ETH_ALEN];
7593
7594         memset(&pinfo, 0, sizeof(pinfo));
7595
7596         if (!info->attrs[NL80211_ATTR_MAC])
7597                 return -EINVAL;
7598
7599         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7600
7601         if (!rdev->ops->get_mpath)
7602                 return -EOPNOTSUPP;
7603
7604         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7605                 return -EOPNOTSUPP;
7606
7607         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7608         if (err)
7609                 return err;
7610
7611         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7612         if (!msg)
7613                 return -ENOMEM;
7614
7615         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7616                                  dev, dst, next_hop, &pinfo) < 0) {
7617                 nlmsg_free(msg);
7618                 return -ENOBUFS;
7619         }
7620
7621         return genlmsg_reply(msg, info);
7622 }
7623
7624 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7625 {
7626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7627         struct net_device *dev = info->user_ptr[1];
7628         u8 *dst = NULL;
7629         u8 *next_hop = NULL;
7630
7631         if (!info->attrs[NL80211_ATTR_MAC])
7632                 return -EINVAL;
7633
7634         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7635                 return -EINVAL;
7636
7637         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7638         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7639
7640         if (!rdev->ops->change_mpath)
7641                 return -EOPNOTSUPP;
7642
7643         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7644                 return -EOPNOTSUPP;
7645
7646         return rdev_change_mpath(rdev, dev, dst, next_hop);
7647 }
7648
7649 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7650 {
7651         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7652         struct net_device *dev = info->user_ptr[1];
7653         u8 *dst = NULL;
7654         u8 *next_hop = NULL;
7655
7656         if (!info->attrs[NL80211_ATTR_MAC])
7657                 return -EINVAL;
7658
7659         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7660                 return -EINVAL;
7661
7662         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7663         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7664
7665         if (!rdev->ops->add_mpath)
7666                 return -EOPNOTSUPP;
7667
7668         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7669                 return -EOPNOTSUPP;
7670
7671         return rdev_add_mpath(rdev, dev, dst, next_hop);
7672 }
7673
7674 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7675 {
7676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7677         struct net_device *dev = info->user_ptr[1];
7678         u8 *dst = NULL;
7679
7680         if (info->attrs[NL80211_ATTR_MAC])
7681                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7682
7683         if (!rdev->ops->del_mpath)
7684                 return -EOPNOTSUPP;
7685
7686         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7687                 return -EOPNOTSUPP;
7688
7689         return rdev_del_mpath(rdev, dev, dst);
7690 }
7691
7692 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7693 {
7694         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7695         int err;
7696         struct net_device *dev = info->user_ptr[1];
7697         struct mpath_info pinfo;
7698         struct sk_buff *msg;
7699         u8 *dst = NULL;
7700         u8 mpp[ETH_ALEN];
7701
7702         memset(&pinfo, 0, sizeof(pinfo));
7703
7704         if (!info->attrs[NL80211_ATTR_MAC])
7705                 return -EINVAL;
7706
7707         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7708
7709         if (!rdev->ops->get_mpp)
7710                 return -EOPNOTSUPP;
7711
7712         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7713                 return -EOPNOTSUPP;
7714
7715         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7716         if (err)
7717                 return err;
7718
7719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7720         if (!msg)
7721                 return -ENOMEM;
7722
7723         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7724                                dev, dst, mpp, &pinfo) < 0) {
7725                 nlmsg_free(msg);
7726                 return -ENOBUFS;
7727         }
7728
7729         return genlmsg_reply(msg, info);
7730 }
7731
7732 static int nl80211_dump_mpp(struct sk_buff *skb,
7733                             struct netlink_callback *cb)
7734 {
7735         struct mpath_info pinfo;
7736         struct cfg80211_registered_device *rdev;
7737         struct wireless_dev *wdev;
7738         u8 dst[ETH_ALEN];
7739         u8 mpp[ETH_ALEN];
7740         int path_idx = cb->args[2];
7741         int err;
7742
7743         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7744         if (err)
7745                 return err;
7746         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7747         __acquire(&rdev->wiphy.mtx);
7748
7749         if (!rdev->ops->dump_mpp) {
7750                 err = -EOPNOTSUPP;
7751                 goto out_err;
7752         }
7753
7754         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7755                 err = -EOPNOTSUPP;
7756                 goto out_err;
7757         }
7758
7759         while (1) {
7760                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7761                                     mpp, &pinfo);
7762                 if (err == -ENOENT)
7763                         break;
7764                 if (err)
7765                         goto out_err;
7766
7767                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7768                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7769                                        wdev->netdev, dst, mpp,
7770                                        &pinfo) < 0)
7771                         goto out;
7772
7773                 path_idx++;
7774         }
7775
7776  out:
7777         cb->args[2] = path_idx;
7778         err = skb->len;
7779  out_err:
7780         wiphy_unlock(&rdev->wiphy);
7781         return err;
7782 }
7783
7784 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7785 {
7786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7787         struct net_device *dev = info->user_ptr[1];
7788         struct wireless_dev *wdev = dev->ieee80211_ptr;
7789         struct bss_parameters params;
7790         int err;
7791
7792         memset(&params, 0, sizeof(params));
7793         /* default to not changing parameters */
7794         params.use_cts_prot = -1;
7795         params.use_short_preamble = -1;
7796         params.use_short_slot_time = -1;
7797         params.ap_isolate = -1;
7798         params.ht_opmode = -1;
7799         params.p2p_ctwindow = -1;
7800         params.p2p_opp_ps = -1;
7801
7802         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7803                 params.use_cts_prot =
7804                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7805         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7806                 params.use_short_preamble =
7807                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7808         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7809                 params.use_short_slot_time =
7810                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7811         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7812                 params.basic_rates =
7813                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7814                 params.basic_rates_len =
7815                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7816         }
7817         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7818                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7819         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7820                 params.ht_opmode =
7821                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7822
7823         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7824                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7825                         return -EINVAL;
7826                 params.p2p_ctwindow =
7827                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7828                 if (params.p2p_ctwindow != 0 &&
7829                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7830                         return -EINVAL;
7831         }
7832
7833         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7834                 u8 tmp;
7835
7836                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7837                         return -EINVAL;
7838                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7839                 params.p2p_opp_ps = tmp;
7840                 if (params.p2p_opp_ps &&
7841                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7842                         return -EINVAL;
7843         }
7844
7845         if (!rdev->ops->change_bss)
7846                 return -EOPNOTSUPP;
7847
7848         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7849             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7850                 return -EOPNOTSUPP;
7851
7852         wdev_lock(wdev);
7853         err = rdev_change_bss(rdev, dev, &params);
7854         wdev_unlock(wdev);
7855
7856         return err;
7857 }
7858
7859 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7860 {
7861         char *data = NULL;
7862         bool is_indoor;
7863         enum nl80211_user_reg_hint_type user_reg_hint_type;
7864         u32 owner_nlportid;
7865
7866         /*
7867          * You should only get this when cfg80211 hasn't yet initialized
7868          * completely when built-in to the kernel right between the time
7869          * window between nl80211_init() and regulatory_init(), if that is
7870          * even possible.
7871          */
7872         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7873                 return -EINPROGRESS;
7874
7875         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7876                 user_reg_hint_type =
7877                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7878         else
7879                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7880
7881         switch (user_reg_hint_type) {
7882         case NL80211_USER_REG_HINT_USER:
7883         case NL80211_USER_REG_HINT_CELL_BASE:
7884                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7885                         return -EINVAL;
7886
7887                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7888                 return regulatory_hint_user(data, user_reg_hint_type);
7889         case NL80211_USER_REG_HINT_INDOOR:
7890                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7891                         owner_nlportid = info->snd_portid;
7892                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7893                 } else {
7894                         owner_nlportid = 0;
7895                         is_indoor = true;
7896                 }
7897
7898                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7899         default:
7900                 return -EINVAL;
7901         }
7902 }
7903
7904 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7905 {
7906         return reg_reload_regdb();
7907 }
7908
7909 static int nl80211_get_mesh_config(struct sk_buff *skb,
7910                                    struct genl_info *info)
7911 {
7912         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7913         struct net_device *dev = info->user_ptr[1];
7914         struct wireless_dev *wdev = dev->ieee80211_ptr;
7915         struct mesh_config cur_params;
7916         int err = 0;
7917         void *hdr;
7918         struct nlattr *pinfoattr;
7919         struct sk_buff *msg;
7920
7921         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7922                 return -EOPNOTSUPP;
7923
7924         if (!rdev->ops->get_mesh_config)
7925                 return -EOPNOTSUPP;
7926
7927         wdev_lock(wdev);
7928         /* If not connected, get default parameters */
7929         if (!wdev->u.mesh.id_len)
7930                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7931         else
7932                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7933         wdev_unlock(wdev);
7934
7935         if (err)
7936                 return err;
7937
7938         /* Draw up a netlink message to send back */
7939         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7940         if (!msg)
7941                 return -ENOMEM;
7942         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7943                              NL80211_CMD_GET_MESH_CONFIG);
7944         if (!hdr)
7945                 goto out;
7946         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7947         if (!pinfoattr)
7948                 goto nla_put_failure;
7949         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7950             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7951                         cur_params.dot11MeshRetryTimeout) ||
7952             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7953                         cur_params.dot11MeshConfirmTimeout) ||
7954             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7955                         cur_params.dot11MeshHoldingTimeout) ||
7956             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7957                         cur_params.dot11MeshMaxPeerLinks) ||
7958             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7959                        cur_params.dot11MeshMaxRetries) ||
7960             nla_put_u8(msg, NL80211_MESHCONF_TTL,
7961                        cur_params.dot11MeshTTL) ||
7962             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7963                        cur_params.element_ttl) ||
7964             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7965                        cur_params.auto_open_plinks) ||
7966             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7967                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7968             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7969                        cur_params.dot11MeshHWMPmaxPREQretries) ||
7970             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7971                         cur_params.path_refresh_time) ||
7972             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7973                         cur_params.min_discovery_timeout) ||
7974             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7975                         cur_params.dot11MeshHWMPactivePathTimeout) ||
7976             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7977                         cur_params.dot11MeshHWMPpreqMinInterval) ||
7978             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7979                         cur_params.dot11MeshHWMPperrMinInterval) ||
7980             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7981                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7982             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7983                        cur_params.dot11MeshHWMPRootMode) ||
7984             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7985                         cur_params.dot11MeshHWMPRannInterval) ||
7986             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7987                        cur_params.dot11MeshGateAnnouncementProtocol) ||
7988             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7989                        cur_params.dot11MeshForwarding) ||
7990             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7991                         cur_params.rssi_threshold) ||
7992             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7993                         cur_params.ht_opmode) ||
7994             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7995                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7996             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7997                         cur_params.dot11MeshHWMProotInterval) ||
7998             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7999                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8000             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8001                         cur_params.power_mode) ||
8002             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8003                         cur_params.dot11MeshAwakeWindowDuration) ||
8004             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8005                         cur_params.plink_timeout) ||
8006             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8007                        cur_params.dot11MeshConnectedToMeshGate) ||
8008             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8009                        cur_params.dot11MeshNolearn) ||
8010             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8011                        cur_params.dot11MeshConnectedToAuthServer))
8012                 goto nla_put_failure;
8013         nla_nest_end(msg, pinfoattr);
8014         genlmsg_end(msg, hdr);
8015         return genlmsg_reply(msg, info);
8016
8017  nla_put_failure:
8018  out:
8019         nlmsg_free(msg);
8020         return -ENOBUFS;
8021 }
8022
8023 static const struct nla_policy
8024 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8025         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8026                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8027         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8028                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8029         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8030                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8031         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8032                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8033         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8034         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8035         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8036         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8037         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8038                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8039         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8040         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8041         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8042         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8043         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8044                 NLA_POLICY_MIN(NLA_U16, 1),
8045         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8046                 NLA_POLICY_MIN(NLA_U16, 1),
8047         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8048                 NLA_POLICY_MIN(NLA_U16, 1),
8049         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8050         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8051                 NLA_POLICY_MIN(NLA_U16, 1),
8052         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8053         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8054         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8055                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8056         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8057         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8058         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8059                 NLA_POLICY_MIN(NLA_U16, 1),
8060         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8061                 NLA_POLICY_MIN(NLA_U16, 1),
8062         [NL80211_MESHCONF_POWER_MODE] =
8063                 NLA_POLICY_RANGE(NLA_U32,
8064                                  NL80211_MESH_POWER_ACTIVE,
8065                                  NL80211_MESH_POWER_MAX),
8066         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8067         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8068         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8069         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8070         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8071 };
8072
8073 static const struct nla_policy
8074         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8075         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8076         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8077         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8078         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8079         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8080         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8081         [NL80211_MESH_SETUP_IE] =
8082                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8083                                        IEEE80211_MAX_DATA_LEN),
8084         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8085 };
8086
8087 static int nl80211_parse_mesh_config(struct genl_info *info,
8088                                      struct mesh_config *cfg,
8089                                      u32 *mask_out)
8090 {
8091         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8092         u32 mask = 0;
8093         u16 ht_opmode;
8094
8095 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8096 do {                                                                    \
8097         if (tb[attr]) {                                                 \
8098                 cfg->param = fn(tb[attr]);                              \
8099                 mask |= BIT((attr) - 1);                                \
8100         }                                                               \
8101 } while (0)
8102
8103         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8104                 return -EINVAL;
8105         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8106                 return -EINVAL;
8107
8108         /* This makes sure that there aren't more than 32 mesh config
8109          * parameters (otherwise our bitfield scheme would not work.) */
8110         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8111
8112         /* Fill in the params struct */
8113         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8114                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8115         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8116                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8117                                   nla_get_u16);
8118         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8119                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8120                                   nla_get_u16);
8121         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8122                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8123                                   nla_get_u16);
8124         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8125                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8126         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8127                                   NL80211_MESHCONF_TTL, nla_get_u8);
8128         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8129                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8130         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8131                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8132                                   nla_get_u8);
8133         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8134                                   mask,
8135                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8136                                   nla_get_u32);
8137         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8138                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8139                                   nla_get_u8);
8140         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8141                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8142                                   nla_get_u32);
8143         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8144             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8145                 return -EINVAL;
8146         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8147                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8148                                   nla_get_u16);
8149         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8150                                   mask,
8151                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8152                                   nla_get_u32);
8153         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8154             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8155              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8156                 return -EINVAL;
8157         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8158                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8159                                   nla_get_u16);
8160         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8161                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8162                                   nla_get_u16);
8163         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8164                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8165                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8166                                   nla_get_u16);
8167         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8168                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8169         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8170                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8171                                   nla_get_u16);
8172         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8173                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8174                                   nla_get_u8);
8175         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8176                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8177         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8178                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8179                                   nla_get_s32);
8180         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8181                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8182                                   nla_get_u8);
8183         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8184                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8185                                   nla_get_u8);
8186         /*
8187          * Check HT operation mode based on
8188          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8189          */
8190         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8191                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8192
8193                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8194                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8195                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8196                         return -EINVAL;
8197
8198                 /* NON_HT_STA bit is reserved, but some programs set it */
8199                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8200
8201                 cfg->ht_opmode = ht_opmode;
8202                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8203         }
8204         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8205                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8206                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8207                                   nla_get_u32);
8208         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8209             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8210              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8211                 return -EINVAL;
8212         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8213                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8214                                   nla_get_u16);
8215         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8216                                   mask,
8217                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8218                                   nla_get_u16);
8219         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8220                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8221         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8222                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8223         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8224                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8225         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8226                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8227         if (mask_out)
8228                 *mask_out = mask;
8229
8230         return 0;
8231
8232 #undef FILL_IN_MESH_PARAM_IF_SET
8233 }
8234
8235 static int nl80211_parse_mesh_setup(struct genl_info *info,
8236                                      struct mesh_setup *setup)
8237 {
8238         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8239         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8240
8241         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8242                 return -EINVAL;
8243         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8244                 return -EINVAL;
8245
8246         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8247                 setup->sync_method =
8248                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8249                  IEEE80211_SYNC_METHOD_VENDOR :
8250                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8251
8252         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8253                 setup->path_sel_proto =
8254                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8255                  IEEE80211_PATH_PROTOCOL_VENDOR :
8256                  IEEE80211_PATH_PROTOCOL_HWMP;
8257
8258         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8259                 setup->path_metric =
8260                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8261                  IEEE80211_PATH_METRIC_VENDOR :
8262                  IEEE80211_PATH_METRIC_AIRTIME;
8263
8264         if (tb[NL80211_MESH_SETUP_IE]) {
8265                 struct nlattr *ieattr =
8266                         tb[NL80211_MESH_SETUP_IE];
8267                 setup->ie = nla_data(ieattr);
8268                 setup->ie_len = nla_len(ieattr);
8269         }
8270         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8271             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8272                 return -EINVAL;
8273         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8274         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8275         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8276         if (setup->is_secure)
8277                 setup->user_mpm = true;
8278
8279         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8280                 if (!setup->user_mpm)
8281                         return -EINVAL;
8282                 setup->auth_id =
8283                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8284         }
8285
8286         return 0;
8287 }
8288
8289 static int nl80211_update_mesh_config(struct sk_buff *skb,
8290                                       struct genl_info *info)
8291 {
8292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8293         struct net_device *dev = info->user_ptr[1];
8294         struct wireless_dev *wdev = dev->ieee80211_ptr;
8295         struct mesh_config cfg = {};
8296         u32 mask;
8297         int err;
8298
8299         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8300                 return -EOPNOTSUPP;
8301
8302         if (!rdev->ops->update_mesh_config)
8303                 return -EOPNOTSUPP;
8304
8305         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8306         if (err)
8307                 return err;
8308
8309         wdev_lock(wdev);
8310         if (!wdev->u.mesh.id_len)
8311                 err = -ENOLINK;
8312
8313         if (!err)
8314                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8315
8316         wdev_unlock(wdev);
8317
8318         return err;
8319 }
8320
8321 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8322                               struct sk_buff *msg)
8323 {
8324         struct nlattr *nl_reg_rules;
8325         unsigned int i;
8326
8327         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8328             (regdom->dfs_region &&
8329              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8330                 goto nla_put_failure;
8331
8332         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8333         if (!nl_reg_rules)
8334                 goto nla_put_failure;
8335
8336         for (i = 0; i < regdom->n_reg_rules; i++) {
8337                 struct nlattr *nl_reg_rule;
8338                 const struct ieee80211_reg_rule *reg_rule;
8339                 const struct ieee80211_freq_range *freq_range;
8340                 const struct ieee80211_power_rule *power_rule;
8341                 unsigned int max_bandwidth_khz;
8342
8343                 reg_rule = &regdom->reg_rules[i];
8344                 freq_range = &reg_rule->freq_range;
8345                 power_rule = &reg_rule->power_rule;
8346
8347                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8348                 if (!nl_reg_rule)
8349                         goto nla_put_failure;
8350
8351                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8352                 if (!max_bandwidth_khz)
8353                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8354                                                                   reg_rule);
8355
8356                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8357                                 reg_rule->flags) ||
8358                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8359                                 freq_range->start_freq_khz) ||
8360                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8361                                 freq_range->end_freq_khz) ||
8362                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8363                                 max_bandwidth_khz) ||
8364                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8365                                 power_rule->max_antenna_gain) ||
8366                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8367                                 power_rule->max_eirp) ||
8368                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8369                                 reg_rule->dfs_cac_ms))
8370                         goto nla_put_failure;
8371
8372                 nla_nest_end(msg, nl_reg_rule);
8373         }
8374
8375         nla_nest_end(msg, nl_reg_rules);
8376         return 0;
8377
8378 nla_put_failure:
8379         return -EMSGSIZE;
8380 }
8381
8382 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8383 {
8384         const struct ieee80211_regdomain *regdom = NULL;
8385         struct cfg80211_registered_device *rdev;
8386         struct wiphy *wiphy = NULL;
8387         struct sk_buff *msg;
8388         int err = -EMSGSIZE;
8389         void *hdr;
8390
8391         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8392         if (!msg)
8393                 return -ENOBUFS;
8394
8395         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8396                              NL80211_CMD_GET_REG);
8397         if (!hdr)
8398                 goto put_failure;
8399
8400         rtnl_lock();
8401
8402         if (info->attrs[NL80211_ATTR_WIPHY]) {
8403                 bool self_managed;
8404
8405                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8406                 if (IS_ERR(rdev)) {
8407                         err = PTR_ERR(rdev);
8408                         goto nla_put_failure;
8409                 }
8410
8411                 wiphy = &rdev->wiphy;
8412                 self_managed = wiphy->regulatory_flags &
8413                                REGULATORY_WIPHY_SELF_MANAGED;
8414
8415                 rcu_read_lock();
8416
8417                 regdom = get_wiphy_regdom(wiphy);
8418
8419                 /* a self-managed-reg device must have a private regdom */
8420                 if (WARN_ON(!regdom && self_managed)) {
8421                         err = -EINVAL;
8422                         goto nla_put_failure_rcu;
8423                 }
8424
8425                 if (regdom &&
8426                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8427                         goto nla_put_failure_rcu;
8428         } else {
8429                 rcu_read_lock();
8430         }
8431
8432         if (!wiphy && reg_last_request_cell_base() &&
8433             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8434                         NL80211_USER_REG_HINT_CELL_BASE))
8435                 goto nla_put_failure_rcu;
8436
8437         if (!regdom)
8438                 regdom = rcu_dereference(cfg80211_regdomain);
8439
8440         if (nl80211_put_regdom(regdom, msg))
8441                 goto nla_put_failure_rcu;
8442
8443         rcu_read_unlock();
8444
8445         genlmsg_end(msg, hdr);
8446         rtnl_unlock();
8447         return genlmsg_reply(msg, info);
8448
8449 nla_put_failure_rcu:
8450         rcu_read_unlock();
8451 nla_put_failure:
8452         rtnl_unlock();
8453 put_failure:
8454         nlmsg_free(msg);
8455         return err;
8456 }
8457
8458 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8459                                u32 seq, int flags, struct wiphy *wiphy,
8460                                const struct ieee80211_regdomain *regdom)
8461 {
8462         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8463                                    NL80211_CMD_GET_REG);
8464
8465         if (!hdr)
8466                 return -1;
8467
8468         genl_dump_check_consistent(cb, hdr);
8469
8470         if (nl80211_put_regdom(regdom, msg))
8471                 goto nla_put_failure;
8472
8473         if (!wiphy && reg_last_request_cell_base() &&
8474             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8475                         NL80211_USER_REG_HINT_CELL_BASE))
8476                 goto nla_put_failure;
8477
8478         if (wiphy &&
8479             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8480                 goto nla_put_failure;
8481
8482         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8483             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8484                 goto nla_put_failure;
8485
8486         genlmsg_end(msg, hdr);
8487         return 0;
8488
8489 nla_put_failure:
8490         genlmsg_cancel(msg, hdr);
8491         return -EMSGSIZE;
8492 }
8493
8494 static int nl80211_get_reg_dump(struct sk_buff *skb,
8495                                 struct netlink_callback *cb)
8496 {
8497         const struct ieee80211_regdomain *regdom = NULL;
8498         struct cfg80211_registered_device *rdev;
8499         int err, reg_idx, start = cb->args[2];
8500
8501         rcu_read_lock();
8502
8503         if (cfg80211_regdomain && start == 0) {
8504                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8505                                           NLM_F_MULTI, NULL,
8506                                           rcu_dereference(cfg80211_regdomain));
8507                 if (err < 0)
8508                         goto out_err;
8509         }
8510
8511         /* the global regdom is idx 0 */
8512         reg_idx = 1;
8513         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8514                 regdom = get_wiphy_regdom(&rdev->wiphy);
8515                 if (!regdom)
8516                         continue;
8517
8518                 if (++reg_idx <= start)
8519                         continue;
8520
8521                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8522                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8523                 if (err < 0) {
8524                         reg_idx--;
8525                         break;
8526                 }
8527         }
8528
8529         cb->args[2] = reg_idx;
8530         err = skb->len;
8531 out_err:
8532         rcu_read_unlock();
8533         return err;
8534 }
8535
8536 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8537 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8538         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8539         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8540         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8541         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8542         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8543         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8544         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8545 };
8546
8547 static int parse_reg_rule(struct nlattr *tb[],
8548         struct ieee80211_reg_rule *reg_rule)
8549 {
8550         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8551         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8552
8553         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8554                 return -EINVAL;
8555         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8556                 return -EINVAL;
8557         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8558                 return -EINVAL;
8559         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8560                 return -EINVAL;
8561         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8562                 return -EINVAL;
8563
8564         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8565
8566         freq_range->start_freq_khz =
8567                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8568         freq_range->end_freq_khz =
8569                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8570         freq_range->max_bandwidth_khz =
8571                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8572
8573         power_rule->max_eirp =
8574                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8575
8576         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8577                 power_rule->max_antenna_gain =
8578                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8579
8580         if (tb[NL80211_ATTR_DFS_CAC_TIME])
8581                 reg_rule->dfs_cac_ms =
8582                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8583
8584         return 0;
8585 }
8586
8587 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8588 {
8589         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8590         struct nlattr *nl_reg_rule;
8591         char *alpha2;
8592         int rem_reg_rules, r;
8593         u32 num_rules = 0, rule_idx = 0;
8594         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8595         struct ieee80211_regdomain *rd;
8596
8597         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8598                 return -EINVAL;
8599
8600         if (!info->attrs[NL80211_ATTR_REG_RULES])
8601                 return -EINVAL;
8602
8603         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8604
8605         if (info->attrs[NL80211_ATTR_DFS_REGION])
8606                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8607
8608         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8609                             rem_reg_rules) {
8610                 num_rules++;
8611                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8612                         return -EINVAL;
8613         }
8614
8615         rtnl_lock();
8616         if (!reg_is_valid_request(alpha2)) {
8617                 r = -EINVAL;
8618                 goto out;
8619         }
8620
8621         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8622         if (!rd) {
8623                 r = -ENOMEM;
8624                 goto out;
8625         }
8626
8627         rd->n_reg_rules = num_rules;
8628         rd->alpha2[0] = alpha2[0];
8629         rd->alpha2[1] = alpha2[1];
8630
8631         /*
8632          * Disable DFS master mode if the DFS region was
8633          * not supported or known on this kernel.
8634          */
8635         if (reg_supported_dfs_region(dfs_region))
8636                 rd->dfs_region = dfs_region;
8637
8638         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8639                             rem_reg_rules) {
8640                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8641                                                 nl_reg_rule, reg_rule_policy,
8642                                                 info->extack);
8643                 if (r)
8644                         goto bad_reg;
8645                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8646                 if (r)
8647                         goto bad_reg;
8648
8649                 rule_idx++;
8650
8651                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8652                         r = -EINVAL;
8653                         goto bad_reg;
8654                 }
8655         }
8656
8657         r = set_regdom(rd, REGD_SOURCE_CRDA);
8658         /* set_regdom takes ownership of rd */
8659         rd = NULL;
8660  bad_reg:
8661         kfree(rd);
8662  out:
8663         rtnl_unlock();
8664         return r;
8665 }
8666 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8667
8668 static int validate_scan_freqs(struct nlattr *freqs)
8669 {
8670         struct nlattr *attr1, *attr2;
8671         int n_channels = 0, tmp1, tmp2;
8672
8673         nla_for_each_nested(attr1, freqs, tmp1)
8674                 if (nla_len(attr1) != sizeof(u32))
8675                         return 0;
8676
8677         nla_for_each_nested(attr1, freqs, tmp1) {
8678                 n_channels++;
8679                 /*
8680                  * Some hardware has a limited channel list for
8681                  * scanning, and it is pretty much nonsensical
8682                  * to scan for a channel twice, so disallow that
8683                  * and don't require drivers to check that the
8684                  * channel list they get isn't longer than what
8685                  * they can scan, as long as they can scan all
8686                  * the channels they registered at once.
8687                  */
8688                 nla_for_each_nested(attr2, freqs, tmp2)
8689                         if (attr1 != attr2 &&
8690                             nla_get_u32(attr1) == nla_get_u32(attr2))
8691                                 return 0;
8692         }
8693
8694         return n_channels;
8695 }
8696
8697 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8698 {
8699         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8700 }
8701
8702 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8703                             struct cfg80211_bss_selection *bss_select)
8704 {
8705         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8706         struct nlattr *nest;
8707         int err;
8708         bool found = false;
8709         int i;
8710
8711         /* only process one nested attribute */
8712         nest = nla_data(nla);
8713         if (!nla_ok(nest, nla_len(nest)))
8714                 return -EINVAL;
8715
8716         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8717                                           nest, nl80211_bss_select_policy,
8718                                           NULL);
8719         if (err)
8720                 return err;
8721
8722         /* only one attribute may be given */
8723         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8724                 if (attr[i]) {
8725                         if (found)
8726                                 return -EINVAL;
8727                         found = true;
8728                 }
8729         }
8730
8731         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8732
8733         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8734                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8735
8736         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8737                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8738                 bss_select->param.band_pref =
8739                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8740                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8741                         return -EINVAL;
8742         }
8743
8744         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8745                 struct nl80211_bss_select_rssi_adjust *adj_param;
8746
8747                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8748                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8749                 bss_select->param.adjust.band = adj_param->band;
8750                 bss_select->param.adjust.delta = adj_param->delta;
8751                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8752                         return -EINVAL;
8753         }
8754
8755         /* user-space did not provide behaviour attribute */
8756         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8757                 return -EINVAL;
8758
8759         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8760                 return -EINVAL;
8761
8762         return 0;
8763 }
8764
8765 int nl80211_parse_random_mac(struct nlattr **attrs,
8766                              u8 *mac_addr, u8 *mac_addr_mask)
8767 {
8768         int i;
8769
8770         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8771                 eth_zero_addr(mac_addr);
8772                 eth_zero_addr(mac_addr_mask);
8773                 mac_addr[0] = 0x2;
8774                 mac_addr_mask[0] = 0x3;
8775
8776                 return 0;
8777         }
8778
8779         /* need both or none */
8780         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8781                 return -EINVAL;
8782
8783         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8784         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8785
8786         /* don't allow or configure an mcast address */
8787         if (!is_multicast_ether_addr(mac_addr_mask) ||
8788             is_multicast_ether_addr(mac_addr))
8789                 return -EINVAL;
8790
8791         /*
8792          * allow users to pass a MAC address that has bits set outside
8793          * of the mask, but don't bother drivers with having to deal
8794          * with such bits
8795          */
8796         for (i = 0; i < ETH_ALEN; i++)
8797                 mac_addr[i] &= mac_addr_mask[i];
8798
8799         return 0;
8800 }
8801
8802 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8803                                               struct ieee80211_channel *chan)
8804 {
8805         unsigned int link_id;
8806         bool all_ok = true;
8807
8808         ASSERT_WDEV_LOCK(wdev);
8809
8810         if (!cfg80211_beaconing_iface_active(wdev))
8811                 return true;
8812
8813         /*
8814          * FIXME: check if we have a free HW resource/link for chan
8815          *
8816          * This, as well as the FIXME below, requires knowing the link
8817          * capabilities of the hardware.
8818          */
8819
8820         /* we cannot leave radar channels */
8821         for_each_valid_link(wdev, link_id) {
8822                 struct cfg80211_chan_def *chandef;
8823
8824                 chandef = wdev_chandef(wdev, link_id);
8825                 if (!chandef || !chandef->chan)
8826                         continue;
8827
8828                 /*
8829                  * FIXME: don't require all_ok, but rather check only the
8830                  *        correct HW resource/link onto which 'chan' falls,
8831                  *        as only that link leaves the channel for doing
8832                  *        the off-channel operation.
8833                  */
8834
8835                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
8836                         all_ok = false;
8837         }
8838
8839         if (all_ok)
8840                 return true;
8841
8842         return regulatory_pre_cac_allowed(wdev->wiphy);
8843 }
8844
8845 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8846                                     enum nl80211_ext_feature_index feat)
8847 {
8848         if (!(flags & flag))
8849                 return true;
8850         if (wiphy_ext_feature_isset(wiphy, feat))
8851                 return true;
8852         return false;
8853 }
8854
8855 static int
8856 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8857                          void *request, struct nlattr **attrs,
8858                          bool is_sched_scan)
8859 {
8860         u8 *mac_addr, *mac_addr_mask;
8861         u32 *flags;
8862         enum nl80211_feature_flags randomness_flag;
8863
8864         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8865                 return 0;
8866
8867         if (is_sched_scan) {
8868                 struct cfg80211_sched_scan_request *req = request;
8869
8870                 randomness_flag = wdev ?
8871                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8872                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8873                 flags = &req->flags;
8874                 mac_addr = req->mac_addr;
8875                 mac_addr_mask = req->mac_addr_mask;
8876         } else {
8877                 struct cfg80211_scan_request *req = request;
8878
8879                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8880                 flags = &req->flags;
8881                 mac_addr = req->mac_addr;
8882                 mac_addr_mask = req->mac_addr_mask;
8883         }
8884
8885         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8886
8887         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8888              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8889             !nl80211_check_scan_feat(wiphy, *flags,
8890                                      NL80211_SCAN_FLAG_LOW_SPAN,
8891                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8892             !nl80211_check_scan_feat(wiphy, *flags,
8893                                      NL80211_SCAN_FLAG_LOW_POWER,
8894                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8895             !nl80211_check_scan_feat(wiphy, *flags,
8896                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
8897                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8898             !nl80211_check_scan_feat(wiphy, *flags,
8899                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8900                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8901             !nl80211_check_scan_feat(wiphy, *flags,
8902                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8903                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8904             !nl80211_check_scan_feat(wiphy, *flags,
8905                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8906                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8907             !nl80211_check_scan_feat(wiphy, *flags,
8908                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8909                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8910             !nl80211_check_scan_feat(wiphy, *flags,
8911                                      NL80211_SCAN_FLAG_RANDOM_SN,
8912                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8913             !nl80211_check_scan_feat(wiphy, *flags,
8914                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8915                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8916                 return -EOPNOTSUPP;
8917
8918         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8919                 int err;
8920
8921                 if (!(wiphy->features & randomness_flag) ||
8922                     (wdev && wdev->connected))
8923                         return -EOPNOTSUPP;
8924
8925                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8926                 if (err)
8927                         return err;
8928         }
8929
8930         return 0;
8931 }
8932
8933 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8934 {
8935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8936         struct wireless_dev *wdev = info->user_ptr[1];
8937         struct cfg80211_scan_request *request;
8938         struct nlattr *scan_freqs = NULL;
8939         bool scan_freqs_khz = false;
8940         struct nlattr *attr;
8941         struct wiphy *wiphy;
8942         int err, tmp, n_ssids = 0, n_channels, i;
8943         size_t ie_len;
8944
8945         wiphy = &rdev->wiphy;
8946
8947         if (wdev->iftype == NL80211_IFTYPE_NAN)
8948                 return -EOPNOTSUPP;
8949
8950         if (!rdev->ops->scan)
8951                 return -EOPNOTSUPP;
8952
8953         if (rdev->scan_req || rdev->scan_msg)
8954                 return -EBUSY;
8955
8956         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8957                 if (!wiphy_ext_feature_isset(wiphy,
8958                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8959                         return -EOPNOTSUPP;
8960                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8961                 scan_freqs_khz = true;
8962         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8963                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8964
8965         if (scan_freqs) {
8966                 n_channels = validate_scan_freqs(scan_freqs);
8967                 if (!n_channels)
8968                         return -EINVAL;
8969         } else {
8970                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8971         }
8972
8973         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8974                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8975                         n_ssids++;
8976
8977         if (n_ssids > wiphy->max_scan_ssids)
8978                 return -EINVAL;
8979
8980         if (info->attrs[NL80211_ATTR_IE])
8981                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8982         else
8983                 ie_len = 0;
8984
8985         if (ie_len > wiphy->max_scan_ie_len)
8986                 return -EINVAL;
8987
8988         request = kzalloc(sizeof(*request)
8989                         + sizeof(*request->ssids) * n_ssids
8990                         + sizeof(*request->channels) * n_channels
8991                         + ie_len, GFP_KERNEL);
8992         if (!request)
8993                 return -ENOMEM;
8994
8995         if (n_ssids)
8996                 request->ssids = (void *)&request->channels[n_channels];
8997         request->n_ssids = n_ssids;
8998         if (ie_len) {
8999                 if (n_ssids)
9000                         request->ie = (void *)(request->ssids + n_ssids);
9001                 else
9002                         request->ie = (void *)(request->channels + n_channels);
9003         }
9004
9005         i = 0;
9006         if (scan_freqs) {
9007                 /* user specified, bail out if channel not found */
9008                 nla_for_each_nested(attr, scan_freqs, tmp) {
9009                         struct ieee80211_channel *chan;
9010                         int freq = nla_get_u32(attr);
9011
9012                         if (!scan_freqs_khz)
9013                                 freq = MHZ_TO_KHZ(freq);
9014
9015                         chan = ieee80211_get_channel_khz(wiphy, freq);
9016                         if (!chan) {
9017                                 err = -EINVAL;
9018                                 goto out_free;
9019                         }
9020
9021                         /* ignore disabled channels */
9022                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9023                                 continue;
9024
9025                         request->channels[i] = chan;
9026                         i++;
9027                 }
9028         } else {
9029                 enum nl80211_band band;
9030
9031                 /* all channels */
9032                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9033                         int j;
9034
9035                         if (!wiphy->bands[band])
9036                                 continue;
9037                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9038                                 struct ieee80211_channel *chan;
9039
9040                                 chan = &wiphy->bands[band]->channels[j];
9041
9042                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9043                                         continue;
9044
9045                                 request->channels[i] = chan;
9046                                 i++;
9047                         }
9048                 }
9049         }
9050
9051         if (!i) {
9052                 err = -EINVAL;
9053                 goto out_free;
9054         }
9055
9056         request->n_channels = i;
9057
9058         wdev_lock(wdev);
9059         for (i = 0; i < request->n_channels; i++) {
9060                 struct ieee80211_channel *chan = request->channels[i];
9061
9062                 /* if we can go off-channel to the target channel we're good */
9063                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9064                         continue;
9065
9066                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9067                         wdev_unlock(wdev);
9068                         err = -EBUSY;
9069                         goto out_free;
9070                 }
9071         }
9072         wdev_unlock(wdev);
9073
9074         i = 0;
9075         if (n_ssids) {
9076                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9077                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9078                                 err = -EINVAL;
9079                                 goto out_free;
9080                         }
9081                         request->ssids[i].ssid_len = nla_len(attr);
9082                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9083                         i++;
9084                 }
9085         }
9086
9087         if (info->attrs[NL80211_ATTR_IE]) {
9088                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9089                 memcpy((void *)request->ie,
9090                        nla_data(info->attrs[NL80211_ATTR_IE]),
9091                        request->ie_len);
9092         }
9093
9094         for (i = 0; i < NUM_NL80211_BANDS; i++)
9095                 if (wiphy->bands[i])
9096                         request->rates[i] =
9097                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9098
9099         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9100                 nla_for_each_nested(attr,
9101                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9102                                     tmp) {
9103                         enum nl80211_band band = nla_type(attr);
9104
9105                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9106                                 err = -EINVAL;
9107                                 goto out_free;
9108                         }
9109
9110                         if (!wiphy->bands[band])
9111                                 continue;
9112
9113                         err = ieee80211_get_ratemask(wiphy->bands[band],
9114                                                      nla_data(attr),
9115                                                      nla_len(attr),
9116                                                      &request->rates[band]);
9117                         if (err)
9118                                 goto out_free;
9119                 }
9120         }
9121
9122         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9123                 request->duration =
9124                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9125                 request->duration_mandatory =
9126                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9127         }
9128
9129         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9130                                        false);
9131         if (err)
9132                 goto out_free;
9133
9134         request->no_cck =
9135                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9136
9137         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9138          * BSSID to scan for. This was problematic because that same attribute
9139          * was already used for another purpose (local random MAC address). The
9140          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9141          * compatibility with older userspace components, also use the
9142          * NL80211_ATTR_MAC value here if it can be determined to be used for
9143          * the specific BSSID use case instead of the random MAC address
9144          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9145          */
9146         if (info->attrs[NL80211_ATTR_BSSID])
9147                 memcpy(request->bssid,
9148                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9149         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9150                  info->attrs[NL80211_ATTR_MAC])
9151                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9152                        ETH_ALEN);
9153         else
9154                 eth_broadcast_addr(request->bssid);
9155
9156         request->wdev = wdev;
9157         request->wiphy = &rdev->wiphy;
9158         request->scan_start = jiffies;
9159
9160         rdev->scan_req = request;
9161         err = cfg80211_scan(rdev);
9162
9163         if (err)
9164                 goto out_free;
9165
9166         nl80211_send_scan_start(rdev, wdev);
9167         dev_hold(wdev->netdev);
9168
9169         return 0;
9170
9171  out_free:
9172         rdev->scan_req = NULL;
9173         kfree(request);
9174
9175         return err;
9176 }
9177
9178 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9179 {
9180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9181         struct wireless_dev *wdev = info->user_ptr[1];
9182
9183         if (!rdev->ops->abort_scan)
9184                 return -EOPNOTSUPP;
9185
9186         if (rdev->scan_msg)
9187                 return 0;
9188
9189         if (!rdev->scan_req)
9190                 return -ENOENT;
9191
9192         rdev_abort_scan(rdev, wdev);
9193         return 0;
9194 }
9195
9196 static int
9197 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9198                                struct cfg80211_sched_scan_request *request,
9199                                struct nlattr **attrs)
9200 {
9201         int tmp, err, i = 0;
9202         struct nlattr *attr;
9203
9204         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9205                 u32 interval;
9206
9207                 /*
9208                  * If scan plans are not specified,
9209                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9210                  * case one scan plan will be set with the specified scan
9211                  * interval and infinite number of iterations.
