wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2021 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 /* policy for the attributes */
 289 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 290
 291 static const struct nla_policy
 292 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 293         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 294         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 295                                         .len = U8_MAX },
 296         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 297                                              .len = U8_MAX },
 298 };
 299
 300 static const struct nla_policy
 301 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 302         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 303         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 304         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 305                 NLA_POLICY_MAX(NLA_U8, 15),
 306         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 307         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 308                 NLA_POLICY_MAX(NLA_U8, 15),
 309         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 310                 NLA_POLICY_MAX(NLA_U8, 31),
 311         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 312         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 313         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 314         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 315         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 316         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 317         [NL80211_PMSR_FTM_REQ_ATTR_BSS_COLOR] = { .type = NLA_U8 },
 318 };
 319
 320 static const struct nla_policy
 321 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 322         [NL80211_PMSR_TYPE_FTM] =
 323                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 324 };
 325
 326 static const struct nla_policy
 327 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 328         [NL80211_PMSR_REQ_ATTR_DATA] =
 329                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 330         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 331 };
 332
 333 static const struct nla_policy
 334 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 335         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 336         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 337         [NL80211_PMSR_PEER_ATTR_REQ] =
 338                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 339         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 340 };
 341
 342 static const struct nla_policy
 343 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 344         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 345         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 346         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 347         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 348         [NL80211_PMSR_ATTR_PEERS] =
 349                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 350 };
 351
 352 static const struct nla_policy
 353 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 354         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 355                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 356         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 357                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 358         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 359                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 360         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 361                 NLA_POLICY_EXACT_LEN(8),
 362         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 363                 NLA_POLICY_EXACT_LEN(8),
 364         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 365 };
 366
 367 static const struct nla_policy
 368 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 369         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 370         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 371         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 372 };
 373
 374 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 375         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 376                                     .len = NL80211_MAX_SUPP_RATES },
 377         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 378                                 .len = NL80211_MAX_SUPP_HT_RATES },
 379         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 380         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 381         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 382         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 383                                                    NL80211_RATE_INFO_HE_GI_0_8,
 384                                                    NL80211_RATE_INFO_HE_GI_3_2),
 385         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 386                                                    NL80211_RATE_INFO_HE_1XLTF,
 387                                                    NL80211_RATE_INFO_HE_4XLTF),
 388 };
 389
 390 static const struct nla_policy
 391 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 392         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 393         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 394         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 395         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 396         [NL80211_TID_CONFIG_ATTR_NOACK] =
 397                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 398         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 399         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 400         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 401                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 402         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 403                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 404         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 405                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 406         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 407                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 408         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 409                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 410 };
 411
 412 static const struct nla_policy
 413 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 414         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 415         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 416         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 417                         NLA_POLICY_RANGE(NLA_BINARY,
 418                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 419                                          IEEE80211_MAX_DATA_LEN),
 420 };
 421
 422 static const struct nla_policy
 423 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 424         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 425         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 426                                                        .len = IEEE80211_MAX_DATA_LEN }
 427 };
 428
 429 static const struct nla_policy
 430 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 431         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 432         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 433 };
 434
 435 static const struct nla_policy
 436 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 437         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 438         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 439 };
 440
 441 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 442         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 443         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 444         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 445                                       .len = 20-1 },
 446         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 447
 448         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 449         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 450         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 451                                                 NL80211_EDMG_CHANNELS_MIN,
 452                                                 NL80211_EDMG_CHANNELS_MAX),
 453         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 454                                                 NL80211_EDMG_BW_CONFIG_MIN,
 455                                                 NL80211_EDMG_BW_CONFIG_MAX),
 456
 457         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 458         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 459         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 460         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 461
 462         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 463         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 464         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 465         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 466         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 467         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 468
 469         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 470         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 471         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 472
 473         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 474         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 475
 476         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 477         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 478                                     .len = WLAN_MAX_KEY_LEN },
 479         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 480         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 481         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 482         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 483         [NL80211_ATTR_KEY_TYPE] =
 484                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 485
 486         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 487         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 488         [NL80211_ATTR_BEACON_HEAD] =
 489                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 490                                        IEEE80211_MAX_DATA_LEN),
 491         [NL80211_ATTR_BEACON_TAIL] =
 492                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 493                                        IEEE80211_MAX_DATA_LEN),
 494         [NL80211_ATTR_STA_AID] =
 495                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 496         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 497         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 498         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 499                                                .len = NL80211_MAX_SUPP_RATES },
 500         [NL80211_ATTR_STA_PLINK_ACTION] =
 501                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 502         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 503                 NLA_POLICY_RANGE(NLA_U8,
 504                                  NL80211_TX_POWER_AUTOMATIC,
 505                                  NL80211_TX_POWER_FIXED),
 506         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 507         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 508         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 509         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 510                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 511         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 512
 513         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 514         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 515         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 516
 517         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 518         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 519         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 520         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 521                                            .len = NL80211_MAX_SUPP_RATES },
 522         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 523
 524         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 525         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 526
 527         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 528
 529         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 530         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 531                                                    validate_ie_attr,
 532                                                    IEEE80211_MAX_DATA_LEN),
 533         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 534         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 535
 536         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 537                                 .len = IEEE80211_MAX_SSID_LEN },
 538         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 539         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 540         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 541         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 542         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 543                                                   NL80211_MFP_NO,
 544                                                   NL80211_MFP_OPTIONAL),
 545         [NL80211_ATTR_STA_FLAGS2] = {
 546                 .len = sizeof(struct nl80211_sta_flag_update),
 547         },
 548         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 549         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 550         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 551         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 552         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 553         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 554         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 555         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 556         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 557         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 558         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 559         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 560         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 561         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 562         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 563                                  .len = IEEE80211_MAX_DATA_LEN },
 564         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 565         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 566                                                    NL80211_PS_DISABLED,
 567                                                    NL80211_PS_ENABLED),
 568         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 569         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 570         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 571         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 572         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 573         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 574         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 575         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 576         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 577         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 578         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 579         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 580         [NL80211_ATTR_STA_PLINK_STATE] =
 581                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 582         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 583         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 584         [NL80211_ATTR_MESH_PEER_AID] =
 585                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 586         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 587         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 588         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 589         [NL80211_ATTR_HIDDEN_SSID] =
 590                 NLA_POLICY_RANGE(NLA_U32,
 591                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 592                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 593         [NL80211_ATTR_IE_PROBE_RESP] =
 594                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 595                                        IEEE80211_MAX_DATA_LEN),
 596         [NL80211_ATTR_IE_ASSOC_RESP] =
 597                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 598                                        IEEE80211_MAX_DATA_LEN),
 599         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 600         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 601         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 602         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 603         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 604         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 605         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 606         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 607         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 608         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 609         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 610                                       .len = IEEE80211_MAX_DATA_LEN },
 611         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 612         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 613         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 614                 .len = NL80211_HT_CAPABILITY_LEN
 615         },
 616         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 617         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 618         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 619         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 620         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 621
 622         /* need to include at least Auth Transaction and Status Code */
 623         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 624
 625         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 626         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 627         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 628         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 629         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 630                 NLA_POLICY_RANGE(NLA_U32,
 631                                  NL80211_MESH_POWER_UNKNOWN + 1,
 632                                  NL80211_MESH_POWER_MAX),
 633         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 634         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 635         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 636         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 637         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 638         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 639         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 640                 .len = NL80211_VHT_CAPABILITY_LEN,
 641         },
 642         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 643         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 644                                   .len = IEEE80211_MAX_DATA_LEN },
 645         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 646         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 647                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 648         [NL80211_ATTR_PEER_AID] =
 649                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 650         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 651         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 652         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 653         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 654         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 655         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 656         /*
 657          * The value of the Length field of the Supported Operating
 658          * Classes element is between 2 and 253.
 659          */
 660         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 661                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 662         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 663         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 664         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 665         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 666         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 667         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 668                                                   IEEE80211_QOS_MAP_LEN_MIN,
 669                                                   IEEE80211_QOS_MAP_LEN_MAX),
 670         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 671         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 672         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 673         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 674         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 675         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 676         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 677         [NL80211_ATTR_USER_PRIO] =
 678                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 679         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 680         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 681         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 682         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 683         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 684         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 685         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 686         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 687         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 688         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 689         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 690                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 691         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 692                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 693         },
 694         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 695         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 696         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 697         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 698         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 699                                     .len = FILS_MAX_KEK_LEN },
 700         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 701         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 702         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 703         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 704         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 705                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 706         },
 707         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 708         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 709                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 710         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 711                                           .len = FILS_ERP_MAX_REALM_LEN },
 712         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 713         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 714                                         .len = FILS_ERP_MAX_RRK_LEN },
 715         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 716         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 717         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 718         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 719         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 720
 721         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 722         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 723         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 724         [NL80211_ATTR_HE_CAPABILITY] =
 725                 NLA_POLICY_RANGE(NLA_BINARY,
 726                                  NL80211_HE_MIN_CAPABILITY_LEN,
 727                                  NL80211_HE_MAX_CAPABILITY_LEN),
 728         [NL80211_ATTR_FTM_RESPONDER] =
 729                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 730         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 731         [NL80211_ATTR_PEER_MEASUREMENTS] =
 732                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 733         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 734         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 735                                         .len = SAE_PASSWORD_MAX_LEN },
 736         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 737         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 738         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 739         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 740         [NL80211_ATTR_TID_CONFIG] =
 741                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 742         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 743         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 744         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 745         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 746         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 747         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 748         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 749                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 750         [NL80211_ATTR_FILS_DISCOVERY] =
 751                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 752         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 753                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 754         [NL80211_ATTR_S1G_CAPABILITY] =
 755                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 756         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 757                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 758         [NL80211_ATTR_SAE_PWE] =
 759                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 760                                  NL80211_SAE_PWE_BOTH),
 761         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 762         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 763         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 764         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 765         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 766         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 767         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 768 };
 769
 770 /* policy for the key attributes */
 771 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 772         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 773         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 774         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 775         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 776         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 777         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 778         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 779         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 780         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 781 };
 782
 783 /* policy for the key default flags */
 784 static const struct nla_policy
 785 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 786         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 787         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 788 };
 789
 790 #ifdef CONFIG_PM
 791 /* policy for WoWLAN attributes */
 792 static const struct nla_policy
 793 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 794         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 795         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 796         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 797         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 798         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 799         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 800         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 801         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 802         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 803         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 804 };
 805
 806 static const struct nla_policy
 807 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 808         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 809         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 810         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 811         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 812         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 813         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 814         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 815                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 816         },
 817         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 818                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 819         },
 820         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 821         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 822         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 823 };
 824 #endif /* CONFIG_PM */
 825
 826 /* policy for coalesce rule attributes */
 827 static const struct nla_policy
 828 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 829         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 830         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 831                 NLA_POLICY_RANGE(NLA_U32,
 832                                  NL80211_COALESCE_CONDITION_MATCH,
 833                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 834         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 835 };
 836
 837 /* policy for GTK rekey offload attributes */
 838 static const struct nla_policy
 839 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 840         [NL80211_REKEY_DATA_KEK] = {
 841                 .type = NLA_BINARY,
 842                 .len = NL80211_KEK_EXT_LEN
 843         },
 844         [NL80211_REKEY_DATA_KCK] = {
 845                 .type = NLA_BINARY,
 846                 .len = NL80211_KCK_EXT_LEN
 847         },
 848         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 849         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 850 };
 851
 852 static const struct nla_policy