9212                  */
9213                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9214                 if (!interval)
9215                         return -EINVAL;
9216
9217                 request->scan_plans[0].interval =
9218                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9219                 if (!request->scan_plans[0].interval)
9220                         return -EINVAL;
9221
9222                 if (request->scan_plans[0].interval >
9223                     wiphy->max_sched_scan_plan_interval)
9224                         request->scan_plans[0].interval =
9225                                 wiphy->max_sched_scan_plan_interval;
9226
9227                 return 0;
9228         }
9229
9230         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9231                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9232
9233                 if (WARN_ON(i >= n_plans))
9234                         return -EINVAL;
9235
9236                 err = nla_parse_nested_deprecated(plan,
9237                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9238                                                   attr, nl80211_plan_policy,
9239                                                   NULL);
9240                 if (err)
9241                         return err;
9242
9243                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9244                         return -EINVAL;
9245
9246                 request->scan_plans[i].interval =
9247                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9248                 if (!request->scan_plans[i].interval ||
9249                     request->scan_plans[i].interval >
9250                     wiphy->max_sched_scan_plan_interval)
9251                         return -EINVAL;
9252
9253                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9254                         request->scan_plans[i].iterations =
9255                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9256                         if (!request->scan_plans[i].iterations ||
9257                             (request->scan_plans[i].iterations >
9258                              wiphy->max_sched_scan_plan_iterations))
9259                                 return -EINVAL;
9260                 } else if (i < n_plans - 1) {
9261                         /*
9262                          * All scan plans but the last one must specify
9263                          * a finite number of iterations
9264                          */
9265                         return -EINVAL;
9266                 }
9267
9268                 i++;
9269         }
9270
9271         /*
9272          * The last scan plan must not specify the number of
9273          * iterations, it is supposed to run infinitely
9274          */
9275         if (request->scan_plans[n_plans - 1].iterations)
9276                 return  -EINVAL;
9277
9278         return 0;
9279 }
9280
9281 static int
9282 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9283                                        struct cfg80211_match_set *match_sets,
9284                                        struct nlattr *tb_band_rssi,
9285                                        s32 rssi_thold)
9286 {
9287         struct nlattr *attr;
9288         int i, tmp, ret = 0;
9289
9290         if (!wiphy_ext_feature_isset(wiphy,
9291                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9292                 if (tb_band_rssi)
9293                         ret = -EOPNOTSUPP;
9294                 else
9295                         for (i = 0; i < NUM_NL80211_BANDS; i++)
9296                                 match_sets->per_band_rssi_thold[i] =
9297                                         NL80211_SCAN_RSSI_THOLD_OFF;
9298                 return ret;
9299         }
9300
9301         for (i = 0; i < NUM_NL80211_BANDS; i++)
9302                 match_sets->per_band_rssi_thold[i] = rssi_thold;
9303
9304         nla_for_each_nested(attr, tb_band_rssi, tmp) {
9305                 enum nl80211_band band = nla_type(attr);
9306
9307                 if (band < 0 || band >= NUM_NL80211_BANDS)
9308                         return -EINVAL;
9309
9310                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9311         }
9312
9313         return 0;
9314 }
9315
9316 static struct cfg80211_sched_scan_request *
9317 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9318                          struct nlattr **attrs, int max_match_sets)
9319 {
9320         struct cfg80211_sched_scan_request *request;
9321         struct nlattr *attr;
9322         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9323         enum nl80211_band band;
9324         size_t ie_len;
9325         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9326         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9327
9328         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9329                 n_channels = validate_scan_freqs(
9330                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9331                 if (!n_channels)
9332                         return ERR_PTR(-EINVAL);
9333         } else {
9334                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9335         }
9336
9337         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9338                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9339                                     tmp)
9340                         n_ssids++;
9341
9342         if (n_ssids > wiphy->max_sched_scan_ssids)
9343                 return ERR_PTR(-EINVAL);
9344
9345         /*
9346          * First, count the number of 'real' matchsets. Due to an issue with
9347          * the old implementation, matchsets containing only the RSSI attribute
9348          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9349          * RSSI for all matchsets, rather than their own matchset for reporting
9350          * all APs with a strong RSSI. This is needed to be compatible with
9351          * older userspace that treated a matchset with only the RSSI as the
9352          * global RSSI for all other matchsets - if there are other matchsets.
9353          */
9354         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9355                 nla_for_each_nested(attr,
9356                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9357                                     tmp) {
9358                         struct nlattr *rssi;
9359
9360                         err = nla_parse_nested_deprecated(tb,
9361                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9362                                                           attr,
9363                                                           nl80211_match_policy,
9364                                                           NULL);
9365                         if (err)
9366                                 return ERR_PTR(err);
9367
9368                         /* SSID and BSSID are mutually exclusive */
9369                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9370                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9371                                 return ERR_PTR(-EINVAL);
9372
9373                         /* add other standalone attributes here */
9374                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9375                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9376                                 n_match_sets++;
9377                                 continue;
9378                         }
9379                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9380                         if (rssi)
9381                                 default_match_rssi = nla_get_s32(rssi);
9382                 }
9383         }
9384
9385         /* However, if there's no other matchset, add the RSSI one */
9386         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9387                 n_match_sets = 1;
9388
9389         if (n_match_sets > max_match_sets)
9390                 return ERR_PTR(-EINVAL);
9391
9392         if (attrs[NL80211_ATTR_IE])
9393                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9394         else
9395                 ie_len = 0;
9396
9397         if (ie_len > wiphy->max_sched_scan_ie_len)
9398                 return ERR_PTR(-EINVAL);
9399
9400         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9401                 /*
9402                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9403                  * each scan plan already specifies its own interval
9404                  */
9405                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9406                         return ERR_PTR(-EINVAL);
9407
9408                 nla_for_each_nested(attr,
9409                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9410                         n_plans++;
9411         } else {
9412                 /*
9413                  * The scan interval attribute is kept for backward
9414                  * compatibility. If no scan plans are specified and sched scan
9415                  * interval is specified, one scan plan will be set with this
9416                  * scan interval and infinite number of iterations.
9417                  */
9418                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9419                         return ERR_PTR(-EINVAL);
9420
9421                 n_plans = 1;
9422         }
9423
9424         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9425                 return ERR_PTR(-EINVAL);
9426
9427         if (!wiphy_ext_feature_isset(
9428                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9429             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9430              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9431                 return ERR_PTR(-EINVAL);
9432
9433         request = kzalloc(sizeof(*request)
9434                         + sizeof(*request->ssids) * n_ssids
9435                         + sizeof(*request->match_sets) * n_match_sets
9436                         + sizeof(*request->scan_plans) * n_plans
9437                         + sizeof(*request->channels) * n_channels
9438                         + ie_len, GFP_KERNEL);
9439         if (!request)
9440                 return ERR_PTR(-ENOMEM);
9441
9442         if (n_ssids)
9443                 request->ssids = (void *)&request->channels[n_channels];
9444         request->n_ssids = n_ssids;
9445         if (ie_len) {
9446                 if (n_ssids)
9447                         request->ie = (void *)(request->ssids + n_ssids);
9448                 else
9449                         request->ie = (void *)(request->channels + n_channels);
9450         }
9451
9452         if (n_match_sets) {
9453                 if (request->ie)
9454                         request->match_sets = (void *)(request->ie + ie_len);
9455                 else if (n_ssids)
9456                         request->match_sets =
9457                                 (void *)(request->ssids + n_ssids);
9458                 else
9459                         request->match_sets =
9460                                 (void *)(request->channels + n_channels);
9461         }
9462         request->n_match_sets = n_match_sets;
9463
9464         if (n_match_sets)
9465                 request->scan_plans = (void *)(request->match_sets +
9466                                                n_match_sets);
9467         else if (request->ie)
9468                 request->scan_plans = (void *)(request->ie + ie_len);
9469         else if (n_ssids)
9470                 request->scan_plans = (void *)(request->ssids + n_ssids);
9471         else
9472                 request->scan_plans = (void *)(request->channels + n_channels);
9473
9474         request->n_scan_plans = n_plans;
9475
9476         i = 0;
9477         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9478                 /* user specified, bail out if channel not found */
9479                 nla_for_each_nested(attr,
9480                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9481                                     tmp) {
9482                         struct ieee80211_channel *chan;
9483
9484                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9485
9486                         if (!chan) {
9487                                 err = -EINVAL;
9488                                 goto out_free;
9489                         }
9490
9491                         /* ignore disabled channels */
9492                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9493                                 continue;
9494
9495                         request->channels[i] = chan;
9496                         i++;
9497                 }
9498         } else {
9499                 /* all channels */
9500                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9501                         int j;
9502
9503                         if (!wiphy->bands[band])
9504                                 continue;
9505                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9506                                 struct ieee80211_channel *chan;
9507
9508                                 chan = &wiphy->bands[band]->channels[j];
9509
9510                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9511                                         continue;
9512
9513                                 request->channels[i] = chan;
9514                                 i++;
9515                         }
9516                 }
9517         }
9518
9519         if (!i) {
9520                 err = -EINVAL;
9521                 goto out_free;
9522         }
9523
9524         request->n_channels = i;
9525
9526         i = 0;
9527         if (n_ssids) {
9528                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9529                                     tmp) {
9530                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9531                                 err = -EINVAL;
9532                                 goto out_free;
9533                         }
9534                         request->ssids[i].ssid_len = nla_len(attr);
9535                         memcpy(request->ssids[i].ssid, nla_data(attr),
9536                                nla_len(attr));
9537                         i++;
9538                 }
9539         }
9540
9541         i = 0;
9542         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9543                 nla_for_each_nested(attr,
9544                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9545                                     tmp) {
9546                         struct nlattr *ssid, *bssid, *rssi;
9547
9548                         err = nla_parse_nested_deprecated(tb,
9549                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9550                                                           attr,
9551                                                           nl80211_match_policy,
9552                                                           NULL);
9553                         if (err)
9554                                 goto out_free;
9555                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9556                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9557
9558                         if (!ssid && !bssid) {
9559                                 i++;
9560                                 continue;
9561                         }
9562
9563                         if (WARN_ON(i >= n_match_sets)) {
9564                                 /* this indicates a programming error,
9565                                  * the loop above should have verified
9566                                  * things properly
9567                                  */
9568                                 err = -EINVAL;
9569                                 goto out_free;
9570                         }
9571
9572                         if (ssid) {
9573                                 memcpy(request->match_sets[i].ssid.ssid,
9574                                        nla_data(ssid), nla_len(ssid));
9575                                 request->match_sets[i].ssid.ssid_len =
9576                                         nla_len(ssid);
9577                         }
9578                         if (bssid)
9579                                 memcpy(request->match_sets[i].bssid,
9580                                        nla_data(bssid), ETH_ALEN);
9581
9582                         /* special attribute - old implementation w/a */
9583                         request->match_sets[i].rssi_thold = default_match_rssi;
9584                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9585                         if (rssi)
9586                                 request->match_sets[i].rssi_thold =
9587                                         nla_get_s32(rssi);
9588
9589                         /* Parse per band RSSI attribute */
9590                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9591                                 &request->match_sets[i],
9592                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9593                                 request->match_sets[i].rssi_thold);
9594                         if (err)
9595                                 goto out_free;
9596
9597                         i++;
9598                 }
9599
9600                 /* there was no other matchset, so the RSSI one is alone */
9601                 if (i == 0 && n_match_sets)
9602                         request->match_sets[0].rssi_thold = default_match_rssi;
9603
9604                 request->min_rssi_thold = INT_MAX;
9605                 for (i = 0; i < n_match_sets; i++)
9606                         request->min_rssi_thold =
9607                                 min(request->match_sets[i].rssi_thold,
9608                                     request->min_rssi_thold);
9609         } else {
9610                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9611         }
9612
9613         if (ie_len) {
9614                 request->ie_len = ie_len;
9615                 memcpy((void *)request->ie,
9616                        nla_data(attrs[NL80211_ATTR_IE]),
9617                        request->ie_len);
9618         }
9619
9620         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9621         if (err)
9622                 goto out_free;
9623
9624         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9625                 request->delay =
9626                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9627
9628         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9629                 request->relative_rssi = nla_get_s8(
9630                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9631                 request->relative_rssi_set = true;
9632         }
9633
9634         if (request->relative_rssi_set &&
9635             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9636                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9637
9638                 rssi_adjust = nla_data(
9639                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9640                 request->rssi_adjust.band = rssi_adjust->band;
9641                 request->rssi_adjust.delta = rssi_adjust->delta;
9642                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9643                         err = -EINVAL;
9644                         goto out_free;
9645                 }
9646         }
9647
9648         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9649         if (err)
9650                 goto out_free;
9651
9652         request->scan_start = jiffies;
9653
9654         return request;
9655
9656 out_free:
9657         kfree(request);
9658         return ERR_PTR(err);
9659 }
9660
9661 static int nl80211_start_sched_scan(struct sk_buff *skb,
9662                                     struct genl_info *info)
9663 {
9664         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9665         struct net_device *dev = info->user_ptr[1];
9666         struct wireless_dev *wdev = dev->ieee80211_ptr;
9667         struct cfg80211_sched_scan_request *sched_scan_req;
9668         bool want_multi;
9669         int err;
9670
9671         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9672                 return -EOPNOTSUPP;
9673
9674         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9675         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9676         if (err)
9677                 return err;
9678
9679         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9680                                                   info->attrs,
9681                                                   rdev->wiphy.max_match_sets);
9682
9683         err = PTR_ERR_OR_ZERO(sched_scan_req);
9684         if (err)
9685                 goto out_err;
9686
9687         /* leave request id zero for legacy request
9688          * or if driver does not support multi-scheduled scan
9689          */
9690         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9691                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9692
9693         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9694         if (err)
9695                 goto out_free;
9696
9697         sched_scan_req->dev = dev;
9698         sched_scan_req->wiphy = &rdev->wiphy;
9699
9700         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9701                 sched_scan_req->owner_nlportid = info->snd_portid;
9702
9703         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9704
9705         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9706         return 0;
9707
9708 out_free:
9709         kfree(sched_scan_req);
9710 out_err:
9711         return err;
9712 }
9713
9714 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9715                                    struct genl_info *info)
9716 {
9717         struct cfg80211_sched_scan_request *req;
9718         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9719         u64 cookie;
9720
9721         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9722                 return -EOPNOTSUPP;
9723
9724         if (info->attrs[NL80211_ATTR_COOKIE]) {
9725                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9726                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9727         }
9728
9729         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9730                                      struct cfg80211_sched_scan_request,
9731                                      list);
9732         if (!req || req->reqid ||
9733             (req->owner_nlportid &&
9734              req->owner_nlportid != info->snd_portid))
9735                 return -ENOENT;
9736
9737         return cfg80211_stop_sched_scan_req(rdev, req, false);
9738 }
9739
9740 static int nl80211_start_radar_detection(struct sk_buff *skb,
9741                                          struct genl_info *info)
9742 {
9743         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9744         struct net_device *dev = info->user_ptr[1];
9745         struct wireless_dev *wdev = dev->ieee80211_ptr;
9746         struct wiphy *wiphy = wdev->wiphy;
9747         struct cfg80211_chan_def chandef;
9748         enum nl80211_dfs_regions dfs_region;
9749         unsigned int cac_time_ms;
9750         int err = -EINVAL;
9751
9752         flush_delayed_work(&rdev->dfs_update_channels_wk);
9753
9754         wiphy_lock(wiphy);
9755
9756         dfs_region = reg_get_dfs_region(wiphy);
9757         if (dfs_region == NL80211_DFS_UNSET)
9758                 goto unlock;
9759
9760         err = nl80211_parse_chandef(rdev, info, &chandef);
9761         if (err)
9762                 goto unlock;
9763
9764         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9765         if (err < 0)
9766                 goto unlock;
9767
9768         if (err == 0) {
9769                 err = -EINVAL;
9770                 goto unlock;
9771         }
9772
9773         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9774                 err = -EINVAL;
9775                 goto unlock;
9776         }
9777
9778         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9779                 err = cfg80211_start_background_radar_detection(rdev, wdev,
9780                                                                 &chandef);
9781                 goto unlock;
9782         }
9783
9784         if (netif_carrier_ok(dev)) {
9785                 err = -EBUSY;
9786                 goto unlock;
9787         }
9788
9789         if (wdev->cac_started) {
9790                 err = -EBUSY;
9791                 goto unlock;
9792         }
9793
9794         /* CAC start is offloaded to HW and can't be started manually */
9795         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9796                 err = -EOPNOTSUPP;
9797                 goto unlock;
9798         }
9799
9800         if (!rdev->ops->start_radar_detection) {
9801                 err = -EOPNOTSUPP;
9802                 goto unlock;
9803         }
9804
9805         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9806         if (WARN_ON(!cac_time_ms))
9807                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9808
9809         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9810         if (!err) {
9811                 wdev->links[0].ap.chandef = chandef;
9812                 wdev->cac_started = true;
9813                 wdev->cac_start_time = jiffies;
9814                 wdev->cac_time_ms = cac_time_ms;
9815         }
9816 unlock:
9817         wiphy_unlock(wiphy);
9818
9819         return err;
9820 }
9821
9822 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9823                                           struct genl_info *info)
9824 {
9825         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9826         struct net_device *dev = info->user_ptr[1];
9827         struct wireless_dev *wdev = dev->ieee80211_ptr;
9828         struct wiphy *wiphy = wdev->wiphy;
9829         struct cfg80211_chan_def chandef;
9830         enum nl80211_dfs_regions dfs_region;
9831         int err;
9832
9833         dfs_region = reg_get_dfs_region(wiphy);
9834         if (dfs_region == NL80211_DFS_UNSET) {
9835                 GENL_SET_ERR_MSG(info,
9836                                  "DFS Region is not set. Unexpected Radar indication");
9837                 return -EINVAL;
9838         }
9839
9840         err = nl80211_parse_chandef(rdev, info, &chandef);
9841         if (err) {
9842                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9843                 return err;
9844         }
9845
9846         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9847         if (err < 0) {
9848                 GENL_SET_ERR_MSG(info, "chandef is invalid");
9849                 return err;
9850         }
9851
9852         if (err == 0) {
9853                 GENL_SET_ERR_MSG(info,
9854                                  "Unexpected Radar indication for chandef/iftype");
9855                 return -EINVAL;
9856         }
9857
9858         /* Do not process this notification if radar is already detected
9859          * by kernel on this channel, and return success.
9860          */
9861         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9862                 return 0;
9863
9864         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9865
9866         cfg80211_sched_dfs_chan_update(rdev);
9867
9868         rdev->radar_chandef = chandef;
9869
9870         /* Propagate this notification to other radios as well */
9871         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9872
9873         return 0;
9874 }
9875
9876 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9877 {
9878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9879         unsigned int link_id = nl80211_link_id(info->attrs);
9880         struct net_device *dev = info->user_ptr[1];
9881         struct wireless_dev *wdev = dev->ieee80211_ptr;
9882         struct cfg80211_csa_settings params;
9883         struct nlattr **csa_attrs = NULL;
9884         int err;
9885         bool need_new_beacon = false;
9886         bool need_handle_dfs_flag = true;
9887         int len, i;
9888         u32 cs_count;
9889
9890         if (!rdev->ops->channel_switch ||
9891             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9892                 return -EOPNOTSUPP;
9893
9894         switch (dev->ieee80211_ptr->iftype) {
9895         case NL80211_IFTYPE_AP:
9896         case NL80211_IFTYPE_P2P_GO:
9897                 need_new_beacon = true;
9898                 /* For all modes except AP the handle_dfs flag needs to be
9899                  * supplied to tell the kernel that userspace will handle radar
9900                  * events when they happen. Otherwise a switch to a channel
9901                  * requiring DFS will be rejected.
9902                  */
9903                 need_handle_dfs_flag = false;
9904
9905                 /* useless if AP is not running */
9906                 if (!wdev->links[link_id].ap.beacon_interval)
9907                         return -ENOTCONN;
9908                 break;
9909         case NL80211_IFTYPE_ADHOC:
9910                 if (!wdev->u.ibss.ssid_len)
9911                         return -ENOTCONN;
9912                 break;
9913         case NL80211_IFTYPE_MESH_POINT:
9914                 if (!wdev->u.mesh.id_len)
9915                         return -ENOTCONN;
9916                 break;
9917         default:
9918                 return -EOPNOTSUPP;
9919         }
9920
9921         memset(&params, 0, sizeof(params));
9922         params.beacon_csa.ftm_responder = -1;
9923
9924         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9925             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9926                 return -EINVAL;
9927
9928         /* only important for AP, IBSS and mesh create IEs internally */
9929         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9930                 return -EINVAL;
9931
9932         /* Even though the attribute is u32, the specification says
9933          * u8, so let's make sure we don't overflow.
9934          */
9935         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9936         if (cs_count > 255)
9937                 return -EINVAL;
9938
9939         params.count = cs_count;
9940
9941         if (!need_new_beacon)
9942                 goto skip_beacons;
9943
9944         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
9945         if (err)
9946                 goto free;
9947
9948         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
9949                             GFP_KERNEL);
9950         if (!csa_attrs) {
9951                 err = -ENOMEM;
9952                 goto free;
9953         }
9954
9955         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9956                                           info->attrs[NL80211_ATTR_CSA_IES],
9957                                           nl80211_policy, info->extack);
9958         if (err)
9959                 goto free;
9960
9961         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
9962         if (err)
9963                 goto free;
9964
9965         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
9966                 err = -EINVAL;
9967                 goto free;
9968         }
9969
9970         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9971         if (!len || (len % sizeof(u16))) {
9972                 err = -EINVAL;
9973                 goto free;
9974         }
9975
9976         params.n_counter_offsets_beacon = len / sizeof(u16);
9977         if (rdev->wiphy.max_num_csa_counters &&
9978             (params.n_counter_offsets_beacon >
9979              rdev->wiphy.max_num_csa_counters)) {
9980                 err = -EINVAL;
9981                 goto free;
9982         }
9983
9984         params.counter_offsets_beacon =
9985                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9986
9987         /* sanity checks - counters should fit and be the same */
9988         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9989                 u16 offset = params.counter_offsets_beacon[i];
9990
9991                 if (offset >= params.beacon_csa.tail_len) {
9992                         err = -EINVAL;
9993                         goto free;
9994                 }
9995
9996                 if (params.beacon_csa.tail[offset] != params.count) {
9997                         err = -EINVAL;
9998                         goto free;
9999                 }
10000         }
10001
10002         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10003                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10004                 if (!len || (len % sizeof(u16))) {
10005                         err = -EINVAL;
10006                         goto free;
10007                 }
10008
10009                 params.n_counter_offsets_presp = len / sizeof(u16);
10010                 if (rdev->wiphy.max_num_csa_counters &&
10011                     (params.n_counter_offsets_presp >
10012                      rdev->wiphy.max_num_csa_counters)) {
10013                         err = -EINVAL;
10014                         goto free;
10015                 }
10016
10017                 params.counter_offsets_presp =
10018                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10019
10020                 /* sanity checks - counters should fit and be the same */
10021                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10022                         u16 offset = params.counter_offsets_presp[i];
10023
10024                         if (offset >= params.beacon_csa.probe_resp_len) {
10025                                 err = -EINVAL;
10026                                 goto free;
10027                         }
10028
10029                         if (params.beacon_csa.probe_resp[offset] !=
10030                             params.count) {
10031                                 err = -EINVAL;
10032                                 goto free;
10033                         }
10034                 }
10035         }
10036
10037 skip_beacons:
10038         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10039         if (err)
10040                 goto free;
10041
10042         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10043                                            wdev->iftype)) {
10044                 err = -EINVAL;
10045                 goto free;
10046         }
10047
10048         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10049                                             &params.chandef,
10050                                             wdev->iftype);
10051         if (err < 0)
10052                 goto free;
10053
10054         if (err > 0) {
10055                 params.radar_required = true;
10056                 if (need_handle_dfs_flag &&
10057                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10058                         err = -EINVAL;
10059                         goto free;
10060                 }
10061         }
10062
10063         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10064                 params.block_tx = true;
10065
10066         wdev_lock(wdev);
10067         err = rdev_channel_switch(rdev, dev, &params);
10068         wdev_unlock(wdev);
10069
10070 free:
10071         kfree(params.beacon_after.mbssid_ies);
10072         kfree(params.beacon_csa.mbssid_ies);
10073         kfree(csa_attrs);
10074         return err;
10075 }
10076
10077 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10078                             u32 seq, int flags,
10079                             struct cfg80211_registered_device *rdev,
10080                             struct wireless_dev *wdev,
10081                             struct cfg80211_internal_bss *intbss)
10082 {
10083         struct cfg80211_bss *res = &intbss->pub;
10084         const struct cfg80211_bss_ies *ies;
10085         unsigned int link_id;
10086         void *hdr;
10087         struct nlattr *bss;
10088
10089         ASSERT_WDEV_LOCK(wdev);
10090
10091         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10092                              NL80211_CMD_NEW_SCAN_RESULTS);
10093         if (!hdr)
10094                 return -1;
10095
10096         genl_dump_check_consistent(cb, hdr);
10097
10098         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10099                 goto nla_put_failure;
10100         if (wdev->netdev &&
10101             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10102                 goto nla_put_failure;
10103         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10104                               NL80211_ATTR_PAD))
10105                 goto nla_put_failure;
10106
10107         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10108         if (!bss)
10109                 goto nla_put_failure;
10110         if ((!is_zero_ether_addr(res->bssid) &&
10111              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10112                 goto nla_put_failure;
10113
10114         rcu_read_lock();
10115         /* indicate whether we have probe response data or not */
10116         if (rcu_access_pointer(res->proberesp_ies) &&
10117             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10118                 goto fail_unlock_rcu;
10119
10120         /* this pointer prefers to be pointed to probe response data
10121          * but is always valid
10122          */
10123         ies = rcu_dereference(res->ies);
10124         if (ies) {
10125                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10126                                       NL80211_BSS_PAD))
10127                         goto fail_unlock_rcu;
10128                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10129                                         ies->len, ies->data))
10130                         goto fail_unlock_rcu;
10131         }
10132
10133         /* and this pointer is always (unless driver didn't know) beacon data */
10134         ies = rcu_dereference(res->beacon_ies);
10135         if (ies && ies->from_beacon) {
10136                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10137                                       NL80211_BSS_PAD))
10138                         goto fail_unlock_rcu;
10139                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10140                                         ies->len, ies->data))
10141                         goto fail_unlock_rcu;
10142         }
10143         rcu_read_unlock();
10144
10145         if (res->beacon_interval &&
10146             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10147                 goto nla_put_failure;
10148         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10149             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10150             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10151                         res->channel->freq_offset) ||
10152             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10153             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10154                         jiffies_to_msecs(jiffies - intbss->ts)))
10155                 goto nla_put_failure;
10156
10157         if (intbss->parent_tsf &&
10158             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10159                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10160              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10161                      intbss->parent_bssid)))
10162                 goto nla_put_failure;
10163
10164         if (intbss->ts_boottime &&
10165             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10166                               intbss->ts_boottime, NL80211_BSS_PAD))
10167                 goto nla_put_failure;
10168
10169         if (!nl80211_put_signal(msg, intbss->pub.chains,
10170                                 intbss->pub.chain_signal,
10171                                 NL80211_BSS_CHAIN_SIGNAL))
10172                 goto nla_put_failure;
10173
10174         switch (rdev->wiphy.signal_type) {
10175         case CFG80211_SIGNAL_TYPE_MBM:
10176                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10177                         goto nla_put_failure;
10178                 break;
10179         case CFG80211_SIGNAL_TYPE_UNSPEC:
10180                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10181                         goto nla_put_failure;
10182                 break;
10183         default:
10184                 break;
10185         }
10186
10187         switch (wdev->iftype) {
10188         case NL80211_IFTYPE_P2P_CLIENT:
10189         case NL80211_IFTYPE_STATION:
10190                 for_each_valid_link(wdev, link_id) {
10191                         if (intbss == wdev->links[link_id].client.current_bss &&
10192                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10193                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10194                              (wdev->valid_links &&
10195                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10196                                           link_id) ||
10197                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10198                                        wdev->u.client.connected_addr)))))
10199                                 goto nla_put_failure;
10200                 }
10201                 break;
10202         case NL80211_IFTYPE_ADHOC:
10203                 if (intbss == wdev->u.ibss.current_bss &&
10204                     nla_put_u32(msg, NL80211_BSS_STATUS,
10205                                 NL80211_BSS_STATUS_IBSS_JOINED))
10206                         goto nla_put_failure;
10207                 break;
10208         default:
10209                 break;
10210         }
10211
10212         nla_nest_end(msg, bss);
10213
10214         genlmsg_end(msg, hdr);
10215         return 0;
10216
10217  fail_unlock_rcu:
10218         rcu_read_unlock();
10219  nla_put_failure:
10220         genlmsg_cancel(msg, hdr);
10221         return -EMSGSIZE;
10222 }
10223
10224 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10225 {
10226         struct cfg80211_registered_device *rdev;
10227         struct cfg80211_internal_bss *scan;
10228         struct wireless_dev *wdev;
10229         int start = cb->args[2], idx = 0;
10230         int err;
10231
10232         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10233         if (err)
10234                 return err;
10235         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10236         __acquire(&rdev->wiphy.mtx);
10237
10238         wdev_lock(wdev);
10239         spin_lock_bh(&rdev->bss_lock);
10240
10241         /*
10242          * dump_scan will be called multiple times to break up the scan results
10243          * into multiple messages.  It is unlikely that any more bss-es will be
10244          * expired after the first call, so only call only call this on the
10245          * first dump_scan invocation.
10246          */
10247         if (start == 0)
10248                 cfg80211_bss_expire(rdev);
10249
10250         cb->seq = rdev->bss_generation;
10251
10252         list_for_each_entry(scan, &rdev->bss_list, list) {
10253                 if (++idx <= start)
10254                         continue;
10255                 if (nl80211_send_bss(skb, cb,
10256                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10257                                 rdev, wdev, scan) < 0) {
10258                         idx--;
10259                         break;
10260                 }
10261         }
10262
10263         spin_unlock_bh(&rdev->bss_lock);
10264         wdev_unlock(wdev);
10265
10266         cb->args[2] = idx;
10267         wiphy_unlock(&rdev->wiphy);
10268
10269         return skb->len;
10270 }
10271
10272 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10273                                int flags, struct net_device *dev,
10274                                bool allow_radio_stats,
10275                                struct survey_info *survey)
10276 {
10277         void *hdr;
10278         struct nlattr *infoattr;
10279
10280         /* skip radio stats if userspace didn't request them */
10281         if (!survey->channel && !allow_radio_stats)
10282                 return 0;
10283
10284         hdr = nl80211hdr_put(msg, portid, seq, flags,
10285                              NL80211_CMD_NEW_SURVEY_RESULTS);
10286         if (!hdr)
10287                 return -ENOMEM;
10288
10289         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10290                 goto nla_put_failure;
10291
10292         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10293         if (!infoattr)
10294                 goto nla_put_failure;
10295
10296         if (survey->channel &&
10297             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10298                         survey->channel->center_freq))
10299                 goto nla_put_failure;
10300
10301         if (survey->channel && survey->channel->freq_offset &&
10302             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10303                         survey->channel->freq_offset))
10304                 goto nla_put_failure;
10305
10306         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10307             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10308                 goto nla_put_failure;
10309         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10310             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10311                 goto nla_put_failure;
10312         if ((survey->filled & SURVEY_INFO_TIME) &&
10313             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10314                         survey->time, NL80211_SURVEY_INFO_PAD))
10315                 goto nla_put_failure;
10316         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10317             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10318                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10319                 goto nla_put_failure;
10320         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10321             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10322                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10323                 goto nla_put_failure;
10324         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10325             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10326                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10327                 goto nla_put_failure;
10328         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10329             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10330                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10331                 goto nla_put_failure;
10332         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10333             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10334                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10335                 goto nla_put_failure;
10336         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10337             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10338                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10339                 goto nla_put_failure;
10340
10341         nla_nest_end(msg, infoattr);
10342
10343         genlmsg_end(msg, hdr);
10344         return 0;
10345
10346  nla_put_failure:
10347         genlmsg_cancel(msg, hdr);
10348         return -EMSGSIZE;
10349 }
10350
10351 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10352 {
10353         struct nlattr **attrbuf;
10354         struct survey_info survey;
10355         struct cfg80211_registered_device *rdev;
10356         struct wireless_dev *wdev;
10357         int survey_idx = cb->args[2];
10358         int res;
10359         bool radio_stats;
10360
10361         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10362         if (!attrbuf)
10363                 return -ENOMEM;
10364
10365         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10366         if (res) {
10367                 kfree(attrbuf);
10368                 return res;
10369         }
10370         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10371         __acquire(&rdev->wiphy.mtx);
10372
10373         /* prepare_wdev_dump parsed the attributes */
10374         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10375
10376         if (!wdev->netdev) {
10377                 res = -EINVAL;
10378                 goto out_err;
10379         }
10380
10381         if (!rdev->ops->dump_survey) {
10382                 res = -EOPNOTSUPP;
10383                 goto out_err;
10384         }
10385
10386         while (1) {
10387                 wdev_lock(wdev);
10388                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10389                 wdev_unlock(wdev);
10390                 if (res == -ENOENT)
10391                         break;
10392                 if (res)
10393                         goto out_err;
10394
10395                 /* don't send disabled channels, but do send non-channel data */
10396                 if (survey.channel &&
10397                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10398                         survey_idx++;
10399                         continue;
10400                 }
10401
10402                 if (nl80211_send_survey(skb,
10403                                 NETLINK_CB(cb->skb).portid,
10404                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10405                                 wdev->netdev, radio_stats, &survey) < 0)
10406                         goto out;
10407                 survey_idx++;
10408         }
10409
10410  out:
10411         cb->args[2] = survey_idx;
10412         res = skb->len;
10413  out_err:
10414         kfree(attrbuf);
10415         wiphy_unlock(&rdev->wiphy);
10416         return res;
10417 }
10418
10419 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10420 {
10421         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10422                                   NL80211_WPA_VERSION_2 |
10423                                   NL80211_WPA_VERSION_3));
10424 }
10425
10426 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10427 {
10428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10429         struct net_device *dev = info->user_ptr[1];
10430         struct ieee80211_channel *chan;
10431         const u8 *bssid, *ssid;
10432         int err, ssid_len;
10433         enum nl80211_auth_type auth_type;
10434         struct key_parse key;
10435         bool local_state_change;
10436         struct cfg80211_auth_request req = {};
10437         u32 freq;
10438
10439         if (!info->attrs[NL80211_ATTR_MAC])
10440                 return -EINVAL;
10441
10442         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10443                 return -EINVAL;
10444
10445         if (!info->attrs[NL80211_ATTR_SSID])
10446                 return -EINVAL;
10447
10448         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10449                 return -EINVAL;
10450
10451         err = nl80211_parse_key(info, &key);
10452         if (err)
10453                 return err;
10454
10455         if (key.idx >= 0) {
10456                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10457                         return -EINVAL;
10458                 if (!key.p.key || !key.p.key_len)
10459                         return -EINVAL;
10460                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10461                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10462                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10463                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10464                         return -EINVAL;
10465                 if (key.idx > 3)
10466                         return -EINVAL;
10467         } else {
10468                 key.p.key_len = 0;
10469                 key.p.key = NULL;
10470         }
10471
10472         if (key.idx >= 0) {
10473                 int i;
10474                 bool ok = false;
10475
10476                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10477                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10478                                 ok = true;
10479                                 break;
10480                         }
10481                 }
10482                 if (!ok)
10483                         return -EINVAL;
10484         }
10485
10486         if (!rdev->ops->auth)
10487                 return -EOPNOTSUPP;
10488
10489         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10490             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10491                 return -EOPNOTSUPP;
10492
10493         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10494         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10495         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10496                 freq +=
10497                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10498
10499         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10500         if (!chan)
10501                 return -EINVAL;
10502
10503         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10504         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10505
10506         if (info->attrs[NL80211_ATTR_IE]) {
10507                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10508                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10509         }
10510
10511         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10512         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10513                 return -EINVAL;
10514
10515         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10516              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10517              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10518              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10519             !info->attrs[NL80211_ATTR_AUTH_DATA])
10520                 return -EINVAL;
10521
10522         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10523                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10524                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10525                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10526                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10527                         return -EINVAL;
10528                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10529                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10530         }
10531
10532         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10533
10534         /*
10535          * Since we no longer track auth state, ignore
10536          * requests to only change local state.
10537          */
10538         if (local_state_change)
10539                 return 0;
10540
10541         req.auth_type = auth_type;
10542         req.key = key.p.key;
10543         req.key_len = key.p.key_len;
10544         req.key_idx = key.idx;
10545         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10546         if (req.link_id >= 0) {
10547                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10548                         return -EINVAL;
10549                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10550                         return -EINVAL;
10551                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10552                 if (!is_valid_ether_addr(req.ap_mld_addr))
10553                         return -EINVAL;
10554         }
10555
10556         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10557                                    IEEE80211_BSS_TYPE_ESS,
10558                                    IEEE80211_PRIVACY_ANY);
10559         if (!req.bss)
10560                 return -ENOENT;
10561
10562         wdev_lock(dev->ieee80211_ptr);
10563         err = cfg80211_mlme_auth(rdev, dev, &req);
10564         wdev_unlock(dev->ieee80211_ptr);
10565
10566         cfg80211_put_bss(&rdev->wiphy, req.bss);
10567
10568         return err;
10569 }
10570
10571 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10572                                      struct genl_info *info)
10573 {
10574         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10575                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10576                 return -EINVAL;
10577         }
10578
10579         if (!rdev->ops->tx_control_port ||
10580             !wiphy_ext_feature_isset(&rdev->wiphy,
10581                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10582                 return -EOPNOTSUPP;
10583
10584         return 0;
10585 }
10586
10587 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10588                                    struct genl_info *info,
10589                                    struct cfg80211_crypto_settings *settings,
10590                                    int cipher_limit)
10591 {
10592         memset(settings, 0, sizeof(*settings));
10593
10594         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10595
10596         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10597                 u16 proto;
10598
10599                 proto = nla_get_u16(
10600                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10601                 settings->control_port_ethertype = cpu_to_be16(proto);
10602                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10603                     proto != ETH_P_PAE)
10604                         return -EINVAL;
10605                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10606                         settings->control_port_no_encrypt = true;
10607         } else
10608                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10609
10610         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10611                 int r = validate_pae_over_nl80211(rdev, info);
10612
10613                 if (r < 0)
10614                         return r;
10615
10616                 settings->control_port_over_nl80211 = true;
10617
10618                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10619                         settings->control_port_no_preauth = true;
10620         }
10621
10622         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10623                 void *data;
10624                 int len, i;
10625
10626                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10627                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10628                 settings->n_ciphers_pairwise = len / sizeof(u32);
10629
10630                 if (len % sizeof(u32))
10631                         return -EINVAL;
10632
10633                 if (settings->n_ciphers_pairwise > cipher_limit)
10634                         return -EINVAL;
10635
10636                 memcpy(settings->ciphers_pairwise, data, len);
10637
10638                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10639                         if (!cfg80211_supported_cipher_suite(
10640                                         &rdev->wiphy,
10641                                         settings->ciphers_pairwise[i]))
10642                                 return -EINVAL;
10643         }
10644
10645         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10646                 settings->cipher_group =
10647                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10648                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10649                                                      settings->cipher_group))
10650                         return -EINVAL;
10651         }
10652
10653         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10654                 settings->wpa_versions =
10655                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10656                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10657                         return -EINVAL;
10658         }
10659
10660         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10661                 void *data;
10662                 int len;
10663
10664                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10665                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10666                 settings->n_akm_suites = len / sizeof(u32);
10667
10668                 if (len % sizeof(u32))
10669                         return -EINVAL;
10670
10671                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10672                         return -EINVAL;
10673
10674                 memcpy(settings->akm_suites, data, len);
10675         }
10676
10677         if (info->attrs[NL80211_ATTR_PMK]) {
10678                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10679                         return -EINVAL;
10680                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10681                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10682                     !wiphy_ext_feature_isset(&rdev->wiphy,
10683                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10684                         return -EINVAL;
10685                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10686         }
10687
10688         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10689                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10690                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10691                     !wiphy_ext_feature_isset(&rdev->wiphy,
10692                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10693                         return -EINVAL;
10694                 settings->sae_pwd =
10695                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10696                 settings->sae_pwd_len =
10697                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10698         }
10699
10700         if (info->attrs[NL80211_ATTR_SAE_PWE])
10701                 settings->sae_pwe =
10702                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10703         else
10704                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10705
10706         return 0;
10707 }
10708
10709 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10710                                               const u8 *ssid, int ssid_len,
10711                                               struct nlattr **attrs)
10712 {
10713         struct ieee80211_channel *chan;
10714         struct cfg80211_bss *bss;
10715         const u8 *bssid;
10716         u32 freq;
10717
10718         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10719                 return ERR_PTR(-EINVAL);
10720
10721         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10722
10723         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10724         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10725                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10726
10727         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10728         if (!chan)
10729                 return ERR_PTR(-EINVAL);
10730
10731         bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10732                                ssid, ssid_len,
10733                                IEEE80211_BSS_TYPE_ESS,
10734                                IEEE80211_PRIVACY_ANY);
10735         if (!bss)
10736                 return ERR_PTR(-ENOENT);
10737
10738         return bss;
10739 }
10740
10741 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10742 {
10743         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10744         struct net_device *dev = info->user_ptr[1];
10745         struct cfg80211_assoc_request req = {};
10746         struct nlattr **attrs = NULL;
10747         const u8 *ap_addr, *ssid;
10748         unsigned int link_id;
10749         int err, ssid_len;
10750
10751         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10752             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10753                 return -EPERM;
10754
10755         if (!info->attrs[NL80211_ATTR_SSID])
10756                 return -EINVAL;
10757
10758         if (!rdev->ops->assoc)
10759                 return -EOPNOTSUPP;
10760
10761         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10762             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10763                 return -EOPNOTSUPP;
10764
10765         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10766         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10767
10768         if (info->attrs[NL80211_ATTR_IE]) {
10769                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10770                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10771
10772                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10773                                            req.ie, req.ie_len)) {
10774                         GENL_SET_ERR_MSG(info,
10775                                          "non-inheritance makes no sense");
10776                         return -EINVAL;
10777                 }
10778         }
10779
10780         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10781                 enum nl80211_mfp mfp =
10782                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10783                 if (mfp == NL80211_MFP_REQUIRED)
10784                         req.use_mfp = true;
10785                 else if (mfp != NL80211_MFP_NO)
10786                         return -EINVAL;
10787         }
10788
10789         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10790                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10791
10792         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10793                 req.flags |= ASSOC_REQ_DISABLE_HT;
10794
10795         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10796                 memcpy(&req.ht_capa_mask,
10797                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10798                        sizeof(req.ht_capa_mask));
10799
10800         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10801                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10802                         return -EINVAL;
10803                 memcpy(&req.ht_capa,
10804                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10805                        sizeof(req.ht_capa));
10806         }
10807
10808         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10809                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10810
10811         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10812                 req.flags |= ASSOC_REQ_DISABLE_HE;
10813
10814         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
10815                 req.flags |= ASSOC_REQ_DISABLE_EHT;
10816
10817         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10818                 memcpy(&req.vht_capa_mask,
10819                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10820                        sizeof(req.vht_capa_mask));
10821
10822         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10823                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10824                         return -EINVAL;
10825                 memcpy(&req.vht_capa,
10826                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10827                        sizeof(req.vht_capa));
10828         }
10829
10830         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10831                 if (!((rdev->wiphy.features &
10832                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10833                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10834                     !wiphy_ext_feature_isset(&rdev->wiphy,
10835                                              NL80211_EXT_FEATURE_RRM))
10836                         return -EINVAL;
10837                 req.flags |= ASSOC_REQ_USE_RRM;
10838         }
10839
10840         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10841                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10842                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10843                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10844                         return -EINVAL;
10845                 req.fils_nonces =
10846                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10847         }
10848
10849         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10850                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10851                         return -EINVAL;
10852                 memcpy(&req.s1g_capa_mask,
10853                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10854                        sizeof(req.s1g_capa_mask));
10855         }
10856
10857         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10858                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10859                         return -EINVAL;
10860                 memcpy(&req.s1g_capa,
10861                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10862                        sizeof(req.s1g_capa));
10863         }
10864
10865         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10866
10867         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
10868                 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
10869                 struct nlattr *link;
10870                 int rem = 0;
10871
10872                 if (req.link_id < 0)
10873                         return -EINVAL;
10874
10875                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10876                         return -EINVAL;
10877
10878                 if (info->attrs[NL80211_ATTR_MAC] ||
10879                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10880                     !info->attrs[NL80211_ATTR_MLD_ADDR])
10881                         return -EINVAL;
10882
10883                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10884                 ap_addr = req.ap_mld_addr;
10885
10886                 attrs = kzalloc(attrsize, GFP_KERNEL);
10887                 if (!attrs)
10888                         return -ENOMEM;
10889
10890                 nla_for_each_nested(link,
10891                                     info->attrs[NL80211_ATTR_MLO_LINKS],
10892                                     rem) {
10893                         memset(attrs, 0, attrsize);
10894
10895                         nla_parse_nested(attrs, NL80211_ATTR_MAX,
10896                                          link, NULL, NULL);
10897
10898                         if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
10899                                 err = -EINVAL;
10900                                 goto free;
10901                         }
10902
10903                         link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
10904                         /* cannot use the same link ID again */
10905                         if (req.links[link_id].bss) {
10906                                 err = -EINVAL;
10907                                 goto free;
10908                         }
10909                         req.links[link_id].bss =
10910                                 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
10911                         if (IS_ERR(req.links[link_id].bss)) {
10912                                 err = PTR_ERR(req.links[link_id].bss);
10913                                 req.links[link_id].bss = NULL;
10914                                 goto free;
10915                         }
10916
10917                         if (attrs[NL80211_ATTR_IE]) {
10918                                 req.links[link_id].elems =
10919                                         nla_data(attrs[NL80211_ATTR_IE]);
10920                                 req.links[link_id].elems_len =
10921                                         nla_len(attrs[NL80211_ATTR_IE]);
10922
10923                                 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
10924                                                        req.links[link_id].elems,
10925                                                        req.links[link_id].elems_len)) {
10926                                         GENL_SET_ERR_MSG(info,
10927                                                          "cannot deal with fragmentation");
10928                                         err = -EINVAL;
10929                                         goto free;
10930                                 }
10931
10932                                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10933                                                            req.links[link_id].elems,
10934                                                            req.links[link_id].elems_len)) {
10935                                         GENL_SET_ERR_MSG(info,
10936                                                          "cannot deal with non-inheritance");
10937                                         err = -EINVAL;
10938                                         goto free;
10939                                 }
10940                         }
10941                 }
10942
10943                 if (!req.links[req.link_id].bss) {
10944                         err = -EINVAL;
10945                         goto free;
10946                 }
10947
10948                 if (req.links[req.link_id].elems_len) {
10949                         GENL_SET_ERR_MSG(info,
10950                                          "cannot have per-link elems on assoc link");
10951                         err = -EINVAL;
10952                         goto free;
10953                 }
10954
10955                 kfree(attrs);
10956                 attrs = NULL;
10957         } else {
10958                 if (req.link_id >= 0)
10959                         return -EINVAL;
10960
10961                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
10962                 if (IS_ERR(req.bss))
10963                         return PTR_ERR(req.bss);
10964                 ap_addr = req.bss->bssid;
10965         }
10966
10967         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
10968         if (!err) {
10969                 wdev_lock(dev->ieee80211_ptr);
10970
10971                 err = cfg80211_mlme_assoc(rdev, dev, &req);
10972
10973                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10974                         dev->ieee80211_ptr->conn_owner_nlportid =
10975                                 info->snd_portid;
10976                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10977                                ap_addr, ETH_ALEN);
10978                 }
10979
10980                 wdev_unlock(dev->ieee80211_ptr);
10981         }
10982
10983 free:
10984         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
10985                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
10986         cfg80211_put_bss(&rdev->wiphy, req.bss);
10987         kfree(attrs);
10988
10989         return err;
10990 }
10991
10992 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
10993 {
10994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10995         struct net_device *dev = info->user_ptr[1];
10996         const u8 *ie = NULL, *bssid;
10997         int ie_len = 0, err;
10998         u16 reason_code;
10999         bool local_state_change;
11000
11001         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11002             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11003                 return -EPERM;
11004
11005         if (!info->attrs[NL80211_ATTR_MAC])
11006                 return -EINVAL;
11007
11008         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11009                 return -EINVAL;
11010
11011         if (!rdev->ops->deauth)
11012                 return -EOPNOTSUPP;
11013
11014         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11015             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11016                 return -EOPNOTSUPP;
11017
11018         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11019
11020         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11021         if (reason_code == 0) {
11022                 /* Reason Code 0 is reserved */
11023                 return -EINVAL;
11024         }
11025
11026         if (info->attrs[NL80211_ATTR_IE]) {
11027                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11028                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11029         }
11030
11031         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11032
11033         wdev_lock(dev->ieee80211_ptr);
11034         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11035                                    local_state_change);
11036         wdev_unlock(dev->ieee80211_ptr);
11037         return err;
11038 }
11039
11040 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11041 {
11042         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11043         struct net_device *dev = info->user_ptr[1];
11044         const u8 *ie = NULL, *bssid;
11045         int ie_len = 0, err;
11046         u16 reason_code;
11047         bool local_state_change;
11048
11049         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11050             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11051                 return -EPERM;
11052
11053         if (!info->attrs[NL80211_ATTR_MAC])
11054                 return -EINVAL;
11055
11056         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11057                 return -EINVAL;
11058
11059         if (!rdev->ops->disassoc)
11060                 return -EOPNOTSUPP;
11061
11062         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11063             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11064                 return -EOPNOTSUPP;
11065
11066         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11067
11068         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11069         if (reason_code == 0) {
11070                 /* Reason Code 0 is reserved */
11071                 return -EINVAL;
11072         }
11073
11074         if (info->attrs[NL80211_ATTR_IE]) {
11075                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11076                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11077         }
11078
11079         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11080
11081         wdev_lock(dev->ieee80211_ptr);
11082         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11083                                      local_state_change);
11084         wdev_unlock(dev->ieee80211_ptr);
11085         return err;
11086 }
11087
11088 static bool
11089 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11090                          int mcast_rate[NUM_NL80211_BANDS],
11091                          int rateval)
11092 {
11093         struct wiphy *wiphy = &rdev->wiphy;
11094         bool found = false;
11095         int band, i;
11096
11097         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11098                 struct ieee80211_supported_band *sband;
11099
11100                 sband = wiphy->bands[band];
11101                 if (!sband)
11102                         continue;
11103
11104                 for (i = 0; i < sband->n_bitrates; i++) {
11105                         if (sband->bitrates[i].bitrate == rateval) {
11106                                 mcast_rate[band] = i + 1;
11107                                 found = true;
11108                                 break;
11109                         }
11110                 }
11111         }
11112
11113         return found;
11114 }
11115
11116 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11117 {
11118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11119         struct net_device *dev = info->user_ptr[1];
11120         struct cfg80211_ibss_params ibss;
11121         struct wiphy *wiphy;
11122         struct cfg80211_cached_keys *connkeys = NULL;
11123         int err;
11124
11125         memset(&ibss, 0, sizeof(ibss));
11126
11127         if (!info->attrs[NL80211_ATTR_SSID] ||
11128             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11129                 return -EINVAL;
11130
11131         ibss.beacon_interval = 100;
11132
11133         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11134                 ibss.beacon_interval =
11135                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11136
11137         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11138                                            ibss.beacon_interval);
11139         if (err)
11140                 return err;
11141
11142         if (!rdev->ops->join_ibss)
11143                 return -EOPNOTSUPP;
11144
11145         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11146                 return -EOPNOTSUPP;
11147
11148         wiphy = &rdev->wiphy;
11149
11150         if (info->attrs[NL80211_ATTR_MAC]) {
11151                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11152
11153                 if (!is_valid_ether_addr(ibss.bssid))
11154                         return -EINVAL;
11155         }
11156         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11157         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11158
11159         if (info->attrs[NL80211_ATTR_IE]) {
11160                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11161                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11162         }
11163
11164         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11165         if (err)
11166                 return err;
11167
11168         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11169                                      NL80211_IFTYPE_ADHOC))
11170                 return -EINVAL;
11171
11172         switch (ibss.chandef.width) {
11173         case NL80211_CHAN_WIDTH_5:
11174         case NL80211_CHAN_WIDTH_10:
11175         case NL80211_CHAN_WIDTH_20_NOHT:
11176                 break;
11177         case NL80211_CHAN_WIDTH_20:
11178         case NL80211_CHAN_WIDTH_40:
11179                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11180                         return -EINVAL;
11181                 break;
11182         case NL80211_CHAN_WIDTH_80:
11183         case NL80211_CHAN_WIDTH_80P80:
11184         case NL80211_CHAN_WIDTH_160:
11185                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11186                         return -EINVAL;
11187                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11188                                              NL80211_EXT_FEATURE_VHT_IBSS))
11189                         return -EINVAL;
11190                 break;
11191         case NL80211_CHAN_WIDTH_320:
11192                 return -EINVAL;
11193         default:
11194                 return -EINVAL;
11195         }
11196
11197         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11198         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11199
11200         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11201                 u8 *rates =
11202                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11203                 int n_rates =
11204                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11205                 struct ieee80211_supported_band *sband =
11206                         wiphy->bands[ibss.chandef.chan->band];
11207
11208                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11209                                              &ibss.basic_rates);
11210                 if (err)
11211                         return err;
11212         }
11213
11214         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11215                 memcpy(&ibss.ht_capa_mask,
11216                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11217                        sizeof(ibss.ht_capa_mask));
11218
11219         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11220                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11221                         return -EINVAL;
11222                 memcpy(&ibss.ht_capa,
11223                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11224                        sizeof(ibss.ht_capa));
11225         }
11226
11227         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11228             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11229                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11230                 return -EINVAL;
11231
11232         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11233                 bool no_ht = false;
11234
11235                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11236                 if (IS_ERR(connkeys))
11237                         return PTR_ERR(connkeys);
11238
11239                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11240                     no_ht) {
11241                         kfree_sensitive(connkeys);
11242                         return -EINVAL;
11243                 }
11244         }
11245
11246         ibss.control_port =
11247                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11248
11249         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11250                 int r = validate_pae_over_nl80211(rdev, info);
11251
11252                 if (r < 0) {
11253                         kfree_sensitive(connkeys);
11254                         return r;
11255                 }
11256
11257                 ibss.control_port_over_nl80211 = true;
11258         }
11259
11260         ibss.userspace_handles_dfs =
11261                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11262
11263         wdev_lock(dev->ieee80211_ptr);
11264         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11265         if (err)
11266                 kfree_sensitive(connkeys);
11267         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11268                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11269         wdev_unlock(dev->ieee80211_ptr);
11270
11271         return err;
11272 }
11273
11274 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11275 {
11276         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11277         struct net_device *dev = info->user_ptr[1];
11278
11279         if (!rdev->ops->leave_ibss)
11280                 return -EOPNOTSUPP;
11281
11282         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11283                 return -EOPNOTSUPP;
11284
11285         return cfg80211_leave_ibss(rdev, dev, false);
11286 }
11287
11288 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11289 {
11290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11291         struct net_device *dev = info->user_ptr[1];
11292         int mcast_rate[NUM_NL80211_BANDS];
11293         u32 nla_rate;
11294
11295         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11296             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11297             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11298                 return -EOPNOTSUPP;
11299
11300         if (!rdev->ops->set_mcast_rate)
11301                 return -EOPNOTSUPP;
11302
11303         memset(mcast_rate, 0, sizeof(mcast_rate));
11304
11305         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11306                 return -EINVAL;
11307
11308         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11309         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11310                 return -EINVAL;
11311
11312         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11313 }
11314
11315 static struct sk_buff *
11316 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11317                             struct wireless_dev *wdev, int approxlen,
11318                             u32 portid, u32 seq, enum nl80211_commands cmd,
11319                             enum nl80211_attrs attr,
11320                             const struct nl80211_vendor_cmd_info *info,
11321                             gfp_t gfp)
11322 {
11323         struct sk_buff *skb;
11324         void *hdr;
11325         struct nlattr *data;
11326
11327         skb = nlmsg_new(approxlen + 100, gfp);
11328         if (!skb)
11329                 return NULL;
11330
11331         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11332         if (!hdr) {
11333                 kfree_skb(skb);
11334                 return NULL;
11335         }
11336
11337         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11338                 goto nla_put_failure;
11339
11340         if (info) {
11341                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11342                                 info->vendor_id))
11343                         goto nla_put_failure;
11344                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11345                                 info->subcmd))
11346                         goto nla_put_failure;
11347         }
11348
11349         if (wdev) {
11350                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11351                                       wdev_id(wdev), NL80211_ATTR_PAD))
11352                         goto nla_put_failure;
11353                 if (wdev->netdev &&
11354                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11355                                 wdev->netdev->ifindex))
11356                         goto nla_put_failure;
11357         }
11358
11359         data = nla_nest_start_noflag(skb, attr);
11360         if (!data)
11361                 goto nla_put_failure;
11362
11363         ((void **)skb->cb)[0] = rdev;
11364         ((void **)skb->cb)[1] = hdr;
11365         ((void **)skb->cb)[2] = data;
11366
11367         return skb;
11368
11369  nla_put_failure:
11370         kfree_skb(skb);
11371         return NULL;
11372 }
11373
11374 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11375                                            struct wireless_dev *wdev,
11376                                            enum nl80211_commands cmd,
11377                                            enum nl80211_attrs attr,
11378                                            unsigned int portid,
11379                                            int vendor_event_idx,
11380                                            int approxlen, gfp_t gfp)
11381 {
11382         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11383         const struct nl80211_vendor_cmd_info *info;
11384
11385         switch (cmd) {
11386         case NL80211_CMD_TESTMODE:
11387                 if (WARN_ON(vendor_event_idx != -1))
11388                         return NULL;
11389                 info = NULL;
11390                 break;
11391         case NL80211_CMD_VENDOR:
11392                 if (WARN_ON(vendor_event_idx < 0 ||
11393                             vendor_event_idx >= wiphy->n_vendor_events))
11394                         return NULL;
11395                 info = &wiphy->vendor_events[vendor_event_idx];
11396                 break;
11397         default:
11398                 WARN_ON(1);
11399                 return NULL;
11400         }
11401
11402         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11403                                            cmd, attr, info, gfp);
11404 }
11405 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11406
11407 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11408 {
11409         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11410         void *hdr = ((void **)skb->cb)[1];
11411         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11412         struct nlattr *data = ((void **)skb->cb)[2];
11413         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11414
11415         /* clear CB data for netlink core to own from now on */
11416         memset(skb->cb, 0, sizeof(skb->cb));
11417
11418         nla_nest_end(skb, data);
11419         genlmsg_end(skb, hdr);
11420
11421         if (nlhdr->nlmsg_pid) {
11422                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11423                                 nlhdr->nlmsg_pid);
11424         } else {
11425                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11426                         mcgrp = NL80211_MCGRP_VENDOR;
11427
11428                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11429                                         skb, 0, mcgrp, gfp);
11430         }
11431 }
11432 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11433
11434 #ifdef CONFIG_NL80211_TESTMODE
11435 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11436 {
11437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11438         struct wireless_dev *wdev;
11439         int err;
11440
11441         lockdep_assert_held(&rdev->wiphy.mtx);
11442
11443         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11444                                           info->attrs);
11445
11446         if (!rdev->ops->testmode_cmd)
11447                 return -EOPNOTSUPP;
11448
11449         if (IS_ERR(wdev)) {
11450                 err = PTR_ERR(wdev);
11451                 if (err != -EINVAL)
11452                         return err;
11453                 wdev = NULL;
11454         } else if (wdev->wiphy != &rdev->wiphy) {
11455                 return -EINVAL;
11456         }
11457
11458         if (!info->attrs[NL80211_ATTR_TESTDATA])
11459                 return -EINVAL;
11460
11461         rdev->cur_cmd_info = info;
11462         err = rdev_testmode_cmd(rdev, wdev,
11463                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11464                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11465         rdev->cur_cmd_info = NULL;
11466
11467         return err;
11468 }
11469
11470 static int nl80211_testmode_dump(struct sk_buff *skb,
11471                                  struct netlink_callback *cb)
11472 {
11473         struct cfg80211_registered_device *rdev;
11474         struct nlattr **attrbuf = NULL;
11475         int err;
11476         long phy_idx;
11477         void *data = NULL;
11478         int data_len = 0;
11479
11480         rtnl_lock();
11481
11482         if (cb->args[0]) {
11483                 /*
11484                  * 0 is a valid index, but not valid for args[0],
11485                  * so we need to offset by 1.
11486                  */
11487                 phy_idx = cb->args[0] - 1;
11488
11489                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11490                 if (!rdev) {
11491                         err = -ENOENT;
11492                         goto out_err;
11493                 }
11494         } else {
11495                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11496                                   GFP_KERNEL);
11497                 if (!attrbuf) {
11498                         err = -ENOMEM;
11499                         goto out_err;
11500                 }
11501
11502                 err = nlmsg_parse_deprecated(cb->nlh,
11503                                              GENL_HDRLEN + nl80211_fam.hdrsize,
11504                                              attrbuf, nl80211_fam.maxattr,
11505                                              nl80211_policy, NULL);
11506                 if (err)
11507                         goto out_err;
11508
11509                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11510                 if (IS_ERR(rdev)) {
11511                         err = PTR_ERR(rdev);
11512                         goto out_err;
11513                 }
11514                 phy_idx = rdev->wiphy_idx;
11515
11516                 if (attrbuf[NL80211_ATTR_TESTDATA])
11517                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11518         }
11519
11520         if (cb->args[1]) {
11521                 data = nla_data((void *)cb->args[1]);
11522                 data_len = nla_len((void *)cb->args[1]);
11523         }
11524
11525         if (!rdev->ops->testmode_dump) {
11526                 err = -EOPNOTSUPP;
11527                 goto out_err;
11528         }
11529
11530         while (1) {
11531                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11532                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11533                                            NL80211_CMD_TESTMODE);
11534                 struct nlattr *tmdata;
11535
11536                 if (!hdr)
11537                         break;
11538
11539                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11540                         genlmsg_cancel(skb, hdr);
11541                         break;
11542                 }
11543
11544                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11545                 if (!tmdata) {
11546                         genlmsg_cancel(skb, hdr);
11547                         break;
11548                 }
11549                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11550                 nla_nest_end(skb, tmdata);
11551
11552                 if (err == -ENOBUFS || err == -ENOENT) {
11553                         genlmsg_cancel(skb, hdr);
11554                         break;
11555                 } else if (err) {
11556                         genlmsg_cancel(skb, hdr);
11557                         goto out_err;
11558                 }
11559
11560                 genlmsg_end(skb, hdr);
11561         }
11562
11563         err = skb->len;
11564         /* see above */
11565         cb->args[0] = phy_idx + 1;
11566  out_err:
11567         kfree(attrbuf);
11568         rtnl_unlock();
11569         return err;
11570 }
11571 #endif
11572
11573 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11574 {
11575         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11576         struct net_device *dev = info->user_ptr[1];
11577         struct cfg80211_connect_params connect;
11578         struct wiphy *wiphy;
11579         struct cfg80211_cached_keys *connkeys = NULL;
11580         u32 freq = 0;
11581         int err;
11582
11583         memset(&connect, 0, sizeof(connect));
11584
11585         if (!info->attrs[NL80211_ATTR_SSID] ||
11586             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11587                 return -EINVAL;
11588
11589         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11590                 connect.auth_type =
11591                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11592                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11593                                              NL80211_CMD_CONNECT))
11594                         return -EINVAL;
11595         } else
11596                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11597
11598         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11599
11600         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11601             !wiphy_ext_feature_isset(&rdev->wiphy,
11602                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11603                 return -EINVAL;
11604         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11605
11606         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11607                                       NL80211_MAX_NR_CIPHER_SUITES);
11608         if (err)
11609                 return err;
11610
11611         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11612             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11613                 return -EOPNOTSUPP;
11614
11615         wiphy = &rdev->wiphy;
11616
11617         connect.bg_scan_period = -1;
11618         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11619                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11620                 connect.bg_scan_period =
11621                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11622         }
11623
11624         if (info->attrs[NL80211_ATTR_MAC])
11625                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11626         else if (info->attrs[NL80211_ATTR_MAC_HINT])
11627                 connect.bssid_hint =
11628                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11629         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11630         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11631
11632         if (info->attrs[NL80211_ATTR_IE]) {
11633                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11634                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11635         }
11636
11637         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11638                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11639                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11640                     !wiphy_ext_feature_isset(&rdev->wiphy,
11641                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
11642                         return -EOPNOTSUPP;
11643         } else {
11644                 connect.mfp = NL80211_MFP_NO;
11645         }
11646
11647         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11648                 connect.prev_bssid =
11649                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11650
11651         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11652                 freq = MHZ_TO_KHZ(nla_get_u32(
11653                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11654         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11655                 freq +=
11656                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11657
11658         if (freq) {
11659                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11660                 if (!connect.channel)
11661                         return -EINVAL;
11662         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11663                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11664                 freq = MHZ_TO_KHZ(freq);
11665                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11666                 if (!connect.channel_hint)
11667                         return -EINVAL;
11668         }
11669
11670         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11671                 connect.edmg.channels =
11672                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11673
11674                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11675                         connect.edmg.bw_config =
11676                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11677         }
11678
11679         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11680                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11681                 if (IS_ERR(connkeys))
11682                         return PTR_ERR(connkeys);
11683         }
11684
11685         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11686                 connect.flags |= ASSOC_REQ_DISABLE_HT;
11687
11688         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11689                 memcpy(&connect.ht_capa_mask,
11690                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11691                        sizeof(connect.ht_capa_mask));
11692
11693         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11694                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11695                         kfree_sensitive(connkeys);
11696                         return -EINVAL;
11697                 }
11698                 memcpy(&connect.ht_capa,
11699                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11700                        sizeof(connect.ht_capa));
11701         }
11702
11703         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11704                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11705
11706         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11707                 connect.flags |= ASSOC_REQ_DISABLE_HE;
11708
11709         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11710                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11711
11712         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11713                 memcpy(&connect.vht_capa_mask,
11714                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11715                        sizeof(connect.vht_capa_mask));
11716
11717         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11718                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11719                         kfree_sensitive(connkeys);
11720                         return -EINVAL;
11721                 }
11722                 memcpy(&connect.vht_capa,
11723                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11724                        sizeof(connect.vht_capa));
11725         }
11726
11727         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11728                 if (!((rdev->wiphy.features &
11729                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11730                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11731                     !wiphy_ext_feature_isset(&rdev->wiphy,
11732                                              NL80211_EXT_FEATURE_RRM)) {
11733                         kfree_sensitive(connkeys);
11734                         return -EINVAL;
11735                 }
11736                 connect.flags |= ASSOC_REQ_USE_RRM;
11737         }
11738
11739         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11740         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11741                 kfree_sensitive(connkeys);
11742                 return -EOPNOTSUPP;
11743         }
11744
11745         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11746                 /* bss selection makes no sense if bssid is set */
11747                 if (connect.bssid) {
11748                         kfree_sensitive(connkeys);
11749                         return -EINVAL;
11750                 }
11751
11752                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11753                                        wiphy, &connect.bss_select);
11754                 if (err) {
11755                         kfree_sensitive(connkeys);
11756                         return err;
11757                 }
11758         }
11759
11760         if (wiphy_ext_feature_isset(&rdev->wiphy,
11761                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11762             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11763             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11764             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11765             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11766                 connect.fils_erp_username =
11767                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11768                 connect.fils_erp_username_len =
11769                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11770                 connect.fils_erp_realm =
11771                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11772                 connect.fils_erp_realm_len =
11773                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11774                 connect.fils_erp_next_seq_num =
11775                         nla_get_u16(
11776                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11777                 connect.fils_erp_rrk =
11778                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11779                 connect.fils_erp_rrk_len =
11780                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11781         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11782                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11783                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11784                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11785                 kfree_sensitive(connkeys);
11786                 return -EINVAL;
11787         }
11788
11789         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
11790                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11791                         kfree_sensitive(connkeys);
11792                         GENL_SET_ERR_MSG(info,
11793                                          "external auth requires connection ownership");
11794                         return -EINVAL;
11795                 }
11796                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
11797         }
11798
11799         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
11800                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
11801
11802         wdev_lock(dev->ieee80211_ptr);
11803
11804         err = cfg80211_connect(rdev, dev, &connect, connkeys,
11805                                connect.prev_bssid);
11806         if (err)
11807                 kfree_sensitive(connkeys);
11808
11809         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11810                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11811                 if (connect.bssid)
11812                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11813                                connect.bssid, ETH_ALEN);
11814                 else
11815                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
11816         }
11817
11818         wdev_unlock(dev->ieee80211_ptr);
11819
11820         return err;
11821 }
11822
11823 static int nl80211_update_connect_params(struct sk_buff *skb,
11824                                          struct genl_info *info)
11825 {
11826         struct cfg80211_connect_params connect = {};
11827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11828         struct net_device *dev = info->user_ptr[1];
11829         struct wireless_dev *wdev = dev->ieee80211_ptr;
11830         bool fils_sk_offload;
11831         u32 auth_type;
11832         u32 changed = 0;
11833         int ret;
11834
11835         if (!rdev->ops->update_connect_params)
11836                 return -EOPNOTSUPP;
11837
11838         if (info->attrs[NL80211_ATTR_IE]) {
11839                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11840                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11841                 changed |= UPDATE_ASSOC_IES;
11842         }
11843
11844         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
11845                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
11846
11847         /*
11848          * when driver supports fils-sk offload all attributes must be
11849          * provided. So the else covers "fils-sk-not-all" and
11850          * "no-fils-sk-any".
11851          */
11852         if (fils_sk_offload &&
11853             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11854             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11855             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11856             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11857                 connect.fils_erp_username =
11858                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11859                 connect.fils_erp_username_len =
11860                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11861                 connect.fils_erp_realm =
11862                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11863                 connect.fils_erp_realm_len =
11864                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11865                 connect.fils_erp_next_seq_num =
11866                         nla_get_u16(
11867                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11868                 connect.fils_erp_rrk =
11869                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11870                 connect.fils_erp_rrk_len =
11871                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11872                 changed |= UPDATE_FILS_ERP_INFO;
11873         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11874                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11875                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11876                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11877                 return -EINVAL;
11878         }
11879
11880         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11881                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11882                 if (!nl80211_valid_auth_type(rdev, auth_type,
11883                                              NL80211_CMD_CONNECT))
11884                         return -EINVAL;
11885
11886                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
11887                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
11888                         return -EINVAL;
11889
11890                 connect.auth_type = auth_type;
11891                 changed |= UPDATE_AUTH_TYPE;
11892         }
11893
11894         wdev_lock(dev->ieee80211_ptr);
11895         if (!wdev->connected)
11896                 ret = -ENOLINK;
11897         else
11898                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11899         wdev_unlock(dev->ieee80211_ptr);
11900
11901         return ret;
11902 }
11903
11904 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11905 {
11906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11907         struct net_device *dev = info->user_ptr[1];
11908         u16 reason;
11909         int ret;
11910
11911         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11912             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11913                 return -EPERM;
11914
11915         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11916                 reason = WLAN_REASON_DEAUTH_LEAVING;
11917         else
11918                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11919
11920         if (reason == 0)
11921                 return -EINVAL;
11922
11923         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11924             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11925                 return -EOPNOTSUPP;
11926
11927         wdev_lock(dev->ieee80211_ptr);
11928         ret = cfg80211_disconnect(rdev, dev, reason, true);
11929         wdev_unlock(dev->ieee80211_ptr);
11930         return ret;
11931 }
11932
11933 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
11934 {
11935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11936         struct net *net;
11937         int err;
11938
11939         if (info->attrs[NL80211_ATTR_PID]) {
11940                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
11941
11942                 net = get_net_ns_by_pid(pid);
11943         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
11944                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
11945
11946                 net = get_net_ns_by_fd(fd);
11947         } else {
11948                 return -EINVAL;
11949         }
11950
11951         if (IS_ERR(net))
11952                 return PTR_ERR(net);
11953
11954         err = 0;
11955
11956         /* check if anything to do */
11957         if (!net_eq(wiphy_net(&rdev->wiphy), net))
11958                 err = cfg80211_switch_netns(rdev, net);
11959
11960         put_net(net);
11961         return err;
11962 }
11963
11964 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
11965 {
11966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11967         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
11968                         struct cfg80211_pmksa *pmksa) = NULL;
11969         struct net_device *dev = info->user_ptr[1];
11970         struct cfg80211_pmksa pmksa;
11971
11972         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
11973
11974         if (!info->attrs[NL80211_ATTR_PMKID])
11975                 return -EINVAL;
11976
11977         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11978
11979         if (info->attrs[NL80211_ATTR_MAC]) {
11980                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11981         } else if (info->attrs[NL80211_ATTR_SSID] &&
11982                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
11983                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
11984                     info->attrs[NL80211_ATTR_PMK])) {
11985                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11986                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11987                 pmksa.cache_id =
11988                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
11989         } else {
11990                 return -EINVAL;
11991         }
11992         if (info->attrs[NL80211_ATTR_PMK]) {
11993                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11994                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
11995         }
11996
11997         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
11998                 pmksa.pmk_lifetime =
11999                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12000
12001         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12002                 pmksa.pmk_reauth_threshold =
12003                         nla_get_u8(
12004                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12005
12006         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12007             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12008             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12009               wiphy_ext_feature_isset(&rdev->wiphy,
12010                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12011                 return -EOPNOTSUPP;
12012
12013         switch (info->genlhdr->cmd) {
12014         case NL80211_CMD_SET_PMKSA:
12015                 rdev_ops = rdev->ops->set_pmksa;
12016                 break;
12017         case NL80211_CMD_DEL_PMKSA:
12018                 rdev_ops = rdev->ops->del_pmksa;
12019                 break;
12020         default:
12021                 WARN_ON(1);
12022                 break;
12023         }
12024
12025         if (!rdev_ops)
12026                 return -EOPNOTSUPP;
12027
12028         return rdev_ops(&rdev->wiphy, dev, &pmksa);
12029 }
12030
12031 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12032 {
12033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12034         struct net_device *dev = info->user_ptr[1];
12035
12036         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12037             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12038                 return -EOPNOTSUPP;
12039
12040         if (!rdev->ops->flush_pmksa)
12041                 return -EOPNOTSUPP;
12042
12043         return rdev_flush_pmksa(rdev, dev);
12044 }
12045
12046 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12047 {
12048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12049         struct net_device *dev = info->user_ptr[1];
12050         u8 action_code, dialog_token;
12051         u32 peer_capability = 0;
12052         u16 status_code;
12053         u8 *peer;
12054         bool initiator;
12055
12056         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12057             !rdev->ops->tdls_mgmt)
12058                 return -EOPNOTSUPP;
12059
12060         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12061             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12062             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12063             !info->attrs[NL80211_ATTR_IE] ||
12064             !info->attrs[NL80211_ATTR_MAC])
12065                 return -EINVAL;
12066
12067         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12068         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12069         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12070         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12071         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12072         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12073                 peer_capability =
12074                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12075
12076         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
12077                               dialog_token, status_code, peer_capability,
12078                               initiator,
12079                               nla_data(info->attrs[NL80211_ATTR_IE]),
12080                               nla_len(info->attrs[NL80211_ATTR_IE]));
12081 }
12082
12083 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12084 {
12085         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12086         struct net_device *dev = info->user_ptr[1];
12087         enum nl80211_tdls_operation operation;
12088         u8 *peer;
12089
12090         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12091             !rdev->ops->tdls_oper)
12092                 return -EOPNOTSUPP;
12093
12094         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12095             !info->attrs[NL80211_ATTR_MAC])
12096                 return -EINVAL;
12097
12098         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12099         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12100
12101         return rdev_tdls_oper(rdev, dev, peer, operation);
12102 }
12103
12104 static int nl80211_remain_on_channel(struct sk_buff *skb,
12105                                      struct genl_info *info)
12106 {
12107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12108         unsigned int link_id = nl80211_link_id(info->attrs);
12109         struct wireless_dev *wdev = info->user_ptr[1];
12110         struct cfg80211_chan_def chandef;
12111         struct sk_buff *msg;
12112         void *hdr;
12113         u64 cookie;
12114         u32 duration;
12115         int err;
12116
12117         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12118             !info->attrs[NL80211_ATTR_DURATION])
12119                 return -EINVAL;
12120
12121         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12122
12123         if (!rdev->ops->remain_on_channel ||
12124             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12125                 return -EOPNOTSUPP;
12126
12127         /*
12128          * We should be on that channel for at least a minimum amount of
12129          * time (10ms) but no longer than the driver supports.