 853 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 854         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 855         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 856         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 857         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 858 };
 859
 860 static const struct nla_policy
 861 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 862         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 863                                                  .len = IEEE80211_MAX_SSID_LEN },
 864         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 865         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 866         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 867                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 868 };
 869
 870 static const struct nla_policy
 871 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 872         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 873         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 874 };
 875
 876 static const struct nla_policy
 877 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 878         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 879         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 880         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 881                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 882         },
 883 };
 884
 885 /* policy for NAN function attributes */
 886 static const struct nla_policy
 887 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 888         [NL80211_NAN_FUNC_TYPE] =
 889                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 890         [NL80211_NAN_FUNC_SERVICE_ID] = {
 891                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 892         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 893         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 894         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 895         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 896         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 897         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 898         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 899         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 900         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 901                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 902         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 903         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 904         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 905         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 906         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 907 };
 908
 909 /* policy for Service Response Filter attributes */
 910 static const struct nla_policy
 911 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 912         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 913         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 914                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 915         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 916         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 917 };
 918
 919 /* policy for packet pattern attributes */
 920 static const struct nla_policy
 921 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 922         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 923         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 924         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 925 };
 926
 927 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 928                                      struct cfg80211_registered_device **rdev,
 929                                      struct wireless_dev **wdev,
 930                                      struct nlattr **attrbuf)
 931 {
 932         int err;
 933
 934         if (!cb->args[0]) {
 935                 struct nlattr **attrbuf_free = NULL;
 936
 937                 if (!attrbuf) {
 938                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 939                                           GFP_KERNEL);
 940                         if (!attrbuf)
 941                                 return -ENOMEM;
 942                         attrbuf_free = attrbuf;
 943                 }
 944
 945                 err = nlmsg_parse_deprecated(cb->nlh,
 946                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 947                                              attrbuf, nl80211_fam.maxattr,
 948                                              nl80211_policy, NULL);
 949                 if (err) {
 950                         kfree(attrbuf_free);
 951                         return err;
 952                 }
 953
 954                 rtnl_lock();
 955                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
 956                                                    attrbuf);
 957                 kfree(attrbuf_free);
 958                 if (IS_ERR(*wdev)) {
 959                         rtnl_unlock();
 960                         return PTR_ERR(*wdev);
 961                 }
 962                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 963                 mutex_lock(&(*rdev)->wiphy.mtx);
 964                 rtnl_unlock();
 965                 /* 0 is the first index - add 1 to parse only once */
 966                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 967                 cb->args[1] = (*wdev)->identifier;
 968         } else {
 969                 /* subtract the 1 again here */
 970                 struct wiphy *wiphy;
 971                 struct wireless_dev *tmp;
 972
 973                 rtnl_lock();
 974                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 975                 if (!wiphy) {
 976                         rtnl_unlock();
 977                         return -ENODEV;
 978                 }
 979                 *rdev = wiphy_to_rdev(wiphy);
 980                 *wdev = NULL;
 981
 982                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 983                         if (tmp->identifier == cb->args[1]) {
 984                                 *wdev = tmp;
 985                                 break;
 986                         }
 987                 }
 988
 989                 if (!*wdev) {
 990                         rtnl_unlock();
 991                         return -ENODEV;
 992                 }
 993                 mutex_lock(&(*rdev)->wiphy.mtx);
 994                 rtnl_unlock();
 995         }
 996
 997         return 0;
 998 }
 999
1000 /* message building helper */
1001 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1002                      int flags, u8 cmd)
1003 {
1004         /* since there is no private header just add the generic one */
1005         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1006 }
1007
1008 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1009                                      const struct ieee80211_reg_rule *rule)
1010 {
1011         int j;
1012         struct nlattr *nl_wmm_rules =
1013                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1014
1015         if (!nl_wmm_rules)
1016                 goto nla_put_failure;
1017
1018         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1019                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1020
1021                 if (!nl_wmm_rule)
1022                         goto nla_put_failure;
1023
1024                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1025                                 rule->wmm_rule.client[j].cw_min) ||
1026                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1027                                 rule->wmm_rule.client[j].cw_max) ||
1028                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1029                                rule->wmm_rule.client[j].aifsn) ||
1030                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1031                                 rule->wmm_rule.client[j].cot))
1032                         goto nla_put_failure;
1033
1034                 nla_nest_end(msg, nl_wmm_rule);
1035         }
1036         nla_nest_end(msg, nl_wmm_rules);
1037
1038         return 0;
1039
1040 nla_put_failure:
1041         return -ENOBUFS;
1042 }
1043
1044 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1045                                    struct ieee80211_channel *chan,
1046                                    bool large)
1047 {
1048         /* Some channels must be completely excluded from the
1049          * list to protect old user-space tools from breaking
1050          */
1051         if (!large && chan->flags &
1052             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1053                 return 0;
1054         if (!large && chan->freq_offset)
1055                 return 0;
1056
1057         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1058                         chan->center_freq))
1059                 goto nla_put_failure;
1060
1061         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1062                 goto nla_put_failure;
1063
1064         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1065             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1066                 goto nla_put_failure;
1067         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1068                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1069                         goto nla_put_failure;
1070                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1071                         goto nla_put_failure;
1072         }
1073         if (chan->flags & IEEE80211_CHAN_RADAR) {
1074                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1075                         goto nla_put_failure;
1076                 if (large) {
1077                         u32 time;
1078
1079                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1080
1081                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1082                                         chan->dfs_state))
1083                                 goto nla_put_failure;
1084                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1085                                         time))
1086                                 goto nla_put_failure;
1087                         if (nla_put_u32(msg,
1088                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1089                                         chan->dfs_cac_ms))
1090                                 goto nla_put_failure;
1091                 }
1092         }
1093
1094         if (large) {
1095                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1096                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1097                         goto nla_put_failure;
1098                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1099                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1100                         goto nla_put_failure;
1101                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1102                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1103                         goto nla_put_failure;
1104                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1105                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1106                         goto nla_put_failure;
1107                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1108                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1109                         goto nla_put_failure;
1110                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1111                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1112                         goto nla_put_failure;
1113                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1114                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1115                         goto nla_put_failure;
1116                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1117                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1118                         goto nla_put_failure;
1119                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1120                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1121                         goto nla_put_failure;
1122                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1123                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1124                         goto nla_put_failure;
1125                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1126                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1127                         goto nla_put_failure;
1128                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1129                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1130                         goto nla_put_failure;
1131                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1132                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1133                         goto nla_put_failure;
1134                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1135                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1136                         goto nla_put_failure;
1137         }
1138
1139         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1140                         DBM_TO_MBM(chan->max_power)))
1141                 goto nla_put_failure;
1142
1143         if (large) {
1144                 const struct ieee80211_reg_rule *rule =
1145                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1146
1147                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1148                         if (nl80211_msg_put_wmm_rules(msg, rule))
1149                                 goto nla_put_failure;
1150                 }
1151         }
1152
1153         return 0;
1154
1155  nla_put_failure:
1156         return -ENOBUFS;
1157 }
1158
1159 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1160                                   struct cfg80211_txq_stats *txqstats,
1161                                   int attrtype)
1162 {
1163         struct nlattr *txqattr;
1164
1165 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1166         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1167             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1168                 return false;                                             \
1169         } while (0)
1170
1171         txqattr = nla_nest_start_noflag(msg, attrtype);
1172         if (!txqattr)
1173                 return false;
1174
1175         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1176         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1177         PUT_TXQVAL_U32(FLOWS, flows);
1178         PUT_TXQVAL_U32(DROPS, drops);
1179         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1180         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1181         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1182         PUT_TXQVAL_U32(COLLISIONS, collisions);
1183         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1184         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1185         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1186         nla_nest_end(msg, txqattr);
1187
1188 #undef PUT_TXQVAL_U32
1189         return true;
1190 }
1191
1192 /* netlink command implementations */
1193
1194 struct key_parse {
1195         struct key_params p;
1196         int idx;
1197         int type;
1198         bool def, defmgmt, defbeacon;
1199         bool def_uni, def_multi;
1200 };
1201
1202 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1203                                  struct key_parse *k)
1204 {
1205         struct nlattr *tb[NL80211_KEY_MAX + 1];
1206         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1207                                               nl80211_key_policy,
1208                                               info->extack);
1209         if (err)
1210                 return err;
1211
1212         k->def = !!tb[NL80211_KEY_DEFAULT];
1213         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1214         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1215
1216         if (k->def) {
1217                 k->def_uni = true;
1218                 k->def_multi = true;
1219         }
1220         if (k->defmgmt || k->defbeacon)
1221                 k->def_multi = true;
1222
1223         if (tb[NL80211_KEY_IDX])
1224                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1225
1226         if (tb[NL80211_KEY_DATA]) {
1227                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1228                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1229         }
1230
1231         if (tb[NL80211_KEY_SEQ]) {
1232                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1233                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1234         }
1235
1236         if (tb[NL80211_KEY_CIPHER])
1237                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1238
1239         if (tb[NL80211_KEY_TYPE])
1240                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1241
1242         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1243                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1244
1245                 err = nla_parse_nested_deprecated(kdt,
1246                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1247                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1248                                                   nl80211_key_default_policy,
1249                                                   info->extack);
1250                 if (err)
1251                         return err;
1252
1253                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1254                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1255         }
1256
1257         if (tb[NL80211_KEY_MODE])
1258                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1259
1260         return 0;
1261 }
1262
1263 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1264 {
1265         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1266                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1267                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1268         }
1269
1270         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1271                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1272                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1273         }
1274
1275         if (info->attrs[NL80211_ATTR_KEY_IDX])
1276                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1277
1278         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1279                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1280
1281         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1282         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1283
1284         if (k->def) {
1285                 k->def_uni = true;
1286                 k->def_multi = true;
1287         }
1288         if (k->defmgmt)
1289                 k->def_multi = true;
1290
1291         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1292                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1293
1294         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1295                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1296                 int err = nla_parse_nested_deprecated(kdt,
1297                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1298                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1299                                                       nl80211_key_default_policy,
1300                                                       info->extack);
1301                 if (err)
1302                         return err;
1303
1304                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1305                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1306         }
1307
1308         return 0;
1309 }
1310
1311 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1312 {
1313         int err;
1314
1315         memset(k, 0, sizeof(*k));
1316         k->idx = -1;
1317         k->type = -1;
1318
1319         if (info->attrs[NL80211_ATTR_KEY])
1320                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1321         else
1322                 err = nl80211_parse_key_old(info, k);
1323
1324         if (err)
1325                 return err;
1326
1327         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1328             (k->defbeacon ? 1 : 0) > 1) {
1329                 GENL_SET_ERR_MSG(info,
1330                                  "key with multiple default flags is invalid");
1331                 return -EINVAL;
1332         }
1333
1334         if (k->defmgmt || k->defbeacon) {
1335                 if (k->def_uni || !k->def_multi) {
1336                         GENL_SET_ERR_MSG(info,
1337                                          "defmgmt/defbeacon key must be mcast");
1338                         return -EINVAL;
1339                 }
1340         }
1341
1342         if (k->idx != -1) {
1343                 if (k->defmgmt) {
1344                         if (k->idx < 4 || k->idx > 5) {
1345                                 GENL_SET_ERR_MSG(info,
1346                                                  "defmgmt key idx not 4 or 5");
1347                                 return -EINVAL;
1348                         }
1349                 } else if (k->defbeacon) {
1350                         if (k->idx < 6 || k->idx > 7) {
1351                                 GENL_SET_ERR_MSG(info,
1352                                                  "defbeacon key idx not 6 or 7");
1353                                 return -EINVAL;
1354                         }
1355                 } else if (k->def) {
1356                         if (k->idx < 0 || k->idx > 3) {
1357                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1358                                 return -EINVAL;
1359                         }
1360                 } else {
1361                         if (k->idx < 0 || k->idx > 7) {
1362                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1363                                 return -EINVAL;
1364                         }
1365                 }
1366         }
1367
1368         return 0;
1369 }
1370
1371 static struct cfg80211_cached_keys *
1372 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1373                        struct genl_info *info, bool *no_ht)
1374 {
1375         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1376         struct key_parse parse;
1377         struct nlattr *key;
1378         struct cfg80211_cached_keys *result;
1379         int rem, err, def = 0;
1380         bool have_key = false;
1381
1382         nla_for_each_nested(key, keys, rem) {
1383                 have_key = true;
1384                 break;
1385         }
1386
1387         if (!have_key)
1388                 return NULL;
1389
1390         result = kzalloc(sizeof(*result), GFP_KERNEL);
1391         if (!result)
1392                 return ERR_PTR(-ENOMEM);
1393
1394         result->def = -1;
1395
1396         nla_for_each_nested(key, keys, rem) {
1397                 memset(&parse, 0, sizeof(parse));
1398                 parse.idx = -1;
1399
1400                 err = nl80211_parse_key_new(info, key, &parse);
1401                 if (err)
1402                         goto error;
1403                 err = -EINVAL;
1404                 if (!parse.p.key)
1405                         goto error;
1406                 if (parse.idx < 0 || parse.idx > 3) {
1407                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1408                         goto error;
1409                 }
1410                 if (parse.def) {
1411                         if (def) {
1412                                 GENL_SET_ERR_MSG(info,
1413                                                  "only one key can be default");
1414                                 goto error;
1415                         }
1416                         def = 1;
1417                         result->def = parse.idx;
1418                         if (!parse.def_uni || !parse.def_multi)
1419                                 goto error;
1420                 } else if (parse.defmgmt)
1421                         goto error;
1422                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1423                                                      parse.idx, false, NULL);
1424                 if (err)
1425                         goto error;
1426                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1427                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1428                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1429                         err = -EINVAL;
1430                         goto error;
1431                 }
1432                 result->params[parse.idx].cipher = parse.p.cipher;
1433                 result->params[parse.idx].key_len = parse.p.key_len;
1434                 result->params[parse.idx].key = result->data[parse.idx];
1435                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1436
1437                 /* must be WEP key if we got here */
1438                 if (no_ht)
1439                         *no_ht = true;
1440         }
1441
1442         if (result->def < 0) {
1443                 err = -EINVAL;
1444                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1445                 goto error;
1446         }
1447
1448         return result;
1449  error:
1450         kfree(result);
1451         return ERR_PTR(err);
1452 }
1453
1454 static int nl80211_key_allowed(struct wireless_dev *wdev)
1455 {
1456         ASSERT_WDEV_LOCK(wdev);
1457
1458         switch (wdev->iftype) {
1459         case NL80211_IFTYPE_AP:
1460         case NL80211_IFTYPE_AP_VLAN:
1461         case NL80211_IFTYPE_P2P_GO:
1462         case NL80211_IFTYPE_MESH_POINT:
1463                 break;
1464         case NL80211_IFTYPE_ADHOC:
1465         case NL80211_IFTYPE_STATION:
1466         case NL80211_IFTYPE_P2P_CLIENT:
1467                 if (!wdev->current_bss)
1468                         return -ENOLINK;
1469                 break;
1470         case NL80211_IFTYPE_UNSPECIFIED:
1471         case NL80211_IFTYPE_OCB:
1472         case NL80211_IFTYPE_MONITOR:
1473         case NL80211_IFTYPE_NAN:
1474         case NL80211_IFTYPE_P2P_DEVICE:
1475         case NL80211_IFTYPE_WDS:
1476         case NUM_NL80211_IFTYPES:
1477                 return -EINVAL;
1478         }
1479
1480         return 0;
1481 }
1482
1483 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1484                                                         u32 freq)
1485 {
1486         struct ieee80211_channel *chan;
1487
1488         chan = ieee80211_get_channel_khz(wiphy, freq);
1489         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1490                 return NULL;
1491         return chan;
1492 }
1493
1494 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1495 {
1496         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1497         int i;
1498
1499         if (!nl_modes)
1500                 goto nla_put_failure;
1501
1502         i = 0;
1503         while (ifmodes) {
1504                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1505                         goto nla_put_failure;
1506                 ifmodes >>= 1;
1507                 i++;
1508         }
1509
1510         nla_nest_end(msg, nl_modes);
1511         return 0;
1512
1513 nla_put_failure:
1514         return -ENOBUFS;
1515 }
1516
1517 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1518                                           struct sk_buff *msg,
1519                                           bool large)
1520 {
1521         struct nlattr *nl_combis;
1522         int i, j;
1523
1524         nl_combis = nla_nest_start_noflag(msg,
1525                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1526         if (!nl_combis)
1527                 goto nla_put_failure;
1528
1529         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1530                 const struct ieee80211_iface_combination *c;
1531                 struct nlattr *nl_combi, *nl_limits;
1532
1533                 c = &wiphy->iface_combinations[i];
1534
1535                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1536                 if (!nl_combi)
1537                         goto nla_put_failure;
1538
1539                 nl_limits = nla_nest_start_noflag(msg,
1540                                                   NL80211_IFACE_COMB_LIMITS);
1541                 if (!nl_limits)
1542                         goto nla_put_failure;
1543
1544                 for (j = 0; j < c->n_limits; j++) {
1545                         struct nlattr *nl_limit;
1546
1547                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1548                         if (!nl_limit)
1549                                 goto nla_put_failure;
1550                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1551                                         c->limits[j].max))
1552                                 goto nla_put_failure;
1553                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1554                                                 c->limits[j].types))
1555                                 goto nla_put_failure;
1556                         nla_nest_end(msg, nl_limit);
1557                 }
1558
1559                 nla_nest_end(msg, nl_limits);
1560
1561                 if (c->beacon_int_infra_match &&
1562                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1563                         goto nla_put_failure;
1564                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1565                                 c->num_different_channels) ||
1566                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1567                                 c->max_interfaces))
1568                         goto nla_put_failure;
1569                 if (large &&
1570                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1571                                 c->radar_detect_widths) ||
1572                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1573                                 c->radar_detect_regions)))
1574                         goto nla_put_failure;
1575                 if (c->beacon_int_min_gcd &&
1576                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1577                                 c->beacon_int_min_gcd))
1578                         goto nla_put_failure;
1579
1580                 nla_nest_end(msg, nl_combi);
1581         }
1582
1583         nla_nest_end(msg, nl_combis);
1584
1585         return 0;
1586 nla_put_failure:
1587         return -ENOBUFS;
1588 }
1589
1590 #ifdef CONFIG_PM
1591 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1592                                         struct sk_buff *msg)
1593 {
1594         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1595         struct nlattr *nl_tcp;
1596
1597         if (!tcp)
1598                 return 0;
1599
1600         nl_tcp = nla_nest_start_noflag(msg,
1601                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1602         if (!nl_tcp)
1603                 return -ENOBUFS;
1604
1605         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1606                         tcp->data_payload_max))