12130          */
12131         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12132             duration > rdev->wiphy.max_remain_on_channel_duration)
12133                 return -EINVAL;
12134
12135         err = nl80211_parse_chandef(rdev, info, &chandef);
12136         if (err)
12137                 return err;
12138
12139         wdev_lock(wdev);
12140         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12141                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12142
12143                 oper_chandef = wdev_chandef(wdev, link_id);
12144
12145                 if (WARN_ON(!oper_chandef)) {
12146                         /* cannot happen since we must beacon to get here */
12147                         WARN_ON(1);
12148                         wdev_unlock(wdev);
12149                         return -EBUSY;
12150                 }
12151
12152                 /* note: returns first one if identical chandefs */
12153                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12154                                                              oper_chandef);
12155
12156                 if (compat_chandef != &chandef) {
12157                         wdev_unlock(wdev);
12158                         return -EBUSY;
12159                 }
12160         }
12161         wdev_unlock(wdev);
12162
12163         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12164         if (!msg)
12165                 return -ENOMEM;
12166
12167         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12168                              NL80211_CMD_REMAIN_ON_CHANNEL);
12169         if (!hdr) {
12170                 err = -ENOBUFS;
12171                 goto free_msg;
12172         }
12173
12174         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12175                                      duration, &cookie);
12176
12177         if (err)
12178                 goto free_msg;
12179
12180         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12181                               NL80211_ATTR_PAD))
12182                 goto nla_put_failure;
12183
12184         genlmsg_end(msg, hdr);
12185
12186         return genlmsg_reply(msg, info);
12187
12188  nla_put_failure:
12189         err = -ENOBUFS;
12190  free_msg:
12191         nlmsg_free(msg);
12192         return err;
12193 }
12194
12195 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12196                                             struct genl_info *info)
12197 {
12198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12199         struct wireless_dev *wdev = info->user_ptr[1];
12200         u64 cookie;
12201
12202         if (!info->attrs[NL80211_ATTR_COOKIE])
12203                 return -EINVAL;
12204
12205         if (!rdev->ops->cancel_remain_on_channel)
12206                 return -EOPNOTSUPP;
12207
12208         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12209
12210         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12211 }
12212
12213 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12214                                        struct genl_info *info)
12215 {
12216         struct cfg80211_bitrate_mask mask;
12217         unsigned int link_id = nl80211_link_id(info->attrs);
12218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12219         struct net_device *dev = info->user_ptr[1];
12220         struct wireless_dev *wdev = dev->ieee80211_ptr;
12221         int err;
12222
12223         if (!rdev->ops->set_bitrate_mask)
12224                 return -EOPNOTSUPP;
12225
12226         wdev_lock(wdev);
12227         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12228                                             NL80211_ATTR_TX_RATES, &mask,
12229                                             dev, true, link_id);
12230         if (err)
12231                 goto out;
12232
12233         err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12234 out:
12235         wdev_unlock(wdev);
12236         return err;
12237 }
12238
12239 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12240 {
12241         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12242         struct wireless_dev *wdev = info->user_ptr[1];
12243         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12244
12245         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12246                 return -EINVAL;
12247
12248         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12249                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12250
12251         switch (wdev->iftype) {
12252         case NL80211_IFTYPE_STATION:
12253         case NL80211_IFTYPE_ADHOC:
12254         case NL80211_IFTYPE_P2P_CLIENT:
12255         case NL80211_IFTYPE_AP:
12256         case NL80211_IFTYPE_AP_VLAN:
12257         case NL80211_IFTYPE_MESH_POINT:
12258         case NL80211_IFTYPE_P2P_GO:
12259         case NL80211_IFTYPE_P2P_DEVICE:
12260                 break;
12261         case NL80211_IFTYPE_NAN:
12262         default:
12263                 return -EOPNOTSUPP;
12264         }
12265
12266         /* not much point in registering if we can't reply */
12267         if (!rdev->ops->mgmt_tx)
12268                 return -EOPNOTSUPP;
12269
12270         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12271             !wiphy_ext_feature_isset(&rdev->wiphy,
12272                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12273                 GENL_SET_ERR_MSG(info,
12274                                  "multicast RX registrations are not supported");
12275                 return -EOPNOTSUPP;
12276         }
12277
12278         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12279                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12280                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12281                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12282                                            info->extack);
12283 }
12284
12285 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12286 {
12287         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12288         struct wireless_dev *wdev = info->user_ptr[1];
12289         struct cfg80211_chan_def chandef;
12290         int err;
12291         void *hdr = NULL;
12292         u64 cookie;
12293         struct sk_buff *msg = NULL;
12294         struct cfg80211_mgmt_tx_params params = {
12295                 .dont_wait_for_ack =
12296                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12297         };
12298
12299         if (!info->attrs[NL80211_ATTR_FRAME])
12300                 return -EINVAL;
12301
12302         if (!rdev->ops->mgmt_tx)
12303                 return -EOPNOTSUPP;
12304
12305         switch (wdev->iftype) {
12306         case NL80211_IFTYPE_P2P_DEVICE:
12307                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12308                         return -EINVAL;
12309                 break;
12310         case NL80211_IFTYPE_STATION:
12311         case NL80211_IFTYPE_ADHOC:
12312         case NL80211_IFTYPE_P2P_CLIENT:
12313         case NL80211_IFTYPE_AP:
12314         case NL80211_IFTYPE_AP_VLAN:
12315         case NL80211_IFTYPE_MESH_POINT:
12316         case NL80211_IFTYPE_P2P_GO:
12317                 break;
12318         case NL80211_IFTYPE_NAN:
12319         default:
12320                 return -EOPNOTSUPP;
12321         }
12322
12323         if (info->attrs[NL80211_ATTR_DURATION]) {
12324                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12325                         return -EINVAL;
12326                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12327
12328                 /*
12329                  * We should wait on the channel for at least a minimum amount
12330                  * of time (10ms) but no longer than the driver supports.
12331                  */
12332                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12333                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12334                         return -EINVAL;
12335         }
12336
12337         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12338
12339         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12340                 return -EINVAL;
12341
12342         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12343
12344         /* get the channel if any has been specified, otherwise pass NULL to
12345          * the driver. The latter will use the current one
12346          */
12347         chandef.chan = NULL;
12348         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12349                 err = nl80211_parse_chandef(rdev, info, &chandef);
12350                 if (err)
12351                         return err;
12352         }
12353
12354         if (!chandef.chan && params.offchan)
12355                 return -EINVAL;
12356
12357         wdev_lock(wdev);
12358         if (params.offchan &&
12359             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12360                 wdev_unlock(wdev);
12361                 return -EBUSY;
12362         }
12363
12364         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12365         /*
12366          * This now races due to the unlock, but we cannot check
12367          * the valid links for the _station_ anyway, so that's up
12368          * to the driver.
12369          */
12370         if (params.link_id >= 0 &&
12371             !(wdev->valid_links & BIT(params.link_id))) {
12372                 wdev_unlock(wdev);
12373                 return -EINVAL;
12374         }
12375         wdev_unlock(wdev);
12376
12377         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12378         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12379
12380         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12381                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12382                 int i;
12383
12384                 if (len % sizeof(u16))
12385                         return -EINVAL;
12386
12387                 params.n_csa_offsets = len / sizeof(u16);
12388                 params.csa_offsets =
12389                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12390
12391                 /* check that all the offsets fit the frame */
12392                 for (i = 0; i < params.n_csa_offsets; i++) {
12393                         if (params.csa_offsets[i] >= params.len)
12394                                 return -EINVAL;
12395                 }
12396         }
12397
12398         if (!params.dont_wait_for_ack) {
12399                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12400                 if (!msg)
12401                         return -ENOMEM;
12402
12403                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12404                                      NL80211_CMD_FRAME);
12405                 if (!hdr) {
12406                         err = -ENOBUFS;
12407                         goto free_msg;
12408                 }
12409         }
12410
12411         params.chan = chandef.chan;
12412         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12413         if (err)
12414                 goto free_msg;
12415
12416         if (msg) {
12417                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12418                                       NL80211_ATTR_PAD))
12419                         goto nla_put_failure;
12420
12421                 genlmsg_end(msg, hdr);
12422                 return genlmsg_reply(msg, info);
12423         }
12424
12425         return 0;
12426
12427  nla_put_failure:
12428         err = -ENOBUFS;
12429  free_msg:
12430         nlmsg_free(msg);
12431         return err;
12432 }
12433
12434 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12435 {
12436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12437         struct wireless_dev *wdev = info->user_ptr[1];
12438         u64 cookie;
12439
12440         if (!info->attrs[NL80211_ATTR_COOKIE])
12441                 return -EINVAL;
12442
12443         if (!rdev->ops->mgmt_tx_cancel_wait)
12444                 return -EOPNOTSUPP;
12445
12446         switch (wdev->iftype) {
12447         case NL80211_IFTYPE_STATION:
12448         case NL80211_IFTYPE_ADHOC:
12449         case NL80211_IFTYPE_P2P_CLIENT:
12450         case NL80211_IFTYPE_AP:
12451         case NL80211_IFTYPE_AP_VLAN:
12452         case NL80211_IFTYPE_P2P_GO:
12453         case NL80211_IFTYPE_P2P_DEVICE:
12454                 break;
12455         case NL80211_IFTYPE_NAN:
12456         default:
12457                 return -EOPNOTSUPP;
12458         }
12459
12460         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12461
12462         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12463 }
12464
12465 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12466 {
12467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12468         struct wireless_dev *wdev;
12469         struct net_device *dev = info->user_ptr[1];
12470         u8 ps_state;
12471         bool state;
12472         int err;
12473
12474         if (!info->attrs[NL80211_ATTR_PS_STATE])
12475                 return -EINVAL;
12476
12477         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12478
12479         wdev = dev->ieee80211_ptr;
12480
12481         if (!rdev->ops->set_power_mgmt)
12482                 return -EOPNOTSUPP;
12483
12484         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12485
12486         if (state == wdev->ps)
12487                 return 0;
12488
12489         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12490         if (!err)
12491                 wdev->ps = state;
12492         return err;
12493 }
12494
12495 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12496 {
12497         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12498         enum nl80211_ps_state ps_state;
12499         struct wireless_dev *wdev;
12500         struct net_device *dev = info->user_ptr[1];
12501         struct sk_buff *msg;
12502         void *hdr;
12503         int err;
12504
12505         wdev = dev->ieee80211_ptr;
12506
12507         if (!rdev->ops->set_power_mgmt)
12508                 return -EOPNOTSUPP;
12509
12510         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12511         if (!msg)
12512                 return -ENOMEM;
12513
12514         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12515                              NL80211_CMD_GET_POWER_SAVE);
12516         if (!hdr) {
12517                 err = -ENOBUFS;
12518                 goto free_msg;
12519         }
12520
12521         if (wdev->ps)
12522                 ps_state = NL80211_PS_ENABLED;
12523         else
12524                 ps_state = NL80211_PS_DISABLED;
12525
12526         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12527                 goto nla_put_failure;
12528
12529         genlmsg_end(msg, hdr);
12530         return genlmsg_reply(msg, info);
12531
12532  nla_put_failure:
12533         err = -ENOBUFS;
12534  free_msg:
12535         nlmsg_free(msg);
12536         return err;
12537 }
12538
12539 static const struct nla_policy
12540 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12541         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12542         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12543         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12544         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12545         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12546         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12547         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12548 };
12549
12550 static int nl80211_set_cqm_txe(struct genl_info *info,
12551                                u32 rate, u32 pkts, u32 intvl)
12552 {
12553         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12554         struct net_device *dev = info->user_ptr[1];
12555         struct wireless_dev *wdev = dev->ieee80211_ptr;
12556
12557         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12558                 return -EINVAL;
12559
12560         if (!rdev->ops->set_cqm_txe_config)
12561                 return -EOPNOTSUPP;
12562
12563         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12564             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12565                 return -EOPNOTSUPP;
12566
12567         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12568 }
12569
12570 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12571                                     struct net_device *dev,
12572                                     struct cfg80211_cqm_config *cqm_config)
12573 {
12574         struct wireless_dev *wdev = dev->ieee80211_ptr;
12575         s32 last, low, high;
12576         u32 hyst;
12577         int i, n, low_index;
12578         int err;
12579
12580         /*
12581          * Obtain current RSSI value if possible, if not and no RSSI threshold
12582          * event has been received yet, we should receive an event after a
12583          * connection is established and enough beacons received to calculate
12584          * the average.
12585          */
12586         if (!cqm_config->last_rssi_event_value &&
12587             wdev->links[0].client.current_bss &&
12588             rdev->ops->get_station) {
12589                 struct station_info sinfo = {};
12590                 u8 *mac_addr;
12591
12592                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12593
12594                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12595                 if (err)
12596                         return err;
12597
12598                 cfg80211_sinfo_release_content(&sinfo);
12599                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12600                         cqm_config->last_rssi_event_value =
12601                                 (s8) sinfo.rx_beacon_signal_avg;
12602         }
12603
12604         last = cqm_config->last_rssi_event_value;
12605         hyst = cqm_config->rssi_hyst;
12606         n = cqm_config->n_rssi_thresholds;
12607
12608         for (i = 0; i < n; i++) {
12609                 i = array_index_nospec(i, n);
12610                 if (last < cqm_config->rssi_thresholds[i])
12611                         break;
12612         }
12613
12614         low_index = i - 1;
12615         if (low_index >= 0) {
12616                 low_index = array_index_nospec(low_index, n);
12617                 low = cqm_config->rssi_thresholds[low_index] - hyst;
12618         } else {
12619                 low = S32_MIN;
12620         }
12621         if (i < n) {
12622                 i = array_index_nospec(i, n);
12623                 high = cqm_config->rssi_thresholds[i] + hyst - 1;
12624         } else {
12625                 high = S32_MAX;
12626         }
12627
12628         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12629 }
12630
12631 static int nl80211_set_cqm_rssi(struct genl_info *info,
12632                                 const s32 *thresholds, int n_thresholds,
12633                                 u32 hysteresis)
12634 {
12635         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12636         struct cfg80211_cqm_config *cqm_config = NULL, *old;
12637         struct net_device *dev = info->user_ptr[1];
12638         struct wireless_dev *wdev = dev->ieee80211_ptr;
12639         int i, err;
12640         s32 prev = S32_MIN;
12641
12642         /* Check all values negative and sorted */
12643         for (i = 0; i < n_thresholds; i++) {
12644                 if (thresholds[i] > 0 || thresholds[i] <= prev)
12645                         return -EINVAL;
12646
12647                 prev = thresholds[i];
12648         }
12649
12650         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12651             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12652                 return -EOPNOTSUPP;
12653
12654         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12655                 n_thresholds = 0;
12656
12657         wdev_lock(wdev);
12658         old = rcu_dereference_protected(wdev->cqm_config,
12659                                         lockdep_is_held(&wdev->mtx));
12660
12661         /* if already disabled just succeed */
12662         if (!n_thresholds && !old) {
12663                 err = 0;
12664                 goto unlock;
12665         }
12666
12667         if (n_thresholds > 1) {
12668                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
12669                                              NL80211_EXT_FEATURE_CQM_RSSI_LIST) ||
12670                     !rdev->ops->set_cqm_rssi_range_config) {
12671                         err = -EOPNOTSUPP;
12672                         goto unlock;
12673                 }
12674         } else {
12675                 if (!rdev->ops->set_cqm_rssi_config) {
12676                         err = -EOPNOTSUPP;
12677                         goto unlock;
12678                 }
12679         }
12680
12681         if (n_thresholds) {
12682                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12683                                                  n_thresholds),
12684                                      GFP_KERNEL);
12685                 if (!cqm_config) {
12686                         err = -ENOMEM;
12687                         goto unlock;
12688                 }
12689
12690                 cqm_config->rssi_hyst = hysteresis;
12691                 cqm_config->n_rssi_thresholds = n_thresholds;
12692                 memcpy(cqm_config->rssi_thresholds, thresholds,
12693                        flex_array_size(cqm_config, rssi_thresholds,
12694                                        n_thresholds));
12695                 cqm_config->use_range_api = n_thresholds > 1 ||
12696                                             !rdev->ops->set_cqm_rssi_config;
12697
12698                 rcu_assign_pointer(wdev->cqm_config, cqm_config);
12699
12700                 if (cqm_config->use_range_api)
12701                         err = cfg80211_cqm_rssi_update(rdev, dev, cqm_config);
12702                 else
12703                         err = rdev_set_cqm_rssi_config(rdev, dev,
12704                                                        thresholds[0],
12705                                                        hysteresis);
12706         } else {
12707                 RCU_INIT_POINTER(wdev->cqm_config, NULL);
12708                 /* if enabled as range also disable via range */
12709                 if (old->use_range_api)
12710                         err = rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12711                 else
12712                         err = rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12713         }
12714
12715         if (err) {
12716                 rcu_assign_pointer(wdev->cqm_config, old);
12717                 kfree_rcu(cqm_config, rcu_head);
12718         } else {
12719                 kfree_rcu(old, rcu_head);
12720         }
12721 unlock:
12722         wdev_unlock(wdev);
12723
12724         return err;
12725 }
12726
12727 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12728 {
12729         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12730         struct nlattr *cqm;
12731         int err;
12732
12733         cqm = info->attrs[NL80211_ATTR_CQM];
12734         if (!cqm)
12735                 return -EINVAL;
12736
12737         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12738                                           nl80211_attr_cqm_policy,
12739                                           info->extack);
12740         if (err)
12741                 return err;
12742
12743         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12744             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12745                 const s32 *thresholds =
12746                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12747                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12748                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12749
12750                 if (len % 4)
12751                         return -EINVAL;
12752
12753                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12754                                             hysteresis);
12755         }
12756
12757         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12758             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12759             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12760                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12761                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12762                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12763
12764                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12765         }
12766
12767         return -EINVAL;
12768 }
12769
12770 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12771 {
12772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12773         struct net_device *dev = info->user_ptr[1];
12774         struct ocb_setup setup = {};
12775         int err;
12776
12777         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12778         if (err)
12779                 return err;
12780
12781         return cfg80211_join_ocb(rdev, dev, &setup);
12782 }
12783
12784 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12785 {
12786         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12787         struct net_device *dev = info->user_ptr[1];
12788
12789         return cfg80211_leave_ocb(rdev, dev);
12790 }
12791
12792 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12793 {
12794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12795         struct net_device *dev = info->user_ptr[1];
12796         struct mesh_config cfg;
12797         struct mesh_setup setup;
12798         int err;
12799
12800         /* start with default */
12801         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
12802         memcpy(&setup, &default_mesh_setup, sizeof(setup));
12803
12804         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
12805                 /* and parse parameters if given */
12806                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
12807                 if (err)
12808                         return err;
12809         }
12810
12811         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
12812             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
12813                 return -EINVAL;
12814
12815         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
12816         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
12817
12818         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12819             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
12820                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12821                         return -EINVAL;
12822
12823         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
12824                 setup.beacon_interval =
12825                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12826
12827                 err = cfg80211_validate_beacon_int(rdev,
12828                                                    NL80211_IFTYPE_MESH_POINT,
12829                                                    setup.beacon_interval);
12830                 if (err)
12831                         return err;
12832         }
12833
12834         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
12835                 setup.dtim_period =
12836                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
12837                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
12838                         return -EINVAL;
12839         }
12840
12841         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
12842                 /* parse additional setup parameters if given */
12843                 err = nl80211_parse_mesh_setup(info, &setup);
12844                 if (err)
12845                         return err;
12846         }
12847
12848         if (setup.user_mpm)
12849                 cfg.auto_open_plinks = false;
12850
12851         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12852                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12853                 if (err)
12854                         return err;
12855         } else {
12856                 /* __cfg80211_join_mesh() will sort it out */
12857                 setup.chandef.chan = NULL;
12858         }
12859
12860         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
12861                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12862                 int n_rates =
12863                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
12864                 struct ieee80211_supported_band *sband;
12865
12866                 if (!setup.chandef.chan)
12867                         return -EINVAL;
12868
12869                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
12870
12871                 err = ieee80211_get_ratemask(sband, rates, n_rates,
12872                                              &setup.basic_rates);
12873                 if (err)
12874                         return err;
12875         }
12876
12877         if (info->attrs[NL80211_ATTR_TX_RATES]) {
12878                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12879                                                     NL80211_ATTR_TX_RATES,
12880                                                     &setup.beacon_rate,
12881                                                     dev, false, 0);
12882                 if (err)
12883                         return err;
12884
12885                 if (!setup.chandef.chan)
12886                         return -EINVAL;
12887
12888                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
12889                                               &setup.beacon_rate);
12890                 if (err)
12891                         return err;
12892         }
12893
12894         setup.userspace_handles_dfs =
12895                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
12896
12897         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
12898                 int r = validate_pae_over_nl80211(rdev, info);
12899
12900                 if (r < 0)
12901                         return r;
12902
12903                 setup.control_port_over_nl80211 = true;
12904         }
12905
12906         wdev_lock(dev->ieee80211_ptr);
12907         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
12908         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
12909                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12910         wdev_unlock(dev->ieee80211_ptr);
12911
12912         return err;
12913 }
12914
12915 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
12916 {
12917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12918         struct net_device *dev = info->user_ptr[1];
12919
12920         return cfg80211_leave_mesh(rdev, dev);
12921 }
12922
12923 #ifdef CONFIG_PM
12924 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
12925                                         struct cfg80211_registered_device *rdev)
12926 {
12927         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
12928         struct nlattr *nl_pats, *nl_pat;
12929         int i, pat_len;
12930
12931         if (!wowlan->n_patterns)
12932                 return 0;
12933
12934         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
12935         if (!nl_pats)
12936                 return -ENOBUFS;
12937
12938         for (i = 0; i < wowlan->n_patterns; i++) {
12939                 nl_pat = nla_nest_start_noflag(msg, i + 1);
12940                 if (!nl_pat)
12941                         return -ENOBUFS;
12942                 pat_len = wowlan->patterns[i].pattern_len;
12943                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
12944                             wowlan->patterns[i].mask) ||
12945                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12946                             wowlan->patterns[i].pattern) ||
12947                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12948                                 wowlan->patterns[i].pkt_offset))
12949                         return -ENOBUFS;
12950                 nla_nest_end(msg, nl_pat);
12951         }
12952         nla_nest_end(msg, nl_pats);
12953
12954         return 0;
12955 }
12956
12957 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
12958                                    struct cfg80211_wowlan_tcp *tcp)
12959 {
12960         struct nlattr *nl_tcp;
12961
12962         if (!tcp)
12963                 return 0;
12964
12965         nl_tcp = nla_nest_start_noflag(msg,
12966                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
12967         if (!nl_tcp)
12968                 return -ENOBUFS;
12969
12970         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
12971             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
12972             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
12973             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
12974             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
12975             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
12976                     tcp->payload_len, tcp->payload) ||
12977             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
12978                         tcp->data_interval) ||
12979             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
12980                     tcp->wake_len, tcp->wake_data) ||
12981             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
12982                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
12983                 return -ENOBUFS;
12984
12985         if (tcp->payload_seq.len &&
12986             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
12987                     sizeof(tcp->payload_seq), &tcp->payload_seq))
12988                 return -ENOBUFS;
12989
12990         if (tcp->payload_tok.len &&
12991             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
12992                     sizeof(tcp->payload_tok) + tcp->tokens_size,
12993                     &tcp->payload_tok))
12994                 return -ENOBUFS;
12995
12996         nla_nest_end(msg, nl_tcp);
12997
12998         return 0;
12999 }
13000
13001 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13002                                   struct cfg80211_sched_scan_request *req)
13003 {
13004         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13005         int i;
13006
13007         if (!req)
13008                 return 0;
13009
13010         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13011         if (!nd)
13012                 return -ENOBUFS;
13013
13014         if (req->n_scan_plans == 1 &&
13015             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13016                         req->scan_plans[0].interval * 1000))
13017                 return -ENOBUFS;
13018
13019         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13020                 return -ENOBUFS;
13021
13022         if (req->relative_rssi_set) {
13023                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13024
13025                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13026                                req->relative_rssi))
13027                         return -ENOBUFS;
13028
13029                 rssi_adjust.band = req->rssi_adjust.band;
13030                 rssi_adjust.delta = req->rssi_adjust.delta;
13031                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13032                             sizeof(rssi_adjust), &rssi_adjust))
13033                         return -ENOBUFS;
13034         }
13035
13036         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13037         if (!freqs)
13038                 return -ENOBUFS;
13039
13040         for (i = 0; i < req->n_channels; i++) {
13041                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13042                         return -ENOBUFS;
13043         }
13044
13045         nla_nest_end(msg, freqs);
13046
13047         if (req->n_match_sets) {
13048                 matches = nla_nest_start_noflag(msg,
13049                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13050                 if (!matches)
13051                         return -ENOBUFS;
13052
13053                 for (i = 0; i < req->n_match_sets; i++) {
13054                         match = nla_nest_start_noflag(msg, i);
13055                         if (!match)
13056                                 return -ENOBUFS;
13057
13058                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13059                                     req->match_sets[i].ssid.ssid_len,
13060                                     req->match_sets[i].ssid.ssid))
13061                                 return -ENOBUFS;
13062                         nla_nest_end(msg, match);
13063                 }
13064                 nla_nest_end(msg, matches);
13065         }
13066
13067         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13068         if (!scan_plans)
13069                 return -ENOBUFS;
13070
13071         for (i = 0; i < req->n_scan_plans; i++) {
13072                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13073                 if (!scan_plan)
13074                         return -ENOBUFS;
13075
13076                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13077                                 req->scan_plans[i].interval) ||
13078                     (req->scan_plans[i].iterations &&
13079                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13080                                  req->scan_plans[i].iterations)))
13081                         return -ENOBUFS;
13082                 nla_nest_end(msg, scan_plan);
13083         }
13084         nla_nest_end(msg, scan_plans);
13085
13086         nla_nest_end(msg, nd);
13087
13088         return 0;
13089 }
13090
13091 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13092 {
13093         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13094         struct sk_buff *msg;
13095         void *hdr;
13096         u32 size = NLMSG_DEFAULT_SIZE;
13097
13098         if (!rdev->wiphy.wowlan)
13099                 return -EOPNOTSUPP;
13100
13101         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13102                 /* adjust size to have room for all the data */
13103                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13104                         rdev->wiphy.wowlan_config->tcp->payload_len +
13105                         rdev->wiphy.wowlan_config->tcp->wake_len +
13106                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13107         }
13108
13109         msg = nlmsg_new(size, GFP_KERNEL);
13110         if (!msg)
13111                 return -ENOMEM;
13112
13113         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13114                              NL80211_CMD_GET_WOWLAN);
13115         if (!hdr)
13116                 goto nla_put_failure;
13117
13118         if (rdev->wiphy.wowlan_config) {
13119                 struct nlattr *nl_wowlan;
13120
13121                 nl_wowlan = nla_nest_start_noflag(msg,
13122                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13123                 if (!nl_wowlan)
13124                         goto nla_put_failure;
13125
13126                 if ((rdev->wiphy.wowlan_config->any &&
13127                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13128                     (rdev->wiphy.wowlan_config->disconnect &&
13129                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13130                     (rdev->wiphy.wowlan_config->magic_pkt &&
13131                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13132                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13133                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13134                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13135                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13136                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13137                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13138                     (rdev->wiphy.wowlan_config->rfkill_release &&
13139                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13140                         goto nla_put_failure;
13141
13142                 if (nl80211_send_wowlan_patterns(msg, rdev))
13143                         goto nla_put_failure;
13144
13145                 if (nl80211_send_wowlan_tcp(msg,
13146                                             rdev->wiphy.wowlan_config->tcp))
13147                         goto nla_put_failure;
13148
13149                 if (nl80211_send_wowlan_nd(
13150                             msg,
13151                             rdev->wiphy.wowlan_config->nd_config))
13152                         goto nla_put_failure;
13153
13154                 nla_nest_end(msg, nl_wowlan);
13155         }
13156
13157         genlmsg_end(msg, hdr);
13158         return genlmsg_reply(msg, info);
13159
13160 nla_put_failure:
13161         nlmsg_free(msg);
13162         return -ENOBUFS;
13163 }
13164
13165 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13166                                     struct nlattr *attr,
13167                                     struct cfg80211_wowlan *trig)
13168 {
13169         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13170         struct cfg80211_wowlan_tcp *cfg;
13171         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13172         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13173         u32 size;
13174         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13175         int err, port;
13176
13177         if (!rdev->wiphy.wowlan->tcp)
13178                 return -EINVAL;
13179
13180         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13181                                           nl80211_wowlan_tcp_policy, NULL);
13182         if (err)
13183                 return err;
13184
13185         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13186             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13187             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13188             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13189             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13190             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13191             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13192             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13193                 return -EINVAL;
13194
13195         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13196         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13197                 return -EINVAL;
13198
13199         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13200                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13201             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13202                 return -EINVAL;
13203
13204         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13205         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13206                 return -EINVAL;
13207
13208         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13209         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13210                 return -EINVAL;
13211
13212         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13213                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13214
13215                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13216                 tokens_size = tokln - sizeof(*tok);
13217
13218                 if (!tok->len || tokens_size % tok->len)
13219                         return -EINVAL;
13220                 if (!rdev->wiphy.wowlan->tcp->tok)
13221                         return -EINVAL;
13222                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13223                         return -EINVAL;
13224                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13225                         return -EINVAL;
13226                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13227                         return -EINVAL;
13228                 if (tok->offset + tok->len > data_size)
13229                         return -EINVAL;
13230         }
13231
13232         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13233                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13234                 if (!rdev->wiphy.wowlan->tcp->seq)
13235                         return -EINVAL;
13236                 if (seq->len == 0 || seq->len > 4)
13237                         return -EINVAL;
13238                 if (seq->len + seq->offset > data_size)
13239                         return -EINVAL;
13240         }
13241
13242         size = sizeof(*cfg);
13243         size += data_size;
13244         size += wake_size + wake_mask_size;
13245         size += tokens_size;
13246
13247         cfg = kzalloc(size, GFP_KERNEL);
13248         if (!cfg)
13249                 return -ENOMEM;
13250         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13251         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13252         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13253                ETH_ALEN);
13254         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13255                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13256         else
13257                 port = 0;
13258 #ifdef CONFIG_INET
13259         /* allocate a socket and port for it and use it */
13260         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13261                             IPPROTO_TCP, &cfg->sock, 1);
13262         if (err) {
13263                 kfree(cfg);
13264                 return err;
13265         }
13266         if (inet_csk_get_port(cfg->sock->sk, port)) {
13267                 sock_release(cfg->sock);
13268                 kfree(cfg);
13269                 return -EADDRINUSE;
13270         }
13271         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13272 #else
13273         if (!port) {
13274                 kfree(cfg);
13275                 return -EINVAL;
13276         }
13277         cfg->src_port = port;
13278 #endif
13279
13280         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13281         cfg->payload_len = data_size;
13282         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13283         memcpy((void *)cfg->payload,
13284                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13285                data_size);
13286         if (seq)
13287                 cfg->payload_seq = *seq;
13288         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13289         cfg->wake_len = wake_size;
13290         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13291         memcpy((void *)cfg->wake_data,
13292                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13293                wake_size);
13294         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13295                          data_size + wake_size;
13296         memcpy((void *)cfg->wake_mask,
13297                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13298                wake_mask_size);
13299         if (tok) {
13300                 cfg->tokens_size = tokens_size;
13301                 cfg->payload_tok = *tok;
13302                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13303                        tokens_size);
13304         }
13305
13306         trig->tcp = cfg;
13307
13308         return 0;
13309 }
13310
13311 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13312                                    const struct wiphy_wowlan_support *wowlan,
13313                                    struct nlattr *attr,
13314                                    struct cfg80211_wowlan *trig)
13315 {
13316         struct nlattr **tb;
13317         int err;
13318
13319         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13320         if (!tb)
13321                 return -ENOMEM;
13322
13323         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13324                 err = -EOPNOTSUPP;
13325                 goto out;
13326         }
13327
13328         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13329                                           nl80211_policy, NULL);
13330         if (err)
13331                 goto out;
13332
13333         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13334                                                    wowlan->max_nd_match_sets);
13335         err = PTR_ERR_OR_ZERO(trig->nd_config);
13336         if (err)
13337                 trig->nd_config = NULL;
13338
13339 out:
13340         kfree(tb);
13341         return err;
13342 }
13343
13344 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13345 {
13346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13347         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13348         struct cfg80211_wowlan new_triggers = {};
13349         struct cfg80211_wowlan *ntrig;
13350         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13351         int err, i;
13352         bool prev_enabled = rdev->wiphy.wowlan_config;
13353         bool regular = false;
13354
13355         if (!wowlan)
13356                 return -EOPNOTSUPP;
13357
13358         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13359                 cfg80211_rdev_free_wowlan(rdev);
13360                 rdev->wiphy.wowlan_config = NULL;
13361                 goto set_wakeup;
13362         }
13363
13364         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13365                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13366                                           nl80211_wowlan_policy, info->extack);
13367         if (err)
13368                 return err;
13369
13370         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13371                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13372                         return -EINVAL;
13373                 new_triggers.any = true;
13374         }
13375
13376         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13377                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13378                         return -EINVAL;
13379                 new_triggers.disconnect = true;
13380                 regular = true;
13381         }
13382
13383         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13384                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13385                         return -EINVAL;
13386                 new_triggers.magic_pkt = true;
13387                 regular = true;
13388         }
13389
13390         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13391                 return -EINVAL;
13392
13393         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13394                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13395                         return -EINVAL;
13396                 new_triggers.gtk_rekey_failure = true;
13397                 regular = true;
13398         }
13399
13400         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13401                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13402                         return -EINVAL;
13403                 new_triggers.eap_identity_req = true;
13404                 regular = true;
13405         }
13406
13407         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13408                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13409                         return -EINVAL;
13410                 new_triggers.four_way_handshake = true;
13411                 regular = true;
13412         }
13413
13414         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13415                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13416                         return -EINVAL;
13417                 new_triggers.rfkill_release = true;
13418                 regular = true;
13419         }
13420
13421         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13422                 struct nlattr *pat;
13423                 int n_patterns = 0;
13424                 int rem, pat_len, mask_len, pkt_offset;
13425                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13426
13427                 regular = true;
13428
13429                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13430                                     rem)
13431                         n_patterns++;
13432                 if (n_patterns > wowlan->n_patterns)
13433                         return -EINVAL;
13434
13435                 new_triggers.patterns = kcalloc(n_patterns,
13436                                                 sizeof(new_triggers.patterns[0]),
13437                                                 GFP_KERNEL);
13438                 if (!new_triggers.patterns)
13439                         return -ENOMEM;
13440
13441                 new_triggers.n_patterns = n_patterns;
13442                 i = 0;
13443
13444                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13445                                     rem) {
13446                         u8 *mask_pat;
13447
13448                         err = nla_parse_nested_deprecated(pat_tb,
13449                                                           MAX_NL80211_PKTPAT,
13450                                                           pat,
13451                                                           nl80211_packet_pattern_policy,
13452                                                           info->extack);
13453                         if (err)
13454                                 goto error;
13455
13456                         err = -EINVAL;
13457                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13458                             !pat_tb[NL80211_PKTPAT_PATTERN])
13459                                 goto error;
13460                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13461                         mask_len = DIV_ROUND_UP(pat_len, 8);
13462                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13463                                 goto error;
13464                         if (pat_len > wowlan->pattern_max_len ||
13465                             pat_len < wowlan->pattern_min_len)
13466                                 goto error;
13467
13468                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
13469                                 pkt_offset = 0;
13470                         else
13471                                 pkt_offset = nla_get_u32(
13472                                         pat_tb[NL80211_PKTPAT_OFFSET]);
13473                         if (pkt_offset > wowlan->max_pkt_offset)
13474                                 goto error;
13475                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13476
13477                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13478                         if (!mask_pat) {
13479                                 err = -ENOMEM;
13480                                 goto error;
13481                         }
13482                         new_triggers.patterns[i].mask = mask_pat;
13483                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13484                                mask_len);
13485                         mask_pat += mask_len;
13486                         new_triggers.patterns[i].pattern = mask_pat;
13487                         new_triggers.patterns[i].pattern_len = pat_len;
13488                         memcpy(mask_pat,
13489                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13490                                pat_len);
13491                         i++;
13492                 }
13493         }
13494
13495         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13496                 regular = true;
13497                 err = nl80211_parse_wowlan_tcp(
13498                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13499                         &new_triggers);
13500                 if (err)
13501                         goto error;
13502         }
13503
13504         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13505                 regular = true;
13506                 err = nl80211_parse_wowlan_nd(
13507                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13508                         &new_triggers);
13509                 if (err)
13510                         goto error;
13511         }
13512
13513         /* The 'any' trigger means the device continues operating more or less
13514          * as in its normal operation mode and wakes up the host on most of the
13515          * normal interrupts (like packet RX, ...)
13516          * It therefore makes little sense to combine with the more constrained
13517          * wakeup trigger modes.
13518          */
13519         if (new_triggers.any && regular) {
13520                 err = -EINVAL;
13521                 goto error;
13522         }
13523
13524         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13525         if (!ntrig) {
13526                 err = -ENOMEM;
13527                 goto error;
13528         }
13529         cfg80211_rdev_free_wowlan(rdev);
13530         rdev->wiphy.wowlan_config = ntrig;
13531
13532  set_wakeup:
13533         if (rdev->ops->set_wakeup &&
13534             prev_enabled != !!rdev->wiphy.wowlan_config)
13535                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13536
13537         return 0;
13538  error:
13539         for (i = 0; i < new_triggers.n_patterns; i++)
13540                 kfree(new_triggers.patterns[i].mask);
13541         kfree(new_triggers.patterns);
13542         if (new_triggers.tcp && new_triggers.tcp->sock)
13543                 sock_release(new_triggers.tcp->sock);
13544         kfree(new_triggers.tcp);
13545         kfree(new_triggers.nd_config);
13546         return err;
13547 }
13548 #endif
13549
13550 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13551                                        struct cfg80211_registered_device *rdev)
13552 {
13553         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13554         int i, j, pat_len;
13555         struct cfg80211_coalesce_rules *rule;
13556
13557         if (!rdev->coalesce->n_rules)
13558                 return 0;
13559
13560         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13561         if (!nl_rules)
13562                 return -ENOBUFS;
13563
13564         for (i = 0; i < rdev->coalesce->n_rules; i++) {
13565                 nl_rule = nla_nest_start_noflag(msg, i + 1);
13566                 if (!nl_rule)
13567                         return -ENOBUFS;
13568
13569                 rule = &rdev->coalesce->rules[i];
13570                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13571                                 rule->delay))
13572                         return -ENOBUFS;
13573
13574                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13575                                 rule->condition))
13576                         return -ENOBUFS;
13577
13578                 nl_pats = nla_nest_start_noflag(msg,
13579                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13580                 if (!nl_pats)
13581                         return -ENOBUFS;
13582
13583                 for (j = 0; j < rule->n_patterns; j++) {
13584                         nl_pat = nla_nest_start_noflag(msg, j + 1);
13585                         if (!nl_pat)
13586                                 return -ENOBUFS;
13587                         pat_len = rule->patterns[j].pattern_len;
13588                         if (nla_put(msg, NL80211_PKTPAT_MASK,
13589                                     DIV_ROUND_UP(pat_len, 8),
13590                                     rule->patterns[j].mask) ||
13591                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13592                                     rule->patterns[j].pattern) ||
13593                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13594                                         rule->patterns[j].pkt_offset))
13595                                 return -ENOBUFS;
13596                         nla_nest_end(msg, nl_pat);
13597                 }
13598                 nla_nest_end(msg, nl_pats);
13599                 nla_nest_end(msg, nl_rule);
13600         }
13601         nla_nest_end(msg, nl_rules);
13602
13603         return 0;
13604 }
13605
13606 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13607 {
13608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13609         struct sk_buff *msg;
13610         void *hdr;
13611
13612         if (!rdev->wiphy.coalesce)
13613                 return -EOPNOTSUPP;
13614
13615         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13616         if (!msg)
13617                 return -ENOMEM;
13618
13619         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13620                              NL80211_CMD_GET_COALESCE);
13621         if (!hdr)
13622                 goto nla_put_failure;
13623
13624         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13625                 goto nla_put_failure;
13626
13627         genlmsg_end(msg, hdr);
13628         return genlmsg_reply(msg, info);
13629
13630 nla_put_failure:
13631         nlmsg_free(msg);
13632         return -ENOBUFS;
13633 }
13634
13635 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13636 {
13637         struct cfg80211_coalesce *coalesce = rdev->coalesce;
13638         int i, j;
13639         struct cfg80211_coalesce_rules *rule;
13640
13641         if (!coalesce)
13642                 return;
13643
13644         for (i = 0; i < coalesce->n_rules; i++) {
13645                 rule = &coalesce->rules[i];
13646                 for (j = 0; j < rule->n_patterns; j++)
13647                         kfree(rule->patterns[j].mask);
13648                 kfree(rule->patterns);
13649         }
13650         kfree(coalesce->rules);
13651         kfree(coalesce);
13652         rdev->coalesce = NULL;
13653 }
13654
13655 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13656                                        struct nlattr *rule,
13657                                        struct cfg80211_coalesce_rules *new_rule)
13658 {
13659         int err, i;
13660         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13661         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13662         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13663         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13664
13665         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13666                                           rule, nl80211_coalesce_policy, NULL);
13667         if (err)
13668                 return err;
13669
13670         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13671                 new_rule->delay =
13672                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13673         if (new_rule->delay > coalesce->max_delay)
13674                 return -EINVAL;
13675
13676         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13677                 new_rule->condition =
13678                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13679
13680         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13681                 return -EINVAL;
13682
13683         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13684                             rem)
13685                 n_patterns++;
13686         if (n_patterns > coalesce->n_patterns)
13687                 return -EINVAL;
13688
13689         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13690                                      GFP_KERNEL);
13691         if (!new_rule->patterns)
13692                 return -ENOMEM;
13693
13694         new_rule->n_patterns = n_patterns;
13695         i = 0;
13696
13697         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13698                             rem) {
13699                 u8 *mask_pat;
13700
13701                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13702                                                   pat,
13703                                                   nl80211_packet_pattern_policy,
13704                                                   NULL);
13705                 if (err)
13706                         return err;
13707
13708                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13709                     !pat_tb[NL80211_PKTPAT_PATTERN])
13710                         return -EINVAL;
13711                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13712                 mask_len = DIV_ROUND_UP(pat_len, 8);
13713                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13714                         return -EINVAL;
13715                 if (pat_len > coalesce->pattern_max_len ||
13716                     pat_len < coalesce->pattern_min_len)
13717                         return -EINVAL;
13718
13719                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13720                         pkt_offset = 0;
13721                 else
13722                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13723                 if (pkt_offset > coalesce->max_pkt_offset)
13724                         return -EINVAL;
13725                 new_rule->patterns[i].pkt_offset = pkt_offset;
13726
13727                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13728                 if (!mask_pat)
13729                         return -ENOMEM;
13730
13731                 new_rule->patterns[i].mask = mask_pat;
13732                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13733                        mask_len);
13734
13735                 mask_pat += mask_len;
13736                 new_rule->patterns[i].pattern = mask_pat;
13737                 new_rule->patterns[i].pattern_len = pat_len;
13738                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13739                        pat_len);
13740                 i++;
13741         }
13742
13743         return 0;
13744 }
13745
13746 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13747 {
13748         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13749         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13750         struct cfg80211_coalesce new_coalesce = {};
13751         struct cfg80211_coalesce *n_coalesce;
13752         int err, rem_rule, n_rules = 0, i, j;
13753         struct nlattr *rule;
13754         struct cfg80211_coalesce_rules *tmp_rule;
13755
13756         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13757                 return -EOPNOTSUPP;
13758
13759         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13760                 cfg80211_rdev_free_coalesce(rdev);
13761                 rdev_set_coalesce(rdev, NULL);
13762                 return 0;
13763         }
13764
13765         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13766                             rem_rule)
13767                 n_rules++;
13768         if (n_rules > coalesce->n_rules)
13769                 return -EINVAL;
13770
13771         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13772                                      GFP_KERNEL);
13773         if (!new_coalesce.rules)
13774                 return -ENOMEM;
13775
13776         new_coalesce.n_rules = n_rules;
13777         i = 0;
13778
13779         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13780                             rem_rule) {
13781                 err = nl80211_parse_coalesce_rule(rdev, rule,
13782                                                   &new_coalesce.rules[i]);
13783                 if (err)
13784                         goto error;
13785
13786                 i++;
13787         }
13788
13789         err = rdev_set_coalesce(rdev, &new_coalesce);
13790         if (err)
13791                 goto error;
13792
13793         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13794         if (!n_coalesce) {
13795                 err = -ENOMEM;
13796                 goto error;
13797         }
13798         cfg80211_rdev_free_coalesce(rdev);
13799         rdev->coalesce = n_coalesce;
13800
13801         return 0;
13802 error:
13803         for (i = 0; i < new_coalesce.n_rules; i++) {
13804                 tmp_rule = &new_coalesce.rules[i];
13805                 for (j = 0; j < tmp_rule->n_patterns; j++)
13806                         kfree(tmp_rule->patterns[j].mask);
13807                 kfree(tmp_rule->patterns);
13808         }
13809         kfree(new_coalesce.rules);
13810
13811         return err;
13812 }
13813
13814 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
13815 {
13816         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13817         struct net_device *dev = info->user_ptr[1];
13818         struct wireless_dev *wdev = dev->ieee80211_ptr;
13819         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
13820         struct cfg80211_gtk_rekey_data rekey_data = {};
13821         int err;
13822
13823         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
13824                 return -EINVAL;
13825
13826         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
13827                                           info->attrs[NL80211_ATTR_REKEY_DATA],
13828                                           nl80211_rekey_policy, info->extack);
13829         if (err)
13830                 return err;
13831
13832         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
13833             !tb[NL80211_REKEY_DATA_KCK])
13834                 return -EINVAL;
13835         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
13836             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13837               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
13838                 return -ERANGE;
13839         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
13840             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
13841               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN))
13842                 return -ERANGE;
13843
13844         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
13845         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
13846         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
13847         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
13848         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
13849         if (tb[NL80211_REKEY_DATA_AKM])
13850                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
13851
13852         wdev_lock(wdev);
13853         if (!wdev->connected) {
13854                 err = -ENOTCONN;
13855                 goto out;
13856         }
13857
13858         if (!rdev->ops->set_rekey_data) {
13859                 err = -EOPNOTSUPP;
13860                 goto out;
13861         }
13862
13863         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
13864  out:
13865         wdev_unlock(wdev);
13866         return err;
13867 }
13868
13869 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
13870                                              struct genl_info *info)
13871 {
13872         struct net_device *dev = info->user_ptr[1];
13873         struct wireless_dev *wdev = dev->ieee80211_ptr;
13874
13875         if (wdev->iftype != NL80211_IFTYPE_AP &&
13876             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13877                 return -EINVAL;
13878
13879         if (wdev->ap_unexpected_nlportid)
13880                 return -EBUSY;
13881
13882         wdev->ap_unexpected_nlportid = info->snd_portid;
13883         return 0;
13884 }
13885
13886 static int nl80211_probe_client(struct sk_buff *skb,
13887                                 struct genl_info *info)
13888 {
13889         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13890         struct net_device *dev = info->user_ptr[1];
13891         struct wireless_dev *wdev = dev->ieee80211_ptr;
13892         struct sk_buff *msg;
13893         void *hdr;
13894         const u8 *addr;
13895         u64 cookie;
13896         int err;
13897
13898         if (wdev->iftype != NL80211_IFTYPE_AP &&
13899             wdev->iftype != NL80211_IFTYPE_P2P_GO)
13900                 return -EOPNOTSUPP;
13901
13902         if (!info->attrs[NL80211_ATTR_MAC])
13903                 return -EINVAL;
13904
13905         if (!rdev->ops->probe_client)
13906                 return -EOPNOTSUPP;
13907
13908         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13909         if (!msg)
13910                 return -ENOMEM;
13911
13912         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13913                              NL80211_CMD_PROBE_CLIENT);
13914         if (!hdr) {
13915                 err = -ENOBUFS;
13916                 goto free_msg;
13917         }
13918
13919         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13920
13921         err = rdev_probe_client(rdev, dev, addr, &cookie);
13922         if (err)
13923                 goto free_msg;
13924
13925         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13926                               NL80211_ATTR_PAD))
13927                 goto nla_put_failure;
13928
13929         genlmsg_end(msg, hdr);
13930
13931         return genlmsg_reply(msg, info);
13932
13933  nla_put_failure:
13934         err = -ENOBUFS;
13935  free_msg:
13936         nlmsg_free(msg);
13937         return err;
13938 }
13939
13940 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
13941 {
13942         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13943         struct cfg80211_beacon_registration *reg, *nreg;
13944         int rv;
13945
13946         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
13947                 return -EOPNOTSUPP;
13948
13949         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
13950         if (!nreg)
13951                 return -ENOMEM;
13952
13953         /* First, check if already registered. */
13954         spin_lock_bh(&rdev->beacon_registrations_lock);
13955         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13956                 if (reg->nlportid == info->snd_portid) {
13957                         rv = -EALREADY;
13958                         goto out_err;
13959                 }
13960         }
13961         /* Add it to the list */
13962         nreg->nlportid = info->snd_portid;
13963         list_add(&nreg->list, &rdev->beacon_registrations);
13964
13965         spin_unlock_bh(&rdev->beacon_registrations_lock);
13966
13967         return 0;
13968 out_err:
13969         spin_unlock_bh(&rdev->beacon_registrations_lock);
13970         kfree(nreg);
13971         return rv;
13972 }
13973
13974 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
13975 {
13976         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13977         struct wireless_dev *wdev = info->user_ptr[1];
13978         int err;
13979
13980         if (!rdev->ops->start_p2p_device)
13981                 return -EOPNOTSUPP;
13982
13983         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13984                 return -EOPNOTSUPP;
13985
13986         if (wdev_running(wdev))
13987                 return 0;
13988
13989         if (rfkill_blocked(rdev->wiphy.rfkill))
13990                 return -ERFKILL;
13991
13992         err = rdev_start_p2p_device(rdev, wdev);
13993         if (err)
13994                 return err;
13995
13996         wdev->is_running = true;
13997         rdev->opencount++;
13998
13999         return 0;
14000 }
14001
14002 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14003 {
14004         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14005         struct wireless_dev *wdev = info->user_ptr[1];
14006
14007         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14008                 return -EOPNOTSUPP;
14009
14010         if (!rdev->ops->stop_p2p_device)
14011                 return -EOPNOTSUPP;
14012
14013         cfg80211_stop_p2p_device(rdev, wdev);
14014
14015         return 0;
14016 }
14017
14018 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14019 {
14020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14021         struct wireless_dev *wdev = info->user_ptr[1];
14022         struct cfg80211_nan_conf conf = {};
14023         int err;
14024
14025         if (wdev->iftype != NL80211_IFTYPE_NAN)
14026                 return -EOPNOTSUPP;
14027
14028         if (wdev_running(wdev))
14029                 return -EEXIST;
14030
14031         if (rfkill_blocked(rdev->wiphy.rfkill))
14032                 return -ERFKILL;
14033
14034         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14035                 return -EINVAL;
14036
14037         conf.master_pref =
14038                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14039
14040         if (info->attrs[NL80211_ATTR_BANDS]) {
14041                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14042
14043                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14044                         return -EOPNOTSUPP;
14045
14046                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14047                         return -EINVAL;
14048
14049                 conf.bands = bands;
14050         }
14051
14052         err = rdev_start_nan(rdev, wdev, &conf);
14053         if (err)
14054                 return err;
14055
14056         wdev->is_running = true;
14057         rdev->opencount++;
14058
14059         return 0;
14060 }
14061
14062 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14063 {
14064         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14065         struct wireless_dev *wdev = info->user_ptr[1];
14066
14067         if (wdev->iftype != NL80211_IFTYPE_NAN)
14068                 return -EOPNOTSUPP;
14069
14070         cfg80211_stop_nan(rdev, wdev);
14071
14072         return 0;
14073 }
14074
14075 static int validate_nan_filter(struct nlattr *filter_attr)
14076 {
14077         struct nlattr *attr;
14078         int len = 0, n_entries = 0, rem;
14079
14080         nla_for_each_nested(attr, filter_attr, rem) {
14081                 len += nla_len(attr);
14082                 n_entries++;
14083         }
14084
14085         if (len >= U8_MAX)
14086                 return -EINVAL;
14087
14088         return n_entries;
14089 }
14090
14091 static int handle_nan_filter(struct nlattr *attr_filter,
14092                              struct cfg80211_nan_func *func,
14093                              bool tx)
14094 {
14095         struct nlattr *attr;
14096         int n_entries, rem, i;
14097         struct cfg80211_nan_func_filter *filter;
14098
14099         n_entries = validate_nan_filter(attr_filter);
14100         if (n_entries < 0)
14101                 return n_entries;
14102
14103         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14104
14105         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14106         if (!filter)
14107                 return -ENOMEM;
14108
14109         i = 0;
14110         nla_for_each_nested(attr, attr_filter, rem) {
14111                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14112                 if (!filter[i].filter)
14113                         goto err;
14114
14115                 filter[i].len = nla_len(attr);
14116                 i++;
14117         }
14118         if (tx) {
14119                 func->num_tx_filters = n_entries;
14120                 func->tx_filters = filter;
14121         } else {
14122                 func->num_rx_filters = n_entries;
14123                 func->rx_filters = filter;
14124         }
14125
14126         return 0;
14127
14128 err:
14129         i = 0;
14130         nla_for_each_nested(attr, attr_filter, rem) {
14131                 kfree(filter[i].filter);
14132                 i++;
14133         }
14134         kfree(filter);
14135         return -ENOMEM;
14136 }
14137
14138 static int nl80211_nan_add_func(struct sk_buff *skb,
14139                                 struct genl_info *info)
14140 {
14141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14142         struct wireless_dev *wdev = info->user_ptr[1];
14143         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14144         struct cfg80211_nan_func *func;
14145         struct sk_buff *msg = NULL;
14146         void *hdr = NULL;
14147         int err = 0;
14148
14149         if (wdev->iftype != NL80211_IFTYPE_NAN)
14150                 return -EOPNOTSUPP;
14151
14152         if (!wdev_running(wdev))
14153                 return -ENOTCONN;
14154
14155         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14156                 return -EINVAL;
14157
14158         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14159                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14160                                           nl80211_nan_func_policy,
14161                                           info->extack);
14162         if (err)
14163                 return err;
14164
14165         func = kzalloc(sizeof(*func), GFP_KERNEL);
14166         if (!func)
14167                 return -ENOMEM;
14168
14169         func->cookie = cfg80211_assign_cookie(rdev);
14170
14171         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14172                 err = -EINVAL;
14173                 goto out;
14174         }
14175
14176
14177         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14178
14179         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14180                 err = -EINVAL;
14181                 goto out;
14182         }
14183
14184         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14185                sizeof(func->service_id));
14186
14187         func->close_range =
14188                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14189
14190         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14191                 func->serv_spec_info_len =
14192                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14193                 func->serv_spec_info =
14194                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14195                                 func->serv_spec_info_len,
14196                                 GFP_KERNEL);
14197                 if (!func->serv_spec_info) {
14198                         err = -ENOMEM;
14199                         goto out;
14200                 }
14201         }
14202
14203         if (tb[NL80211_NAN_FUNC_TTL])
14204                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14205
14206         switch (func->type) {
14207         case NL80211_NAN_FUNC_PUBLISH:
14208                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14209                         err = -EINVAL;
14210                         goto out;
14211                 }
14212
14213                 func->publish_type =
14214                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14215                 func->publish_bcast =
14216                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14217
14218                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14219                         func->publish_bcast) {
14220                         err = -EINVAL;
14221                         goto out;
14222                 }
14223                 break;
14224         case NL80211_NAN_FUNC_SUBSCRIBE:
14225                 func->subscribe_active =
14226                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14227                 break;
14228         case NL80211_NAN_FUNC_FOLLOW_UP:
14229                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14230                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14231                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14232                         err = -EINVAL;
14233                         goto out;
14234                 }
14235
14236                 func->followup_id =
14237                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14238                 func->followup_reqid =
14239                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14240                 memcpy(func->followup_dest.addr,
14241                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14242                        sizeof(func->followup_dest.addr));
14243                 if (func->ttl) {
14244                         err = -EINVAL;
14245                         goto out;
14246                 }
14247                 break;
14248         default:
14249                 err = -EINVAL;
14250                 goto out;
14251         }
14252
14253         if (tb[NL80211_NAN_FUNC_SRF]) {
14254                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14255
14256                 err = nla_parse_nested_deprecated(srf_tb,
14257                                                   NL80211_NAN_SRF_ATTR_MAX,
14258                                                   tb[NL80211_NAN_FUNC_SRF],
14259                                                   nl80211_nan_srf_policy,
14260                                                   info->extack);
14261                 if (err)
14262                         goto out;
14263
14264                 func->srf_include =
14265                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14266
14267                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14268                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14269                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14270                                 err = -EINVAL;
14271                                 goto out;
14272                         }
14273
14274                         func->srf_bf_len =
14275                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14276                         func->srf_bf =
14277                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14278                                         func->srf_bf_len, GFP_KERNEL);
14279                         if (!func->srf_bf) {
14280                                 err = -ENOMEM;
14281                                 goto out;
14282                         }
14283
14284                         func->srf_bf_idx =
14285                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14286                 } else {
14287                         struct nlattr *attr, *mac_attr =
14288                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14289                         int n_entries, rem, i = 0;
14290
14291                         if (!mac_attr) {
14292                                 err = -EINVAL;
14293                                 goto out;
14294                         }
14295
14296                         n_entries = validate_acl_mac_addrs(mac_attr);
14297                         if (n_entries <= 0) {
14298                                 err = -EINVAL;
14299                                 goto out;
14300                         }
14301
14302                         func->srf_num_macs = n_entries;
14303                         func->srf_macs =
14304                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14305                                         GFP_KERNEL);
14306                         if (!func->srf_macs) {
14307                                 err = -ENOMEM;
14308                                 goto out;
14309                         }
14310
14311                         nla_for_each_nested(attr, mac_attr, rem)
14312                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14313                                        sizeof(*func->srf_macs));
14314                 }
14315         }
14316
14317         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14318                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14319                                         func, true);
14320                 if (err)
14321                         goto out;
14322         }
14323
14324         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14325                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14326                                         func, false);
14327                 if (err)
14328                         goto out;
14329         }
14330
14331         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14332         if (!msg) {
14333                 err = -ENOMEM;
14334                 goto out;
14335         }
14336
14337         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14338                              NL80211_CMD_ADD_NAN_FUNCTION);
14339         /* This can't really happen - we just allocated 4KB */
14340         if (WARN_ON(!hdr)) {
14341                 err = -ENOMEM;
14342                 goto out;
14343         }
14344
14345         err = rdev_add_nan_func(rdev, wdev, func);
14346 out:
14347         if (err < 0) {
14348                 cfg80211_free_nan_func(func);
14349                 nlmsg_free(msg);
14350                 return err;
14351         }
14352
14353         /* propagate the instance id and cookie to userspace  */
14354         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14355                               NL80211_ATTR_PAD))
14356                 goto nla_put_failure;
14357
14358         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14359         if (!func_attr)
14360                 goto nla_put_failure;
14361
14362         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14363                        func->instance_id))
14364                 goto nla_put_failure;
14365
14366         nla_nest_end(msg, func_attr);
14367
14368         genlmsg_end(msg, hdr);
14369         return genlmsg_reply(msg, info);
14370
14371 nla_put_failure:
14372         nlmsg_free(msg);
14373         return -ENOBUFS;
14374 }
14375
14376 static int nl80211_nan_del_func(struct sk_buff *skb,
14377                                struct genl_info *info)
14378 {
14379         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14380         struct wireless_dev *wdev = info->user_ptr[1];
14381         u64 cookie;
14382
14383         if (wdev->iftype != NL80211_IFTYPE_NAN)
14384                 return -EOPNOTSUPP;
14385
14386         if (!wdev_running(wdev))
14387                 return -ENOTCONN;
14388
14389         if (!info->attrs[NL80211_ATTR_COOKIE])
14390                 return -EINVAL;
14391
14392         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14393
14394         rdev_del_nan_func(rdev, wdev, cookie);
14395
14396         return 0;
14397 }
14398
14399 static int nl80211_nan_change_config(struct sk_buff *skb,
14400                                      struct genl_info *info)
14401 {
14402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14403         struct wireless_dev *wdev = info->user_ptr[1];
14404         struct cfg80211_nan_conf conf = {};
14405         u32 changed = 0;
14406
14407         if (wdev->iftype != NL80211_IFTYPE_NAN)
14408                 return -EOPNOTSUPP;
14409
14410         if (!wdev_running(wdev))
14411                 return -ENOTCONN;
14412
14413         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14414                 conf.master_pref =
14415                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14416                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14417                         return -EINVAL;
14418
14419                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14420         }
14421
14422         if (info->attrs[NL80211_ATTR_BANDS]) {
14423                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14424
14425                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14426                         return -EOPNOTSUPP;
14427
14428                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14429                         return -EINVAL;
14430
14431                 conf.bands = bands;
14432                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14433         }
14434
14435         if (!changed)
14436                 return -EINVAL;
14437
14438         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14439 }
14440
14441 void cfg80211_nan_match(struct wireless_dev *wdev,
14442                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14443 {
14444         struct wiphy *wiphy = wdev->wiphy;
14445         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14446         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14447         struct sk_buff *msg;
14448         void *hdr;
14449
14450         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14451                 return;
14452
14453         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14454         if (!msg)
14455                 return;
14456
14457         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14458         if (!hdr) {
14459                 nlmsg_free(msg);
14460                 return;
14461         }
14462
14463         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14464             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14465                                          wdev->netdev->ifindex)) ||
14466             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14467                               NL80211_ATTR_PAD))
14468                 goto nla_put_failure;
14469
14470         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14471                               NL80211_ATTR_PAD) ||
14472             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14473                 goto nla_put_failure;
14474
14475         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14476         if (!match_attr)
14477                 goto nla_put_failure;
14478
14479         local_func_attr = nla_nest_start_noflag(msg,
14480                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14481         if (!local_func_attr)
14482                 goto nla_put_failure;
14483
14484         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14485                 goto nla_put_failure;
14486
14487         nla_nest_end(msg, local_func_attr);
14488
14489         peer_func_attr = nla_nest_start_noflag(msg,
14490                                                NL80211_NAN_MATCH_FUNC_PEER);
14491         if (!peer_func_attr)
14492                 goto nla_put_failure;
14493
14494         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14495             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14496                 goto nla_put_failure;
14497
14498         if (match->info && match->info_len &&
14499             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14500                     match->info))
14501                 goto nla_put_failure;
14502
14503         nla_nest_end(msg, peer_func_attr);
14504         nla_nest_end(msg, match_attr);
14505         genlmsg_end(msg, hdr);
14506
14507         if (!wdev->owner_nlportid)
14508                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14509                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14510         else
14511                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14512                                 wdev->owner_nlportid);
14513
14514         return;
14515
14516 nla_put_failure:
14517         nlmsg_free(msg);
14518 }
14519 EXPORT_SYMBOL(cfg80211_nan_match);
14520
14521 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14522                                   u8 inst_id,
14523                                   enum nl80211_nan_func_term_reason reason,
14524                                   u64 cookie, gfp_t gfp)
14525 {
14526         struct wiphy *wiphy = wdev->wiphy;
14527         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14528         struct sk_buff *msg;
14529         struct nlattr *func_attr;
14530         void *hdr;
14531
14532         if (WARN_ON(!inst_id))
14533                 return;
14534
14535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14536         if (!msg)
14537                 return;
14538
14539         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14540         if (!hdr) {
14541                 nlmsg_free(msg);
14542                 return;
14543         }
14544
14545         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14546             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14547                                          wdev->netdev->ifindex)) ||
14548             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14549                               NL80211_ATTR_PAD))
14550                 goto nla_put_failure;
14551
14552         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14553                               NL80211_ATTR_PAD))
14554                 goto nla_put_failure;
14555
14556         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14557         if (!func_attr)
14558                 goto nla_put_failure;
14559
14560         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14561             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14562                 goto nla_put_failure;
14563
14564         nla_nest_end(msg, func_attr);
14565         genlmsg_end(msg, hdr);
14566
14567         if (!wdev->owner_nlportid)
14568                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14569                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14570         else
14571                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14572                                 wdev->owner_nlportid);
14573
14574         return;
14575
14576 nla_put_failure:
14577         nlmsg_free(msg);
14578 }
14579 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14580
14581 static int nl80211_get_protocol_features(struct sk_buff *skb,
14582                                          struct genl_info *info)
14583 {
14584         void *hdr;
14585         struct sk_buff *msg;
14586
14587         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14588         if (!msg)
14589                 return -ENOMEM;
14590
14591         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14592                              NL80211_CMD_GET_PROTOCOL_FEATURES);
14593         if (!hdr)
14594                 goto nla_put_failure;
14595
14596         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14597                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14598                 goto nla_put_failure;
14599
14600         genlmsg_end(msg, hdr);
14601         return genlmsg_reply(msg, info);
14602
14603  nla_put_failure:
14604         kfree_skb(msg);
14605         return -ENOBUFS;
14606 }
14607
14608 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14609 {
14610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14611         struct cfg80211_update_ft_ies_params ft_params;
14612         struct net_device *dev = info->user_ptr[1];
14613
14614         if (!rdev->ops->update_ft_ies)
14615                 return -EOPNOTSUPP;
14616
14617         if (!info->attrs[NL80211_ATTR_MDID] ||
14618             !info->attrs[NL80211_ATTR_IE])
14619                 return -EINVAL;
14620
14621         memset(&ft_params, 0, sizeof(ft_params));
14622         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14623         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14624         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14625
14626         return rdev_update_ft_ies(rdev, dev, &ft_params);
14627 }
14628
14629 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14630                                        struct genl_info *info)
14631 {
14632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14633         struct wireless_dev *wdev = info->user_ptr[1];
14634         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14635         u16 duration;
14636         int ret;
14637
14638         if (!rdev->ops->crit_proto_start)
14639                 return -EOPNOTSUPP;
14640
14641         if (WARN_ON(!rdev->ops->crit_proto_stop))
14642                 return -EINVAL;
14643
14644         if (rdev->crit_proto_nlportid)
14645                 return -EBUSY;
14646
14647         /* determine protocol if provided */
14648         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14649                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14650
14651         if (proto >= NUM_NL80211_CRIT_PROTO)
14652                 return -EINVAL;
14653
14654         /* timeout must be provided */
14655         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14656                 return -EINVAL;
14657
14658         duration =
14659                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14660
14661         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14662         if (!ret)
14663                 rdev->crit_proto_nlportid = info->snd_portid;
14664
14665         return ret;
14666 }
14667
14668 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14669                                       struct genl_info *info)
14670 {
14671         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14672         struct wireless_dev *wdev = info->user_ptr[1];
14673
14674         if (!rdev->ops->crit_proto_stop)
14675                 return -EOPNOTSUPP;
14676
14677         if (rdev->crit_proto_nlportid) {
14678                 rdev->crit_proto_nlportid = 0;
14679                 rdev_crit_proto_stop(rdev, wdev);
14680         }
14681         return 0;
14682 }
14683
14684 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14685                                        struct nlattr *attr,
14686                                        struct netlink_ext_ack *extack)
14687 {
14688         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14689                 if (attr->nla_type & NLA_F_NESTED) {
14690                         NL_SET_ERR_MSG_ATTR(extack, attr,
14691                                             "unexpected nested data");
14692                         return -EINVAL;
14693                 }
14694
14695                 return 0;
14696         }
14697
14698         if (!(attr->nla_type & NLA_F_NESTED)) {
14699                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14700                 return -EINVAL;
14701         }
14702
14703         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14704 }
14705
14706 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14707 {
14708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14709         struct wireless_dev *wdev =
14710                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14711                                            info->attrs);
14712         int i, err;
14713         u32 vid, subcmd;
14714
14715         if (!rdev->wiphy.vendor_commands)
14716                 return -EOPNOTSUPP;
14717
14718         if (IS_ERR(wdev)) {
14719                 err = PTR_ERR(wdev);
14720                 if (err != -EINVAL)
14721                         return err;
14722                 wdev = NULL;
14723         } else if (wdev->wiphy != &rdev->wiphy) {
14724                 return -EINVAL;
14725         }
14726
14727         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14728             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14729                 return -EINVAL;
14730
14731         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14732         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14733         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14734                 const struct wiphy_vendor_command *vcmd;
14735                 void *data = NULL;
14736                 int len = 0;
14737
14738                 vcmd = &rdev->wiphy.vendor_commands[i];
14739
14740                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14741                         continue;
14742
14743                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14744                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14745                         if (!wdev)
14746                                 return -EINVAL;
14747                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14748                             !wdev->netdev)
14749                                 return -EINVAL;
14750
14751                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14752                                 if (!wdev_running(wdev))
14753                                         return -ENETDOWN;
14754                         }
14755                 } else {
14756                         wdev = NULL;
14757                 }
14758
14759                 if (!vcmd->doit)
14760                         return -EOPNOTSUPP;
14761
14762                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14763                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14764                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14765
14766                         err = nl80211_vendor_check_policy(vcmd,
14767                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
14768                                         info->extack);
14769                         if (err)
14770                                 return err;
14771                 }
14772
14773                 rdev->cur_cmd_info = info;
14774                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14775                 rdev->cur_cmd_info = NULL;
14776                 return err;
14777         }
14778
14779         return -EOPNOTSUPP;
14780 }
14781
14782 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14783                                        struct netlink_callback *cb,
14784                                        struct cfg80211_registered_device **rdev,
14785                                        struct wireless_dev **wdev)
14786 {
14787         struct nlattr **attrbuf;
14788         u32 vid, subcmd;
14789         unsigned int i;
14790         int vcmd_idx = -1;
14791         int err;
14792         void *data = NULL;
14793         unsigned int data_len = 0;
14794
14795         if (cb->args[0]) {
14796                 /* subtract the 1 again here */
14797                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14798                 struct wireless_dev *tmp;
14799
14800                 if (!wiphy)
14801                         return -ENODEV;
14802                 *rdev = wiphy_to_rdev(wiphy);
14803                 *wdev = NULL;
14804
14805                 if (cb->args[1]) {
14806                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
14807                                 if (tmp->identifier == cb->args[1] - 1) {
14808                                         *wdev = tmp;
14809                                         break;
14810                                 }
14811                         }
14812                 }
14813
14814                 /* keep rtnl locked in successful case */
14815                 return 0;
14816         }
14817
14818         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
14819         if (!attrbuf)
14820                 return -ENOMEM;
14821
14822         err = nlmsg_parse_deprecated(cb->nlh,
14823                                      GENL_HDRLEN + nl80211_fam.hdrsize,
14824                                      attrbuf, nl80211_fam.maxattr,
14825                                      nl80211_policy, NULL);
14826         if (err)
14827                 goto out;
14828
14829         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
14830             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
14831                 err = -EINVAL;
14832                 goto out;
14833         }
14834
14835         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
14836         if (IS_ERR(*wdev))
14837                 *wdev = NULL;
14838
14839         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
14840         if (IS_ERR(*rdev)) {
14841                 err = PTR_ERR(*rdev);
14842                 goto out;
14843         }
14844
14845         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
14846         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
14847
14848         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
14849                 const struct wiphy_vendor_command *vcmd;
14850
14851                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
14852
14853                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14854                         continue;
14855
14856                 if (!vcmd->dumpit) {
14857                         err = -EOPNOTSUPP;
14858                         goto out;
14859                 }
14860
14861                 vcmd_idx = i;
14862                 break;
14863         }
14864
14865         if (vcmd_idx < 0) {
14866                 err = -EOPNOTSUPP;
14867                 goto out;
14868         }
14869
14870         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
14871                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14872                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
14873
14874                 err = nl80211_vendor_check_policy(
14875                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
14876                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
14877                                 cb->extack);
14878                 if (err)
14879                         goto out;
14880         }
14881
14882         /* 0 is the first index - add 1 to parse only once */
14883         cb->args[0] = (*rdev)->wiphy_idx + 1;
14884         /* add 1 to know if it was NULL */
14885         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
14886         cb->args[2] = vcmd_idx;
14887         cb->args[3] = (unsigned long)data;
14888         cb->args[4] = data_len;
14889
14890         /* keep rtnl locked in successful case */
14891         err = 0;
14892 out:
14893         kfree(attrbuf);
14894         return err;
14895 }
14896
14897 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
14898                                    struct netlink_callback *cb)
14899 {
14900         struct cfg80211_registered_device *rdev;
14901         struct wireless_dev *wdev;
14902         unsigned int vcmd_idx;
14903         const struct wiphy_vendor_command *vcmd;
14904         void *data;
14905         int data_len;
14906         int err;
14907         struct nlattr *vendor_data;
14908
14909         rtnl_lock();
14910         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
14911         if (err)
14912                 goto out;
14913
14914         vcmd_idx = cb->args[2];
14915         data = (void *)cb->args[3];
14916         data_len = cb->args[4];
14917         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
14918
14919         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14920                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14921                 if (!wdev) {
14922                         err = -EINVAL;
14923                         goto out;
14924                 }
14925                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14926                     !wdev->netdev) {
14927                         err = -EINVAL;
14928                         goto out;
14929                 }
14930
14931                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14932                         if (!wdev_running(wdev)) {
14933                                 err = -ENETDOWN;
14934                                 goto out;
14935                         }
14936                 }
14937         }
14938
14939         while (1) {
14940                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
14941                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
14942                                            NL80211_CMD_VENDOR);
14943                 if (!hdr)
14944                         break;
14945
14946                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14947                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
14948                                                wdev_id(wdev),
14949                                                NL80211_ATTR_PAD))) {
14950                         genlmsg_cancel(skb, hdr);
14951                         break;
14952                 }
14953
14954                 vendor_data = nla_nest_start_noflag(skb,
14955                                                     NL80211_ATTR_VENDOR_DATA);
14956                 if (!vendor_data) {
14957                         genlmsg_cancel(skb, hdr);
14958                         break;
14959                 }
14960
14961                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
14962                                    (unsigned long *)&cb->args[5]);
14963                 nla_nest_end(skb, vendor_data);
14964
14965                 if (err == -ENOBUFS || err == -ENOENT) {
14966                         genlmsg_cancel(skb, hdr);
14967                         break;
14968                 } else if (err <= 0) {
14969                         genlmsg_cancel(skb, hdr);
14970                         goto out;
14971                 }
14972
14973                 genlmsg_end(skb, hdr);
14974         }
14975
14976         err = skb->len;
14977  out:
14978         rtnl_unlock();
14979         return err;
14980 }
14981
14982 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
14983                                            enum nl80211_commands cmd,
14984                                            enum nl80211_attrs attr,
14985                                            int approxlen)
14986 {
14987         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14988
14989         if (WARN_ON(!rdev->cur_cmd_info))
14990                 return NULL;
14991
14992         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
14993                                            rdev->cur_cmd_info->snd_portid,
14994                                            rdev->cur_cmd_info->snd_seq,
14995                                            cmd, attr, NULL, GFP_KERNEL);
14996 }
14997 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
14998
14999 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15000 {
15001         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15002         void *hdr = ((void **)skb->cb)[1];
15003         struct nlattr *data = ((void **)skb->cb)[2];
15004
15005         /* clear CB data for netlink core to own from now on */
15006         memset(skb->cb, 0, sizeof(skb->cb));
15007
15008         if (WARN_ON(!rdev->cur_cmd_info)) {
15009                 kfree_skb(skb);
15010                 return -EINVAL;
15011         }
15012
15013         nla_nest_end(skb, data);
15014         genlmsg_end(skb, hdr);
15015         return genlmsg_reply(skb, rdev->cur_cmd_info);
15016 }
15017 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15018
15019 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15020 {
15021         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15022
15023         if (WARN_ON(!rdev->cur_cmd_info))
15024                 return 0;
15025
15026         return rdev->cur_cmd_info->snd_portid;
15027 }
15028 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15029
15030 static int nl80211_set_qos_map(struct sk_buff *skb,
15031                                struct genl_info *info)
15032 {
15033         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15034         struct cfg80211_qos_map *qos_map = NULL;
15035         struct net_device *dev = info->user_ptr[1];
15036         u8 *pos, len, num_des, des_len, des;
15037         int ret;
15038
15039         if (!rdev->ops->set_qos_map)
15040                 return -EOPNOTSUPP;
15041
15042         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15043                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15044                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15045
15046                 if (len % 2)
15047                         return -EINVAL;
15048
15049                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15050                 if (!qos_map)
15051                         return -ENOMEM;
15052
15053                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15054                 if (num_des) {
15055                         des_len = num_des *
15056                                 sizeof(struct cfg80211_dscp_exception);
15057                         memcpy(qos_map->dscp_exception, pos, des_len);
15058                         qos_map->num_des = num_des;
15059                         for (des = 0; des < num_des; des++) {
15060                                 if (qos_map->dscp_exception[des].up > 7) {
15061                                         kfree(qos_map);
15062                                         return -EINVAL;
15063                                 }
15064                         }
15065                         pos += des_len;
15066                 }
15067                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15068         }
15069
15070         wdev_lock(dev->ieee80211_ptr);
15071         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15072         if (!ret)
15073                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15074         wdev_unlock(dev->ieee80211_ptr);
15075
15076         kfree(qos_map);
15077         return ret;
15078 }
15079
15080 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15081 {
15082         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15083         struct net_device *dev = info->user_ptr[1];
15084         struct wireless_dev *wdev = dev->ieee80211_ptr;
15085         const u8 *peer;
15086         u8 tsid, up;
15087         u16 admitted_time = 0;
15088         int err;
15089
15090         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15091                 return -EOPNOTSUPP;
15092
15093         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15094             !info->attrs[NL80211_ATTR_USER_PRIO])
15095                 return -EINVAL;
15096
15097         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15098         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15099
15100         /* WMM uses TIDs 0-7 even for TSPEC */
15101         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15102                 /* TODO: handle 802.11 TSPEC/admission control
15103                  * need more attributes for that (e.g. BA session requirement);
15104                  * change the WMM adminssion test above to allow both then
15105                  */
15106                 return -EINVAL;
15107         }
15108
15109         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15110
15111         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15112                 admitted_time =
15113                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15114                 if (!admitted_time)
15115                         return -EINVAL;
15116         }
15117
15118         wdev_lock(wdev);
15119         switch (wdev->iftype) {
15120         case NL80211_IFTYPE_STATION:
15121         case NL80211_IFTYPE_P2P_CLIENT:
15122                 if (wdev->connected)
15123                         break;
15124                 err = -ENOTCONN;
15125                 goto out;
15126         default:
15127                 err = -EOPNOTSUPP;
15128                 goto out;
15129         }
15130
15131         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15132
15133  out:
15134         wdev_unlock(wdev);
15135         return err;
15136 }
15137
15138 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15139 {
15140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15141         struct net_device *dev = info->user_ptr[1];
15142         struct wireless_dev *wdev = dev->ieee80211_ptr;
15143         const u8 *peer;
15144         u8 tsid;
15145         int err;
15146
15147         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15148                 return -EINVAL;
15149
15150         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15151         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15152
15153         wdev_lock(wdev);
15154         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15155         wdev_unlock(wdev);
15156
15157         return err;
15158 }
15159
15160 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15161                                        struct genl_info *info)
15162 {
15163         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15164         struct net_device *dev = info->user_ptr[1];
15165         struct wireless_dev *wdev = dev->ieee80211_ptr;
15166         struct cfg80211_chan_def chandef = {};
15167         const u8 *addr;
15168         u8 oper_class;
15169         int err;
15170
15171         if (!rdev->ops->tdls_channel_switch ||
15172             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15173                 return -EOPNOTSUPP;
15174
15175         switch (dev->ieee80211_ptr->iftype) {
15176         case NL80211_IFTYPE_STATION:
15177         case NL80211_IFTYPE_P2P_CLIENT:
15178                 break;
15179         default:
15180                 return -EOPNOTSUPP;
15181         }
15182
15183         if (!info->attrs[NL80211_ATTR_MAC] ||
15184             !info->attrs[NL80211_ATTR_OPER_CLASS])
15185                 return -EINVAL;
15186
15187         err = nl80211_parse_chandef(rdev, info, &chandef);
15188         if (err)
15189                 return err;
15190
15191         /*
15192          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15193          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15194          * specification is not defined for them.