1607                 return -ENOBUFS;
1608
1609         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1610                         tcp->data_payload_max))
1611                 return -ENOBUFS;
1612
1613         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1614                 return -ENOBUFS;
1615
1616         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1617                                 sizeof(*tcp->tok), tcp->tok))
1618                 return -ENOBUFS;
1619
1620         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1621                         tcp->data_interval_max))
1622                 return -ENOBUFS;
1623
1624         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1625                         tcp->wake_payload_max))
1626                 return -ENOBUFS;
1627
1628         nla_nest_end(msg, nl_tcp);
1629         return 0;
1630 }
1631
1632 static int nl80211_send_wowlan(struct sk_buff *msg,
1633                                struct cfg80211_registered_device *rdev,
1634                                bool large)
1635 {
1636         struct nlattr *nl_wowlan;
1637
1638         if (!rdev->wiphy.wowlan)
1639                 return 0;
1640
1641         nl_wowlan = nla_nest_start_noflag(msg,
1642                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1643         if (!nl_wowlan)
1644                 return -ENOBUFS;
1645
1646         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1647              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1648             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1649              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1650             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1651              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1652             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1653              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1654             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1655              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1656             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1657              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1658             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1659              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1660             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1661              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1662                 return -ENOBUFS;
1663
1664         if (rdev->wiphy.wowlan->n_patterns) {
1665                 struct nl80211_pattern_support pat = {
1666                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1667                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1668                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1669                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1670                 };
1671
1672                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1673                             sizeof(pat), &pat))
1674                         return -ENOBUFS;
1675         }
1676
1677         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1678             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1679                         rdev->wiphy.wowlan->max_nd_match_sets))
1680                 return -ENOBUFS;
1681
1682         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1683                 return -ENOBUFS;
1684
1685         nla_nest_end(msg, nl_wowlan);
1686
1687         return 0;
1688 }
1689 #endif
1690
1691 static int nl80211_send_coalesce(struct sk_buff *msg,
1692                                  struct cfg80211_registered_device *rdev)
1693 {
1694         struct nl80211_coalesce_rule_support rule;
1695
1696         if (!rdev->wiphy.coalesce)
1697                 return 0;
1698
1699         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1700         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1701         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1702         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1703         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1704         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1705
1706         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1707                 return -ENOBUFS;
1708
1709         return 0;
1710 }
1711
1712 static int
1713 nl80211_send_iftype_data(struct sk_buff *msg,
1714                          const struct ieee80211_supported_band *sband,
1715                          const struct ieee80211_sband_iftype_data *iftdata)
1716 {
1717         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1718
1719         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1720                                 iftdata->types_mask))
1721                 return -ENOBUFS;
1722
1723         if (he_cap->has_he) {
1724                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1725                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1726                             he_cap->he_cap_elem.mac_cap_info) ||
1727                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1728                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1729                             he_cap->he_cap_elem.phy_cap_info) ||
1730                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1731                             sizeof(he_cap->he_mcs_nss_supp),
1732                             &he_cap->he_mcs_nss_supp) ||
1733                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1734                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1735                         return -ENOBUFS;
1736         }
1737
1738         if (sband->band == NL80211_BAND_6GHZ &&
1739             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1740                     sizeof(iftdata->he_6ghz_capa),
1741                     &iftdata->he_6ghz_capa))
1742                 return -ENOBUFS;
1743
1744         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1745             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1746                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1747                 return -ENOBUFS;
1748
1749         return 0;
1750 }
1751
1752 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1753                                       struct ieee80211_supported_band *sband,
1754                                       bool large)
1755 {
1756         struct nlattr *nl_rates, *nl_rate;
1757         struct ieee80211_rate *rate;
1758         int i;
1759
1760         /* add HT info */
1761         if (sband->ht_cap.ht_supported &&
1762             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1763                      sizeof(sband->ht_cap.mcs),
1764                      &sband->ht_cap.mcs) ||
1765              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1766                          sband->ht_cap.cap) ||
1767              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1768                         sband->ht_cap.ampdu_factor) ||
1769              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1770                         sband->ht_cap.ampdu_density)))
1771                 return -ENOBUFS;
1772
1773         /* add VHT info */
1774         if (sband->vht_cap.vht_supported &&
1775             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1776                      sizeof(sband->vht_cap.vht_mcs),
1777                      &sband->vht_cap.vht_mcs) ||
1778              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1779                          sband->vht_cap.cap)))
1780                 return -ENOBUFS;
1781
1782         if (large && sband->n_iftype_data) {
1783                 struct nlattr *nl_iftype_data =
1784                         nla_nest_start_noflag(msg,
1785                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1786                 int err;
1787
1788                 if (!nl_iftype_data)
1789                         return -ENOBUFS;
1790
1791                 for (i = 0; i < sband->n_iftype_data; i++) {
1792                         struct nlattr *iftdata;
1793
1794                         iftdata = nla_nest_start_noflag(msg, i + 1);
1795                         if (!iftdata)
1796                                 return -ENOBUFS;
1797
1798                         err = nl80211_send_iftype_data(msg, sband,
1799                                                        &sband->iftype_data[i]);
1800                         if (err)
1801                                 return err;
1802
1803                         nla_nest_end(msg, iftdata);
1804                 }
1805
1806                 nla_nest_end(msg, nl_iftype_data);
1807         }
1808
1809         /* add EDMG info */
1810         if (large && sband->edmg_cap.channels &&
1811             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1812                        sband->edmg_cap.channels) ||
1813             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1814                        sband->edmg_cap.bw_config)))
1815
1816                 return -ENOBUFS;
1817
1818         /* add bitrates */
1819         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1820         if (!nl_rates)
1821                 return -ENOBUFS;
1822
1823         for (i = 0; i < sband->n_bitrates; i++) {
1824                 nl_rate = nla_nest_start_noflag(msg, i);
1825                 if (!nl_rate)
1826                         return -ENOBUFS;
1827
1828                 rate = &sband->bitrates[i];
1829                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1830                                 rate->bitrate))
1831                         return -ENOBUFS;
1832                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1833                     nla_put_flag(msg,
1834                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1835                         return -ENOBUFS;
1836
1837                 nla_nest_end(msg, nl_rate);
1838         }
1839
1840         nla_nest_end(msg, nl_rates);
1841
1842         return 0;
1843 }
1844
1845 static int
1846 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1847                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1848 {
1849         u16 stypes;
1850         struct nlattr *nl_ftypes, *nl_ifs;
1851         enum nl80211_iftype ift;
1852         int i;
1853
1854         if (!mgmt_stypes)
1855                 return 0;
1856
1857         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1858         if (!nl_ifs)
1859                 return -ENOBUFS;
1860
1861         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1862                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1863                 if (!nl_ftypes)
1864                         return -ENOBUFS;
1865                 i = 0;
1866                 stypes = mgmt_stypes[ift].tx;
1867                 while (stypes) {
1868                         if ((stypes & 1) &&
1869                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1870                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1871                                 return -ENOBUFS;
1872                         stypes >>= 1;
1873                         i++;
1874                 }
1875                 nla_nest_end(msg, nl_ftypes);
1876         }
1877
1878         nla_nest_end(msg, nl_ifs);
1879
1880         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
1881         if (!nl_ifs)
1882                 return -ENOBUFS;
1883
1884         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1885                 nl_ftypes = nla_nest_start_noflag(msg, ift);
1886                 if (!nl_ftypes)
1887                         return -ENOBUFS;
1888                 i = 0;
1889                 stypes = mgmt_stypes[ift].rx;
1890                 while (stypes) {
1891                         if ((stypes & 1) &&
1892                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1893                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1894                                 return -ENOBUFS;
1895                         stypes >>= 1;
1896                         i++;
1897                 }
1898                 nla_nest_end(msg, nl_ftypes);
1899         }
1900         nla_nest_end(msg, nl_ifs);
1901
1902         return 0;
1903 }
1904
1905 #define CMD(op, n)                                                      \
1906          do {                                                           \
1907                 if (rdev->ops->op) {                                    \
1908                         i++;                                            \
1909                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1910                                 goto nla_put_failure;                   \
1911                 }                                                       \
1912         } while (0)
1913
1914 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1915                                         struct sk_buff *msg)
1916 {
1917         int i = 0;
1918
1919         /*
1920          * do *NOT* add anything into this function, new things need to be
1921          * advertised only to new versions of userspace that can deal with
1922          * the split (and they can't possibly care about new features...
1923          */
1924         CMD(add_virtual_intf, NEW_INTERFACE);
1925         CMD(change_virtual_intf, SET_INTERFACE);
1926         CMD(add_key, NEW_KEY);
1927         CMD(start_ap, START_AP);
1928         CMD(add_station, NEW_STATION);
1929         CMD(add_mpath, NEW_MPATH);
1930         CMD(update_mesh_config, SET_MESH_CONFIG);
1931         CMD(change_bss, SET_BSS);
1932         CMD(auth, AUTHENTICATE);
1933         CMD(assoc, ASSOCIATE);
1934         CMD(deauth, DEAUTHENTICATE);
1935         CMD(disassoc, DISASSOCIATE);
1936         CMD(join_ibss, JOIN_IBSS);
1937         CMD(join_mesh, JOIN_MESH);
1938         CMD(set_pmksa, SET_PMKSA);
1939         CMD(del_pmksa, DEL_PMKSA);
1940         CMD(flush_pmksa, FLUSH_PMKSA);
1941         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1942                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1943         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1944         CMD(mgmt_tx, FRAME);
1945         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1946         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1947                 i++;
1948                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1949                         goto nla_put_failure;
1950         }
1951         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1952             rdev->ops->join_mesh) {
1953                 i++;
1954                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1955                         goto nla_put_failure;
1956         }
1957         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1958                 CMD(tdls_mgmt, TDLS_MGMT);
1959                 CMD(tdls_oper, TDLS_OPER);
1960         }
1961         if (rdev->wiphy.max_sched_scan_reqs)
1962                 CMD(sched_scan_start, START_SCHED_SCAN);
1963         CMD(probe_client, PROBE_CLIENT);
1964         CMD(set_noack_map, SET_NOACK_MAP);
1965         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1966                 i++;
1967                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1968                         goto nla_put_failure;
1969         }
1970         CMD(start_p2p_device, START_P2P_DEVICE);
1971         CMD(set_mcast_rate, SET_MCAST_RATE);
1972 #ifdef CONFIG_NL80211_TESTMODE
1973         CMD(testmode_cmd, TESTMODE);
1974 #endif
1975
1976         if (rdev->ops->connect || rdev->ops->auth) {
1977                 i++;
1978                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1979                         goto nla_put_failure;
1980         }
1981
1982         if (rdev->ops->disconnect || rdev->ops->deauth) {
1983                 i++;
1984                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1985                         goto nla_put_failure;
1986         }
1987
1988         return i;
1989  nla_put_failure:
1990         return -ENOBUFS;
1991 }
1992
1993 static int
1994 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
1995                            struct sk_buff *msg)
1996 {
1997         struct nlattr *ftm;
1998
1999         if (!cap->ftm.supported)
2000                 return 0;
2001
2002         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2003         if (!ftm)
2004                 return -ENOBUFS;
2005
2006         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2007                 return -ENOBUFS;
2008         if (cap->ftm.non_asap &&
2009             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2010                 return -ENOBUFS;
2011         if (cap->ftm.request_lci &&
2012             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2013                 return -ENOBUFS;
2014         if (cap->ftm.request_civicloc &&
2015             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2016                 return -ENOBUFS;
2017         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2018                         cap->ftm.preambles))
2019                 return -ENOBUFS;
2020         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2021                         cap->ftm.bandwidths))
2022                 return -ENOBUFS;
2023         if (cap->ftm.max_bursts_exponent >= 0 &&
2024             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2025                         cap->ftm.max_bursts_exponent))
2026                 return -ENOBUFS;
2027         if (cap->ftm.max_ftms_per_burst &&
2028             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2029                         cap->ftm.max_ftms_per_burst))
2030                 return -ENOBUFS;
2031         if (cap->ftm.trigger_based &&
2032             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2033                 return -ENOBUFS;
2034         if (cap->ftm.non_trigger_based &&
2035             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2036                 return -ENOBUFS;
2037
2038         nla_nest_end(msg, ftm);
2039         return 0;
2040 }
2041
2042 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2043                                   struct sk_buff *msg)
2044 {
2045         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2046         struct nlattr *pmsr, *caps;
2047
2048         if (!cap)
2049                 return 0;
2050
2051         /*
2052          * we don't need to clean up anything here since the caller
2053          * will genlmsg_cancel() if we fail
2054          */
2055
2056         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2057         if (!pmsr)
2058                 return -ENOBUFS;
2059
2060         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2061                 return -ENOBUFS;
2062
2063         if (cap->report_ap_tsf &&
2064             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2065                 return -ENOBUFS;
2066
2067         if (cap->randomize_mac_addr &&
2068             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2069                 return -ENOBUFS;
2070
2071         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2072         if (!caps)
2073                 return -ENOBUFS;
2074
2075         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2076                 return -ENOBUFS;
2077
2078         nla_nest_end(msg, caps);
2079         nla_nest_end(msg, pmsr);
2080
2081         return 0;
2082 }
2083
2084 static int
2085 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2086                               struct sk_buff *msg)
2087 {
2088         int i;
2089         struct nlattr *nested, *nested_akms;
2090         const struct wiphy_iftype_akm_suites *iftype_akms;
2091
2092         if (!rdev->wiphy.num_iftype_akm_suites ||
2093             !rdev->wiphy.iftype_akm_suites)
2094                 return 0;
2095
2096         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2097         if (!nested)
2098                 return -ENOBUFS;
2099
2100         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2101                 nested_akms = nla_nest_start(msg, i + 1);
2102                 if (!nested_akms)
2103                         return -ENOBUFS;
2104
2105                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2106
2107                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2108                                         iftype_akms->iftypes_mask))
2109                         return -ENOBUFS;
2110
2111                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2112                             sizeof(u32) * iftype_akms->n_akm_suites,
2113                             iftype_akms->akm_suites)) {
2114                         return -ENOBUFS;
2115                 }
2116                 nla_nest_end(msg, nested_akms);
2117         }
2118
2119         nla_nest_end(msg, nested);
2120
2121         return 0;
2122 }
2123
2124 static int
2125 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2126                                struct sk_buff *msg)
2127 {
2128         struct nlattr *supp;
2129
2130         if (!rdev->wiphy.tid_config_support.vif &&
2131             !rdev->wiphy.tid_config_support.peer)
2132                 return 0;
2133
2134         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2135         if (!supp)
2136                 return -ENOSPC;
2137
2138         if (rdev->wiphy.tid_config_support.vif &&
2139             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2140                               rdev->wiphy.tid_config_support.vif,
2141                               NL80211_TID_CONFIG_ATTR_PAD))
2142                 goto fail;
2143
2144         if (rdev->wiphy.tid_config_support.peer &&
2145             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2146                               rdev->wiphy.tid_config_support.peer,
2147                               NL80211_TID_CONFIG_ATTR_PAD))
2148                 goto fail;
2149
2150         /* for now we just use the same value ... makes more sense */
2151         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2152                        rdev->wiphy.tid_config_support.max_retry))
2153                 goto fail;
2154         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2155                        rdev->wiphy.tid_config_support.max_retry))
2156                 goto fail;
2157
2158         nla_nest_end(msg, supp);
2159
2160         return 0;
2161 fail:
2162         nla_nest_cancel(msg, supp);
2163         return -ENOBUFS;
2164 }
2165
2166 static int
2167 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2168                       struct sk_buff *msg)
2169 {
2170         struct nlattr *sar_capa, *specs, *sub_freq_range;
2171         u8 num_freq_ranges;
2172         int i;
2173
2174         if (!rdev->wiphy.sar_capa)
2175                 return 0;
2176
2177         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2178
2179         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2180         if (!sar_capa)
2181                 return -ENOSPC;
2182
2183         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2184                 goto fail;
2185
2186         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2187         if (!specs)
2188                 goto fail;
2189
2190         /* report supported freq_ranges */
2191         for (i = 0; i < num_freq_ranges; i++) {
2192                 sub_freq_range = nla_nest_start(msg, i + 1);
2193                 if (!sub_freq_range)
2194                         goto fail;
2195
2196                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2197                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2198                         goto fail;
2199
2200                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2201                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2202                         goto fail;
2203
2204                 nla_nest_end(msg, sub_freq_range);
2205         }
2206
2207         nla_nest_end(msg, specs);
2208         nla_nest_end(msg, sar_capa);
2209
2210         return 0;
2211 fail:
2212         nla_nest_cancel(msg, sar_capa);
2213         return -ENOBUFS;
2214 }
2215
2216 struct nl80211_dump_wiphy_state {
2217         s64 filter_wiphy;
2218         long start;
2219         long split_start, band_start, chan_start, capa_start;
2220         bool split;
2221 };
2222
2223 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2224                               enum nl80211_commands cmd,
2225                               struct sk_buff *msg, u32 portid, u32 seq,
2226                               int flags, struct nl80211_dump_wiphy_state *state)
2227 {
2228         void *hdr;
2229         struct nlattr *nl_bands, *nl_band;
2230         struct nlattr *nl_freqs, *nl_freq;
2231         struct nlattr *nl_cmds;
2232         enum nl80211_band band;
2233         struct ieee80211_channel *chan;
2234         int i;
2235         const struct ieee80211_txrx_stypes *mgmt_stypes =
2236                                 rdev->wiphy.mgmt_stypes;
2237         u32 features;
2238
2239         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2240         if (!hdr)
2241                 return -ENOBUFS;
2242
2243         if (WARN_ON(!state))
2244                 return -EINVAL;
2245
2246         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2247             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2248                            wiphy_name(&rdev->wiphy)) ||
2249             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2250                         cfg80211_rdev_list_generation))
2251                 goto nla_put_failure;
2252
2253         if (cmd != NL80211_CMD_NEW_WIPHY)
2254                 goto finish;
2255
2256         switch (state->split_start) {
2257         case 0:
2258                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2259                                rdev->wiphy.retry_short) ||
2260                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2261                                rdev->wiphy.retry_long) ||
2262                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2263                                 rdev->wiphy.frag_threshold) ||
2264                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2265                                 rdev->wiphy.rts_threshold) ||
2266                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2267                                rdev->wiphy.coverage_class) ||
2268                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2269                                rdev->wiphy.max_scan_ssids) ||
2270                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2271                                rdev->wiphy.max_sched_scan_ssids) ||
2272                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2273                                 rdev->wiphy.max_scan_ie_len) ||
2274                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2275                                 rdev->wiphy.max_sched_scan_ie_len) ||
2276                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2277                                rdev->wiphy.max_match_sets))
2278                         goto nla_put_failure;
2279
2280                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2281                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2282                         goto nla_put_failure;
2283                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2284                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2285                         goto nla_put_failure;
2286                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2287                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2288                         goto nla_put_failure;
2289                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2290                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2291                         goto nla_put_failure;
2292                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2293                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2294                         goto nla_put_failure;
2295                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2296                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2297                         goto nla_put_failure;
2298                 state->split_start++;
2299                 if (state->split)
2300                         break;
2301                 fallthrough;
2302         case 1:
2303                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2304                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2305                             rdev->wiphy.cipher_suites))
2306                         goto nla_put_failure;
2307
2308                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2309                                rdev->wiphy.max_num_pmkids))
2310                         goto nla_put_failure;
2311
2312                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2313                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2314                         goto nla_put_failure;
2315
2316                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2317                                 rdev->wiphy.available_antennas_tx) ||
2318                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2319                                 rdev->wiphy.available_antennas_rx))
2320                         goto nla_put_failure;
2321
2322                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2323                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2324                                 rdev->wiphy.probe_resp_offload))
2325                         goto nla_put_failure;
2326
2327                 if ((rdev->wiphy.available_antennas_tx ||
2328                      rdev->wiphy.available_antennas_rx) &&
2329                     rdev->ops->get_antenna) {
2330                         u32 tx_ant = 0, rx_ant = 0;
2331                         int res;
2332
2333                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2334                         if (!res) {
2335                                 if (nla_put_u32(msg,
2336                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2337                                                 tx_ant) ||
2338                                     nla_put_u32(msg,
2339                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2340                                                 rx_ant))
2341                                         goto nla_put_failure;
2342                         }
2343                 }
2344
2345                 state->split_start++;
2346                 if (state->split)
2347                         break;
2348                 fallthrough;
2349         case 2:
2350                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2351                                         rdev->wiphy.interface_modes))
2352                                 goto nla_put_failure;
2353                 state->split_start++;
2354                 if (state->split)
2355                         break;
2356                 fallthrough;
2357         case 3:
2358                 nl_bands = nla_nest_start_noflag(msg,
2359                                                  NL80211_ATTR_WIPHY_BANDS);
2360                 if (!nl_bands)
2361                         goto nla_put_failure;
2362
2363                 for (band = state->band_start;
2364                      band < (state->split ?