15195          */
15196         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15197             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15198             chandef.width != NL80211_CHAN_WIDTH_20)
15199                 return -EINVAL;
15200
15201         /* we will be active on the TDLS link */
15202         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15203                                            wdev->iftype))
15204                 return -EINVAL;
15205
15206         /* don't allow switching to DFS channels */
15207         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15208                 return -EINVAL;
15209
15210         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15211         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15212
15213         wdev_lock(wdev);
15214         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15215         wdev_unlock(wdev);
15216
15217         return err;
15218 }
15219
15220 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15221                                               struct genl_info *info)
15222 {
15223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15224         struct net_device *dev = info->user_ptr[1];
15225         struct wireless_dev *wdev = dev->ieee80211_ptr;
15226         const u8 *addr;
15227
15228         if (!rdev->ops->tdls_channel_switch ||
15229             !rdev->ops->tdls_cancel_channel_switch ||
15230             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15231                 return -EOPNOTSUPP;
15232
15233         switch (dev->ieee80211_ptr->iftype) {
15234         case NL80211_IFTYPE_STATION:
15235         case NL80211_IFTYPE_P2P_CLIENT:
15236                 break;
15237         default:
15238                 return -EOPNOTSUPP;
15239         }
15240
15241         if (!info->attrs[NL80211_ATTR_MAC])
15242                 return -EINVAL;
15243
15244         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15245
15246         wdev_lock(wdev);
15247         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15248         wdev_unlock(wdev);
15249
15250         return 0;
15251 }
15252
15253 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15254                                             struct genl_info *info)
15255 {
15256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15257         struct net_device *dev = info->user_ptr[1];
15258         struct wireless_dev *wdev = dev->ieee80211_ptr;
15259         const struct nlattr *nla;
15260         bool enabled;
15261
15262         if (!rdev->ops->set_multicast_to_unicast)
15263                 return -EOPNOTSUPP;
15264
15265         if (wdev->iftype != NL80211_IFTYPE_AP &&
15266             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15267                 return -EOPNOTSUPP;
15268
15269         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15270         enabled = nla_get_flag(nla);
15271
15272         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15273 }
15274
15275 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15276 {
15277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15278         struct net_device *dev = info->user_ptr[1];
15279         struct wireless_dev *wdev = dev->ieee80211_ptr;
15280         struct cfg80211_pmk_conf pmk_conf = {};
15281         int ret;
15282
15283         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15284             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15285                 return -EOPNOTSUPP;
15286
15287         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15288                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15289                 return -EOPNOTSUPP;
15290
15291         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15292                 return -EINVAL;
15293
15294         wdev_lock(wdev);
15295         if (!wdev->connected) {
15296                 ret = -ENOTCONN;
15297                 goto out;
15298         }
15299
15300         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15301         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15302                 ret = -EINVAL;
15303                 goto out;
15304         }
15305
15306         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15307         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15308         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15309             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15310                 ret = -EINVAL;
15311                 goto out;
15312         }
15313
15314         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15315                 pmk_conf.pmk_r0_name =
15316                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15317
15318         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15319 out:
15320         wdev_unlock(wdev);
15321         return ret;
15322 }
15323
15324 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15325 {
15326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15327         struct net_device *dev = info->user_ptr[1];
15328         struct wireless_dev *wdev = dev->ieee80211_ptr;
15329         const u8 *aa;
15330         int ret;
15331
15332         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15333             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15334                 return -EOPNOTSUPP;
15335
15336         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15337                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15338                 return -EOPNOTSUPP;
15339
15340         if (!info->attrs[NL80211_ATTR_MAC])
15341                 return -EINVAL;
15342
15343         wdev_lock(wdev);
15344         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15345         ret = rdev_del_pmk(rdev, dev, aa);
15346         wdev_unlock(wdev);
15347
15348         return ret;
15349 }
15350
15351 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15352 {
15353         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15354         struct net_device *dev = info->user_ptr[1];
15355         struct cfg80211_external_auth_params params;
15356
15357         if (!rdev->ops->external_auth)
15358                 return -EOPNOTSUPP;
15359
15360         if (!info->attrs[NL80211_ATTR_SSID] &&
15361             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15362             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15363                 return -EINVAL;
15364
15365         if (!info->attrs[NL80211_ATTR_BSSID])
15366                 return -EINVAL;
15367
15368         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15369                 return -EINVAL;
15370
15371         memset(&params, 0, sizeof(params));
15372
15373         if (info->attrs[NL80211_ATTR_SSID]) {
15374                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15375                 if (params.ssid.ssid_len == 0)
15376                         return -EINVAL;
15377                 memcpy(params.ssid.ssid,
15378                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15379                        params.ssid.ssid_len);
15380         }
15381
15382         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15383                ETH_ALEN);
15384
15385         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15386
15387         if (info->attrs[NL80211_ATTR_PMKID])
15388                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15389
15390         return rdev_external_auth(rdev, dev, &params);
15391 }
15392
15393 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15394 {
15395         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15397         struct net_device *dev = info->user_ptr[1];
15398         struct wireless_dev *wdev = dev->ieee80211_ptr;
15399         const u8 *buf;
15400         size_t len;
15401         u8 *dest;
15402         u16 proto;
15403         bool noencrypt;
15404         u64 cookie = 0;
15405         int link_id;
15406         int err;
15407
15408         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15409                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15410                 return -EOPNOTSUPP;
15411
15412         if (!rdev->ops->tx_control_port)
15413                 return -EOPNOTSUPP;
15414
15415         if (!info->attrs[NL80211_ATTR_FRAME] ||
15416             !info->attrs[NL80211_ATTR_MAC] ||
15417             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15418                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15419                 return -EINVAL;
15420         }
15421
15422         wdev_lock(wdev);
15423
15424         switch (wdev->iftype) {
15425         case NL80211_IFTYPE_AP:
15426         case NL80211_IFTYPE_P2P_GO:
15427         case NL80211_IFTYPE_MESH_POINT:
15428                 break;
15429         case NL80211_IFTYPE_ADHOC:
15430                 if (wdev->u.ibss.current_bss)
15431                         break;
15432                 err = -ENOTCONN;
15433                 goto out;
15434         case NL80211_IFTYPE_STATION:
15435         case NL80211_IFTYPE_P2P_CLIENT:
15436                 if (wdev->connected)
15437                         break;
15438                 err = -ENOTCONN;
15439                 goto out;
15440         default:
15441                 err = -EOPNOTSUPP;
15442                 goto out;
15443         }
15444
15445         wdev_unlock(wdev);
15446
15447         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15448         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15449         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15450         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15451         noencrypt =
15452                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15453
15454         link_id = nl80211_link_id_or_invalid(info->attrs);
15455
15456         err = rdev_tx_control_port(rdev, dev, buf, len,
15457                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15458                                    dont_wait_for_ack ? NULL : &cookie);
15459         if (!err && !dont_wait_for_ack)
15460                 nl_set_extack_cookie_u64(info->extack, cookie);
15461         return err;
15462  out:
15463         wdev_unlock(wdev);
15464         return err;
15465 }
15466
15467 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15468                                            struct genl_info *info)
15469 {
15470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15471         struct net_device *dev = info->user_ptr[1];
15472         struct wireless_dev *wdev = dev->ieee80211_ptr;
15473         struct cfg80211_ftm_responder_stats ftm_stats = {};
15474         unsigned int link_id = nl80211_link_id(info->attrs);
15475         struct sk_buff *msg;
15476         void *hdr;
15477         struct nlattr *ftm_stats_attr;
15478         int err;
15479
15480         if (wdev->iftype != NL80211_IFTYPE_AP ||
15481             !wdev->links[link_id].ap.beacon_interval)
15482                 return -EOPNOTSUPP;
15483
15484         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15485         if (err)
15486                 return err;
15487
15488         if (!ftm_stats.filled)
15489                 return -ENODATA;
15490
15491         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15492         if (!msg)
15493                 return -ENOMEM;
15494
15495         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15496                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15497         if (!hdr)
15498                 goto nla_put_failure;
15499
15500         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15501                 goto nla_put_failure;
15502
15503         ftm_stats_attr = nla_nest_start_noflag(msg,
15504                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15505         if (!ftm_stats_attr)
15506                 goto nla_put_failure;
15507
15508 #define SET_FTM(field, name, type)                                       \
15509         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15510             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15511                              ftm_stats.field))                           \
15512                 goto nla_put_failure; } while (0)
15513 #define SET_FTM_U64(field, name)                                         \
15514         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15515             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15516                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15517                 goto nla_put_failure; } while (0)
15518
15519         SET_FTM(success_num, SUCCESS_NUM, u32);
15520         SET_FTM(partial_num, PARTIAL_NUM, u32);
15521         SET_FTM(failed_num, FAILED_NUM, u32);
15522         SET_FTM(asap_num, ASAP_NUM, u32);
15523         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15524         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15525         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15526         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15527         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15528 #undef SET_FTM
15529
15530         nla_nest_end(msg, ftm_stats_attr);
15531
15532         genlmsg_end(msg, hdr);
15533         return genlmsg_reply(msg, info);
15534
15535 nla_put_failure:
15536         nlmsg_free(msg);
15537         return -ENOBUFS;
15538 }
15539
15540 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15541 {
15542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15543         struct cfg80211_update_owe_info owe_info;
15544         struct net_device *dev = info->user_ptr[1];
15545
15546         if (!rdev->ops->update_owe_info)
15547                 return -EOPNOTSUPP;
15548
15549         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15550             !info->attrs[NL80211_ATTR_MAC])
15551                 return -EINVAL;
15552
15553         memset(&owe_info, 0, sizeof(owe_info));
15554         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15555         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15556
15557         if (info->attrs[NL80211_ATTR_IE]) {
15558                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15559                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15560         }
15561
15562         return rdev_update_owe_info(rdev, dev, &owe_info);
15563 }
15564
15565 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15566 {
15567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15568         struct net_device *dev = info->user_ptr[1];
15569         struct wireless_dev *wdev = dev->ieee80211_ptr;
15570         struct station_info sinfo = {};
15571         const u8 *buf;
15572         size_t len;
15573         u8 *dest;
15574         int err;
15575
15576         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15577                 return -EOPNOTSUPP;
15578
15579         if (!info->attrs[NL80211_ATTR_MAC] ||
15580             !info->attrs[NL80211_ATTR_FRAME]) {
15581                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15582                 return -EINVAL;
15583         }
15584
15585         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15586                 return -EOPNOTSUPP;
15587
15588         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15589         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15590         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15591
15592         if (len < sizeof(struct ethhdr))
15593                 return -EINVAL;
15594
15595         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15596             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15597                 return -EINVAL;
15598
15599         err = rdev_get_station(rdev, dev, dest, &sinfo);
15600         if (err)
15601                 return err;
15602
15603         cfg80211_sinfo_release_content(&sinfo);
15604
15605         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15606 }
15607
15608 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15609                           struct nlattr *attrs[], struct net_device *dev,
15610                           struct cfg80211_tid_cfg *tid_conf,
15611                           struct genl_info *info, const u8 *peer,
15612                           unsigned int link_id)
15613 {
15614         struct netlink_ext_ack *extack = info->extack;
15615         u64 mask;
15616         int err;
15617
15618         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15619                 return -EINVAL;
15620
15621         tid_conf->config_override =
15622                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15623         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15624
15625         if (tid_conf->config_override) {
15626                 if (rdev->ops->reset_tid_config) {
15627                         err = rdev_reset_tid_config(rdev, dev, peer,
15628                                                     tid_conf->tids);
15629                         if (err)
15630                                 return err;
15631                 } else {
15632                         return -EINVAL;
15633                 }
15634         }
15635
15636         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15637                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15638                 tid_conf->noack =
15639                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15640         }
15641
15642         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15643                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15644                 tid_conf->retry_short =
15645                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15646
15647                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15648                         return -EINVAL;
15649         }
15650
15651         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15652                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15653                 tid_conf->retry_long =
15654                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15655
15656                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15657                         return -EINVAL;
15658         }
15659
15660         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15661                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15662                 tid_conf->ampdu =
15663                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15664         }
15665
15666         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15667                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15668                 tid_conf->rtscts =
15669                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15670         }
15671
15672         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15673                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15674                 tid_conf->amsdu =
15675                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15676         }
15677
15678         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15679                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15680
15681                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15682
15683                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15684                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15685                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15686                                                     &tid_conf->txrate_mask, dev,
15687                                                     true, link_id);
15688                         if (err)
15689                                 return err;
15690
15691                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15692                 }
15693                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15694         }
15695
15696         if (peer)
15697                 mask = rdev->wiphy.tid_config_support.peer;
15698         else
15699                 mask = rdev->wiphy.tid_config_support.vif;
15700
15701         if (tid_conf->mask & ~mask) {
15702                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15703                 return -ENOTSUPP;
15704         }
15705
15706         return 0;
15707 }
15708
15709 static int nl80211_set_tid_config(struct sk_buff *skb,
15710                                   struct genl_info *info)
15711 {
15712         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15713         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15714         unsigned int link_id = nl80211_link_id(info->attrs);
15715         struct net_device *dev = info->user_ptr[1];
15716         struct cfg80211_tid_config *tid_config;
15717         struct nlattr *tid;
15718         int conf_idx = 0, rem_conf;
15719         int ret = -EINVAL;
15720         u32 num_conf = 0;
15721
15722         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15723                 return -EINVAL;
15724
15725         if (!rdev->ops->set_tid_config)
15726                 return -EOPNOTSUPP;
15727
15728         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15729                             rem_conf)
15730                 num_conf++;
15731
15732         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15733                              GFP_KERNEL);
15734         if (!tid_config)
15735                 return -ENOMEM;
15736
15737         tid_config->n_tid_conf = num_conf;
15738
15739         if (info->attrs[NL80211_ATTR_MAC])
15740                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15741
15742         wdev_lock(dev->ieee80211_ptr);
15743
15744         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15745                             rem_conf) {
15746                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15747                                        tid, NULL, NULL);
15748
15749                 if (ret)
15750                         goto bad_tid_conf;
15751
15752                 ret = parse_tid_conf(rdev, attrs, dev,
15753                                      &tid_config->tid_conf[conf_idx],
15754                                      info, tid_config->peer, link_id);
15755                 if (ret)
15756                         goto bad_tid_conf;
15757
15758                 conf_idx++;
15759         }
15760
15761         ret = rdev_set_tid_config(rdev, dev, tid_config);
15762
15763 bad_tid_conf:
15764         kfree(tid_config);
15765         wdev_unlock(dev->ieee80211_ptr);
15766         return ret;
15767 }
15768
15769 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15770 {
15771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15772         struct cfg80211_color_change_settings params = {};
15773         struct net_device *dev = info->user_ptr[1];
15774         struct wireless_dev *wdev = dev->ieee80211_ptr;
15775         struct nlattr **tb;
15776         u16 offset;
15777         int err;
15778
15779         if (!rdev->ops->color_change)
15780                 return -EOPNOTSUPP;
15781
15782         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15783                                      NL80211_EXT_FEATURE_BSS_COLOR))
15784                 return -EOPNOTSUPP;
15785
15786         if (wdev->iftype != NL80211_IFTYPE_AP)
15787                 return -EOPNOTSUPP;
15788
15789         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15790             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15791             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15792                 return -EINVAL;
15793
15794         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15795         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15796
15797         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next);
15798         if (err)
15799                 return err;
15800
15801         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15802         if (!tb)
15803                 return -ENOMEM;
15804
15805         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15806                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15807                                nl80211_policy, info->extack);
15808         if (err)
15809                 goto out;
15810
15811         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change);
15812         if (err)
15813                 goto out;
15814
15815         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15816                 err = -EINVAL;
15817                 goto out;
15818         }
15819
15820         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15821                 err = -EINVAL;
15822                 goto out;
15823         }
15824
15825         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15826         if (offset >= params.beacon_color_change.tail_len) {
15827                 err = -EINVAL;
15828                 goto out;
15829         }
15830
15831         if (params.beacon_color_change.tail[offset] != params.count) {
15832                 err = -EINVAL;
15833                 goto out;
15834         }
15835
15836         params.counter_offset_beacon = offset;
15837
15838         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
15839                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
15840                     sizeof(u16)) {
15841                         err = -EINVAL;
15842                         goto out;
15843                 }
15844
15845                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
15846                 if (offset >= params.beacon_color_change.probe_resp_len) {
15847                         err = -EINVAL;
15848                         goto out;
15849                 }
15850
15851                 if (params.beacon_color_change.probe_resp[offset] !=
15852                     params.count) {
15853                         err = -EINVAL;
15854                         goto out;
15855                 }
15856
15857                 params.counter_offset_presp = offset;
15858         }
15859
15860         wdev_lock(wdev);
15861         err = rdev_color_change(rdev, dev, &params);
15862         wdev_unlock(wdev);
15863
15864 out:
15865         kfree(params.beacon_next.mbssid_ies);
15866         kfree(params.beacon_color_change.mbssid_ies);
15867         kfree(tb);
15868         return err;
15869 }
15870
15871 static int nl80211_set_fils_aad(struct sk_buff *skb,
15872                                 struct genl_info *info)
15873 {
15874         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15875         struct net_device *dev = info->user_ptr[1];
15876         struct cfg80211_fils_aad fils_aad = {};
15877         u8 *nonces;
15878
15879         if (!info->attrs[NL80211_ATTR_MAC] ||
15880             !info->attrs[NL80211_ATTR_FILS_KEK] ||
15881             !info->attrs[NL80211_ATTR_FILS_NONCES])
15882                 return -EINVAL;
15883
15884         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15885         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
15886         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
15887         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
15888         fils_aad.snonce = nonces;
15889         fils_aad.anonce = nonces + FILS_NONCE_LEN;
15890
15891         return rdev_set_fils_aad(rdev, dev, &fils_aad);
15892 }
15893
15894 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
15895 {
15896         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15897         unsigned int link_id = nl80211_link_id(info->attrs);
15898         struct net_device *dev = info->user_ptr[1];
15899         struct wireless_dev *wdev = dev->ieee80211_ptr;
15900         int ret;
15901
15902         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
15903                 return -EINVAL;
15904
15905         switch (wdev->iftype) {
15906         case NL80211_IFTYPE_AP:
15907                 break;
15908         default:
15909                 return -EINVAL;
15910         }
15911
15912         if (!info->attrs[NL80211_ATTR_MAC] ||
15913             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
15914                 return -EINVAL;
15915
15916         wdev_lock(wdev);
15917         wdev->valid_links |= BIT(link_id);
15918         ether_addr_copy(wdev->links[link_id].addr,
15919                         nla_data(info->attrs[NL80211_ATTR_MAC]));
15920
15921         ret = rdev_add_intf_link(rdev, wdev, link_id);
15922         if (ret) {
15923                 wdev->valid_links &= ~BIT(link_id);
15924                 eth_zero_addr(wdev->links[link_id].addr);
15925         }
15926         wdev_unlock(wdev);
15927
15928         return ret;
15929 }
15930
15931 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
15932 {
15933         unsigned int link_id = nl80211_link_id(info->attrs);
15934         struct net_device *dev = info->user_ptr[1];
15935         struct wireless_dev *wdev = dev->ieee80211_ptr;
15936
15937         /* cannot remove if there's no link */
15938         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
15939                 return -EINVAL;
15940
15941         switch (wdev->iftype) {
15942         case NL80211_IFTYPE_AP:
15943                 break;
15944         default:
15945                 return -EINVAL;
15946         }
15947
15948         wdev_lock(wdev);
15949         cfg80211_remove_link(wdev, link_id);
15950         wdev_unlock(wdev);
15951
15952         return 0;
15953 }
15954
15955 static int
15956 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
15957                              bool add)
15958 {
15959         struct link_station_parameters params = {};
15960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15961         struct net_device *dev = info->user_ptr[1];
15962         int err;
15963
15964         if ((add && !rdev->ops->add_link_station) ||
15965             (!add && !rdev->ops->mod_link_station))
15966                 return -EOPNOTSUPP;
15967
15968         if (add && !info->attrs[NL80211_ATTR_MAC])
15969                 return -EINVAL;
15970
15971         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
15972                 return -EINVAL;
15973
15974         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
15975                 return -EINVAL;
15976
15977         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
15978
15979         if (info->attrs[NL80211_ATTR_MAC]) {
15980                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
15981                 if (!is_valid_ether_addr(params.link_mac))
15982                         return -EINVAL;
15983         }
15984
15985         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
15986                 return -EINVAL;
15987
15988         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
15989
15990         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
15991                 params.supported_rates =
15992                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
15993                 params.supported_rates_len =
15994                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
15995         }
15996
15997         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
15998                 params.ht_capa =
15999                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16000
16001         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16002                 params.vht_capa =
16003                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16004
16005         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16006                 params.he_capa =
16007                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16008                 params.he_capa_len =
16009                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16010
16011                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16012                         params.eht_capa =
16013                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16014                         params.eht_capa_len =
16015                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16016
16017                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16018                                                         (const u8 *)params.eht_capa,
16019                                                         params.eht_capa_len,
16020                                                         false))
16021                                 return -EINVAL;
16022                 }
16023         }
16024
16025         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16026                 params.he_6ghz_capa =
16027                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16028
16029         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16030                 params.opmode_notif_used = true;
16031                 params.opmode_notif =
16032                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16033         }
16034
16035         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16036                                                 &params.txpwr_set);
16037         if (err)
16038                 return err;
16039
16040         wdev_lock(dev->ieee80211_ptr);
16041         if (add)
16042                 err = rdev_add_link_station(rdev, dev, &params);
16043         else
16044                 err = rdev_mod_link_station(rdev, dev, &params);
16045         wdev_unlock(dev->ieee80211_ptr);
16046
16047         return err;
16048 }
16049
16050 static int
16051 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16052 {
16053         return nl80211_add_mod_link_station(skb, info, true);
16054 }
16055
16056 static int
16057 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16058 {
16059         return nl80211_add_mod_link_station(skb, info, false);
16060 }
16061
16062 static int
16063 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16064 {
16065         struct link_station_del_parameters params = {};
16066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16067         struct net_device *dev = info->user_ptr[1];
16068         int ret;
16069
16070         if (!rdev->ops->del_link_station)
16071                 return -EOPNOTSUPP;
16072
16073         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16074             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16075                 return -EINVAL;
16076
16077         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16078         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16079
16080         wdev_lock(dev->ieee80211_ptr);
16081         ret = rdev_del_link_station(rdev, dev, &params);
16082         wdev_unlock(dev->ieee80211_ptr);
16083
16084         return ret;
16085 }
16086
16087 #define NL80211_FLAG_NEED_WIPHY         0x01
16088 #define NL80211_FLAG_NEED_NETDEV        0x02
16089 #define NL80211_FLAG_NEED_RTNL          0x04
16090 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16091 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16092                                          NL80211_FLAG_CHECK_NETDEV_UP)
16093 #define NL80211_FLAG_NEED_WDEV          0x10
16094 /* If a netdev is associated, it must be UP, P2P must be started */
16095 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16096                                          NL80211_FLAG_CHECK_NETDEV_UP)
16097 #define NL80211_FLAG_CLEAR_SKB          0x20
16098 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16099 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16100 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16101
16102 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16103         SELECTOR(__sel, NONE, 0) /* must be first */    \
16104         SELECTOR(__sel, WIPHY,                          \
16105                  NL80211_FLAG_NEED_WIPHY)               \
16106         SELECTOR(__sel, WDEV,                           \
16107                  NL80211_FLAG_NEED_WDEV)                \
16108         SELECTOR(__sel, NETDEV,                         \
16109                  NL80211_FLAG_NEED_NETDEV)              \
16110         SELECTOR(__sel, NETDEV_LINK,                    \
16111                  NL80211_FLAG_NEED_NETDEV |             \
16112                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16113         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16114                  NL80211_FLAG_NEED_NETDEV |             \
16115                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16116         SELECTOR(__sel, WIPHY_RTNL,                     \
16117                  NL80211_FLAG_NEED_WIPHY |              \
16118                  NL80211_FLAG_NEED_RTNL)                \
16119         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16120                  NL80211_FLAG_NEED_WIPHY |              \
16121                  NL80211_FLAG_NEED_RTNL |               \
16122                  NL80211_FLAG_NO_WIPHY_MTX)             \
16123         SELECTOR(__sel, WDEV_RTNL,                      \
16124                  NL80211_FLAG_NEED_WDEV |               \
16125                  NL80211_FLAG_NEED_RTNL)                \
16126         SELECTOR(__sel, NETDEV_RTNL,                    \
16127                  NL80211_FLAG_NEED_NETDEV |             \
16128                  NL80211_FLAG_NEED_RTNL)                \
16129         SELECTOR(__sel, NETDEV_UP,                      \
16130                  NL80211_FLAG_NEED_NETDEV_UP)           \
16131         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16132                  NL80211_FLAG_NEED_NETDEV_UP |          \
16133                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16134         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16135                  NL80211_FLAG_NEED_NETDEV_UP |          \
16136                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16137         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16138                  NL80211_FLAG_NEED_NETDEV_UP |          \
16139                  NL80211_FLAG_CLEAR_SKB |               \
16140                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16141         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16142                  NL80211_FLAG_NEED_NETDEV_UP |          \
16143                  NL80211_FLAG_NO_WIPHY_MTX)             \
16144         SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,          \
16145                  NL80211_FLAG_NEED_NETDEV_UP |          \
16146                  NL80211_FLAG_NO_WIPHY_MTX |            \
16147                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16148         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16149                  NL80211_FLAG_NEED_NETDEV_UP |          \
16150                  NL80211_FLAG_CLEAR_SKB)                \
16151         SELECTOR(__sel, WDEV_UP,                        \
16152                  NL80211_FLAG_NEED_WDEV_UP)             \
16153         SELECTOR(__sel, WDEV_UP_LINK,                   \
16154                  NL80211_FLAG_NEED_WDEV_UP |            \
16155                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16156         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16157                  NL80211_FLAG_NEED_WDEV_UP |            \
16158                  NL80211_FLAG_NEED_RTNL)                \
16159         SELECTOR(__sel, WIPHY_CLEAR,                    \
16160                  NL80211_FLAG_NEED_WIPHY |              \
16161                  NL80211_FLAG_CLEAR_SKB)
16162
16163 enum nl80211_internal_flags_selector {
16164 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16165         INTERNAL_FLAG_SELECTORS(_)
16166 #undef SELECTOR
16167 };
16168
16169 static u32 nl80211_internal_flags[] = {
16170 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16171         INTERNAL_FLAG_SELECTORS(_)
16172 #undef SELECTOR
16173 };
16174
16175 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
16176                             struct genl_info *info)
16177 {
16178         struct cfg80211_registered_device *rdev = NULL;
16179         struct wireless_dev *wdev = NULL;
16180         struct net_device *dev = NULL;
16181         u32 internal_flags;
16182         int err;
16183
16184         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16185                 return -EINVAL;
16186
16187         internal_flags = nl80211_internal_flags[ops->internal_flags];
16188
16189         rtnl_lock();
16190         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16191                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16192                 if (IS_ERR(rdev)) {
16193                         err = PTR_ERR(rdev);
16194                         goto out_unlock;
16195                 }
16196                 info->user_ptr[0] = rdev;
16197         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16198                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16199                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16200                                                   info->attrs);
16201                 if (IS_ERR(wdev)) {
16202                         err = PTR_ERR(wdev);
16203                         goto out_unlock;
16204                 }
16205
16206                 dev = wdev->netdev;
16207                 dev_hold(dev);
16208                 rdev = wiphy_to_rdev(wdev->wiphy);
16209
16210                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16211                         if (!dev) {
16212                                 err = -EINVAL;
16213                                 goto out_unlock;
16214                         }
16215
16216                         info->user_ptr[1] = dev;
16217                 } else {
16218                         info->user_ptr[1] = wdev;
16219                 }
16220
16221                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16222                     !wdev_running(wdev)) {
16223                         err = -ENETDOWN;
16224                         goto out_unlock;
16225                 }
16226
16227                 info->user_ptr[0] = rdev;
16228         }
16229
16230         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16231                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16232
16233                 if (!wdev) {
16234                         err = -EINVAL;
16235                         goto out_unlock;
16236                 }
16237
16238                 /* MLO -> require valid link ID */
16239                 if (wdev->valid_links &&
16240                     (!link_id ||
16241                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16242                         err = -EINVAL;
16243                         goto out_unlock;
16244                 }
16245
16246                 /* non-MLO -> no link ID attribute accepted */
16247                 if (!wdev->valid_links && link_id) {
16248                         err = -EINVAL;
16249                         goto out_unlock;
16250                 }
16251         }
16252
16253         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16254                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16255                     (wdev && wdev->valid_links)) {
16256                         err = -EINVAL;
16257                         goto out_unlock;
16258                 }
16259         }
16260
16261         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16262                 wiphy_lock(&rdev->wiphy);
16263                 /* we keep the mutex locked until post_doit */
16264                 __release(&rdev->wiphy.mtx);
16265         }
16266         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16267                 rtnl_unlock();
16268
16269         return 0;
16270 out_unlock:
16271         rtnl_unlock();
16272         dev_put(dev);
16273         return err;
16274 }
16275
16276 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
16277                               struct genl_info *info)
16278 {
16279         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16280
16281         if (info->user_ptr[1]) {
16282                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16283                         struct wireless_dev *wdev = info->user_ptr[1];
16284
16285                         dev_put(wdev->netdev);
16286                 } else {
16287                         dev_put(info->user_ptr[1]);
16288                 }
16289         }
16290
16291         if (info->user_ptr[0] &&
16292             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16293                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16294
16295                 /* we kept the mutex locked since pre_doit */
16296                 __acquire(&rdev->wiphy.mtx);
16297                 wiphy_unlock(&rdev->wiphy);
16298         }
16299
16300         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16301                 rtnl_unlock();
16302
16303         /* If needed, clear the netlink message payload from the SKB
16304          * as it might contain key data that shouldn't stick around on
16305          * the heap after the SKB is freed. The netlink message header
16306          * is still needed for further processing, so leave it intact.