2365                                 NUM_NL80211_BANDS :
2366                                 NL80211_BAND_60GHZ + 1);
2367                      band++) {
2368                         struct ieee80211_supported_band *sband;
2369
2370                         /* omit higher bands for ancient software */
2371                         if (band > NL80211_BAND_5GHZ && !state->split)
2372                                 break;
2373
2374                         sband = rdev->wiphy.bands[band];
2375
2376                         if (!sband)
2377                                 continue;
2378
2379                         nl_band = nla_nest_start_noflag(msg, band);
2380                         if (!nl_band)
2381                                 goto nla_put_failure;
2382
2383                         switch (state->chan_start) {
2384                         case 0:
2385                                 if (nl80211_send_band_rateinfo(msg, sband,
2386                                                                state->split))
2387                                         goto nla_put_failure;
2388                                 state->chan_start++;
2389                                 if (state->split)
2390                                         break;
2391                                 fallthrough;
2392                         default:
2393                                 /* add frequencies */
2394                                 nl_freqs = nla_nest_start_noflag(msg,
2395                                                                  NL80211_BAND_ATTR_FREQS);
2396                                 if (!nl_freqs)
2397                                         goto nla_put_failure;
2398
2399                                 for (i = state->chan_start - 1;
2400                                      i < sband->n_channels;
2401                                      i++) {
2402                                         nl_freq = nla_nest_start_noflag(msg,
2403                                                                         i);
2404                                         if (!nl_freq)
2405                                                 goto nla_put_failure;
2406
2407                                         chan = &sband->channels[i];
2408
2409                                         if (nl80211_msg_put_channel(
2410                                                         msg, &rdev->wiphy, chan,
2411                                                         state->split))
2412                                                 goto nla_put_failure;
2413
2414                                         nla_nest_end(msg, nl_freq);
2415                                         if (state->split)
2416                                                 break;
2417                                 }
2418                                 if (i < sband->n_channels)
2419                                         state->chan_start = i + 2;
2420                                 else
2421                                         state->chan_start = 0;
2422                                 nla_nest_end(msg, nl_freqs);
2423                         }
2424
2425                         nla_nest_end(msg, nl_band);
2426
2427                         if (state->split) {
2428                                 /* start again here */
2429                                 if (state->chan_start)
2430                                         band--;
2431                                 break;
2432                         }
2433                 }
2434                 nla_nest_end(msg, nl_bands);
2435
2436                 if (band < NUM_NL80211_BANDS)
2437                         state->band_start = band + 1;
2438                 else
2439                         state->band_start = 0;
2440
2441                 /* if bands & channels are done, continue outside */
2442                 if (state->band_start == 0 && state->chan_start == 0)
2443                         state->split_start++;
2444                 if (state->split)
2445                         break;
2446                 fallthrough;
2447         case 4:
2448                 nl_cmds = nla_nest_start_noflag(msg,
2449                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2450                 if (!nl_cmds)
2451                         goto nla_put_failure;
2452
2453                 i = nl80211_add_commands_unsplit(rdev, msg);
2454                 if (i < 0)
2455                         goto nla_put_failure;
2456                 if (state->split) {
2457                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2458                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2459                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2460                                 CMD(channel_switch, CHANNEL_SWITCH);
2461                         CMD(set_qos_map, SET_QOS_MAP);
2462                         if (rdev->wiphy.features &
2463                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2464                                 CMD(add_tx_ts, ADD_TX_TS);
2465                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2466                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2467                         CMD(update_ft_ies, UPDATE_FT_IES);
2468                         if (rdev->wiphy.sar_capa)
2469                                 CMD(set_sar_specs, SET_SAR_SPECS);
2470                 }
2471 #undef CMD
2472
2473                 nla_nest_end(msg, nl_cmds);
2474                 state->split_start++;
2475                 if (state->split)
2476                         break;
2477                 fallthrough;
2478         case 5:
2479                 if (rdev->ops->remain_on_channel &&
2480                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2481                     nla_put_u32(msg,
2482                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2483                                 rdev->wiphy.max_remain_on_channel_duration))
2484                         goto nla_put_failure;
2485
2486                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2487                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2488                         goto nla_put_failure;
2489
2490                 state->split_start++;
2491                 if (state->split)
2492                         break;
2493                 fallthrough;
2494         case 6:
2495 #ifdef CONFIG_PM
2496                 if (nl80211_send_wowlan(msg, rdev, state->split))
2497                         goto nla_put_failure;
2498                 state->split_start++;
2499                 if (state->split)
2500                         break;
2501 #else
2502                 state->split_start++;
2503 #endif
2504                 fallthrough;
2505         case 7:
2506                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2507                                         rdev->wiphy.software_iftypes))
2508                         goto nla_put_failure;
2509
2510                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2511                                                    state->split))
2512                         goto nla_put_failure;
2513
2514                 state->split_start++;
2515                 if (state->split)
2516                         break;
2517                 fallthrough;
2518         case 8:
2519                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2520                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2521                                 rdev->wiphy.ap_sme_capa))
2522                         goto nla_put_failure;
2523
2524                 features = rdev->wiphy.features;
2525                 /*
2526                  * We can only add the per-channel limit information if the
2527                  * dump is split, otherwise it makes it too big. Therefore
2528                  * only advertise it in that case.
2529                  */
2530                 if (state->split)
2531                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2532                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2533                         goto nla_put_failure;
2534
2535                 if (rdev->wiphy.ht_capa_mod_mask &&
2536                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2537                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2538                             rdev->wiphy.ht_capa_mod_mask))
2539                         goto nla_put_failure;
2540
2541                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2542                     rdev->wiphy.max_acl_mac_addrs &&
2543                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2544                                 rdev->wiphy.max_acl_mac_addrs))
2545                         goto nla_put_failure;
2546
2547                 /*
2548                  * Any information below this point is only available to
2549                  * applications that can deal with it being split. This
2550                  * helps ensure that newly added capabilities don't break
2551                  * older tools by overrunning their buffers.
2552                  *
2553                  * We still increment split_start so that in the split
2554                  * case we'll continue with more data in the next round,
2555                  * but break unconditionally so unsplit data stops here.
2556                  */
2557                 if (state->split)
2558                         state->split_start++;
2559                 else
2560                         state->split_start = 0;
2561                 break;
2562         case 9:
2563                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2564                         goto nla_put_failure;
2565
2566                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2567                                 rdev->wiphy.max_sched_scan_plans) ||
2568                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2569                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2570                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2571                                 rdev->wiphy.max_sched_scan_plan_iterations))
2572                         goto nla_put_failure;
2573
2574                 if (rdev->wiphy.extended_capabilities &&
2575                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2576                              rdev->wiphy.extended_capabilities_len,
2577                              rdev->wiphy.extended_capabilities) ||
2578                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2579                              rdev->wiphy.extended_capabilities_len,
2580                              rdev->wiphy.extended_capabilities_mask)))
2581                         goto nla_put_failure;
2582
2583                 if (rdev->wiphy.vht_capa_mod_mask &&
2584                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2585                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2586                             rdev->wiphy.vht_capa_mod_mask))
2587                         goto nla_put_failure;
2588
2589                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2590                             rdev->wiphy.perm_addr))
2591                         goto nla_put_failure;
2592
2593                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2594                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2595                             rdev->wiphy.addr_mask))
2596                         goto nla_put_failure;
2597
2598                 if (rdev->wiphy.n_addresses > 1) {
2599                         void *attr;
2600
2601                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2602                         if (!attr)
2603                                 goto nla_put_failure;
2604
2605                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2606                                 if (nla_put(msg, i + 1, ETH_ALEN,
2607                                             rdev->wiphy.addresses[i].addr))
2608                                         goto nla_put_failure;
2609
2610                         nla_nest_end(msg, attr);
2611                 }
2612
2613                 state->split_start++;
2614                 break;
2615         case 10:
2616                 if (nl80211_send_coalesce(msg, rdev))
2617                         goto nla_put_failure;
2618
2619                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2620                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2621                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2622                         goto nla_put_failure;
2623
2624                 if (rdev->wiphy.max_ap_assoc_sta &&
2625                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2626                                 rdev->wiphy.max_ap_assoc_sta))
2627                         goto nla_put_failure;
2628
2629                 state->split_start++;
2630                 break;
2631         case 11:
2632                 if (rdev->wiphy.n_vendor_commands) {
2633                         const struct nl80211_vendor_cmd_info *info;
2634                         struct nlattr *nested;
2635
2636                         nested = nla_nest_start_noflag(msg,
2637                                                        NL80211_ATTR_VENDOR_DATA);
2638                         if (!nested)
2639                                 goto nla_put_failure;
2640
2641                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2642                                 info = &rdev->wiphy.vendor_commands[i].info;
2643                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2644                                         goto nla_put_failure;
2645                         }
2646                         nla_nest_end(msg, nested);
2647                 }
2648
2649                 if (rdev->wiphy.n_vendor_events) {
2650                         const struct nl80211_vendor_cmd_info *info;
2651                         struct nlattr *nested;
2652
2653                         nested = nla_nest_start_noflag(msg,
2654                                                        NL80211_ATTR_VENDOR_EVENTS);
2655                         if (!nested)
2656                                 goto nla_put_failure;
2657
2658                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2659                                 info = &rdev->wiphy.vendor_events[i];
2660                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2661                                         goto nla_put_failure;
2662                         }
2663                         nla_nest_end(msg, nested);
2664                 }
2665                 state->split_start++;
2666                 break;
2667         case 12:
2668                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2669                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2670                                rdev->wiphy.max_num_csa_counters))
2671                         goto nla_put_failure;
2672
2673                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2674                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2675                         goto nla_put_failure;
2676
2677                 if (rdev->wiphy.max_sched_scan_reqs &&
2678                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2679                                 rdev->wiphy.max_sched_scan_reqs))
2680                         goto nla_put_failure;
2681
2682                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2683                             sizeof(rdev->wiphy.ext_features),
2684                             rdev->wiphy.ext_features))
2685                         goto nla_put_failure;
2686
2687                 if (rdev->wiphy.bss_select_support) {
2688                         struct nlattr *nested;
2689                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2690
2691                         nested = nla_nest_start_noflag(msg,
2692                                                        NL80211_ATTR_BSS_SELECT);
2693                         if (!nested)
2694                                 goto nla_put_failure;
2695
2696                         i = 0;
2697                         while (bss_select_support) {
2698                                 if ((bss_select_support & 1) &&
2699                                     nla_put_flag(msg, i))
2700                                         goto nla_put_failure;
2701                                 i++;
2702                                 bss_select_support >>= 1;
2703                         }
2704                         nla_nest_end(msg, nested);
2705                 }
2706
2707                 state->split_start++;
2708                 break;
2709         case 13:
2710                 if (rdev->wiphy.num_iftype_ext_capab &&
2711                     rdev->wiphy.iftype_ext_capab) {
2712                         struct nlattr *nested_ext_capab, *nested;
2713
2714                         nested = nla_nest_start_noflag(msg,
2715                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2716                         if (!nested)
2717                                 goto nla_put_failure;
2718
2719                         for (i = state->capa_start;
2720                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2721                                 const struct wiphy_iftype_ext_capab *capab;
2722
2723                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2724
2725                                 nested_ext_capab = nla_nest_start_noflag(msg,
2726                                                                          i);
2727                                 if (!nested_ext_capab ||
2728                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2729                                                 capab->iftype) ||
2730                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2731                                             capab->extended_capabilities_len,
2732                                             capab->extended_capabilities) ||
2733                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2734                                             capab->extended_capabilities_len,
2735                                             capab->extended_capabilities_mask))
2736                                         goto nla_put_failure;
2737
2738                                 nla_nest_end(msg, nested_ext_capab);
2739                                 if (state->split)
2740                                         break;
2741                         }
2742                         nla_nest_end(msg, nested);
2743                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2744                                 state->capa_start = i + 1;
2745                                 break;
2746                         }
2747                 }
2748
2749                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2750                                 rdev->wiphy.nan_supported_bands))
2751                         goto nla_put_failure;
2752
2753                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2754                                             NL80211_EXT_FEATURE_TXQS)) {
2755                         struct cfg80211_txq_stats txqstats = {};
2756                         int res;
2757
2758                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2759                         if (!res &&
2760                             !nl80211_put_txq_stats(msg, &txqstats,
2761                                                    NL80211_ATTR_TXQ_STATS))
2762                                 goto nla_put_failure;
2763
2764                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2765                                         rdev->wiphy.txq_limit))
2766                                 goto nla_put_failure;
2767                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2768                                         rdev->wiphy.txq_memory_limit))
2769                                 goto nla_put_failure;
2770                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2771                                         rdev->wiphy.txq_quantum))
2772                                 goto nla_put_failure;
2773                 }
2774
2775                 state->split_start++;
2776                 break;
2777         case 14:
2778                 if (nl80211_send_pmsr_capa(rdev, msg))
2779                         goto nla_put_failure;
2780
2781                 state->split_start++;
2782                 break;
2783         case 15:
2784                 if (rdev->wiphy.akm_suites &&
2785                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2786                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2787                             rdev->wiphy.akm_suites))
2788                         goto nla_put_failure;
2789
2790                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2791                         goto nla_put_failure;
2792
2793                 if (nl80211_put_tid_config_support(rdev, msg))
2794                         goto nla_put_failure;
2795                 state->split_start++;
2796                 break;
2797         case 16:
2798                 if (nl80211_put_sar_specs(rdev, msg))
2799                         goto nla_put_failure;
2800
2801                 /* done */
2802                 state->split_start = 0;
2803                 break;
2804         }
2805  finish:
2806         genlmsg_end(msg, hdr);
2807         return 0;
2808
2809  nla_put_failure:
2810         genlmsg_cancel(msg, hdr);
2811         return -EMSGSIZE;
2812 }
2813
2814 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2815                                     struct netlink_callback *cb,
2816                                     struct nl80211_dump_wiphy_state *state)
2817 {
2818         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
2819         int ret;
2820
2821         if (!tb)
2822                 return -ENOMEM;
2823
2824         ret = nlmsg_parse_deprecated(cb->nlh,
2825                                      GENL_HDRLEN + nl80211_fam.hdrsize,
2826                                      tb, nl80211_fam.maxattr,
2827                                      nl80211_policy, NULL);
2828         /* ignore parse errors for backward compatibility */
2829         if (ret) {
2830                 ret = 0;
2831                 goto out;
2832         }
2833
2834         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2835         if (tb[NL80211_ATTR_WIPHY])
2836                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2837         if (tb[NL80211_ATTR_WDEV])
2838                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2839         if (tb[NL80211_ATTR_IFINDEX]) {
2840                 struct net_device *netdev;
2841                 struct cfg80211_registered_device *rdev;
2842                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2843
2844                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2845                 if (!netdev) {
2846                         ret = -ENODEV;
2847                         goto out;
2848                 }
2849                 if (netdev->ieee80211_ptr) {
2850                         rdev = wiphy_to_rdev(
2851                                 netdev->ieee80211_ptr->wiphy);
2852                         state->filter_wiphy = rdev->wiphy_idx;
2853                 }
2854         }
2855
2856         ret = 0;
2857 out:
2858         kfree(tb);
2859         return ret;
2860 }
2861
2862 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2863 {
2864         int idx = 0, ret;
2865         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2866         struct cfg80211_registered_device *rdev;
2867
2868         rtnl_lock();
2869         if (!state) {
2870                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2871                 if (!state) {
2872                         rtnl_unlock();
2873                         return -ENOMEM;
2874                 }
2875                 state->filter_wiphy = -1;
2876                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2877                 if (ret) {
2878                         kfree(state);
2879                         rtnl_unlock();
2880                         return ret;
2881                 }
2882                 cb->args[0] = (long)state;
2883         }
2884
2885         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2886                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2887                         continue;
2888                 if (++idx <= state->start)
2889                         continue;
2890                 if (state->filter_wiphy != -1 &&
2891                     state->filter_wiphy != rdev->wiphy_idx)
2892                         continue;
2893                 /* attempt to fit multiple wiphy data chunks into the skb */
2894                 do {
2895                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2896                                                  skb,
2897                                                  NETLINK_CB(cb->skb).portid,
2898                                                  cb->nlh->nlmsg_seq,
2899                                                  NLM_F_MULTI, state);
2900                         if (ret < 0) {
2901                                 /*
2902                                  * If sending the wiphy data didn't fit (ENOBUFS
2903                                  * or EMSGSIZE returned), this SKB is still
2904                                  * empty (so it's not too big because another
2905                                  * wiphy dataset is already in the skb) and
2906                                  * we've not tried to adjust the dump allocation
2907                                  * yet ... then adjust the alloc size to be
2908                                  * bigger, and return 1 but with the empty skb.
2909                                  * This results in an empty message being RX'ed
2910                                  * in userspace, but that is ignored.
2911                                  *
2912                                  * We can then retry with the larger buffer.
2913                                  */
2914                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2915                                     !skb->len && !state->split &&
2916                                     cb->min_dump_alloc < 4096) {
2917                                         cb->min_dump_alloc = 4096;
2918                                         state->split_start = 0;
2919                                         rtnl_unlock();
2920                                         return 1;
2921                                 }
2922                                 idx--;
2923                                 break;
2924                         }
2925                 } while (state->split_start > 0);
2926                 break;
2927         }
2928         rtnl_unlock();
2929
2930         state->start = idx;
2931
2932         return skb->len;
2933 }
2934
2935 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2936 {
2937         kfree((void *)cb->args[0]);
2938         return 0;
2939 }
2940
2941 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2942 {
2943         struct sk_buff *msg;
2944         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2945         struct nl80211_dump_wiphy_state state = {};
2946
2947         msg = nlmsg_new(4096, GFP_KERNEL);
2948         if (!msg)
2949                 return -ENOMEM;
2950
2951         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2952                                info->snd_portid, info->snd_seq, 0,
2953                                &state) < 0) {
2954                 nlmsg_free(msg);
2955                 return -ENOBUFS;
2956         }
2957
2958         return genlmsg_reply(msg, info);
2959 }
2960
2961 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2962         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2963         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2964         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2965         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2966         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2967 };
2968
2969 static int parse_txq_params(struct nlattr *tb[],
2970                             struct ieee80211_txq_params *txq_params)
2971 {
2972         u8 ac;
2973
2974         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2975             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2976             !tb[NL80211_TXQ_ATTR_AIFS])
2977                 return -EINVAL;
2978
2979         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2980         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2981         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2982         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2983         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2984
2985         if (ac >= NL80211_NUM_ACS)
2986                 return -EINVAL;
2987         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2988         return 0;
2989 }
2990
2991 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2992 {
2993         /*
2994          * You can only set the channel explicitly for some interfaces,
2995          * most have their channel managed via their respective
2996          * "establish a connection" command (connect, join, ...)
2997          *
2998          * For AP/GO and mesh mode, the channel can be set with the
2999          * channel userspace API, but is only stored and passed to the
3000          * low-level driver when the AP starts or the mesh is joined.
3001          * This is for backward compatibility, userspace can also give
3002          * the channel in the start-ap or join-mesh commands instead.
3003          *
3004          * Monitors are special as they are normally slaved to
3005          * whatever else is going on, so they have their own special
3006          * operation to set the monitor channel if possible.
3007          */
3008         return !wdev ||
3009                 wdev->iftype == NL80211_IFTYPE_AP ||
3010                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3011                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3012                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3013 }
3014
3015 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3016                           struct genl_info *info,
3017                           struct cfg80211_chan_def *chandef)
3018 {
3019         struct netlink_ext_ack *extack = info->extack;
3020         struct nlattr **attrs = info->attrs;
3021         u32 control_freq;
3022
3023         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
3024                 return -EINVAL;
3025
3026         control_freq = MHZ_TO_KHZ(
3027                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3028         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3029                 control_freq +=
3030                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3031
3032         memset(chandef, 0, sizeof(*chandef));
3033         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3034         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3035         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3036         chandef->freq1_offset = control_freq % 1000;
3037         chandef->center_freq2 = 0;
3038
3039         /* Primary channel not allowed */
3040         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3041                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3042                                     "Channel is disabled");
3043                 return -EINVAL;
3044         }
3045
3046         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3047                 enum nl80211_channel_type chantype;
3048
3049                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3050
3051                 switch (chantype) {
3052                 case NL80211_CHAN_NO_HT:
3053                 case NL80211_CHAN_HT20:
3054                 case NL80211_CHAN_HT40PLUS:
3055                 case NL80211_CHAN_HT40MINUS:
3056                         cfg80211_chandef_create(chandef, chandef->chan,
3057                                                 chantype);
3058                         /* user input for center_freq is incorrect */
3059                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3060                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3061                                 NL_SET_ERR_MSG_ATTR(extack,
3062                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3063                                                     "bad center frequency 1");
3064                                 return -EINVAL;
3065                         }
3066                         /* center_freq2 must be zero */
3067                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3068                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3069                                 NL_SET_ERR_MSG_ATTR(extack,
3070                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3071                                                     "center frequency 2 can't be used");
3072                                 return -EINVAL;
3073                         }
3074                         break;
3075                 default:
3076                         NL_SET_ERR_MSG_ATTR(extack,
3077                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3078                                             "invalid channel type");
3079                         return -EINVAL;
3080                 }
3081         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3082                 chandef->width =
3083                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3084                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3085                         /* User input error for channel width doesn't match channel  */
3086                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3087                                 NL_SET_ERR_MSG_ATTR(extack,
3088                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3089                                                     "bad channel width");
3090                                 return -EINVAL;
3091                         }
3092                 }
3093                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3094                         chandef->center_freq1 =
3095                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3096                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3097                                 chandef->freq1_offset = nla_get_u32(
3098                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3099                         else
3100                                 chandef->freq1_offset = 0;
3101                 }
3102                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3103                         chandef->center_freq2 =
3104                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3105         }
3106
3107         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3108                 chandef->edmg.channels =
3109                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3110
3111                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3112                         chandef->edmg.bw_config =
3113                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3114         } else {
3115                 chandef->edmg.bw_config = 0;
3116                 chandef->edmg.channels = 0;
3117         }
3118
3119         if (!cfg80211_chandef_valid(chandef)) {
3120                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3121                 return -EINVAL;
3122         }
3123
3124         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3125                                      IEEE80211_CHAN_DISABLED)) {
3126                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3127                 return -EINVAL;
3128         }
3129
3130         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3131              chandef->width == NL80211_CHAN_WIDTH_10) &&
3132             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3133                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3134                 return -EINVAL;
3135         }
3136
3137         return 0;
3138 }
3139
3140 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3141                                  struct net_device *dev,
3142                                  struct genl_info *info)
3143 {
3144         struct cfg80211_chan_def chandef;
3145         int result;
3146         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3147         struct wireless_dev *wdev = NULL;
3148
3149         if (dev)
3150                 wdev = dev->ieee80211_ptr;
3151         if (!nl80211_can_set_dev_channel(wdev))
3152                 return -EOPNOTSUPP;
3153         if (wdev)
3154                 iftype = wdev->iftype;
3155
3156         result = nl80211_parse_chandef(rdev, info, &chandef);
3157         if (result)
3158                 return result;
3159
3160         switch (iftype) {
3161         case NL80211_IFTYPE_AP:
3162         case NL80211_IFTYPE_P2P_GO:
3163                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3164                                                    iftype)) {
3165                         result = -EINVAL;
3166                         break;
3167                 }
3168                 if (wdev->beacon_interval) {
3169                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3170                             !(rdev->wiphy.features &
3171                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
3172                                 result = -EBUSY;
3173                                 break;
3174                         }
3175
3176                         /* Only allow dynamic channel width changes */
3177                         if (chandef.chan != wdev->preset_chandef.chan) {
3178                                 result = -EBUSY;
3179                                 break;
3180                         }
3181                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
3182                         if (result)
3183                                 break;
3184                 }
3185                 wdev->preset_chandef = chandef;
3186                 result = 0;
3187                 break;
3188         case NL80211_IFTYPE_MESH_POINT:
3189                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3190                 break;
3191         case NL80211_IFTYPE_MONITOR:
3192                 result = cfg80211_set_monitor_channel(rdev, &chandef);
3193                 break;
3194         default:
3195                 result = -EINVAL;
3196         }
3197
3198         return result;
3199 }
3200
3201 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3202 {
3203         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3204         struct net_device *netdev = info->user_ptr[1];
3205
3206         return __nl80211_set_channel(rdev, netdev, info);
3207 }
3208
3209 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3210 {
3211         struct cfg80211_registered_device *rdev = NULL;
3212         struct net_device *netdev = NULL;
3213         struct wireless_dev *wdev;
3214         int result = 0, rem_txq_params = 0;
3215         struct nlattr *nl_txq_params;
3216         u32 changed;
3217         u8 retry_short = 0, retry_long = 0;
3218         u32 frag_threshold = 0, rts_threshold = 0;
3219         u8 coverage_class = 0;
3220         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3221
3222         rtnl_lock();
3223         /*
3224          * Try to find the wiphy and netdev. Normally this
3225          * function shouldn't need the netdev, but this is
3226          * done for backward compatibility -- previously
3227          * setting the channel was done per wiphy, but now
3228          * it is per netdev. Previous userland like hostapd
3229          * also passed a netdev to set_wiphy, so that it is
3230          * possible to let that go to the right netdev!
3231          */
3232
3233         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3234                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3235
3236                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3237                 if (netdev && netdev->ieee80211_ptr)
3238                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3239                 else
3240                         netdev = NULL;
3241         }
3242
3243         if (!netdev) {
3244                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3245                                                   info->attrs);
3246                 if (IS_ERR(rdev)) {
3247                         rtnl_unlock();
3248                         return PTR_ERR(rdev);
3249                 }
3250                 wdev = NULL;
3251                 netdev = NULL;
3252                 result = 0;
3253         } else
3254                 wdev = netdev->ieee80211_ptr;
3255
3256         wiphy_lock(&rdev->wiphy);
3257
3258         /*
3259          * end workaround code, by now the rdev is available
3260          * and locked, and wdev may or may not be NULL.
3261          */
3262
3263         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3264                 result = cfg80211_dev_rename(
3265                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3266         rtnl_unlock();
3267
3268         if (result)
3269                 goto out;
3270
3271         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3272                 struct ieee80211_txq_params txq_params;
3273                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3274
3275                 if (!rdev->ops->set_txq_params) {
3276                         result = -EOPNOTSUPP;
3277                         goto out;
3278                 }
3279
3280                 if (!netdev) {
3281                         result = -EINVAL;
3282                         goto out;
3283                 }
3284
3285                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3286                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3287                         result = -EINVAL;
3288                         goto out;
3289                 }
3290
3291                 if (!netif_running(netdev)) {
3292                         result = -ENETDOWN;
3293                         goto out;
3294                 }
3295
3296                 nla_for_each_nested(nl_txq_params,
3297                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3298                                     rem_txq_params) {
3299                         result = nla_parse_nested_deprecated(tb,
3300                                                              NL80211_TXQ_ATTR_MAX,
3301                                                              nl_txq_params,
3302                                                              txq_params_policy,
3303                                                              info->extack);
3304                         if (result)
3305                                 goto out;
3306                         result = parse_txq_params(tb, &txq_params);
3307                         if (result)
3308                                 goto out;
3309
3310                         result = rdev_set_txq_params(rdev, netdev,
3311                                                      &txq_params);
3312                         if (result)
3313                                 goto out;
3314                 }
3315         }
3316
3317         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3318                 result = __nl80211_set_channel(
3319                         rdev,
3320                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3321                         info);
3322                 if (result)
3323                         goto out;
3324         }
3325
3326         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3327                 struct wireless_dev *txp_wdev = wdev;
3328                 enum nl80211_tx_power_setting type;
3329                 int idx, mbm = 0;
3330
3331                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3332                         txp_wdev = NULL;
3333
3334                 if (!rdev->ops->set_tx_power) {
3335                         result = -EOPNOTSUPP;
3336                         goto out;
3337                 }
3338
3339                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3340                 type = nla_get_u32(info->attrs[idx]);
3341
3342                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3343                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3344                         result = -EINVAL;
3345                         goto out;
3346                 }
3347
3348                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3349                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3350                         mbm = nla_get_u32(info->attrs[idx]);
3351                 }
3352
3353                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3354                 if (result)
3355                         goto out;
3356         }
3357
3358         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3359             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3360                 u32 tx_ant, rx_ant;
3361
3362                 if ((!rdev->wiphy.available_antennas_tx &&
3363                      !rdev->wiphy.available_antennas_rx) ||
3364                     !rdev->ops->set_antenna) {
3365                         result = -EOPNOTSUPP;
3366                         goto out;
3367                 }
3368
3369                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3370                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3371
3372                 /* reject antenna configurations which don't match the
3373                  * available antenna masks, except for the "all" mask */
3374                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3375                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3376                         result = -EINVAL;
3377                         goto out;
3378                 }
3379
3380                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3381                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3382
3383                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3384                 if (result)
3385                         goto out;
3386         }
3387
3388         changed = 0;
3389
3390         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3391                 retry_short = nla_get_u8(
3392                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3393
3394                 changed |= WIPHY_PARAM_RETRY_SHORT;
3395         }
3396
3397         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3398                 retry_long = nla_get_u8(
3399                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3400
3401                 changed |= WIPHY_PARAM_RETRY_LONG;
3402         }
3403
3404         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3405                 frag_threshold = nla_get_u32(
3406                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3407                 if (frag_threshold < 256) {
3408                         result = -EINVAL;
3409                         goto out;
3410                 }
3411
3412                 if (frag_threshold != (u32) -1) {
3413                         /*
3414                          * Fragments (apart from the last one) are required to
3415                          * have even length. Make the fragmentation code
3416                          * simpler by stripping LSB should someone try to use
3417                          * odd threshold value.