16307          */
16308         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16309                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16310
16311                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16312         }
16313 }
16314
16315 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16316                                      struct cfg80211_sar_specs *sar_specs,
16317                                      struct nlattr *spec[], int index)
16318 {
16319         u32 range_index, i;
16320
16321         if (!sar_specs || !spec)
16322                 return -EINVAL;
16323
16324         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16325             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16326                 return -EINVAL;
16327
16328         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16329
16330         /* check if range_index exceeds num_freq_ranges */
16331         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16332                 return -EINVAL;
16333
16334         /* check if range_index duplicates */
16335         for (i = 0; i < index; i++) {
16336                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16337                         return -EINVAL;
16338         }
16339
16340         sar_specs->sub_specs[index].power =
16341                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16342
16343         sar_specs->sub_specs[index].freq_range_index = range_index;
16344
16345         return 0;
16346 }
16347
16348 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16349 {
16350         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16351         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16352         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16353         struct cfg80211_sar_specs *sar_spec;
16354         enum nl80211_sar_type type;
16355         struct nlattr *spec_list;
16356         u32 specs;
16357         int rem, err;
16358
16359         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16360                 return -EOPNOTSUPP;
16361
16362         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16363                 return -EINVAL;
16364
16365         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16366                          info->attrs[NL80211_ATTR_SAR_SPEC],
16367                          NULL, NULL);
16368
16369         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16370                 return -EINVAL;
16371
16372         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16373         if (type != rdev->wiphy.sar_capa->type)
16374                 return -EINVAL;
16375
16376         specs = 0;
16377         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16378                 specs++;
16379
16380         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16381                 return -EINVAL;
16382
16383         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16384         if (!sar_spec)
16385                 return -ENOMEM;
16386
16387         sar_spec->type = type;
16388         specs = 0;
16389         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16390                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16391                                  spec_list, NULL, NULL);
16392
16393                 switch (type) {
16394                 case NL80211_SAR_TYPE_POWER:
16395                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16396                                                       spec, specs)) {
16397                                 err = -EINVAL;
16398                                 goto error;
16399                         }
16400                         break;
16401                 default:
16402                         err = -EINVAL;
16403                         goto error;
16404                 }
16405                 specs++;
16406         }
16407
16408         sar_spec->num_sub_specs = specs;
16409
16410         rdev->cur_cmd_info = info;
16411         err = rdev_set_sar_specs(rdev, sar_spec);
16412         rdev->cur_cmd_info = NULL;
16413 error:
16414         kfree(sar_spec);
16415         return err;
16416 }
16417
16418 #define SELECTOR(__sel, name, value) \
16419         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16420 int __missing_selector(void);
16421 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16422
16423 static const struct genl_ops nl80211_ops[] = {
16424         {
16425                 .cmd = NL80211_CMD_GET_WIPHY,
16426                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16427                 .doit = nl80211_get_wiphy,
16428                 .dumpit = nl80211_dump_wiphy,
16429                 .done = nl80211_dump_wiphy_done,
16430                 /* can be retrieved by unprivileged users */
16431                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16432         },
16433 };
16434
16435 static const struct genl_small_ops nl80211_small_ops[] = {
16436         {
16437                 .cmd = NL80211_CMD_SET_WIPHY,
16438                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16439                 .doit = nl80211_set_wiphy,
16440                 .flags = GENL_UNS_ADMIN_PERM,
16441         },
16442         {
16443                 .cmd = NL80211_CMD_GET_INTERFACE,
16444                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16445                 .doit = nl80211_get_interface,
16446                 .dumpit = nl80211_dump_interface,
16447                 /* can be retrieved by unprivileged users */
16448                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16449         },
16450         {
16451                 .cmd = NL80211_CMD_SET_INTERFACE,
16452                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16453                 .doit = nl80211_set_interface,
16454                 .flags = GENL_UNS_ADMIN_PERM,
16455                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16456                                          NL80211_FLAG_NEED_RTNL),
16457         },
16458         {
16459                 .cmd = NL80211_CMD_NEW_INTERFACE,
16460                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16461                 .doit = nl80211_new_interface,
16462                 .flags = GENL_UNS_ADMIN_PERM,
16463                 .internal_flags =
16464                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
16465                                NL80211_FLAG_NEED_RTNL |
16466                                /* we take the wiphy mutex later ourselves */
16467                                NL80211_FLAG_NO_WIPHY_MTX),
16468         },
16469         {
16470                 .cmd = NL80211_CMD_DEL_INTERFACE,
16471                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16472                 .doit = nl80211_del_interface,
16473                 .flags = GENL_UNS_ADMIN_PERM,
16474                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16475                                          NL80211_FLAG_NEED_RTNL),
16476         },
16477         {
16478                 .cmd = NL80211_CMD_GET_KEY,
16479                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16480                 .doit = nl80211_get_key,
16481                 .flags = GENL_UNS_ADMIN_PERM,
16482                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16483         },
16484         {
16485                 .cmd = NL80211_CMD_SET_KEY,
16486                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16487                 .doit = nl80211_set_key,
16488                 .flags = GENL_UNS_ADMIN_PERM,
16489                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16490                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16491                                          NL80211_FLAG_CLEAR_SKB),
16492         },
16493         {
16494                 .cmd = NL80211_CMD_NEW_KEY,
16495                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16496                 .doit = nl80211_new_key,
16497                 .flags = GENL_UNS_ADMIN_PERM,
16498                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16499                                          NL80211_FLAG_CLEAR_SKB),
16500         },
16501         {
16502                 .cmd = NL80211_CMD_DEL_KEY,
16503                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16504                 .doit = nl80211_del_key,
16505                 .flags = GENL_UNS_ADMIN_PERM,
16506                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16507         },
16508         {
16509                 .cmd = NL80211_CMD_SET_BEACON,
16510                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16511                 .flags = GENL_UNS_ADMIN_PERM,
16512                 .doit = nl80211_set_beacon,
16513                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16514                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16515         },
16516         {
16517                 .cmd = NL80211_CMD_START_AP,
16518                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16519                 .flags = GENL_UNS_ADMIN_PERM,
16520                 .doit = nl80211_start_ap,
16521                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16522                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16523         },
16524         {
16525                 .cmd = NL80211_CMD_STOP_AP,
16526                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16527                 .flags = GENL_UNS_ADMIN_PERM,
16528                 .doit = nl80211_stop_ap,
16529                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16530                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16531         },
16532         {
16533                 .cmd = NL80211_CMD_GET_STATION,
16534                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16535                 .doit = nl80211_get_station,
16536                 .dumpit = nl80211_dump_station,
16537                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16538         },
16539         {
16540                 .cmd = NL80211_CMD_SET_STATION,
16541                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16542                 .doit = nl80211_set_station,
16543                 .flags = GENL_UNS_ADMIN_PERM,
16544                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16545         },
16546         {
16547                 .cmd = NL80211_CMD_NEW_STATION,
16548                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16549                 .doit = nl80211_new_station,
16550                 .flags = GENL_UNS_ADMIN_PERM,
16551                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16552         },
16553         {
16554                 .cmd = NL80211_CMD_DEL_STATION,
16555                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16556                 .doit = nl80211_del_station,
16557                 .flags = GENL_UNS_ADMIN_PERM,
16558                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16559         },
16560         {
16561                 .cmd = NL80211_CMD_GET_MPATH,
16562                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16563                 .doit = nl80211_get_mpath,
16564                 .dumpit = nl80211_dump_mpath,
16565                 .flags = GENL_UNS_ADMIN_PERM,
16566                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16567         },
16568         {
16569                 .cmd = NL80211_CMD_GET_MPP,
16570                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16571                 .doit = nl80211_get_mpp,
16572                 .dumpit = nl80211_dump_mpp,
16573                 .flags = GENL_UNS_ADMIN_PERM,
16574                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16575         },
16576         {
16577                 .cmd = NL80211_CMD_SET_MPATH,
16578                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16579                 .doit = nl80211_set_mpath,
16580                 .flags = GENL_UNS_ADMIN_PERM,
16581                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16582         },
16583         {
16584                 .cmd = NL80211_CMD_NEW_MPATH,
16585                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16586                 .doit = nl80211_new_mpath,
16587                 .flags = GENL_UNS_ADMIN_PERM,
16588                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16589         },
16590         {
16591                 .cmd = NL80211_CMD_DEL_MPATH,
16592                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16593                 .doit = nl80211_del_mpath,
16594                 .flags = GENL_UNS_ADMIN_PERM,
16595                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16596         },
16597         {
16598                 .cmd = NL80211_CMD_SET_BSS,
16599                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16600                 .doit = nl80211_set_bss,
16601                 .flags = GENL_UNS_ADMIN_PERM,
16602                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16603         },
16604         {
16605                 .cmd = NL80211_CMD_GET_REG,
16606                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16607                 .doit = nl80211_get_reg_do,
16608                 .dumpit = nl80211_get_reg_dump,
16609                 /* can be retrieved by unprivileged users */
16610         },
16611 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16612         {
16613                 .cmd = NL80211_CMD_SET_REG,
16614                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16615                 .doit = nl80211_set_reg,
16616                 .flags = GENL_ADMIN_PERM,
16617         },
16618 #endif
16619         {
16620                 .cmd = NL80211_CMD_REQ_SET_REG,
16621                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16622                 .doit = nl80211_req_set_reg,
16623                 .flags = GENL_ADMIN_PERM,
16624         },
16625         {
16626                 .cmd = NL80211_CMD_RELOAD_REGDB,
16627                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16628                 .doit = nl80211_reload_regdb,
16629                 .flags = GENL_ADMIN_PERM,
16630         },
16631         {
16632                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16633                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16634                 .doit = nl80211_get_mesh_config,
16635                 /* can be retrieved by unprivileged users */
16636                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16637         },
16638         {
16639                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16640                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16641                 .doit = nl80211_update_mesh_config,
16642                 .flags = GENL_UNS_ADMIN_PERM,
16643                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16644         },
16645         {
16646                 .cmd = NL80211_CMD_TRIGGER_SCAN,
16647                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16648                 .doit = nl80211_trigger_scan,
16649                 .flags = GENL_UNS_ADMIN_PERM,
16650                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16651         },
16652         {
16653                 .cmd = NL80211_CMD_ABORT_SCAN,
16654                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16655                 .doit = nl80211_abort_scan,
16656                 .flags = GENL_UNS_ADMIN_PERM,
16657                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16658         },
16659         {
16660                 .cmd = NL80211_CMD_GET_SCAN,
16661                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16662                 .dumpit = nl80211_dump_scan,
16663         },
16664         {
16665                 .cmd = NL80211_CMD_START_SCHED_SCAN,
16666                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16667                 .doit = nl80211_start_sched_scan,
16668                 .flags = GENL_UNS_ADMIN_PERM,
16669                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16670         },
16671         {
16672                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16673                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16674                 .doit = nl80211_stop_sched_scan,
16675                 .flags = GENL_UNS_ADMIN_PERM,
16676                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16677         },
16678         {
16679                 .cmd = NL80211_CMD_AUTHENTICATE,
16680                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16681                 .doit = nl80211_authenticate,
16682                 .flags = GENL_UNS_ADMIN_PERM,
16683                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16684                                          NL80211_FLAG_CLEAR_SKB),
16685         },
16686         {
16687                 .cmd = NL80211_CMD_ASSOCIATE,
16688                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16689                 .doit = nl80211_associate,
16690                 .flags = GENL_UNS_ADMIN_PERM,
16691                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16692                                          NL80211_FLAG_CLEAR_SKB),
16693         },
16694         {
16695                 .cmd = NL80211_CMD_DEAUTHENTICATE,
16696                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16697                 .doit = nl80211_deauthenticate,
16698                 .flags = GENL_UNS_ADMIN_PERM,
16699                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16700         },
16701         {
16702                 .cmd = NL80211_CMD_DISASSOCIATE,
16703                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16704                 .doit = nl80211_disassociate,
16705                 .flags = GENL_UNS_ADMIN_PERM,
16706                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16707         },
16708         {
16709                 .cmd = NL80211_CMD_JOIN_IBSS,
16710                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16711                 .doit = nl80211_join_ibss,
16712                 .flags = GENL_UNS_ADMIN_PERM,
16713                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16714         },
16715         {
16716                 .cmd = NL80211_CMD_LEAVE_IBSS,
16717                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16718                 .doit = nl80211_leave_ibss,
16719                 .flags = GENL_UNS_ADMIN_PERM,
16720                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16721         },
16722 #ifdef CONFIG_NL80211_TESTMODE
16723         {
16724                 .cmd = NL80211_CMD_TESTMODE,
16725                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16726                 .doit = nl80211_testmode_do,
16727                 .dumpit = nl80211_testmode_dump,
16728                 .flags = GENL_UNS_ADMIN_PERM,
16729                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16730         },
16731 #endif
16732         {
16733                 .cmd = NL80211_CMD_CONNECT,
16734                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16735                 .doit = nl80211_connect,
16736                 .flags = GENL_UNS_ADMIN_PERM,
16737                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16738                                          NL80211_FLAG_CLEAR_SKB),
16739         },
16740         {
16741                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16742                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16743                 .doit = nl80211_update_connect_params,
16744                 .flags = GENL_ADMIN_PERM,
16745                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16746                                          NL80211_FLAG_CLEAR_SKB),
16747         },
16748         {
16749                 .cmd = NL80211_CMD_DISCONNECT,
16750                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16751                 .doit = nl80211_disconnect,
16752                 .flags = GENL_UNS_ADMIN_PERM,
16753                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16754         },
16755         {
16756                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16757                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16758                 .doit = nl80211_wiphy_netns,
16759                 .flags = GENL_UNS_ADMIN_PERM,
16760                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16761                                          NL80211_FLAG_NEED_RTNL |
16762                                          NL80211_FLAG_NO_WIPHY_MTX),
16763         },
16764         {
16765                 .cmd = NL80211_CMD_GET_SURVEY,
16766                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16767                 .dumpit = nl80211_dump_survey,
16768         },
16769         {
16770                 .cmd = NL80211_CMD_SET_PMKSA,
16771                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16772                 .doit = nl80211_setdel_pmksa,
16773                 .flags = GENL_UNS_ADMIN_PERM,
16774                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16775                                          NL80211_FLAG_CLEAR_SKB),
16776         },
16777         {
16778                 .cmd = NL80211_CMD_DEL_PMKSA,
16779                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16780                 .doit = nl80211_setdel_pmksa,
16781                 .flags = GENL_UNS_ADMIN_PERM,
16782                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16783         },
16784         {
16785                 .cmd = NL80211_CMD_FLUSH_PMKSA,
16786                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16787                 .doit = nl80211_flush_pmksa,
16788                 .flags = GENL_UNS_ADMIN_PERM,
16789                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16790         },
16791         {
16792                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16793                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16794                 .doit = nl80211_remain_on_channel,
16795                 .flags = GENL_UNS_ADMIN_PERM,
16796                 /* FIXME: requiring a link ID here is probably not good */
16797                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16798                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16799         },
16800         {
16801                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16802                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16803                 .doit = nl80211_cancel_remain_on_channel,
16804                 .flags = GENL_UNS_ADMIN_PERM,
16805                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16806         },
16807         {
16808                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
16809                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16810                 .doit = nl80211_set_tx_bitrate_mask,
16811                 .flags = GENL_UNS_ADMIN_PERM,
16812                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16813                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16814         },
16815         {
16816                 .cmd = NL80211_CMD_REGISTER_FRAME,
16817                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16818                 .doit = nl80211_register_mgmt,
16819                 .flags = GENL_UNS_ADMIN_PERM,
16820                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16821         },
16822         {
16823                 .cmd = NL80211_CMD_FRAME,
16824                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16825                 .doit = nl80211_tx_mgmt,
16826                 .flags = GENL_UNS_ADMIN_PERM,
16827                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16828         },
16829         {
16830                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
16831                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16832                 .doit = nl80211_tx_mgmt_cancel_wait,
16833                 .flags = GENL_UNS_ADMIN_PERM,
16834                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16835         },
16836         {
16837                 .cmd = NL80211_CMD_SET_POWER_SAVE,
16838                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16839                 .doit = nl80211_set_power_save,
16840                 .flags = GENL_UNS_ADMIN_PERM,
16841                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16842         },
16843         {
16844                 .cmd = NL80211_CMD_GET_POWER_SAVE,
16845                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16846                 .doit = nl80211_get_power_save,
16847                 /* can be retrieved by unprivileged users */
16848                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16849         },
16850         {
16851                 .cmd = NL80211_CMD_SET_CQM,
16852                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16853                 .doit = nl80211_set_cqm,
16854                 .flags = GENL_UNS_ADMIN_PERM,
16855                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16856         },
16857         {
16858                 .cmd = NL80211_CMD_SET_CHANNEL,
16859                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16860                 .doit = nl80211_set_channel,
16861                 .flags = GENL_UNS_ADMIN_PERM,
16862                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16863                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16864         },
16865         {
16866                 .cmd = NL80211_CMD_JOIN_MESH,
16867                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16868                 .doit = nl80211_join_mesh,
16869                 .flags = GENL_UNS_ADMIN_PERM,
16870                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16871         },
16872         {
16873                 .cmd = NL80211_CMD_LEAVE_MESH,
16874                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16875                 .doit = nl80211_leave_mesh,
16876                 .flags = GENL_UNS_ADMIN_PERM,
16877                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16878         },
16879         {
16880                 .cmd = NL80211_CMD_JOIN_OCB,
16881                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16882                 .doit = nl80211_join_ocb,
16883                 .flags = GENL_UNS_ADMIN_PERM,
16884                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16885         },
16886         {
16887                 .cmd = NL80211_CMD_LEAVE_OCB,
16888                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16889                 .doit = nl80211_leave_ocb,
16890                 .flags = GENL_UNS_ADMIN_PERM,
16891                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16892         },
16893 #ifdef CONFIG_PM
16894         {
16895                 .cmd = NL80211_CMD_GET_WOWLAN,
16896                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16897                 .doit = nl80211_get_wowlan,
16898                 /* can be retrieved by unprivileged users */
16899                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16900         },
16901         {
16902                 .cmd = NL80211_CMD_SET_WOWLAN,
16903                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16904                 .doit = nl80211_set_wowlan,
16905                 .flags = GENL_UNS_ADMIN_PERM,
16906                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16907         },
16908 #endif
16909         {
16910                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
16911                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16912                 .doit = nl80211_set_rekey_data,
16913                 .flags = GENL_UNS_ADMIN_PERM,
16914                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16915                                          NL80211_FLAG_CLEAR_SKB),
16916         },
16917         {
16918                 .cmd = NL80211_CMD_TDLS_MGMT,
16919                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16920                 .doit = nl80211_tdls_mgmt,
16921                 .flags = GENL_UNS_ADMIN_PERM,
16922                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16923         },
16924         {
16925                 .cmd = NL80211_CMD_TDLS_OPER,
16926                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16927                 .doit = nl80211_tdls_oper,
16928                 .flags = GENL_UNS_ADMIN_PERM,
16929                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16930         },
16931         {
16932                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
16933                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16934                 .doit = nl80211_register_unexpected_frame,
16935                 .flags = GENL_UNS_ADMIN_PERM,
16936                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16937         },
16938         {
16939                 .cmd = NL80211_CMD_PROBE_CLIENT,
16940                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16941                 .doit = nl80211_probe_client,
16942                 .flags = GENL_UNS_ADMIN_PERM,
16943                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16944         },
16945         {
16946                 .cmd = NL80211_CMD_REGISTER_BEACONS,
16947                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16948                 .doit = nl80211_register_beacons,
16949                 .flags = GENL_UNS_ADMIN_PERM,
16950                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16951         },
16952         {
16953                 .cmd = NL80211_CMD_SET_NOACK_MAP,
16954                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16955                 .doit = nl80211_set_noack_map,
16956                 .flags = GENL_UNS_ADMIN_PERM,
16957                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16958         },
16959         {
16960                 .cmd = NL80211_CMD_START_P2P_DEVICE,
16961                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16962                 .doit = nl80211_start_p2p_device,
16963                 .flags = GENL_UNS_ADMIN_PERM,
16964                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16965                                          NL80211_FLAG_NEED_RTNL),
16966         },
16967         {
16968                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
16969                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16970                 .doit = nl80211_stop_p2p_device,
16971                 .flags = GENL_UNS_ADMIN_PERM,
16972                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16973                                          NL80211_FLAG_NEED_RTNL),
16974         },
16975         {
16976                 .cmd = NL80211_CMD_START_NAN,
16977                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16978                 .doit = nl80211_start_nan,
16979                 .flags = GENL_ADMIN_PERM,
16980                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16981                                          NL80211_FLAG_NEED_RTNL),
16982         },
16983         {
16984                 .cmd = NL80211_CMD_STOP_NAN,
16985                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16986                 .doit = nl80211_stop_nan,
16987                 .flags = GENL_ADMIN_PERM,
16988                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16989                                          NL80211_FLAG_NEED_RTNL),
16990         },
16991         {
16992                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
16993                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16994                 .doit = nl80211_nan_add_func,
16995                 .flags = GENL_ADMIN_PERM,
16996                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16997         },
16998         {
16999                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17000                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17001                 .doit = nl80211_nan_del_func,
17002                 .flags = GENL_ADMIN_PERM,
17003                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17004         },
17005         {
17006                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17007                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17008                 .doit = nl80211_nan_change_config,
17009                 .flags = GENL_ADMIN_PERM,
17010                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17011         },
17012         {
17013                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17014                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17015                 .doit = nl80211_set_mcast_rate,
17016                 .flags = GENL_UNS_ADMIN_PERM,
17017                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17018         },
17019         {
17020                 .cmd = NL80211_CMD_SET_MAC_ACL,
17021                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17022                 .doit = nl80211_set_mac_acl,
17023                 .flags = GENL_UNS_ADMIN_PERM,
17024                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17025                                          NL80211_FLAG_MLO_UNSUPPORTED),
17026         },
17027         {
17028                 .cmd = NL80211_CMD_RADAR_DETECT,
17029                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17030                 .doit = nl80211_start_radar_detection,
17031                 .flags = GENL_UNS_ADMIN_PERM,
17032                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17033                                          NL80211_FLAG_NO_WIPHY_MTX |
17034                                          NL80211_FLAG_MLO_UNSUPPORTED),
17035         },
17036         {
17037                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17038                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17039                 .doit = nl80211_get_protocol_features,
17040         },
17041         {
17042                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17043                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17044                 .doit = nl80211_update_ft_ies,
17045                 .flags = GENL_UNS_ADMIN_PERM,
17046                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17047         },
17048         {
17049                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17050                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17051                 .doit = nl80211_crit_protocol_start,
17052                 .flags = GENL_UNS_ADMIN_PERM,
17053                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17054         },
17055         {
17056                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17057                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17058                 .doit = nl80211_crit_protocol_stop,
17059                 .flags = GENL_UNS_ADMIN_PERM,
17060                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17061         },
17062         {
17063                 .cmd = NL80211_CMD_GET_COALESCE,
17064                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17065                 .doit = nl80211_get_coalesce,
17066                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17067         },
17068         {
17069                 .cmd = NL80211_CMD_SET_COALESCE,
17070                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17071                 .doit = nl80211_set_coalesce,
17072                 .flags = GENL_UNS_ADMIN_PERM,
17073                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17074         },
17075         {
17076                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17077                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17078                 .doit = nl80211_channel_switch,
17079                 .flags = GENL_UNS_ADMIN_PERM,
17080                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17081                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17082         },
17083         {
17084                 .cmd = NL80211_CMD_VENDOR,
17085                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17086                 .doit = nl80211_vendor_cmd,
17087                 .dumpit = nl80211_vendor_cmd_dump,
17088                 .flags = GENL_UNS_ADMIN_PERM,
17089                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17090                                          NL80211_FLAG_CLEAR_SKB),
17091         },
17092         {
17093                 .cmd = NL80211_CMD_SET_QOS_MAP,
17094                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17095                 .doit = nl80211_set_qos_map,
17096                 .flags = GENL_UNS_ADMIN_PERM,
17097                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17098         },
17099         {
17100                 .cmd = NL80211_CMD_ADD_TX_TS,
17101                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17102                 .doit = nl80211_add_tx_ts,
17103                 .flags = GENL_UNS_ADMIN_PERM,
17104                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17105                                          NL80211_FLAG_MLO_UNSUPPORTED),
17106         },
17107         {
17108                 .cmd = NL80211_CMD_DEL_TX_TS,
17109                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17110                 .doit = nl80211_del_tx_ts,
17111                 .flags = GENL_UNS_ADMIN_PERM,
17112                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17113         },
17114         {
17115                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17116                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17117                 .doit = nl80211_tdls_channel_switch,
17118                 .flags = GENL_UNS_ADMIN_PERM,
17119                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17120         },
17121         {
17122                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17123                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17124                 .doit = nl80211_tdls_cancel_channel_switch,
17125                 .flags = GENL_UNS_ADMIN_PERM,
17126                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17127         },
17128         {
17129                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17130                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17131                 .doit = nl80211_set_multicast_to_unicast,
17132                 .flags = GENL_UNS_ADMIN_PERM,
17133                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17134         },
17135         {
17136                 .cmd = NL80211_CMD_SET_PMK,
17137                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17138                 .doit = nl80211_set_pmk,
17139                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17140                                          NL80211_FLAG_CLEAR_SKB),
17141         },
17142         {
17143                 .cmd = NL80211_CMD_DEL_PMK,
17144                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17145                 .doit = nl80211_del_pmk,
17146                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17147         },
17148         {
17149                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17150                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17151                 .doit = nl80211_external_auth,
17152                 .flags = GENL_ADMIN_PERM,
17153                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17154         },
17155         {
17156                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17157                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17158                 .doit = nl80211_tx_control_port,
17159                 .flags = GENL_UNS_ADMIN_PERM,
17160                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17161         },
17162         {
17163                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17164                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17165                 .doit = nl80211_get_ftm_responder_stats,
17166                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17167                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17168         },
17169         {
17170                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17171                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17172                 .doit = nl80211_pmsr_start,
17173                 .flags = GENL_UNS_ADMIN_PERM,
17174                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17175         },
17176         {
17177                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17178                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17179                 .doit = nl80211_notify_radar_detection,
17180                 .flags = GENL_UNS_ADMIN_PERM,
17181                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17182         },
17183         {
17184                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17185                 .doit = nl80211_update_owe_info,
17186                 .flags = GENL_ADMIN_PERM,
17187                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17188         },
17189         {
17190                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17191                 .doit = nl80211_probe_mesh_link,
17192                 .flags = GENL_UNS_ADMIN_PERM,
17193                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17194         },
17195         {
17196                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17197                 .doit = nl80211_set_tid_config,
17198                 .flags = GENL_UNS_ADMIN_PERM,
17199                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17200                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17201         },
17202         {
17203                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17204                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17205                 .doit = nl80211_set_sar_specs,
17206                 .flags = GENL_UNS_ADMIN_PERM,
17207                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17208                                          NL80211_FLAG_NEED_RTNL),
17209         },
17210         {
17211                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17212                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17213                 .doit = nl80211_color_change,
17214                 .flags = GENL_UNS_ADMIN_PERM,
17215                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17216         },
17217         {
17218                 .cmd = NL80211_CMD_SET_FILS_AAD,
17219                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17220                 .doit = nl80211_set_fils_aad,
17221                 .flags = GENL_UNS_ADMIN_PERM,
17222                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17223         },
17224         {
17225                 .cmd = NL80211_CMD_ADD_LINK,
17226                 .doit = nl80211_add_link,
17227                 .flags = GENL_UNS_ADMIN_PERM,
17228                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17229         },
17230         {
17231                 .cmd = NL80211_CMD_REMOVE_LINK,
17232                 .doit = nl80211_remove_link,
17233                 .flags = GENL_UNS_ADMIN_PERM,
17234                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17235                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17236         },
17237         {
17238                 .cmd = NL80211_CMD_ADD_LINK_STA,
17239                 .doit = nl80211_add_link_station,
17240                 .flags = GENL_UNS_ADMIN_PERM,
17241                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17242                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17243         },
17244         {
17245                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17246                 .doit = nl80211_modify_link_station,
17247                 .flags = GENL_UNS_ADMIN_PERM,
17248                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17249                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17250         },
17251         {
17252                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17253                 .doit = nl80211_remove_link_station,
17254                 .flags = GENL_UNS_ADMIN_PERM,
17255                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17256                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17257         },
17258 };
17259
17260 static struct genl_family nl80211_fam __ro_after_init = {
17261         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17262         .hdrsize = 0,                   /* no private header */
17263         .version = 1,                   /* no particular meaning now */
17264         .maxattr = NL80211_ATTR_MAX,
17265         .policy = nl80211_policy,
17266         .netnsok = true,
17267         .pre_doit = nl80211_pre_doit,
17268         .post_doit = nl80211_post_doit,
17269         .module = THIS_MODULE,
17270         .ops = nl80211_ops,
17271         .n_ops = ARRAY_SIZE(nl80211_ops),
17272         .small_ops = nl80211_small_ops,
17273         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17274         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17275         .mcgrps = nl80211_mcgrps,
17276         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17277         .parallel_ops = true,
17278 };
17279
17280 /* notification functions */
17281
17282 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17283                           enum nl80211_commands cmd)
17284 {
17285         struct sk_buff *msg;
17286         struct nl80211_dump_wiphy_state state = {};
17287
17288         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17289                 cmd != NL80211_CMD_DEL_WIPHY);
17290
17291         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17292         if (!msg)
17293                 return;
17294
17295         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17296                 nlmsg_free(msg);
17297                 return;
17298         }
17299
17300         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17301                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17302 }
17303
17304 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17305                                 struct wireless_dev *wdev,
17306                                 enum nl80211_commands cmd)
17307 {
17308         struct sk_buff *msg;
17309
17310         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17311         if (!msg)
17312                 return;
17313
17314         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17315                 nlmsg_free(msg);
17316                 return;
17317         }
17318
17319         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17320                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17321 }
17322
17323 static int nl80211_add_scan_req(struct sk_buff *msg,
17324                                 struct cfg80211_registered_device *rdev)
17325 {
17326         struct cfg80211_scan_request *req = rdev->scan_req;
17327         struct nlattr *nest;
17328         int i;
17329         struct cfg80211_scan_info *info;
17330
17331         if (WARN_ON(!req))
17332                 return 0;
17333
17334         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17335         if (!nest)
17336                 goto nla_put_failure;
17337         for (i = 0; i < req->n_ssids; i++) {
17338                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17339                         goto nla_put_failure;
17340         }
17341         nla_nest_end(msg, nest);
17342
17343         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17344                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17345                 if (!nest)
17346                         goto nla_put_failure;
17347                 for (i = 0; i < req->n_channels; i++) {
17348                         if (nla_put_u32(msg, i,
17349                                    ieee80211_channel_to_khz(req->channels[i])))
17350                                 goto nla_put_failure;
17351                 }
17352                 nla_nest_end(msg, nest);
17353         } else {
17354                 nest = nla_nest_start_noflag(msg,
17355                                              NL80211_ATTR_SCAN_FREQUENCIES);
17356                 if (!nest)
17357                         goto nla_put_failure;
17358                 for (i = 0; i < req->n_channels; i++) {
17359                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17360                                 goto nla_put_failure;
17361                 }
17362                 nla_nest_end(msg, nest);
17363         }
17364
17365         if (req->ie &&
17366             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17367                 goto nla_put_failure;
17368
17369         if (req->flags &&
17370             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17371                 goto nla_put_failure;
17372
17373         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17374                 &rdev->scan_req->info;
17375         if (info->scan_start_tsf &&
17376             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17377                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17378              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17379                      info->tsf_bssid)))
17380                 goto nla_put_failure;
17381
17382         return 0;
17383  nla_put_failure:
17384         return -ENOBUFS;
17385 }
17386
17387 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17388                                  struct cfg80211_registered_device *rdev,
17389                                  struct wireless_dev *wdev,
17390                                  u32 portid, u32 seq, int flags,
17391                                  u32 cmd)
17392 {
17393         void *hdr;
17394
17395         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17396         if (!hdr)
17397                 return -1;
17398
17399         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17400             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17401                                          wdev->netdev->ifindex)) ||
17402             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17403                               NL80211_ATTR_PAD))
17404                 goto nla_put_failure;
17405
17406         /* ignore errors and send incomplete event anyway */
17407         nl80211_add_scan_req(msg, rdev);
17408
17409         genlmsg_end(msg, hdr);
17410         return 0;
17411
17412  nla_put_failure:
17413         genlmsg_cancel(msg, hdr);
17414         return -EMSGSIZE;
17415 }
17416
17417 static int
17418 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17419                             struct cfg80211_sched_scan_request *req, u32 cmd)
17420 {
17421         void *hdr;
17422
17423         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17424         if (!hdr)
17425                 return -1;
17426
17427         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17428                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17429             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17430             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17431                               NL80211_ATTR_PAD))
17432                 goto nla_put_failure;
17433
17434         genlmsg_end(msg, hdr);
17435         return 0;
17436
17437  nla_put_failure:
17438         genlmsg_cancel(msg, hdr);
17439         return -EMSGSIZE;
17440 }
17441
17442 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17443                              struct wireless_dev *wdev)
17444 {
17445         struct sk_buff *msg;
17446
17447         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17448         if (!msg)
17449                 return;
17450
17451         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17452                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
17453                 nlmsg_free(msg);
17454                 return;
17455         }
17456
17457         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17458                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17459 }
17460
17461 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17462                                        struct wireless_dev *wdev, bool aborted)
17463 {
17464         struct sk_buff *msg;
17465
17466         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17467         if (!msg)
17468                 return NULL;
17469
17470         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17471                                   aborted ? NL80211_CMD_SCAN_ABORTED :
17472                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17473                 nlmsg_free(msg);
17474                 return NULL;
17475         }
17476
17477         return msg;
17478 }
17479
17480 /* send message created by nl80211_build_scan_msg() */
17481 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17482                            struct sk_buff *msg)
17483 {
17484         if (!msg)
17485                 return;
17486
17487         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17488                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17489 }
17490
17491 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17492 {
17493         struct sk_buff *msg;
17494
17495         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17496         if (!msg)
17497                 return;
17498
17499         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17500                 nlmsg_free(msg);
17501                 return;
17502         }
17503
17504         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17505                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17506 }
17507
17508 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17509                                           struct regulatory_request *request)
17510 {
17511         /* Userspace can always count this one always being set */
17512         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17513                 goto nla_put_failure;
17514
17515         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17516                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17517                                NL80211_REGDOM_TYPE_WORLD))
17518                         goto nla_put_failure;
17519         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17520                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17521                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17522                         goto nla_put_failure;
17523         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17524                    request->intersect) {
17525                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17526                                NL80211_REGDOM_TYPE_INTERSECTION))
17527                         goto nla_put_failure;
17528         } else {
17529                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17530                                NL80211_REGDOM_TYPE_COUNTRY) ||
17531                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17532                                    request->alpha2))
17533                         goto nla_put_failure;
17534         }
17535
17536         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17537                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17538
17539                 if (wiphy &&
17540                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17541                         goto nla_put_failure;
17542
17543                 if (wiphy &&
17544                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17545                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17546                         goto nla_put_failure;
17547         }
17548
17549         return true;
17550
17551 nla_put_failure:
17552         return false;
17553 }
17554
17555 /*
17556  * This can happen on global regulatory changes or device specific settings
17557  * based on custom regulatory domains.
17558  */
17559 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17560                                      struct regulatory_request *request)
17561 {
17562         struct sk_buff *msg;
17563         void *hdr;
17564
17565         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17566         if (!msg)
17567                 return;
17568
17569         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17570         if (!hdr)
17571                 goto nla_put_failure;
17572
17573         if (!nl80211_reg_change_event_fill(msg, request))
17574                 goto nla_put_failure;
17575
17576         genlmsg_end(msg, hdr);
17577
17578         rcu_read_lock();
17579         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17580                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17581         rcu_read_unlock();
17582
17583         return;
17584
17585 nla_put_failure:
17586         nlmsg_free(msg);
17587 }
17588
17589 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17590                                     struct net_device *netdev,
17591                                     const u8 *buf, size_t len,
17592                                     enum nl80211_commands cmd, gfp_t gfp,
17593                                     int uapsd_queues, const u8 *req_ies,
17594                                     size_t req_ies_len, bool reconnect)
17595 {
17596         struct sk_buff *msg;
17597         void *hdr;
17598
17599         msg = nlmsg_new(100 + len + req_ies_len, gfp);
17600         if (!msg)
17601                 return;
17602
17603         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17604         if (!hdr) {
17605                 nlmsg_free(msg);
17606                 return;
17607         }
17608
17609         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17610             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17611             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17612             (req_ies &&
17613              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17614                 goto nla_put_failure;
17615
17616         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17617                 goto nla_put_failure;
17618
17619         if (uapsd_queues >= 0) {
17620                 struct nlattr *nla_wmm =
17621                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17622                 if (!nla_wmm)
17623                         goto nla_put_failure;
17624
17625                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17626                                uapsd_queues))
17627                         goto nla_put_failure;
17628
17629                 nla_nest_end(msg, nla_wmm);
17630         }
17631
17632         genlmsg_end(msg, hdr);
17633
17634         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17635                                 NL80211_MCGRP_MLME, gfp);
17636         return;
17637
17638  nla_put_failure:
17639         nlmsg_free(msg);
17640 }
17641
17642 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17643                           struct net_device *netdev, const u8 *buf,
17644                           size_t len, gfp_t gfp)
17645 {
17646         nl80211_send_mlme_event(rdev, netdev, buf, len,
17647                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17648                                 false);
17649 }
17650
17651 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17652                            struct net_device *netdev,
17653                            struct cfg80211_rx_assoc_resp *data)
17654 {
17655         nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17656                                 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17657                                 data->uapsd_queues,
17658                                 data->req_ies, data->req_ies_len, false);
17659 }
17660
17661 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17662                          struct net_device *netdev, const u8 *buf,
17663                          size_t len, bool reconnect, gfp_t gfp)
17664 {
17665         nl80211_send_mlme_event(rdev, netdev, buf, len,
17666                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17667                                 reconnect);
17668 }
17669
17670 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17671                            struct net_device *netdev, const u8 *buf,
17672                            size_t len, bool reconnect, gfp_t gfp)
17673 {
17674         nl80211_send_mlme_event(rdev, netdev, buf, len,
17675                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17676                                 reconnect);
17677 }
17678
17679 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17680                                   size_t len)
17681 {
17682         struct wireless_dev *wdev = dev->ieee80211_ptr;
17683         struct wiphy *wiphy = wdev->wiphy;
17684         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17685         const struct ieee80211_mgmt *mgmt = (void *)buf;
17686         u32 cmd;
17687
17688         if (WARN_ON(len < 2))
17689                 return;
17690
17691         if (ieee80211_is_deauth(mgmt->frame_control)) {
17692                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17693         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17694                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17695         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17696                 if (wdev->unprot_beacon_reported &&
17697                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17698                         return;
17699                 cmd = NL80211_CMD_UNPROT_BEACON;
17700                 wdev->unprot_beacon_reported = jiffies;
17701         } else {
17702                 return;
17703         }
17704
17705         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17706         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17707                                 NULL, 0, false);
17708 }
17709 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17710
17711 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17712                                       struct net_device *netdev, int cmd,
17713                                       const u8 *addr, gfp_t gfp)
17714 {
17715         struct sk_buff *msg;
17716         void *hdr;
17717
17718         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17719         if (!msg)
17720                 return;
17721
17722         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17723         if (!hdr) {
17724                 nlmsg_free(msg);
17725                 return;
17726         }
17727
17728         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17729             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17730             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17731             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17732                 goto nla_put_failure;
17733
17734         genlmsg_end(msg, hdr);
17735
17736         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17737                                 NL80211_MCGRP_MLME, gfp);
17738         return;
17739
17740  nla_put_failure:
17741         nlmsg_free(msg);
17742 }
17743
17744 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17745                                struct net_device *netdev, const u8 *addr,
17746                                gfp_t gfp)
17747 {
17748         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17749                                   addr, gfp);
17750 }
17751
17752 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17753                                 struct net_device *netdev, const u8 *addr,
17754                                 gfp_t gfp)
17755 {
17756         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17757                                   addr, gfp);
17758 }
17759
17760 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17761                                  struct net_device *netdev,
17762                                  struct cfg80211_connect_resp_params *cr,
17763                                  gfp_t gfp)
17764 {
17765         struct sk_buff *msg;
17766         void *hdr;
17767         unsigned int link;
17768         size_t link_info_size = 0;
17769         const u8 *connected_addr = cr->valid_links ?
17770                                    cr->ap_mld_addr : cr->links[0].bssid;
17771
17772         if (cr->valid_links) {
17773                 for_each_valid_link(cr, link) {
17774                         /* Nested attribute header */
17775                         link_info_size += NLA_HDRLEN;
17776                         /* Link ID */
17777                         link_info_size += nla_total_size(sizeof(u8));
17778                         link_info_size += cr->links[link].addr ?
17779                                           nla_total_size(ETH_ALEN) : 0;
17780                         link_info_size += (cr->links[link].bssid ||
17781                                            cr->links[link].bss) ?
17782                                           nla_total_size(ETH_ALEN) : 0;
17783                 }
17784         }
17785
17786         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17787                         cr->fils.kek_len + cr->fils.pmk_len +
17788                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
17789                         gfp);
17790         if (!msg)
17791                 return;
17792
17793         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17794         if (!hdr) {
17795                 nlmsg_free(msg);
17796                 return;
17797         }
17798
17799         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17800             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17801             (connected_addr &&
17802              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
17803             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
17804                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
17805                         cr->status) ||
17806             (cr->status < 0 &&
17807              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17808               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
17809                           cr->timeout_reason))) ||
17810             (cr->req_ie &&
17811              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
17812             (cr->resp_ie &&
17813              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
17814                      cr->resp_ie)) ||
17815             (cr->fils.update_erp_next_seq_num &&
17816              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17817                          cr->fils.erp_next_seq_num)) ||
17818             (cr->status == WLAN_STATUS_SUCCESS &&
17819              ((cr->fils.kek &&
17820                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
17821                        cr->fils.kek)) ||
17822               (cr->fils.pmk &&
17823                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
17824               (cr->fils.pmkid &&
17825                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
17826                 goto nla_put_failure;
17827
17828         if (cr->valid_links) {
17829                 int i = 1;
17830                 struct nlattr *nested;
17831
17832                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
17833                 if (!nested)
17834                         goto nla_put_failure;
17835
17836                 for_each_valid_link(cr, link) {
17837                         struct nlattr *nested_mlo_links;
17838                         const u8 *bssid = cr->links[link].bss ?
17839                                           cr->links[link].bss->bssid :
17840                                           cr->links[link].bssid;
17841
17842                         nested_mlo_links = nla_nest_start(msg, i);
17843                         if (!nested_mlo_links)
17844                                 goto nla_put_failure;
17845
17846                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
17847                             (bssid &&
17848                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
17849                             (cr->links[link].addr &&
17850                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
17851                                      cr->links[link].addr)))
17852                                 goto nla_put_failure;
17853
17854                         nla_nest_end(msg, nested_mlo_links);
17855                         i++;
17856                 }
17857                 nla_nest_end(msg, nested);
17858         }
17859
17860         genlmsg_end(msg, hdr);
17861
17862         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17863                                 NL80211_MCGRP_MLME, gfp);
17864         return;
17865
17866  nla_put_failure:
17867         nlmsg_free(msg);
17868 }
17869
17870 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
17871                          struct net_device *netdev,
17872                          struct cfg80211_roam_info *info, gfp_t gfp)
17873 {
17874         struct sk_buff *msg;
17875         void *hdr;
17876         size_t link_info_size = 0;
17877         unsigned int link;
17878         const u8 *connected_addr = info->ap_mld_addr ?
17879                                    info->ap_mld_addr :
17880                                    (info->links[0].bss ?
17881                                     info->links[0].bss->bssid :
17882                                     info->links[0].bssid);
17883
17884         if (info->valid_links) {
17885                 for_each_valid_link(info, link) {
17886                         /* Nested attribute header */
17887                         link_info_size += NLA_HDRLEN;
17888                         /* Link ID */
17889                         link_info_size += nla_total_size(sizeof(u8));
17890                         link_info_size += info->links[link].addr ?
17891                                           nla_total_size(ETH_ALEN) : 0;
17892                         link_info_size += (info->links[link].bssid ||
17893                                            info->links[link].bss) ?
17894                                           nla_total_size(ETH_ALEN) : 0;
17895                 }
17896         }
17897
17898         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
17899                         info->fils.kek_len + info->fils.pmk_len +
17900                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
17901                         link_info_size, gfp);
17902         if (!msg)
17903                 return;
17904
17905         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
17906         if (!hdr) {
17907                 nlmsg_free(msg);
17908                 return;
17909         }
17910
17911         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17912             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17913             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
17914             (info->req_ie &&
17915              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
17916                      info->req_ie)) ||
17917             (info->resp_ie &&
17918              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
17919                      info->resp_ie)) ||
17920             (info->fils.update_erp_next_seq_num &&
17921              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
17922                          info->fils.erp_next_seq_num)) ||
17923             (info->fils.kek &&
17924              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
17925                      info->fils.kek)) ||
17926             (info->fils.pmk &&
17927              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
17928             (info->fils.pmkid &&
17929              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
17930                 goto nla_put_failure;
17931
17932         if (info->valid_links) {
17933                 int i = 1;
17934                 struct nlattr *nested;
17935
17936                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
17937                 if (!nested)
17938                         goto nla_put_failure;
17939
17940                 for_each_valid_link(info, link) {
17941                         struct nlattr *nested_mlo_links;
17942                         const u8 *bssid = info->links[link].bss ?