3418                          */
3419                         frag_threshold &= ~0x1;
3420                 }
3421                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3422         }
3423
3424         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3425                 rts_threshold = nla_get_u32(
3426                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3427                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3428         }
3429
3430         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3431                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3432                         result = -EINVAL;
3433                         goto out;
3434                 }
3435
3436                 coverage_class = nla_get_u8(
3437                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3438                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3439         }
3440
3441         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3442                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3443                         result = -EOPNOTSUPP;
3444                         goto out;
3445                 }
3446
3447                 changed |= WIPHY_PARAM_DYN_ACK;
3448         }
3449
3450         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3451                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3452                                              NL80211_EXT_FEATURE_TXQS)) {
3453                         result = -EOPNOTSUPP;
3454                         goto out;
3455                 }
3456                 txq_limit = nla_get_u32(
3457                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3458                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3459         }
3460
3461         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3462                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3463                                              NL80211_EXT_FEATURE_TXQS)) {
3464                         result = -EOPNOTSUPP;
3465                         goto out;
3466                 }
3467                 txq_memory_limit = nla_get_u32(
3468                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3469                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3470         }
3471
3472         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3473                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3474                                              NL80211_EXT_FEATURE_TXQS)) {
3475                         result = -EOPNOTSUPP;
3476                         goto out;
3477                 }
3478                 txq_quantum = nla_get_u32(
3479                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3480                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3481         }
3482
3483         if (changed) {
3484                 u8 old_retry_short, old_retry_long;
3485                 u32 old_frag_threshold, old_rts_threshold;
3486                 u8 old_coverage_class;
3487                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3488
3489                 if (!rdev->ops->set_wiphy_params) {
3490                         result = -EOPNOTSUPP;
3491                         goto out;
3492                 }
3493
3494                 old_retry_short = rdev->wiphy.retry_short;
3495                 old_retry_long = rdev->wiphy.retry_long;
3496                 old_frag_threshold = rdev->wiphy.frag_threshold;
3497                 old_rts_threshold = rdev->wiphy.rts_threshold;
3498                 old_coverage_class = rdev->wiphy.coverage_class;
3499                 old_txq_limit = rdev->wiphy.txq_limit;
3500                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3501                 old_txq_quantum = rdev->wiphy.txq_quantum;
3502
3503                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3504                         rdev->wiphy.retry_short = retry_short;
3505                 if (changed & WIPHY_PARAM_RETRY_LONG)
3506                         rdev->wiphy.retry_long = retry_long;
3507                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3508                         rdev->wiphy.frag_threshold = frag_threshold;
3509                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3510                         rdev->wiphy.rts_threshold = rts_threshold;
3511                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3512                         rdev->wiphy.coverage_class = coverage_class;
3513                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3514                         rdev->wiphy.txq_limit = txq_limit;
3515                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3516                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3517                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3518                         rdev->wiphy.txq_quantum = txq_quantum;
3519
3520                 result = rdev_set_wiphy_params(rdev, changed);
3521                 if (result) {
3522                         rdev->wiphy.retry_short = old_retry_short;
3523                         rdev->wiphy.retry_long = old_retry_long;
3524                         rdev->wiphy.frag_threshold = old_frag_threshold;
3525                         rdev->wiphy.rts_threshold = old_rts_threshold;
3526                         rdev->wiphy.coverage_class = old_coverage_class;
3527                         rdev->wiphy.txq_limit = old_txq_limit;
3528                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3529                         rdev->wiphy.txq_quantum = old_txq_quantum;
3530                         goto out;
3531                 }
3532         }
3533
3534         result = 0;
3535
3536 out:
3537         wiphy_unlock(&rdev->wiphy);
3538         return result;
3539 }
3540
3541 static int nl80211_send_chandef(struct sk_buff *msg,
3542                                 const struct cfg80211_chan_def *chandef)
3543 {
3544         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3545                 return -EINVAL;
3546
3547         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3548                         chandef->chan->center_freq))
3549                 return -ENOBUFS;
3550         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3551                         chandef->chan->freq_offset))
3552                 return -ENOBUFS;
3553         switch (chandef->width) {
3554         case NL80211_CHAN_WIDTH_20_NOHT:
3555         case NL80211_CHAN_WIDTH_20:
3556         case NL80211_CHAN_WIDTH_40:
3557                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3558                                 cfg80211_get_chandef_type(chandef)))
3559                         return -ENOBUFS;
3560                 break;
3561         default:
3562                 break;
3563         }
3564         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3565                 return -ENOBUFS;
3566         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3567                 return -ENOBUFS;
3568         if (chandef->center_freq2 &&
3569             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3570                 return -ENOBUFS;
3571         return 0;
3572 }
3573
3574 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3575                               struct cfg80211_registered_device *rdev,
3576                               struct wireless_dev *wdev,
3577                               enum nl80211_commands cmd)
3578 {
3579         struct net_device *dev = wdev->netdev;
3580         void *hdr;
3581
3582         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3583                 cmd != NL80211_CMD_DEL_INTERFACE &&
3584                 cmd != NL80211_CMD_SET_INTERFACE);
3585
3586         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3587         if (!hdr)
3588                 return -1;
3589
3590         if (dev &&
3591             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3592              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3593                 goto nla_put_failure;
3594
3595         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3596             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3597             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3598                               NL80211_ATTR_PAD) ||
3599             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3600             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3601                         rdev->devlist_generation ^
3602                         (cfg80211_rdev_list_generation << 2)) ||
3603             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3604                 goto nla_put_failure;
3605
3606         if (rdev->ops->get_channel) {
3607                 int ret;
3608                 struct cfg80211_chan_def chandef = {};
3609
3610                 ret = rdev_get_channel(rdev, wdev, &chandef);
3611                 if (ret == 0) {
3612                         if (nl80211_send_chandef(msg, &chandef))
3613                                 goto nla_put_failure;
3614                 }
3615         }
3616
3617         if (rdev->ops->get_tx_power) {
3618                 int dbm, ret;
3619
3620                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3621                 if (ret == 0 &&
3622                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3623                                 DBM_TO_MBM(dbm)))
3624                         goto nla_put_failure;
3625         }
3626
3627         wdev_lock(wdev);
3628         switch (wdev->iftype) {
3629         case NL80211_IFTYPE_AP:
3630         case NL80211_IFTYPE_P2P_GO:
3631                 if (wdev->ssid_len &&
3632                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
3633                         goto nla_put_failure_locked;
3634                 break;
3635         case NL80211_IFTYPE_STATION:
3636         case NL80211_IFTYPE_P2P_CLIENT:
3637         case NL80211_IFTYPE_ADHOC: {
3638                 const u8 *ssid_ie;
3639                 if (!wdev->current_bss)
3640                         break;
3641                 rcu_read_lock();
3642                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
3643                                                WLAN_EID_SSID);
3644                 if (ssid_ie &&
3645                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
3646                         goto nla_put_failure_rcu_locked;
3647                 rcu_read_unlock();
3648                 break;
3649                 }
3650         default:
3651                 /* nothing */
3652                 break;
3653         }
3654         wdev_unlock(wdev);
3655
3656         if (rdev->ops->get_txq_stats) {
3657                 struct cfg80211_txq_stats txqstats = {};
3658                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3659
3660                 if (ret == 0 &&
3661                     !nl80211_put_txq_stats(msg, &txqstats,
3662                                            NL80211_ATTR_TXQ_STATS))
3663                         goto nla_put_failure;
3664         }
3665
3666         genlmsg_end(msg, hdr);
3667         return 0;
3668
3669  nla_put_failure_rcu_locked:
3670         rcu_read_unlock();
3671  nla_put_failure_locked:
3672         wdev_unlock(wdev);
3673  nla_put_failure:
3674         genlmsg_cancel(msg, hdr);
3675         return -EMSGSIZE;
3676 }
3677
3678 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3679 {
3680         int wp_idx = 0;
3681         int if_idx = 0;
3682         int wp_start = cb->args[0];
3683         int if_start = cb->args[1];
3684         int filter_wiphy = -1;
3685         struct cfg80211_registered_device *rdev;
3686         struct wireless_dev *wdev;
3687         int ret;
3688
3689         rtnl_lock();
3690         if (!cb->args[2]) {
3691                 struct nl80211_dump_wiphy_state state = {
3692                         .filter_wiphy = -1,
3693                 };
3694
3695                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3696                 if (ret)
3697                         goto out_unlock;
3698
3699                 filter_wiphy = state.filter_wiphy;
3700
3701                 /*
3702                  * if filtering, set cb->args[2] to +1 since 0 is the default
3703                  * value needed to determine that parsing is necessary.
3704                  */
3705                 if (filter_wiphy >= 0)
3706                         cb->args[2] = filter_wiphy + 1;
3707                 else
3708                         cb->args[2] = -1;
3709         } else if (cb->args[2] > 0) {
3710                 filter_wiphy = cb->args[2] - 1;
3711         }
3712
3713         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3714                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3715                         continue;
3716                 if (wp_idx < wp_start) {
3717                         wp_idx++;
3718                         continue;
3719                 }
3720
3721                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3722                         continue;
3723
3724                 if_idx = 0;
3725
3726                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3727                         if (if_idx < if_start) {
3728                                 if_idx++;
3729                                 continue;
3730                         }
3731                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
3732                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
3733                                                rdev, wdev,
3734                                                NL80211_CMD_NEW_INTERFACE) < 0) {
3735                                 goto out;
3736                         }
3737                         if_idx++;
3738                 }
3739
3740                 wp_idx++;
3741         }
3742  out:
3743         cb->args[0] = wp_idx;
3744         cb->args[1] = if_idx;
3745
3746         ret = skb->len;
3747  out_unlock:
3748         rtnl_unlock();
3749
3750         return ret;
3751 }
3752
3753 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3754 {
3755         struct sk_buff *msg;
3756         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3757         struct wireless_dev *wdev = info->user_ptr[1];
3758
3759         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3760         if (!msg)
3761                 return -ENOMEM;
3762
3763         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3764                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
3765                 nlmsg_free(msg);
3766                 return -ENOBUFS;
3767         }
3768
3769         return genlmsg_reply(msg, info);
3770 }
3771
3772 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3773         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3774         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3775         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3776         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3777         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3778         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3779 };
3780
3781 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3782 {
3783         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3784         int flag;
3785
3786         *mntrflags = 0;
3787
3788         if (!nla)
3789                 return -EINVAL;
3790
3791         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
3792                 return -EINVAL;
3793
3794         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3795                 if (flags[flag])
3796                         *mntrflags |= (1<<flag);
3797
3798         *mntrflags |= MONITOR_FLAG_CHANGED;
3799
3800         return 0;
3801 }
3802
3803 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3804                                      enum nl80211_iftype type,
3805                                      struct genl_info *info,
3806                                      struct vif_params *params)
3807 {
3808         bool change = false;
3809         int err;
3810
3811         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3812                 if (type != NL80211_IFTYPE_MONITOR)
3813                         return -EINVAL;
3814
3815                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3816                                           &params->flags);
3817                 if (err)
3818                         return err;
3819
3820                 change = true;
3821         }
3822
3823         if (params->flags & MONITOR_FLAG_ACTIVE &&
3824             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3825                 return -EOPNOTSUPP;
3826
3827         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3828                 const u8 *mumimo_groups;
3829                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3830
3831                 if (type != NL80211_IFTYPE_MONITOR)
3832                         return -EINVAL;
3833
3834                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3835                         return -EOPNOTSUPP;
3836
3837                 mumimo_groups =
3838                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3839
3840                 /* bits 0 and 63 are reserved and must be zero */
3841                 if ((mumimo_groups[0] & BIT(0)) ||
3842                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3843                         return -EINVAL;
3844
3845                 params->vht_mumimo_groups = mumimo_groups;
3846                 change = true;
3847         }
3848
3849         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3850                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3851
3852                 if (type != NL80211_IFTYPE_MONITOR)
3853                         return -EINVAL;
3854
3855                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3856                         return -EOPNOTSUPP;
3857
3858                 params->vht_mumimo_follow_addr =
3859                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3860                 change = true;
3861         }
3862
3863         return change ? 1 : 0;
3864 }
3865
3866 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3867                                struct net_device *netdev, u8 use_4addr,
3868                                enum nl80211_iftype iftype)
3869 {
3870         if (!use_4addr) {
3871                 if (netdev && netif_is_bridge_port(netdev))
3872                         return -EBUSY;
3873                 return 0;
3874         }
3875
3876         switch (iftype) {
3877         case NL80211_IFTYPE_AP_VLAN:
3878                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3879                         return 0;
3880                 break;
3881         case NL80211_IFTYPE_STATION:
3882                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3883                         return 0;
3884                 break;
3885         default:
3886                 break;
3887         }
3888
3889         return -EOPNOTSUPP;
3890 }
3891
3892 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3893 {
3894         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3895         struct vif_params params;
3896         int err;
3897         enum nl80211_iftype otype, ntype;
3898         struct net_device *dev = info->user_ptr[1];
3899         bool change = false;
3900
3901         memset(&params, 0, sizeof(params));
3902
3903         otype = ntype = dev->ieee80211_ptr->iftype;
3904
3905         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3906                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3907                 if (otype != ntype)
3908                         change = true;
3909         }
3910
3911         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3912                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3913
3914                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3915                         return -EINVAL;
3916                 if (netif_running(dev))
3917                         return -EBUSY;
3918
3919                 wdev_lock(wdev);
3920                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3921                              IEEE80211_MAX_MESH_ID_LEN);
3922                 wdev->mesh_id_up_len =
3923                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3924                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3925                        wdev->mesh_id_up_len);
3926                 wdev_unlock(wdev);
3927         }
3928
3929         if (info->attrs[NL80211_ATTR_4ADDR]) {
3930                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3931                 change = true;
3932                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3933                 if (err)
3934                         return err;
3935         } else {
3936                 params.use_4addr = -1;
3937         }
3938
3939         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3940         if (err < 0)
3941                 return err;
3942         if (err > 0)
3943                 change = true;
3944
3945         if (change)
3946                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3947         else
3948                 err = 0;
3949
3950         if (!err && params.use_4addr != -1)
3951                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3952
3953         if (change && !err) {
3954                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3955
3956                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
3957         }
3958
3959         return err;
3960 }
3961
3962 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3963 {
3964         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3965         struct vif_params params;
3966         struct wireless_dev *wdev;
3967         struct sk_buff *msg;
3968         int err;
3969         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3970
3971         memset(&params, 0, sizeof(params));
3972
3973         if (!info->attrs[NL80211_ATTR_IFNAME])
3974                 return -EINVAL;
3975
3976         if (info->attrs[NL80211_ATTR_IFTYPE])
3977                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3978
3979         if (!rdev->ops->add_virtual_intf)
3980                 return -EOPNOTSUPP;
3981
3982         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3983              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3984             info->attrs[NL80211_ATTR_MAC]) {
3985                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3986                            ETH_ALEN);
3987                 if (!is_valid_ether_addr(params.macaddr))
3988                         return -EADDRNOTAVAIL;
3989         }
3990
3991         if (info->attrs[NL80211_ATTR_4ADDR]) {
3992                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3993                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3994                 if (err)
3995                         return err;
3996         }
3997
3998         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3999                 return -EOPNOTSUPP;
4000
4001         err = nl80211_parse_mon_options(rdev, type, info, &params);
4002         if (err < 0)
4003                 return err;
4004
4005         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4006         if (!msg)
4007                 return -ENOMEM;
4008
4009         wdev = rdev_add_virtual_intf(rdev,
4010                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4011                                 NET_NAME_USER, type, &params);
4012         if (WARN_ON(!wdev)) {
4013                 nlmsg_free(msg);
4014                 return -EPROTO;
4015         } else if (IS_ERR(wdev)) {
4016                 nlmsg_free(msg);
4017                 return PTR_ERR(wdev);
4018         }
4019
4020         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4021                 wdev->owner_nlportid = info->snd_portid;
4022
4023         switch (type) {
4024         case NL80211_IFTYPE_MESH_POINT:
4025                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4026                         break;
4027                 wdev_lock(wdev);
4028                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4029                              IEEE80211_MAX_MESH_ID_LEN);
4030                 wdev->mesh_id_up_len =
4031                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4032                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4033                        wdev->mesh_id_up_len);
4034                 wdev_unlock(wdev);
4035                 break;
4036         case NL80211_IFTYPE_NAN:
4037         case NL80211_IFTYPE_P2P_DEVICE:
4038                 /*
4039                  * P2P Device and NAN do not have a netdev, so don't go
4040                  * through the netdev notifier and must be added here
4041                  */
4042                 cfg80211_init_wdev(wdev);
4043                 cfg80211_register_wdev(rdev, wdev);
4044                 break;
4045         default:
4046                 break;
4047         }
4048
4049         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4050                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4051                 nlmsg_free(msg);
4052                 return -ENOBUFS;
4053         }
4054
4055         return genlmsg_reply(msg, info);
4056 }
4057
4058 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4059 {
4060         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4061         int ret;
4062
4063         /* to avoid failing a new interface creation due to pending removal */
4064         cfg80211_destroy_ifaces(rdev);
4065
4066         wiphy_lock(&rdev->wiphy);
4067         ret = _nl80211_new_interface(skb, info);
4068         wiphy_unlock(&rdev->wiphy);
4069
4070         return ret;
4071 }
4072
4073 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4074 {
4075         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4076         struct wireless_dev *wdev = info->user_ptr[1];
4077
4078         if (!rdev->ops->del_virtual_intf)
4079                 return -EOPNOTSUPP;
4080
4081         /*
4082          * We hold RTNL, so this is safe, without RTNL opencount cannot
4083          * reach 0, and thus the rdev cannot be deleted.
4084          *
4085          * We need to do it for the dev_close(), since that will call
4086          * the netdev notifiers, and we need to acquire the mutex there
4087          * but don't know if we get there from here or from some other
4088          * place (e.g. "ip link set ... down").
4089          */
4090         mutex_unlock(&rdev->wiphy.mtx);
4091
4092         /*
4093          * If we remove a wireless device without a netdev then clear
4094          * user_ptr[1] so that nl80211_post_doit won't dereference it
4095          * to check if it needs to do dev_put(). Otherwise it crashes
4096          * since the wdev has been freed, unlike with a netdev where
4097          * we need the dev_put() for the netdev to really be freed.
4098          */
4099         if (!wdev->netdev)
4100                 info->user_ptr[1] = NULL;
4101         else
4102                 dev_close(wdev->netdev);
4103
4104         mutex_lock(&rdev->wiphy.mtx);
4105
4106         return rdev_del_virtual_intf(rdev, wdev);
4107 }
4108
4109 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4110 {
4111         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4112         struct net_device *dev = info->user_ptr[1];
4113         u16 noack_map;
4114
4115         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4116                 return -EINVAL;
4117
4118         if (!rdev->ops->set_noack_map)
4119                 return -EOPNOTSUPP;
4120
4121         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4122
4123         return rdev_set_noack_map(rdev, dev, noack_map);
4124 }
4125
4126 struct get_key_cookie {
4127         struct sk_buff *msg;
4128         int error;
4129         int idx;
4130 };
4131
4132 static void get_key_callback(void *c, struct key_params *params)
4133 {
4134         struct nlattr *key;
4135         struct get_key_cookie *cookie = c;
4136
4137         if ((params->key &&
4138              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4139                      params->key_len, params->key)) ||
4140             (params->seq &&
4141              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4142                      params->seq_len, params->seq)) ||
4143             (params->cipher &&
4144              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4145                          params->cipher)))
4146                 goto nla_put_failure;
4147
4148         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4149         if (!key)
4150                 goto nla_put_failure;
4151
4152         if ((params->key &&
4153              nla_put(cookie->msg, NL80211_KEY_DATA,
4154                      params->key_len, params->key)) ||
4155             (params->seq &&
4156              nla_put(cookie->msg, NL80211_KEY_SEQ,
4157                      params->seq_len, params->seq)) ||
4158             (params->cipher &&
4159              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4160                          params->cipher)))
4161                 goto nla_put_failure;
4162
4163         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4164                 goto nla_put_failure;
4165
4166         nla_nest_end(cookie->msg, key);
4167
4168         return;
4169  nla_put_failure:
4170         cookie->error = 1;
4171 }
4172
4173 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4174 {
4175         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4176         int err;
4177         struct net_device *dev = info->user_ptr[1];
4178         u8 key_idx = 0;
4179         const u8 *mac_addr = NULL;
4180         bool pairwise;
4181         struct get_key_cookie cookie = {
4182                 .error = 0,
4183         };
4184         void *hdr;
4185         struct sk_buff *msg;
4186         bool bigtk_support = false;
4187
4188         if (wiphy_ext_feature_isset(&rdev->wiphy,
4189                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4190                 bigtk_support = true;
4191
4192         if ((dev->ieee80211_ptr->iftype == NL80211_IFTYPE_STATION ||
4193              dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4194             wiphy_ext_feature_isset(&rdev->wiphy,
4195                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4196                 bigtk_support = true;
4197
4198         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4199                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4200
4201                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4202                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4203                         return -EINVAL;
4204                 }
4205         }
4206
4207         if (info->attrs[NL80211_ATTR_MAC])
4208                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4209
4210         pairwise = !!mac_addr;
4211         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4212                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4213
4214                 if (kt != NL80211_KEYTYPE_GROUP &&
4215                     kt != NL80211_KEYTYPE_PAIRWISE)
4216                         return -EINVAL;
4217                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4218         }
4219
4220         if (!rdev->ops->get_key)
4221                 return -EOPNOTSUPP;
4222
4223         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4224                 return -ENOENT;
4225
4226         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4227         if (!msg)
4228                 return -ENOMEM;
4229
4230         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4231                              NL80211_CMD_NEW_KEY);
4232         if (!hdr)
4233                 goto nla_put_failure;
4234
4235         cookie.msg = msg;
4236         cookie.idx = key_idx;
4237
4238         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4239             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4240                 goto nla_put_failure;
4241         if (mac_addr &&
4242             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4243                 goto nla_put_failure;
4244
4245         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
4246                            get_key_callback);
4247
4248         if (err)
4249                 goto free_msg;
4250
4251         if (cookie.error)
4252                 goto nla_put_failure;
4253
4254         genlmsg_end(msg, hdr);
4255         return genlmsg_reply(msg, info);
4256
4257  nla_put_failure:
4258         err = -ENOBUFS;
4259  free_msg:
4260         nlmsg_free(msg);
4261         return err;
4262 }
4263
4264 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4265 {
4266         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4267         struct key_parse key;
4268         int err;
4269         struct net_device *dev = info->user_ptr[1];
4270
4271         err = nl80211_parse_key(info, &key);
4272         if (err)
4273                 return err;
4274
4275         if (key.idx < 0)
4276                 return -EINVAL;
4277
4278         /* Only support setting default key and
4279          * Extended Key ID action NL80211_KEY_SET_TX.
4280          */
4281         if (!key.def && !key.defmgmt && !key.defbeacon &&
4282             !(key.p.mode == NL80211_KEY_SET_TX))
4283                 return -EINVAL;
4284
4285         wdev_lock(dev->ieee80211_ptr);
4286
4287         if (key.def) {
4288                 if (!rdev->ops->set_default_key) {
4289                         err = -EOPNOTSUPP;
4290                         goto out;
4291                 }
4292
4293                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4294                 if (err)
4295                         goto out;
4296
4297                 err = rdev_set_default_key(rdev, dev, key.idx,
4298                                                  key.def_uni, key.def_multi);
4299
4300                 if (err)
4301                         goto out;
4302
4303 #ifdef CONFIG_CFG80211_WEXT
4304                 dev->ieee80211_ptr->wext.default_key = key.idx;
4305 #endif
4306         } else if (key.defmgmt) {
4307                 if (key.def_uni || !key.def_multi) {
4308                         err = -EINVAL;
4309                         goto out;
4310                 }
4311
4312                 if (!rdev->ops->set_default_mgmt_key) {
4313                         err = -EOPNOTSUPP;
4314                         goto out;
4315                 }
4316
4317                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4318                 if (err)
4319                         goto out;
4320
4321                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
4322                 if (err)
4323                         goto out;
4324
4325 #ifdef CONFIG_CFG80211_WEXT
4326                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
4327 #endif
4328         } else if (key.defbeacon) {
4329                 if (key.def_uni || !key.def_multi) {
4330                         err = -EINVAL;
4331                         goto out;
4332                 }
4333
4334                 if (!rdev->ops->set_default_beacon_key) {
4335                         err = -EOPNOTSUPP;
4336                         goto out;
4337                 }
4338
4339                 err = nl80211_key_allowed(dev->ieee80211_ptr);
4340                 if (err)
4341                         goto out;
4342
4343                 err = rdev_set_default_beacon_key(rdev, dev, key.idx);
4344                 if (err)
4345                         goto out;
4346         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4347                    wiphy_ext_feature_isset(&rdev->wiphy,
4348                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4349                 u8 *mac_addr = NULL;
4350
4351                 if (info->attrs[NL80211_ATTR_MAC])
4352                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4353
4354                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4355                         err = -EINVAL;
4356                         goto out;
4357                 }
4358
4359                 err = rdev_add_key(rdev, dev, key.idx,
4360                                    NL80211_KEYTYPE_PAIRWISE,
4361                                    mac_addr, &key.p);
4362         } else {
4363                 err = -EINVAL;
4364         }
4365  out:
4366         wdev_unlock(dev->ieee80211_ptr);
4367
4368         return err;
4369 }
4370
4371 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4372 {
4373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4374         int err;
4375         struct net_device *dev = info->user_ptr[1];
4376         struct key_parse key;
4377         const u8 *mac_addr = NULL;
4378
4379         err = nl80211_parse_key(info, &key);
4380         if (err)
4381                 return err;
4382
4383         if (!key.p.key) {
4384                 GENL_SET_ERR_MSG(info, "no key");
4385                 return -EINVAL;
4386         }
4387
4388         if (info->attrs[NL80211_ATTR_MAC])
4389                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4390
4391         if (key.type == -1) {
4392                 if (mac_addr)
4393                         key.type = NL80211_KEYTYPE_PAIRWISE;
4394                 else
4395                         key.type = NL80211_KEYTYPE_GROUP;
4396         }
4397
4398         /* for now */
4399         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4400             key.type != NL80211_KEYTYPE_GROUP) {
4401                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4402                 return -EINVAL;
4403         }
4404
4405         if (key.type == NL80211_KEYTYPE_GROUP &&
4406             info->attrs[NL80211_ATTR_VLAN_ID])
4407                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4408
4409         if (!rdev->ops->add_key)
4410                 return -EOPNOTSUPP;
4411
4412         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4413                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4414                                            mac_addr)) {
4415                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4416                 return -EINVAL;
4417         }
4418
4419         wdev_lock(dev->ieee80211_ptr);
4420         err = nl80211_key_allowed(dev->ieee80211_ptr);
4421         if (err)
4422                 GENL_SET_ERR_MSG(info, "key not allowed");
4423         if (!err) {
4424                 err = rdev_add_key(rdev, dev, key.idx,
4425                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4426                                     mac_addr, &key.p);
4427                 if (err)
4428                         GENL_SET_ERR_MSG(info, "key addition failed");
4429         }
4430         wdev_unlock(dev->ieee80211_ptr);
4431
4432         return err;
4433 }
4434
4435 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4436 {
4437         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4438         int err;
4439         struct net_device *dev = info->user_ptr[1];
4440         u8 *mac_addr = NULL;
4441         struct key_parse key;
4442
4443         err = nl80211_parse_key(info, &key);
4444         if (err)
4445                 return err;
4446
4447         if (info->attrs[NL80211_ATTR_MAC])
4448                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4449
4450         if (key.type == -1) {
4451                 if (mac_addr)
4452                         key.type = NL80211_KEYTYPE_PAIRWISE;
4453                 else
4454                         key.type = NL80211_KEYTYPE_GROUP;
4455         }
4456
4457         /* for now */
4458         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4459             key.type != NL80211_KEYTYPE_GROUP)
4460                 return -EINVAL;
4461
4462         if (!cfg80211_valid_key_idx(rdev, key.idx,
4463                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4464                 return -EINVAL;
4465
4466         if (!rdev->ops->del_key)
4467                 return -EOPNOTSUPP;
4468
4469         wdev_lock(dev->ieee80211_ptr);
4470         err = nl80211_key_allowed(dev->ieee80211_ptr);
4471
4472         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4473             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4474                 err = -ENOENT;
4475
4476         if (!err)
4477                 err = rdev_del_key(rdev, dev, key.idx,
4478                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4479                                    mac_addr);
4480
4481 #ifdef CONFIG_CFG80211_WEXT
4482         if (!err) {
4483                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
4484                         dev->ieee80211_ptr->wext.default_key = -1;
4485                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
4486                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
4487         }
4488 #endif
4489         wdev_unlock(dev->ieee80211_ptr);
4490
4491         return err;
4492 }
4493
4494 /* This function returns an error or the number of nested attributes */
4495 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4496 {
4497         struct nlattr *attr;
4498         int n_entries = 0, tmp;
4499
4500         nla_for_each_nested(attr, nl_attr, tmp) {
4501                 if (nla_len(attr) != ETH_ALEN)
4502                         return -EINVAL;
4503
4504                 n_entries++;
4505         }
4506
4507         return n_entries;
4508 }
4509
4510 /*
4511  * This function parses ACL information and allocates memory for ACL data.
4512  * On successful return, the calling function is responsible to free the
4513  * ACL buffer returned by this function.
4514  */
4515 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4516                                                 struct genl_info *info)
4517 {
4518         enum nl80211_acl_policy acl_policy;
4519         struct nlattr *attr;
4520         struct cfg80211_acl_data *acl;
4521         int i = 0, n_entries, tmp;
4522
4523         if (!wiphy->max_acl_mac_addrs)
4524                 return ERR_PTR(-EOPNOTSUPP);
4525
4526         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4527                 return ERR_PTR(-EINVAL);
4528
4529         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4530         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4531             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4532                 return ERR_PTR(-EINVAL);
4533
4534         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4535                 return ERR_PTR(-EINVAL);
4536
4537         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4538         if (n_entries < 0)
4539                 return ERR_PTR(n_entries);
4540
4541         if (n_entries > wiphy->max_acl_mac_addrs)
4542                 return ERR_PTR(-ENOTSUPP);
4543
4544         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4545         if (!acl)
4546                 return ERR_PTR(-ENOMEM);
4547
4548         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4549                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4550                 i++;
4551         }
4552
4553         acl->n_acl_entries = n_entries;
4554         acl->acl_policy = acl_policy;
4555
4556         return acl;
4557 }
4558
4559 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4560 {
4561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4562         struct net_device *dev = info->user_ptr[1];
4563         struct cfg80211_acl_data *acl;
4564         int err;
4565
4566         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4567             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4568                 return -EOPNOTSUPP;
4569
4570         if (!dev->ieee80211_ptr->beacon_interval)
4571                 return -EINVAL;
4572
4573         acl = parse_acl_data(&rdev->wiphy, info);
4574         if (IS_ERR(acl))
4575                 return PTR_ERR(acl);
4576
4577         err = rdev_set_mac_acl(rdev, dev, acl);
4578
4579         kfree(acl);
4580
4581         return err;
4582 }
4583
4584 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4585                            u8 *rates, u8 rates_len)
4586 {
4587         u8 i;
4588         u32 mask = 0;
4589
4590         for (i = 0; i < rates_len; i++) {
4591                 int rate = (rates[i] & 0x7f) * 5;
4592                 int ridx;
4593
4594                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4595                         struct ieee80211_rate *srate =
4596                                 &sband->bitrates[ridx];
4597                         if (rate == srate->bitrate) {
4598                                 mask |= 1 << ridx;
4599                                 break;
4600                         }
4601                 }
4602                 if (ridx == sband->n_bitrates)
4603                         return 0; /* rate not found */
4604         }
4605
4606         return mask;
4607 }
4608
4609 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4610                                u8 *rates, u8 rates_len,
4611                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4612 {
4613         u8 i;
4614
4615         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4616
4617         for (i = 0; i < rates_len; i++) {
4618                 int ridx, rbit;
4619
4620                 ridx = rates[i] / 8;
4621                 rbit = BIT(rates[i] % 8);
4622
4623                 /* check validity */
4624                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4625                         return false;
4626
4627                 /* check availability */
4628                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4629                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4630                         mcs[ridx] |= rbit;
4631                 else
4632                         return false;
4633         }
4634
4635         return true;
4636 }
4637
4638 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4639 {
4640         u16 mcs_mask = 0;
4641
4642         switch (vht_mcs_map) {
4643         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4644                 break;
4645         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4646                 mcs_mask = 0x00FF;
4647                 break;
4648         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4649                 mcs_mask = 0x01FF;
4650                 break;
4651         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4652                 mcs_mask = 0x03FF;
4653                 break;
4654         default:
4655                 break;
4656         }
4657
4658         return mcs_mask;
4659 }
4660
4661 static void vht_build_mcs_mask(u16 vht_mcs_map,
4662                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
4663 {
4664         u8 nss;
4665
4666         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
4667                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
4668                 vht_mcs_map >>= 2;
4669         }
4670 }
4671
4672 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
4673                              struct nl80211_txrate_vht *txrate,
4674                              u16 mcs[NL80211_VHT_NSS_MAX])
4675 {
4676         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4677         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
4678         u8 i;
4679
4680         if (!sband->vht_cap.vht_supported)
4681                 return false;
4682
4683         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
4684
4685         /* Build vht_mcs_mask from VHT capabilities */
4686         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4687
4688         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4689                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4690                         mcs[i] = txrate->mcs[i];
4691                 else
4692                         return false;
4693         }
4694
4695         return true;
4696 }
4697
4698 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
4699 {
4700         switch (he_mcs_map) {
4701         case IEEE80211_HE_MCS_NOT_SUPPORTED:
4702                 return 0;
4703         case IEEE80211_HE_MCS_SUPPORT_0_7:
4704                 return 0x00FF;
4705         case IEEE80211_HE_MCS_SUPPORT_0_9:
4706                 return 0x03FF;
4707         case IEEE80211_HE_MCS_SUPPORT_0_11:
4708                 return 0xFFF;
4709         default:
4710                 break;
4711         }
4712         return 0;
4713 }
4714
4715 static void he_build_mcs_mask(u16 he_mcs_map,
4716                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
4717 {
4718         u8 nss;
4719
4720         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
4721                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
4722                 he_mcs_map >>= 2;
4723         }
4724 }
4725
4726 static u16 he_get_txmcsmap(struct genl_info *info,
4727                            const struct ieee80211_sta_he_cap *he_cap)
4728 {
4729         struct net_device *dev = info->user_ptr[1];
4730         struct wireless_dev *wdev = dev->ieee80211_ptr;
4731         __le16  tx_mcs;
4732
4733         switch (wdev->chandef.width) {
4734         case NL80211_CHAN_WIDTH_80P80:
4735                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
4736                 break;
4737         case NL80211_CHAN_WIDTH_160:
4738                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
4739                 break;
4740         default:
4741                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
4742                 break;
4743         }
4744         return le16_to_cpu(tx_mcs);
4745 }
4746
4747 static bool he_set_mcs_mask(struct genl_info *info,
4748                             struct wireless_dev *wdev,
4749                             struct ieee80211_supported_band *sband,
4750                             struct nl80211_txrate_he *txrate,
4751                             u16 mcs[NL80211_HE_NSS_MAX])
4752 {
4753         const struct ieee80211_sta_he_cap *he_cap;
4754         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
4755         u16 tx_mcs_map = 0;
4756         u8 i;
4757
4758         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4759         if (!he_cap)
4760                 return false;
4761
4762         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
4763
4764         tx_mcs_map = he_get_txmcsmap(info, he_cap);
4765
4766         /* Build he_mcs_mask from HE capabilities */
4767         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
4768
4769         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4770                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
4771                         mcs[i] = txrate->mcs[i];
4772                 else
4773                         return false;
4774         }
4775
4776         return true;
4777 }
4778
4779 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
4780                                          struct nlattr *attrs[],
4781                                          enum nl80211_attrs attr,
4782                                          struct cfg80211_bitrate_mask *mask,
4783                                          struct net_device *dev,
4784                                          bool default_all_enabled)
4785 {
4786         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
4787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4788         struct wireless_dev *wdev = dev->ieee80211_ptr;
4789         int rem, i;
4790         struct nlattr *tx_rates;
4791         struct ieee80211_supported_band *sband;
4792         u16 vht_tx_mcs_map, he_tx_mcs_map;
4793
4794         memset(mask, 0, sizeof(*mask));
4795         /* Default to all rates enabled */
4796         for (i = 0; i < NUM_NL80211_BANDS; i++) {
4797                 const struct ieee80211_sta_he_cap *he_cap;
4798
4799                 if (!default_all_enabled)
4800                         break;
4801
4802                 sband = rdev->wiphy.bands[i];
4803
4804                 if (!sband)
4805                         continue;
4806
4807                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
4808                 memcpy(mask->control[i].ht_mcs,
4809                        sband->ht_cap.mcs.rx_mask,
4810                        sizeof(mask->control[i].ht_mcs));
4811
4812                 if (sband->vht_cap.vht_supported) {
4813                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
4814                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
4815                 }
4816
4817                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
4818                 if (!he_cap)
4819                         continue;
4820
4821                 he_tx_mcs_map = he_get_txmcsmap(info, he_cap);
4822                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
4823
4824                 mask->control[i].he_gi = 0xFF;
4825                 mask->control[i].he_ltf = 0xFF;
4826         }
4827
4828         /* if no rates are given set it back to the defaults */
4829         if (!attrs[attr])
4830                 goto out;
4831
4832         /* The nested attribute uses enum nl80211_band as the index. This maps
4833          * directly to the enum nl80211_band values used in cfg80211.