17943                                           info->links[link].bss->bssid :
17944                                           info->links[link].bssid;
17945
17946                         nested_mlo_links = nla_nest_start(msg, i);
17947                         if (!nested_mlo_links)
17948                                 goto nla_put_failure;
17949
17950                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
17951                             (bssid &&
17952                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
17953                             (info->links[link].addr &&
17954                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
17955                                      info->links[link].addr)))
17956                                 goto nla_put_failure;
17957
17958                         nla_nest_end(msg, nested_mlo_links);
17959                         i++;
17960                 }
17961                 nla_nest_end(msg, nested);
17962         }
17963
17964         genlmsg_end(msg, hdr);
17965
17966         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17967                                 NL80211_MCGRP_MLME, gfp);
17968         return;
17969
17970  nla_put_failure:
17971         nlmsg_free(msg);
17972 }
17973
17974 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
17975                                   struct net_device *netdev, const u8 *bssid)
17976 {
17977         struct sk_buff *msg;
17978         void *hdr;
17979
17980         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17981         if (!msg)
17982                 return;
17983
17984         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
17985         if (!hdr) {
17986                 nlmsg_free(msg);
17987                 return;
17988         }
17989
17990         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17991             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17992             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17993                 goto nla_put_failure;
17994
17995         genlmsg_end(msg, hdr);
17996
17997         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17998                                 NL80211_MCGRP_MLME, GFP_KERNEL);
17999         return;
18000
18001  nla_put_failure:
18002         nlmsg_free(msg);
18003 }
18004
18005 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18006                                struct net_device *netdev, u16 reason,
18007                                const u8 *ie, size_t ie_len, bool from_ap)
18008 {
18009         struct sk_buff *msg;
18010         void *hdr;
18011
18012         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18013         if (!msg)
18014                 return;
18015
18016         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18017         if (!hdr) {
18018                 nlmsg_free(msg);
18019                 return;
18020         }
18021
18022         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18023             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18024             (reason &&
18025              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18026             (from_ap &&
18027              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18028             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18029                 goto nla_put_failure;
18030
18031         genlmsg_end(msg, hdr);
18032
18033         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18034                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18035         return;
18036
18037  nla_put_failure:
18038         nlmsg_free(msg);
18039 }
18040
18041 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18042                              struct net_device *netdev, const u8 *bssid,
18043                              gfp_t gfp)
18044 {
18045         struct sk_buff *msg;
18046         void *hdr;
18047
18048         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18049         if (!msg)
18050                 return;
18051
18052         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18053         if (!hdr) {
18054                 nlmsg_free(msg);
18055                 return;
18056         }
18057
18058         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18059             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18060             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18061                 goto nla_put_failure;
18062
18063         genlmsg_end(msg, hdr);
18064
18065         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18066                                 NL80211_MCGRP_MLME, gfp);
18067         return;
18068
18069  nla_put_failure:
18070         nlmsg_free(msg);
18071 }
18072
18073 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18074                                         const u8 *ie, u8 ie_len,
18075                                         int sig_dbm, gfp_t gfp)
18076 {
18077         struct wireless_dev *wdev = dev->ieee80211_ptr;
18078         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18079         struct sk_buff *msg;
18080         void *hdr;
18081
18082         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18083                 return;
18084
18085         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18086
18087         msg = nlmsg_new(100 + ie_len, gfp);
18088         if (!msg)
18089                 return;
18090
18091         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18092         if (!hdr) {
18093                 nlmsg_free(msg);
18094                 return;
18095         }
18096
18097         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18098             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18099             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18100             (ie_len && ie &&
18101              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18102             (sig_dbm &&
18103              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18104                 goto nla_put_failure;
18105
18106         genlmsg_end(msg, hdr);
18107
18108         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18109                                 NL80211_MCGRP_MLME, gfp);
18110         return;
18111
18112  nla_put_failure:
18113         nlmsg_free(msg);
18114 }
18115 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18116
18117 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18118                                  struct net_device *netdev, const u8 *addr,
18119                                  enum nl80211_key_type key_type, int key_id,
18120                                  const u8 *tsc, gfp_t gfp)
18121 {
18122         struct sk_buff *msg;
18123         void *hdr;
18124
18125         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18126         if (!msg)
18127                 return;
18128
18129         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18130         if (!hdr) {
18131                 nlmsg_free(msg);
18132                 return;
18133         }
18134
18135         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18136             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18137             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18138             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18139             (key_id != -1 &&
18140              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18141             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18142                 goto nla_put_failure;
18143
18144         genlmsg_end(msg, hdr);
18145
18146         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18147                                 NL80211_MCGRP_MLME, gfp);
18148         return;
18149
18150  nla_put_failure:
18151         nlmsg_free(msg);
18152 }
18153
18154 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18155                                     struct ieee80211_channel *channel_before,
18156                                     struct ieee80211_channel *channel_after)
18157 {
18158         struct sk_buff *msg;
18159         void *hdr;
18160         struct nlattr *nl_freq;
18161
18162         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18163         if (!msg)
18164                 return;
18165
18166         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18167         if (!hdr) {
18168                 nlmsg_free(msg);
18169                 return;
18170         }
18171
18172         /*
18173          * Since we are applying the beacon hint to a wiphy we know its
18174          * wiphy_idx is valid
18175          */
18176         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18177                 goto nla_put_failure;
18178
18179         /* Before */
18180         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18181         if (!nl_freq)
18182                 goto nla_put_failure;
18183
18184         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18185                 goto nla_put_failure;
18186         nla_nest_end(msg, nl_freq);
18187
18188         /* After */
18189         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18190         if (!nl_freq)
18191                 goto nla_put_failure;
18192
18193         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18194                 goto nla_put_failure;
18195         nla_nest_end(msg, nl_freq);
18196
18197         genlmsg_end(msg, hdr);
18198
18199         rcu_read_lock();
18200         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18201                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18202         rcu_read_unlock();
18203
18204         return;
18205
18206 nla_put_failure:
18207         nlmsg_free(msg);
18208 }
18209
18210 static void nl80211_send_remain_on_chan_event(
18211         int cmd, struct cfg80211_registered_device *rdev,
18212         struct wireless_dev *wdev, u64 cookie,
18213         struct ieee80211_channel *chan,
18214         unsigned int duration, gfp_t gfp)
18215 {
18216         struct sk_buff *msg;
18217         void *hdr;
18218
18219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18220         if (!msg)
18221                 return;
18222
18223         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18224         if (!hdr) {
18225                 nlmsg_free(msg);
18226                 return;
18227         }
18228
18229         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18230             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18231                                          wdev->netdev->ifindex)) ||
18232             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18233                               NL80211_ATTR_PAD) ||
18234             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18235             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18236                         NL80211_CHAN_NO_HT) ||
18237             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18238                               NL80211_ATTR_PAD))
18239                 goto nla_put_failure;
18240
18241         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18242             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18243                 goto nla_put_failure;
18244
18245         genlmsg_end(msg, hdr);
18246
18247         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18248                                 NL80211_MCGRP_MLME, gfp);
18249         return;
18250
18251  nla_put_failure:
18252         nlmsg_free(msg);
18253 }
18254
18255 void cfg80211_assoc_comeback(struct net_device *netdev,
18256                              const u8 *ap_addr, u32 timeout)
18257 {
18258         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18259         struct wiphy *wiphy = wdev->wiphy;
18260         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18261         struct sk_buff *msg;
18262         void *hdr;
18263
18264         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18265
18266         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18267         if (!msg)
18268                 return;
18269
18270         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18271         if (!hdr) {
18272                 nlmsg_free(msg);
18273                 return;
18274         }
18275
18276         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18277             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18278             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18279             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18280                 goto nla_put_failure;
18281
18282         genlmsg_end(msg, hdr);
18283
18284         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18285                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18286         return;
18287
18288  nla_put_failure:
18289         nlmsg_free(msg);
18290 }
18291 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18292
18293 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18294                                struct ieee80211_channel *chan,
18295                                unsigned int duration, gfp_t gfp)
18296 {
18297         struct wiphy *wiphy = wdev->wiphy;
18298         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18299
18300         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18301         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18302                                           rdev, wdev, cookie, chan,
18303                                           duration, gfp);
18304 }
18305 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18306
18307 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18308                                         struct ieee80211_channel *chan,
18309                                         gfp_t gfp)
18310 {
18311         struct wiphy *wiphy = wdev->wiphy;
18312         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18313
18314         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18315         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18316                                           rdev, wdev, cookie, chan, 0, gfp);
18317 }
18318 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18319
18320 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18321                                         struct ieee80211_channel *chan,
18322                                         gfp_t gfp)
18323 {
18324         struct wiphy *wiphy = wdev->wiphy;
18325         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18326
18327         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18328         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18329                                           rdev, wdev, cookie, chan, 0, gfp);
18330 }
18331 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18332
18333 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18334                       struct station_info *sinfo, gfp_t gfp)
18335 {
18336         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18337         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18338         struct sk_buff *msg;
18339
18340         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18341
18342         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18343         if (!msg)
18344                 return;
18345
18346         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18347                                  rdev, dev, mac_addr, sinfo) < 0) {
18348                 nlmsg_free(msg);
18349                 return;
18350         }
18351
18352         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18353                                 NL80211_MCGRP_MLME, gfp);
18354 }
18355 EXPORT_SYMBOL(cfg80211_new_sta);
18356
18357 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18358                             struct station_info *sinfo, gfp_t gfp)
18359 {
18360         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18361         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18362         struct sk_buff *msg;
18363         struct station_info empty_sinfo = {};
18364
18365         if (!sinfo)
18366                 sinfo = &empty_sinfo;
18367
18368         trace_cfg80211_del_sta(dev, mac_addr);
18369
18370         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18371         if (!msg) {
18372                 cfg80211_sinfo_release_content(sinfo);
18373                 return;
18374         }
18375
18376         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18377                                  rdev, dev, mac_addr, sinfo) < 0) {
18378                 nlmsg_free(msg);
18379                 return;
18380         }
18381
18382         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18383                                 NL80211_MCGRP_MLME, gfp);
18384 }
18385 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18386
18387 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18388                           enum nl80211_connect_failed_reason reason,
18389                           gfp_t gfp)
18390 {
18391         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18392         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18393         struct sk_buff *msg;
18394         void *hdr;
18395
18396         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18397         if (!msg)
18398                 return;
18399
18400         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18401         if (!hdr) {
18402                 nlmsg_free(msg);
18403                 return;
18404         }
18405
18406         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18407             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18408             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18409                 goto nla_put_failure;
18410
18411         genlmsg_end(msg, hdr);
18412
18413         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18414                                 NL80211_MCGRP_MLME, gfp);
18415         return;
18416
18417  nla_put_failure:
18418         nlmsg_free(msg);
18419 }
18420 EXPORT_SYMBOL(cfg80211_conn_failed);
18421
18422 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18423                                        const u8 *addr, gfp_t gfp)
18424 {
18425         struct wireless_dev *wdev = dev->ieee80211_ptr;
18426         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18427         struct sk_buff *msg;
18428         void *hdr;
18429         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18430
18431         if (!nlportid)
18432                 return false;
18433
18434         msg = nlmsg_new(100, gfp);
18435         if (!msg)
18436                 return true;
18437
18438         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18439         if (!hdr) {
18440                 nlmsg_free(msg);
18441                 return true;
18442         }
18443
18444         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18445             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18446             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18447                 goto nla_put_failure;
18448
18449         genlmsg_end(msg, hdr);
18450         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18451         return true;
18452
18453  nla_put_failure:
18454         nlmsg_free(msg);
18455         return true;
18456 }
18457
18458 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18459                                 const u8 *addr, gfp_t gfp)
18460 {
18461         struct wireless_dev *wdev = dev->ieee80211_ptr;
18462         bool ret;
18463
18464         trace_cfg80211_rx_spurious_frame(dev, addr);
18465
18466         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18467                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18468                 trace_cfg80211_return_bool(false);
18469                 return false;
18470         }
18471         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18472                                          addr, gfp);
18473         trace_cfg80211_return_bool(ret);
18474         return ret;
18475 }
18476 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18477
18478 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18479                                         const u8 *addr, gfp_t gfp)
18480 {
18481         struct wireless_dev *wdev = dev->ieee80211_ptr;
18482         bool ret;
18483
18484         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18485
18486         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18487                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18488                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18489                 trace_cfg80211_return_bool(false);
18490                 return false;
18491         }
18492         ret = __nl80211_unexpected_frame(dev,
18493                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18494                                          addr, gfp);
18495         trace_cfg80211_return_bool(ret);
18496         return ret;
18497 }
18498 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18499
18500 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18501                       struct wireless_dev *wdev, u32 nlportid,
18502                       struct cfg80211_rx_info *info, gfp_t gfp)
18503 {
18504         struct net_device *netdev = wdev->netdev;
18505         struct sk_buff *msg;
18506         void *hdr;
18507
18508         msg = nlmsg_new(100 + info->len, gfp);
18509         if (!msg)
18510                 return -ENOMEM;
18511
18512         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18513         if (!hdr) {
18514                 nlmsg_free(msg);
18515                 return -ENOMEM;
18516         }
18517
18518         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18519             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18520                                         netdev->ifindex)) ||
18521             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18522                               NL80211_ATTR_PAD) ||
18523             (info->have_link_id &&
18524              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18525             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18526             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18527             (info->sig_dbm &&
18528              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18529             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18530             (info->flags &&
18531              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18532             (info->rx_tstamp && nla_put_u64_64bit(msg,
18533                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
18534                                                   info->rx_tstamp,
18535                                                   NL80211_ATTR_PAD)) ||
18536             (info->ack_tstamp && nla_put_u64_64bit(msg,
18537                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
18538                                                    info->ack_tstamp,
18539                                                    NL80211_ATTR_PAD)))
18540                 goto nla_put_failure;
18541
18542         genlmsg_end(msg, hdr);
18543
18544         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18545
18546  nla_put_failure:
18547         nlmsg_free(msg);
18548         return -ENOBUFS;
18549 }
18550
18551 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18552                                     struct cfg80211_tx_status *status,
18553                                     gfp_t gfp, enum nl80211_commands command)
18554 {
18555         struct wiphy *wiphy = wdev->wiphy;
18556         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18557         struct net_device *netdev = wdev->netdev;
18558         struct sk_buff *msg;
18559         void *hdr;
18560
18561         if (command == NL80211_CMD_FRAME_TX_STATUS)
18562                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18563                                               status->ack);
18564         else
18565                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18566                                                       status->ack);
18567
18568         msg = nlmsg_new(100 + status->len, gfp);
18569         if (!msg)
18570                 return;
18571
18572         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18573         if (!hdr) {
18574                 nlmsg_free(msg);
18575                 return;
18576         }
18577
18578         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18579             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18580                                    netdev->ifindex)) ||
18581             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18582                               NL80211_ATTR_PAD) ||
18583             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18584             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18585                               NL80211_ATTR_PAD) ||
18586             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18587             (status->tx_tstamp &&
18588              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18589                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
18590             (status->ack_tstamp &&
18591              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18592                                status->ack_tstamp, NL80211_ATTR_PAD)))
18593                 goto nla_put_failure;
18594
18595         genlmsg_end(msg, hdr);
18596
18597         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18598                                 NL80211_MCGRP_MLME, gfp);
18599         return;
18600
18601 nla_put_failure:
18602         nlmsg_free(msg);
18603 }
18604
18605 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18606                                      const u8 *buf, size_t len, bool ack,
18607                                      gfp_t gfp)
18608 {
18609         struct cfg80211_tx_status status = {
18610                 .cookie = cookie,
18611                 .buf = buf,
18612                 .len = len,
18613                 .ack = ack
18614         };
18615
18616         nl80211_frame_tx_status(wdev, &status, gfp,
18617                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18618 }
18619 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18620
18621 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18622                                  struct cfg80211_tx_status *status, gfp_t gfp)
18623 {
18624         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18625 }
18626 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18627
18628 static int __nl80211_rx_control_port(struct net_device *dev,
18629                                      struct sk_buff *skb,
18630                                      bool unencrypted, gfp_t gfp)
18631 {
18632         struct wireless_dev *wdev = dev->ieee80211_ptr;
18633         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18634         struct ethhdr *ehdr = eth_hdr(skb);
18635         const u8 *addr = ehdr->h_source;
18636         u16 proto = be16_to_cpu(skb->protocol);
18637         struct sk_buff *msg;
18638         void *hdr;
18639         struct nlattr *frame;
18640
18641         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18642
18643         if (!nlportid)
18644                 return -ENOENT;
18645
18646         msg = nlmsg_new(100 + skb->len, gfp);
18647         if (!msg)
18648                 return -ENOMEM;
18649
18650         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18651         if (!hdr) {
18652                 nlmsg_free(msg);
18653                 return -ENOBUFS;
18654         }
18655
18656         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18657             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18658             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18659                               NL80211_ATTR_PAD) ||
18660             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18661             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18662             (unencrypted && nla_put_flag(msg,
18663                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18664                 goto nla_put_failure;
18665
18666         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18667         if (!frame)
18668                 goto nla_put_failure;
18669
18670         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18671         genlmsg_end(msg, hdr);
18672
18673         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18674
18675  nla_put_failure:
18676         nlmsg_free(msg);
18677         return -ENOBUFS;
18678 }
18679
18680 bool cfg80211_rx_control_port(struct net_device *dev,
18681                               struct sk_buff *skb, bool unencrypted)
18682 {
18683         int ret;
18684
18685         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
18686         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
18687         trace_cfg80211_return_bool(ret == 0);
18688         return ret == 0;
18689 }
18690 EXPORT_SYMBOL(cfg80211_rx_control_port);
18691
18692 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
18693                                             const char *mac, gfp_t gfp)
18694 {
18695         struct wireless_dev *wdev = dev->ieee80211_ptr;
18696         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18697         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18698         void **cb;
18699
18700         if (!msg)
18701                 return NULL;
18702
18703         cb = (void **)msg->cb;
18704
18705         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
18706         if (!cb[0]) {
18707                 nlmsg_free(msg);
18708                 return NULL;
18709         }
18710
18711         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18712             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18713                 goto nla_put_failure;
18714
18715         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18716                 goto nla_put_failure;
18717
18718         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
18719         if (!cb[1])
18720                 goto nla_put_failure;
18721
18722         cb[2] = rdev;
18723
18724         return msg;
18725  nla_put_failure:
18726         nlmsg_free(msg);
18727         return NULL;
18728 }
18729
18730 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
18731 {
18732         void **cb = (void **)msg->cb;
18733         struct cfg80211_registered_device *rdev = cb[2];
18734
18735         nla_nest_end(msg, cb[1]);
18736         genlmsg_end(msg, cb[0]);
18737
18738         memset(msg->cb, 0, sizeof(msg->cb));
18739
18740         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18741                                 NL80211_MCGRP_MLME, gfp);
18742 }
18743
18744 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18745                               enum nl80211_cqm_rssi_threshold_event rssi_event,
18746                               s32 rssi_level, gfp_t gfp)
18747 {
18748         struct wireless_dev *wdev = dev->ieee80211_ptr;
18749         struct cfg80211_cqm_config *cqm_config;
18750
18751         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
18752
18753         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
18754                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
18755                 return;
18756
18757         rcu_read_lock();
18758         cqm_config = rcu_dereference(wdev->cqm_config);
18759         if (cqm_config) {
18760                 cqm_config->last_rssi_event_value = rssi_level;
18761                 cqm_config->last_rssi_event_type = rssi_event;
18762                 wiphy_work_queue(wdev->wiphy, &wdev->cqm_rssi_work);
18763         }
18764         rcu_read_unlock();
18765 }
18766 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
18767
18768 void cfg80211_cqm_rssi_notify_work(struct wiphy *wiphy, struct wiphy_work *work)
18769 {
18770         struct wireless_dev *wdev = container_of(work, struct wireless_dev,
18771                                                  cqm_rssi_work);
18772         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18773         enum nl80211_cqm_rssi_threshold_event rssi_event;
18774         struct cfg80211_cqm_config *cqm_config;
18775         struct sk_buff *msg;
18776         s32 rssi_level;
18777
18778         wdev_lock(wdev);
18779         cqm_config = rcu_dereference_protected(wdev->cqm_config,
18780                                                lockdep_is_held(&wdev->mtx));
18781         if (!cqm_config)
18782                 goto unlock;
18783
18784         if (cqm_config->use_range_api)
18785                 cfg80211_cqm_rssi_update(rdev, wdev->netdev, cqm_config);
18786
18787         rssi_level = cqm_config->last_rssi_event_value;
18788         rssi_event = cqm_config->last_rssi_event_type;
18789
18790         msg = cfg80211_prepare_cqm(wdev->netdev, NULL, GFP_KERNEL);
18791         if (!msg)
18792                 goto unlock;
18793
18794         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
18795                         rssi_event))
18796                 goto nla_put_failure;
18797
18798         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
18799                                       rssi_level))
18800                 goto nla_put_failure;
18801
18802         cfg80211_send_cqm(msg, GFP_KERNEL);
18803
18804         goto unlock;
18805
18806  nla_put_failure:
18807         nlmsg_free(msg);
18808  unlock:
18809         wdev_unlock(wdev);
18810 }
18811
18812 void cfg80211_cqm_txe_notify(struct net_device *dev,
18813                              const u8 *peer, u32 num_packets,
18814                              u32 rate, u32 intvl, gfp_t gfp)
18815 {
18816         struct sk_buff *msg;
18817
18818         msg = cfg80211_prepare_cqm(dev, peer, gfp);
18819         if (!msg)
18820                 return;
18821
18822         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
18823                 goto nla_put_failure;
18824
18825         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
18826                 goto nla_put_failure;
18827
18828         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
18829                 goto nla_put_failure;
18830
18831         cfg80211_send_cqm(msg, gfp);
18832         return;
18833
18834  nla_put_failure:
18835         nlmsg_free(msg);
18836 }
18837 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
18838
18839 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
18840                                  const u8 *peer, u32 num_packets, gfp_t gfp)
18841 {
18842         struct sk_buff *msg;
18843
18844         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
18845
18846         msg = cfg80211_prepare_cqm(dev, peer, gfp);
18847         if (!msg)
18848                 return;
18849
18850         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
18851                 goto nla_put_failure;
18852
18853         cfg80211_send_cqm(msg, gfp);
18854         return;
18855
18856  nla_put_failure:
18857         nlmsg_free(msg);
18858 }
18859 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
18860
18861 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
18862 {
18863         struct sk_buff *msg;
18864
18865         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18866         if (!msg)
18867                 return;
18868
18869         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
18870                 goto nla_put_failure;
18871
18872         cfg80211_send_cqm(msg, gfp);
18873         return;
18874
18875  nla_put_failure:
18876         nlmsg_free(msg);
18877 }
18878 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
18879
18880 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
18881                                      struct net_device *netdev, const u8 *bssid,
18882                                      const u8 *replay_ctr, gfp_t gfp)
18883 {
18884         struct sk_buff *msg;
18885         struct nlattr *rekey_attr;
18886         void *hdr;
18887
18888         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18889         if (!msg)
18890                 return;
18891
18892         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
18893         if (!hdr) {
18894                 nlmsg_free(msg);
18895                 return;
18896         }
18897
18898         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18899             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18900             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18901                 goto nla_put_failure;
18902
18903         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
18904         if (!rekey_attr)
18905                 goto nla_put_failure;
18906
18907         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
18908                     NL80211_REPLAY_CTR_LEN, replay_ctr))
18909                 goto nla_put_failure;
18910
18911         nla_nest_end(msg, rekey_attr);
18912
18913         genlmsg_end(msg, hdr);
18914
18915         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18916                                 NL80211_MCGRP_MLME, gfp);
18917         return;
18918
18919  nla_put_failure:
18920         nlmsg_free(msg);
18921 }
18922
18923 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
18924                                const u8 *replay_ctr, gfp_t gfp)
18925 {
18926         struct wireless_dev *wdev = dev->ieee80211_ptr;
18927         struct wiphy *wiphy = wdev->wiphy;
18928         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18929
18930         trace_cfg80211_gtk_rekey_notify(dev, bssid);
18931         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
18932 }
18933 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
18934
18935 static void
18936 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
18937                                struct net_device *netdev, int index,
18938                                const u8 *bssid, bool preauth, gfp_t gfp)
18939 {
18940         struct sk_buff *msg;
18941         struct nlattr *attr;
18942         void *hdr;
18943
18944         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18945         if (!msg)
18946                 return;
18947
18948         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
18949         if (!hdr) {
18950                 nlmsg_free(msg);
18951                 return;
18952         }
18953
18954         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18955             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
18956                 goto nla_put_failure;
18957
18958         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
18959         if (!attr)
18960                 goto nla_put_failure;
18961
18962         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
18963             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
18964             (preauth &&
18965              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
18966                 goto nla_put_failure;
18967
18968         nla_nest_end(msg, attr);
18969
18970         genlmsg_end(msg, hdr);
18971
18972         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18973                                 NL80211_MCGRP_MLME, gfp);
18974         return;
18975
18976  nla_put_failure:
18977         nlmsg_free(msg);
18978 }
18979
18980 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
18981                                      const u8 *bssid, bool preauth, gfp_t gfp)
18982 {
18983         struct wireless_dev *wdev = dev->ieee80211_ptr;
18984         struct wiphy *wiphy = wdev->wiphy;
18985         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18986
18987         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
18988         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
18989 }
18990 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
18991
18992 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
18993                                      struct net_device *netdev,
18994                                      unsigned int link_id,
18995                                      struct cfg80211_chan_def *chandef,
18996                                      gfp_t gfp,
18997                                      enum nl80211_commands notif,
18998                                      u8 count, bool quiet)
18999 {
19000         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19001         struct sk_buff *msg;
19002         void *hdr;
19003
19004         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19005         if (!msg)
19006                 return;
19007
19008         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19009         if (!hdr) {
19010                 nlmsg_free(msg);
19011                 return;
19012         }
19013
19014         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19015                 goto nla_put_failure;
19016
19017         if (wdev->valid_links &&
19018             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19019                 goto nla_put_failure;
19020
19021         if (nl80211_send_chandef(msg, chandef))
19022                 goto nla_put_failure;
19023
19024         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19025                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19026                         goto nla_put_failure;
19027                 if (quiet &&
19028                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19029                         goto nla_put_failure;
19030         }
19031
19032         genlmsg_end(msg, hdr);
19033
19034         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19035                                 NL80211_MCGRP_MLME, gfp);
19036         return;
19037
19038  nla_put_failure:
19039         nlmsg_free(msg);
19040 }
19041
19042 void cfg80211_ch_switch_notify(struct net_device *dev,
19043                                struct cfg80211_chan_def *chandef,
19044                                unsigned int link_id)
19045 {
19046         struct wireless_dev *wdev = dev->ieee80211_ptr;
19047         struct wiphy *wiphy = wdev->wiphy;
19048         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19049
19050         ASSERT_WDEV_LOCK(wdev);
19051         WARN_INVALID_LINK_ID(wdev, link_id);
19052
19053         trace_cfg80211_ch_switch_notify(dev, chandef, link_id);
19054
19055         switch (wdev->iftype) {
19056         case NL80211_IFTYPE_STATION:
19057         case NL80211_IFTYPE_P2P_CLIENT:
19058                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19059                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19060                                                         chandef->chan);
19061                 break;
19062         case NL80211_IFTYPE_MESH_POINT:
19063                 wdev->u.mesh.chandef = *chandef;
19064                 wdev->u.mesh.preset_chandef = *chandef;
19065                 break;
19066         case NL80211_IFTYPE_AP:
19067         case NL80211_IFTYPE_P2P_GO:
19068                 wdev->links[link_id].ap.chandef = *chandef;
19069                 break;
19070         case NL80211_IFTYPE_ADHOC:
19071                 wdev->u.ibss.chandef = *chandef;
19072                 break;
19073         default:
19074                 WARN_ON(1);
19075                 break;
19076         }
19077
19078         cfg80211_sched_dfs_chan_update(rdev);
19079
19080         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19081                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
19082 }
19083 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19084
19085 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19086                                        struct cfg80211_chan_def *chandef,
19087                                        unsigned int link_id, u8 count,
19088                                        bool quiet)
19089 {
19090         struct wireless_dev *wdev = dev->ieee80211_ptr;
19091         struct wiphy *wiphy = wdev->wiphy;
19092         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19093
19094         ASSERT_WDEV_LOCK(wdev);
19095         WARN_INVALID_LINK_ID(wdev, link_id);
19096
19097         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id);
19098
19099         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19100                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19101                                  count, quiet);
19102 }
19103 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19104
19105 int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
19106                               enum nl80211_commands cmd, u8 count,
19107                               u64 color_bitmap)
19108 {
19109         struct wireless_dev *wdev = dev->ieee80211_ptr;
19110         struct wiphy *wiphy = wdev->wiphy;
19111         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19112         struct sk_buff *msg;
19113         void *hdr;
19114
19115         ASSERT_WDEV_LOCK(wdev);
19116
19117         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19118
19119         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19120         if (!msg)
19121                 return -ENOMEM;
19122
19123         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19124         if (!hdr)
19125                 goto nla_put_failure;
19126
19127         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19128                 goto nla_put_failure;
19129
19130         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19131             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19132                 goto nla_put_failure;
19133
19134         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19135             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19136                               color_bitmap, NL80211_ATTR_PAD))
19137                 goto nla_put_failure;
19138
19139         genlmsg_end(msg, hdr);
19140
19141         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19142                                        msg, 0, NL80211_MCGRP_MLME, gfp);
19143
19144 nla_put_failure:
19145         nlmsg_free(msg);
19146         return -EINVAL;
19147 }
19148 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19149
19150 void
19151 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19152                      const struct cfg80211_chan_def *chandef,
19153                      enum nl80211_radar_event event,
19154                      struct net_device *netdev, gfp_t gfp)
19155 {
19156         struct sk_buff *msg;
19157         void *hdr;
19158
19159         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19160         if (!msg)
19161                 return;
19162
19163         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19164         if (!hdr) {
19165                 nlmsg_free(msg);
19166                 return;
19167         }
19168
19169         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19170                 goto nla_put_failure;
19171
19172         /* NOP and radar events don't need a netdev parameter */
19173         if (netdev) {
19174                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19175
19176                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19177                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19178                                       NL80211_ATTR_PAD))
19179                         goto nla_put_failure;
19180         }
19181
19182         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19183                 goto nla_put_failure;
19184
19185         if (nl80211_send_chandef(msg, chandef))
19186                 goto nla_put_failure;
19187
19188         genlmsg_end(msg, hdr);
19189
19190         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19191                                 NL80211_MCGRP_MLME, gfp);
19192         return;
19193
19194  nla_put_failure:
19195         nlmsg_free(msg);
19196 }
19197
19198 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19199                                        struct sta_opmode_info *sta_opmode,
19200                                        gfp_t gfp)
19201 {
19202         struct sk_buff *msg;
19203         struct wireless_dev *wdev = dev->ieee80211_ptr;
19204         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19205         void *hdr;
19206
19207         if (WARN_ON(!mac))
19208                 return;
19209
19210         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19211         if (!msg)
19212                 return;
19213
19214         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19215         if (!hdr) {
19216                 nlmsg_free(msg);
19217                 return;
19218         }
19219
19220         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19221                 goto nla_put_failure;
19222
19223         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19224                 goto nla_put_failure;
19225
19226         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19227                 goto nla_put_failure;
19228
19229         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19230             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19231                 goto nla_put_failure;
19232
19233         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19234             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19235                 goto nla_put_failure;
19236
19237         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19238             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19239                 goto nla_put_failure;
19240
19241         genlmsg_end(msg, hdr);
19242
19243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19244                                 NL80211_MCGRP_MLME, gfp);
19245
19246         return;
19247
19248 nla_put_failure:
19249         nlmsg_free(msg);
19250 }
19251 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19252
19253 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19254                            u64 cookie, bool acked, s32 ack_signal,
19255                            bool is_valid_ack_signal, gfp_t gfp)
19256 {
19257         struct wireless_dev *wdev = dev->ieee80211_ptr;
19258         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19259         struct sk_buff *msg;
19260         void *hdr;
19261
19262         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19263
19264         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19265
19266         if (!msg)
19267                 return;
19268
19269         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19270         if (!hdr) {
19271                 nlmsg_free(msg);
19272                 return;
19273         }
19274
19275         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19276             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19277             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19278             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19279                               NL80211_ATTR_PAD) ||
19280             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19281             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19282                                                 ack_signal)))
19283                 goto nla_put_failure;
19284
19285         genlmsg_end(msg, hdr);
19286
19287         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19288                                 NL80211_MCGRP_MLME, gfp);
19289         return;
19290
19291  nla_put_failure:
19292         nlmsg_free(msg);
19293 }
19294 EXPORT_SYMBOL(cfg80211_probe_status);
19295
19296 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19297                                      size_t len, int freq, int sig_dbm)
19298 {
19299         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19300         struct sk_buff *msg;
19301         void *hdr;
19302         struct cfg80211_beacon_registration *reg;
19303
19304         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19305
19306         spin_lock_bh(&rdev->beacon_registrations_lock);
19307         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19308                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19309                 if (!msg) {
19310                         spin_unlock_bh(&rdev->beacon_registrations_lock);
19311                         return;
19312                 }
19313
19314                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19315                 if (!hdr)
19316                         goto nla_put_failure;
19317
19318                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19319                     (freq &&
19320                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19321                                   KHZ_TO_MHZ(freq)) ||
19322                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19323                                   freq % 1000))) ||
19324                     (sig_dbm &&
19325                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19326                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19327                         goto nla_put_failure;
19328
19329                 genlmsg_end(msg, hdr);
19330
19331                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19332         }
19333         spin_unlock_bh(&rdev->beacon_registrations_lock);
19334         return;
19335
19336  nla_put_failure:
19337         spin_unlock_bh(&rdev->beacon_registrations_lock);
19338         nlmsg_free(msg);
19339 }
19340 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19341
19342 #ifdef CONFIG_PM
19343 static int cfg80211_net_detect_results(struct sk_buff *msg,
19344                                        struct cfg80211_wowlan_wakeup *wakeup)
19345 {
19346         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19347         struct nlattr *nl_results, *nl_match, *nl_freqs;
19348         int i, j;
19349
19350         nl_results = nla_nest_start_noflag(msg,
19351                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19352         if (!nl_results)
19353                 return -EMSGSIZE;
19354
19355         for (i = 0; i < nd->n_matches; i++) {
19356                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19357
19358                 nl_match = nla_nest_start_noflag(msg, i);
19359                 if (!nl_match)
19360                         break;
19361
19362                 /* The SSID attribute is optional in nl80211, but for
19363                  * simplicity reasons it's always present in the
19364                  * cfg80211 structure.  If a driver can't pass the
19365                  * SSID, that needs to be changed.  A zero length SSID
19366                  * is still a valid SSID (wildcard), so it cannot be
19367                  * used for this purpose.
19368                  */
19369                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19370                             match->ssid.ssid)) {
19371                         nla_nest_cancel(msg, nl_match);
19372                         goto out;
19373                 }
19374
19375                 if (match->n_channels) {
19376                         nl_freqs = nla_nest_start_noflag(msg,
19377                                                          NL80211_ATTR_SCAN_FREQUENCIES);
19378                         if (!nl_freqs) {
19379                                 nla_nest_cancel(msg, nl_match);
19380                                 goto out;
19381                         }
19382
19383                         for (j = 0; j < match->n_channels; j++) {
19384                                 if (nla_put_u32(msg, j, match->channels[j])) {
19385                                         nla_nest_cancel(msg, nl_freqs);
19386                                         nla_nest_cancel(msg, nl_match);
19387                                         goto out;
19388                                 }
19389                         }
19390
19391                         nla_nest_end(msg, nl_freqs);
19392                 }
19393
19394                 nla_nest_end(msg, nl_match);
19395         }
19396
19397 out:
19398         nla_nest_end(msg, nl_results);
19399         return 0;
19400 }
19401
19402 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19403                                    struct cfg80211_wowlan_wakeup *wakeup,
19404                                    gfp_t gfp)
19405 {
19406         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19407         struct sk_buff *msg;
19408         void *hdr;
19409         int size = 200;
19410
19411         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19412
19413         if (wakeup)
19414                 size += wakeup->packet_present_len;
19415
19416         msg = nlmsg_new(size, gfp);
19417         if (!msg)
19418                 return;
19419
19420         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19421         if (!hdr)
19422                 goto free_msg;
19423
19424         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19425             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19426                               NL80211_ATTR_PAD))
19427                 goto free_msg;
19428
19429         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19430                                         wdev->netdev->ifindex))
19431                 goto free_msg;
19432
19433         if (wakeup) {
19434                 struct nlattr *reasons;
19435
19436                 reasons = nla_nest_start_noflag(msg,
19437                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
19438                 if (!reasons)
19439                         goto free_msg;
19440
19441                 if (wakeup->disconnect &&
19442                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19443                         goto free_msg;
19444                 if (wakeup->magic_pkt &&
19445                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19446                         goto free_msg;
19447                 if (wakeup->gtk_rekey_failure &&
19448                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19449                         goto free_msg;
19450                 if (wakeup->eap_identity_req &&
19451                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19452                         goto free_msg;
19453                 if (wakeup->four_way_handshake &&
19454                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19455                         goto free_msg;
19456                 if (wakeup->rfkill_release &&
19457                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19458                         goto free_msg;
19459
19460                 if (wakeup->pattern_idx >= 0 &&
19461                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19462                                 wakeup->pattern_idx))
19463                         goto free_msg;
19464
19465                 if (wakeup->tcp_match &&
19466                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19467                         goto free_msg;
19468
19469                 if (wakeup->tcp_connlost &&
19470                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19471                         goto free_msg;
19472
19473                 if (wakeup->tcp_nomoretokens &&
19474                     nla_put_flag(msg,
19475                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19476                         goto free_msg;
19477
19478                 if (wakeup->packet) {
19479                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19480                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19481
19482                         if (!wakeup->packet_80211) {
19483                                 pkt_attr =
19484                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19485                                 len_attr =
19486                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19487                         }
19488
19489                         if (wakeup->packet_len &&
19490                             nla_put_u32(msg, len_attr, wakeup->packet_len))
19491                                 goto free_msg;
19492
19493                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19494                                     wakeup->packet))
19495                                 goto free_msg;
19496                 }
19497
19498                 if (wakeup->net_detect &&
19499                     cfg80211_net_detect_results(msg, wakeup))
19500                                 goto free_msg;
19501
19502                 nla_nest_end(msg, reasons);
19503         }
19504
19505         genlmsg_end(msg, hdr);
19506
19507         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19508                                 NL80211_MCGRP_MLME, gfp);
19509         return;
19510
19511  free_msg:
19512         nlmsg_free(msg);
19513 }
19514 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19515 #endif
19516
19517 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19518                                 enum nl80211_tdls_operation oper,
19519                                 u16 reason_code, gfp_t gfp)
19520 {
19521         struct wireless_dev *wdev = dev->ieee80211_ptr;
19522         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19523         struct sk_buff *msg;
19524         void *hdr;
19525
19526         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19527                                          reason_code);
19528
19529         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19530         if (!msg)
19531                 return;
19532
19533         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19534         if (!hdr) {
19535                 nlmsg_free(msg);
19536                 return;
19537         }
19538
19539         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19540             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19541             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19542             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19543             (reason_code > 0 &&
19544              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19545                 goto nla_put_failure;
19546
19547         genlmsg_end(msg, hdr);
19548
19549         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19550                                 NL80211_MCGRP_MLME, gfp);
19551         return;
19552
19553  nla_put_failure:
19554         nlmsg_free(msg);
19555 }
19556 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19557
19558 static int nl80211_netlink_notify(struct notifier_block * nb,
19559                                   unsigned long state,
19560                                   void *_notify)
19561 {
19562         struct netlink_notify *notify = _notify;
19563         struct cfg80211_registered_device *rdev;
19564         struct wireless_dev *wdev;
19565         struct cfg80211_beacon_registration *reg, *tmp;
19566
19567         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19568                 return NOTIFY_DONE;
19569
19570         rcu_read_lock();
19571
19572         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19573                 struct cfg80211_sched_scan_request *sched_scan_req;
19574
19575                 list_for_each_entry_rcu(sched_scan_req,
19576                                         &rdev->sched_scan_req_list,
19577                                         list) {
19578                         if (sched_scan_req->owner_nlportid == notify->portid) {
19579                                 sched_scan_req->nl_owner_dead = true;
19580                                 schedule_work(&rdev->sched_scan_stop_wk);
19581                         }
19582                 }
19583
19584                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19585                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
19586
19587                         if (wdev->owner_nlportid == notify->portid) {
19588                                 wdev->nl_owner_dead = true;
19589                                 schedule_work(&rdev->destroy_work);
19590                         } else if (wdev->conn_owner_nlportid == notify->portid) {
19591                                 schedule_work(&wdev->disconnect_wk);
19592                         }
19593
19594                         cfg80211_release_pmsr(wdev, notify->portid);
19595                 }
19596
19597                 spin_lock_bh(&rdev->beacon_registrations_lock);
19598                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19599                                          list) {
19600                         if (reg->nlportid == notify->portid) {
19601                                 list_del(&reg->list);
19602                                 kfree(reg);
19603                                 break;
19604                         }
19605                 }
19606                 spin_unlock_bh(&rdev->beacon_registrations_lock);
19607         }
19608
19609         rcu_read_unlock();
19610
19611         /*
19612          * It is possible that the user space process that is controlling the
19613          * indoor setting disappeared, so notify the regulatory core.
19614          */
19615         regulatory_netlink_notify(notify->portid);
19616         return NOTIFY_OK;
19617 }
19618
19619 static struct notifier_block nl80211_netlink_notifier = {
19620         .notifier_call = nl80211_netlink_notify,
19621 };
19622
19623 void cfg80211_ft_event(struct net_device *netdev,
19624                        struct cfg80211_ft_event_params *ft_event)
19625 {
19626         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19627         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19628         struct sk_buff *msg;
19629         void *hdr;
19630
19631         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19632
19633         if (!ft_event->target_ap)
19634                 return;
19635
19636         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19637                         GFP_KERNEL);
19638         if (!msg)
19639                 return;
19640
19641         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19642         if (!hdr)
19643                 goto out;
19644
19645         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19646             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19647             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19648                 goto out;
19649
19650         if (ft_event->ies &&
19651             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19652                 goto out;
19653         if (ft_event->ric_ies &&
19654             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19655                     ft_event->ric_ies))
19656                 goto out;
19657
19658         genlmsg_end(msg, hdr);
19659
19660         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19661                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19662         return;
19663  out:
19664         nlmsg_free(msg);
19665 }
19666 EXPORT_SYMBOL(cfg80211_ft_event);
19667
19668 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19669 {
19670         struct cfg80211_registered_device *rdev;
19671         struct sk_buff *msg;
19672         void *hdr;
19673         u32 nlportid;
19674
19675         rdev = wiphy_to_rdev(wdev->wiphy);
19676         if (!rdev->crit_proto_nlportid)
19677                 return;
19678
19679         nlportid = rdev->crit_proto_nlportid;
19680         rdev->crit_proto_nlportid = 0;
19681
19682         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19683         if (!msg)
19684                 return;
19685
19686         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19687         if (!hdr)
19688                 goto nla_put_failure;
19689
19690         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19691             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19692                               NL80211_ATTR_PAD))
19693                 goto nla_put_failure;
19694
19695         genlmsg_end(msg, hdr);
19696
19697         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19698         return;
19699
19700  nla_put_failure:
19701         nlmsg_free(msg);
19702 }
19703 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
19704
19705 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
19706 {
19707         struct wiphy *wiphy = wdev->wiphy;
19708         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19709         struct sk_buff *msg;
19710         void *hdr;
19711
19712         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19713         if (!msg)
19714                 return;
19715
19716         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
19717         if (!hdr)
19718                 goto out;
19719
19720         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19721             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
19722             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19723                               NL80211_ATTR_PAD))
19724                 goto out;
19725
19726         genlmsg_end(msg, hdr);
19727
19728         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
19729                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19730         return;
19731  out:
19732         nlmsg_free(msg);
19733 }
19734
19735 int cfg80211_external_auth_request(struct net_device *dev,
19736                                    struct cfg80211_external_auth_params *params,
19737                                    gfp_t gfp)
19738 {
19739         struct wireless_dev *wdev = dev->ieee80211_ptr;
19740         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19741         struct sk_buff *msg;
19742         void *hdr;
19743
19744         if (!wdev->conn_owner_nlportid)
19745                 return -EINVAL;
19746
19747         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19748         if (!msg)
19749                 return -ENOMEM;
19750
19751         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
19752         if (!hdr)
19753                 goto nla_put_failure;
19754
19755         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19756             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19757             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
19758             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
19759                         params->action) ||
19760             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
19761             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
19762                     params->ssid.ssid))
19763                 goto nla_put_failure;
19764
19765         genlmsg_end(msg, hdr);
19766         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
19767                         wdev->conn_owner_nlportid);
19768         return 0;
19769
19770  nla_put_failure:
19771         nlmsg_free(msg);
19772         return -ENOBUFS;
19773 }
19774 EXPORT_SYMBOL(cfg80211_external_auth_request);
19775
19776 void cfg80211_update_owe_info_event(struct net_device *netdev,
19777                                     struct cfg80211_update_owe_info *owe_info,
19778                                     gfp_t gfp)
19779 {
19780         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19781         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19782         struct sk_buff *msg;
19783         void *hdr;
19784
19785         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
19786
19787         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19788         if (!msg)
19789                 return;
19790
19791         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
19792         if (!hdr)
19793                 goto nla_put_failure;
19794
19795         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19796             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19797             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
19798                 goto nla_put_failure;
19799
19800         if (!owe_info->ie_len ||
19801             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
19802                 goto nla_put_failure;
19803
19804         genlmsg_end(msg, hdr);
19805
19806         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19807                                 NL80211_MCGRP_MLME, gfp);
19808         return;
19809
19810 nla_put_failure:
19811         genlmsg_cancel(msg, hdr);
19812         nlmsg_free(msg);
19813 }
19814 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
19815
19816 /* initialisation/exit functions */
19817
19818 int __init nl80211_init(void)
19819 {
19820         int err;
19821
19822         err = genl_register_family(&nl80211_fam);
19823         if (err)
19824                 return err;
19825
19826         err = netlink_register_notifier(&nl80211_netlink_notifier);
19827         if (err)
19828                 goto err_out;
19829
19830         return 0;
19831  err_out:
19832         genl_unregister_family(&nl80211_fam);
19833         return err;
19834 }
19835
19836 void nl80211_exit(void)
19837 {
19838         netlink_unregister_notifier(&nl80211_netlink_notifier);
19839         genl_unregister_family(&nl80211_fam);
19840 }