4834          */
4835         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
4836         nla_for_each_nested(tx_rates, attrs[attr], rem) {
4837                 enum nl80211_band band = nla_type(tx_rates);
4838                 int err;
4839
4840                 if (band < 0 || band >= NUM_NL80211_BANDS)
4841                         return -EINVAL;
4842                 sband = rdev->wiphy.bands[band];
4843                 if (sband == NULL)
4844                         return -EINVAL;
4845                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
4846                                                   tx_rates,
4847                                                   nl80211_txattr_policy,
4848                                                   info->extack);
4849                 if (err)
4850                         return err;
4851                 if (tb[NL80211_TXRATE_LEGACY]) {
4852                         mask->control[band].legacy = rateset_to_mask(
4853                                 sband,
4854                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
4855                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
4856                         if ((mask->control[band].legacy == 0) &&
4857                             nla_len(tb[NL80211_TXRATE_LEGACY]))
4858                                 return -EINVAL;
4859                 }
4860                 if (tb[NL80211_TXRATE_HT]) {
4861                         if (!ht_rateset_to_mask(
4862                                         sband,
4863                                         nla_data(tb[NL80211_TXRATE_HT]),
4864                                         nla_len(tb[NL80211_TXRATE_HT]),
4865                                         mask->control[band].ht_mcs))
4866                                 return -EINVAL;
4867                 }
4868
4869                 if (tb[NL80211_TXRATE_VHT]) {
4870                         if (!vht_set_mcs_mask(
4871                                         sband,
4872                                         nla_data(tb[NL80211_TXRATE_VHT]),
4873                                         mask->control[band].vht_mcs))
4874                                 return -EINVAL;
4875                 }
4876
4877                 if (tb[NL80211_TXRATE_GI]) {
4878                         mask->control[band].gi =
4879                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
4880                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
4881                                 return -EINVAL;
4882                 }
4883                 if (tb[NL80211_TXRATE_HE] &&
4884                     !he_set_mcs_mask(info, wdev, sband,
4885                                      nla_data(tb[NL80211_TXRATE_HE]),
4886                                      mask->control[band].he_mcs))
4887                         return -EINVAL;
4888
4889                 if (tb[NL80211_TXRATE_HE_GI])
4890                         mask->control[band].he_gi =
4891                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
4892                 if (tb[NL80211_TXRATE_HE_LTF])
4893                         mask->control[band].he_ltf =
4894                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
4895
4896                 if (mask->control[band].legacy == 0) {
4897                         /* don't allow empty legacy rates if HT, VHT or HE
4898                          * are not even supported.
4899                          */
4900                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
4901                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
4902                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
4903                                 return -EINVAL;
4904
4905                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
4906                                 if (mask->control[band].ht_mcs[i])
4907                                         goto out;
4908
4909                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
4910                                 if (mask->control[band].vht_mcs[i])
4911                                         goto out;
4912
4913                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
4914                                 if (mask->control[band].he_mcs[i])
4915                                         goto out;
4916
4917                         /* legacy and mcs rates may not be both empty */
4918                         return -EINVAL;
4919                 }
4920         }
4921
4922 out:
4923         return 0;
4924 }
4925
4926 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
4927                                    enum nl80211_band band,
4928                                    struct cfg80211_bitrate_mask *beacon_rate)
4929 {
4930         u32 count_ht, count_vht, count_he, i;
4931         u32 rate = beacon_rate->control[band].legacy;
4932
4933         /* Allow only one rate */
4934         if (hweight32(rate) > 1)
4935                 return -EINVAL;
4936
4937         count_ht = 0;
4938         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
4939                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
4940                         return -EINVAL;
4941                 } else if (beacon_rate->control[band].ht_mcs[i]) {
4942                         count_ht++;
4943                         if (count_ht > 1)
4944                                 return -EINVAL;
4945                 }
4946                 if (count_ht && rate)
4947                         return -EINVAL;
4948         }
4949
4950         count_vht = 0;
4951         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4952                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4953                         return -EINVAL;
4954                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4955                         count_vht++;
4956                         if (count_vht > 1)
4957                                 return -EINVAL;
4958                 }
4959                 if (count_vht && rate)
4960                         return -EINVAL;
4961         }
4962
4963         count_he = 0;
4964         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
4965                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
4966                         return -EINVAL;
4967                 } else if (beacon_rate->control[band].he_mcs[i]) {
4968                         count_he++;
4969                         if (count_he > 1)
4970                                 return -EINVAL;
4971                 }
4972                 if (count_he && rate)
4973                         return -EINVAL;
4974         }
4975
4976         if ((count_ht && count_vht && count_he) ||
4977             (!rate && !count_ht && !count_vht && !count_he))
4978                 return -EINVAL;
4979
4980         if (rate &&
4981             !wiphy_ext_feature_isset(&rdev->wiphy,
4982                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4983                 return -EINVAL;
4984         if (count_ht &&
4985             !wiphy_ext_feature_isset(&rdev->wiphy,
4986                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4987                 return -EINVAL;
4988         if (count_vht &&
4989             !wiphy_ext_feature_isset(&rdev->wiphy,
4990                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4991                 return -EINVAL;
4992         if (count_he &&
4993             !wiphy_ext_feature_isset(&rdev->wiphy,
4994                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
4995                 return -EINVAL;
4996
4997         return 0;
4998 }
4999
5000 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5001                                 struct nlattr *attrs[],
5002                                 struct cfg80211_beacon_data *bcn)
5003 {
5004         bool haveinfo = false;
5005         int err;
5006
5007         memset(bcn, 0, sizeof(*bcn));
5008
5009         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5010                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5011                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5012                 if (!bcn->head_len)
5013                         return -EINVAL;
5014                 haveinfo = true;
5015         }
5016
5017         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5018                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5019                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5020                 haveinfo = true;
5021         }
5022
5023         if (!haveinfo)
5024                 return -EINVAL;
5025
5026         if (attrs[NL80211_ATTR_IE]) {
5027                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5028                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5029         }
5030
5031         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5032                 bcn->proberesp_ies =
5033                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5034                 bcn->proberesp_ies_len =
5035                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5036         }
5037
5038         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5039                 bcn->assocresp_ies =
5040                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5041                 bcn->assocresp_ies_len =
5042                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5043         }
5044
5045         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5046                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5047                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5048         }
5049
5050         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5051                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5052
5053                 err = nla_parse_nested_deprecated(tb,
5054                                                   NL80211_FTM_RESP_ATTR_MAX,
5055                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5056                                                   NULL, NULL);
5057                 if (err)
5058                         return err;
5059
5060                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5061                     wiphy_ext_feature_isset(&rdev->wiphy,
5062                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5063                         bcn->ftm_responder = 1;
5064                 else
5065                         return -EOPNOTSUPP;
5066
5067                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5068                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5069                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5070                 }
5071
5072                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5073                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5074                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5075                 }
5076         } else {
5077                 bcn->ftm_responder = -1;
5078         }
5079
5080         return 0;
5081 }
5082
5083 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5084                                     struct ieee80211_he_obss_pd *he_obss_pd)
5085 {
5086         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5087         int err;
5088
5089         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5090                                he_obss_pd_policy, NULL);
5091         if (err)
5092                 return err;
5093
5094         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5095                 return -EINVAL;
5096
5097         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5098
5099         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5100                 he_obss_pd->min_offset =
5101                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5102         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5103                 he_obss_pd->max_offset =
5104                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5105         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5106                 he_obss_pd->non_srg_max_offset =
5107                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5108
5109         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5110                 return -EINVAL;
5111
5112         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5113                 memcpy(he_obss_pd->bss_color_bitmap,
5114                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5115                        sizeof(he_obss_pd->bss_color_bitmap));
5116
5117         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5118                 memcpy(he_obss_pd->partial_bssid_bitmap,
5119                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5120                        sizeof(he_obss_pd->partial_bssid_bitmap));
5121
5122         he_obss_pd->enable = true;
5123
5124         return 0;
5125 }
5126
5127 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5128                                       struct cfg80211_he_bss_color *he_bss_color)
5129 {
5130         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5131         int err;
5132
5133         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5134                                he_bss_color_policy, NULL);
5135         if (err)
5136                 return err;
5137
5138         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5139                 return -EINVAL;
5140
5141         he_bss_color->color =
5142                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5143         he_bss_color->enabled =
5144                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5145         he_bss_color->partial =
5146                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5147
5148         return 0;
5149 }
5150
5151 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5152                                         struct nlattr *attrs,
5153                                         struct cfg80211_ap_settings *params)
5154 {
5155         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5156         int ret;
5157         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5158
5159         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5160                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5161                 return -EINVAL;
5162
5163         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5164                                NULL, NULL);
5165         if (ret)
5166                 return ret;
5167
5168         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5169             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5170             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5171                 return -EINVAL;
5172
5173         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5174         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5175         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5176         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5177
5178         return 0;
5179 }
5180
5181 static int
5182 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5183                                      struct nlattr *attrs,
5184                                      struct cfg80211_ap_settings *params)
5185 {
5186         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5187         int ret;
5188         struct cfg80211_unsol_bcast_probe_resp *presp =
5189                                         &params->unsol_bcast_probe_resp;
5190
5191         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5192                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5193                 return -EINVAL;
5194
5195         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5196                                attrs, NULL, NULL);
5197         if (ret)
5198                 return ret;
5199
5200         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5201             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5202                 return -EINVAL;
5203
5204         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5205         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5206         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5207         return 0;
5208 }
5209
5210 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5211                                             const u8 *rates)
5212 {
5213         int i;
5214
5215         if (!rates)
5216                 return;
5217
5218         for (i = 0; i < rates[1]; i++) {
5219                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5220                         params->ht_required = true;
5221                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5222                         params->vht_required = true;
5223                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5224                         params->he_required = true;
5225                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5226                         params->sae_h2e_required = true;
5227         }
5228 }
5229
5230 /*
5231  * Since the nl80211 API didn't include, from the beginning, attributes about
5232  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5233  * benefit of drivers that rebuild IEs in the firmware.
5234  */
5235 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5236 {
5237         const struct cfg80211_beacon_data *bcn = &params->beacon;
5238         size_t ies_len = bcn->tail_len;
5239         const u8 *ies = bcn->tail;
5240         const u8 *rates;
5241         const u8 *cap;
5242
5243         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
5244         nl80211_check_ap_rate_selectors(params, rates);
5245
5246         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5247         nl80211_check_ap_rate_selectors(params, rates);
5248
5249         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5250         if (cap && cap[1] >= sizeof(*params->ht_cap))
5251                 params->ht_cap = (void *)(cap + 2);
5252         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5253         if (cap && cap[1] >= sizeof(*params->vht_cap))
5254                 params->vht_cap = (void *)(cap + 2);
5255         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5256         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
5257                 params->he_cap = (void *)(cap + 3);
5258         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5259         if (cap && cap[1] >= sizeof(*params->he_oper) + 1)
5260                 params->he_oper = (void *)(cap + 3);
5261 }
5262
5263 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5264                                    struct cfg80211_ap_settings *params)
5265 {
5266         struct wireless_dev *wdev;
5267         bool ret = false;
5268
5269         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5270                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5271                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5272                         continue;
5273
5274                 if (!wdev->preset_chandef.chan)
5275                         continue;
5276
5277                 params->chandef = wdev->preset_chandef;
5278                 ret = true;
5279                 break;
5280         }
5281
5282         return ret;
5283 }
5284
5285 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5286                                     enum nl80211_auth_type auth_type,
5287                                     enum nl80211_commands cmd)
5288 {
5289         if (auth_type > NL80211_AUTHTYPE_MAX)
5290                 return false;
5291
5292         switch (cmd) {
5293         case NL80211_CMD_AUTHENTICATE:
5294                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5295                     auth_type == NL80211_AUTHTYPE_SAE)
5296                         return false;
5297                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5298                                              NL80211_EXT_FEATURE_FILS_STA) &&
5299                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5300                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5301                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5302                         return false;
5303                 return true;
5304         case NL80211_CMD_CONNECT:
5305                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5306                     !wiphy_ext_feature_isset(&rdev->wiphy,
5307                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5308                     auth_type == NL80211_AUTHTYPE_SAE)
5309                         return false;
5310
5311                 /* FILS with SK PFS or PK not supported yet */
5312                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5313                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5314                         return false;
5315                 if (!wiphy_ext_feature_isset(
5316                             &rdev->wiphy,
5317                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5318                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5319                         return false;
5320                 return true;
5321         case NL80211_CMD_START_AP:
5322                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5323                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5324                     auth_type == NL80211_AUTHTYPE_SAE)
5325                         return false;
5326                 /* FILS not supported yet */
5327                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5328                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5329                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5330                         return false;
5331                 return true;
5332         default:
5333                 return false;
5334         }
5335 }
5336
5337 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5338 {
5339         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5340         struct net_device *dev = info->user_ptr[1];
5341         struct wireless_dev *wdev = dev->ieee80211_ptr;
5342         struct cfg80211_ap_settings params;
5343         int err;
5344
5345         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5346             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5347                 return -EOPNOTSUPP;
5348
5349         if (!rdev->ops->start_ap)
5350                 return -EOPNOTSUPP;
5351
5352         if (wdev->beacon_interval)
5353                 return -EALREADY;
5354
5355         memset(&params, 0, sizeof(params));
5356
5357         /* these are required for START_AP */
5358         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5359             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5360             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5361                 return -EINVAL;
5362
5363         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
5364         if (err)
5365                 return err;
5366
5367         params.beacon_interval =
5368                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5369         params.dtim_period =
5370                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5371
5372         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5373                                            params.beacon_interval);
5374         if (err)
5375                 return err;
5376
5377         /*
5378          * In theory, some of these attributes should be required here
5379          * but since they were not used when the command was originally
5380          * added, keep them optional for old user space programs to let
5381          * them continue to work with drivers that do not need the
5382          * additional information -- drivers must check!
5383          */
5384         if (info->attrs[NL80211_ATTR_SSID]) {
5385                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5386                 params.ssid_len =
5387                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5388                 if (params.ssid_len == 0)
5389                         return -EINVAL;
5390         }
5391
5392         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5393                 params.hidden_ssid = nla_get_u32(
5394                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5395
5396         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5397
5398         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5399                 params.auth_type = nla_get_u32(
5400                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5401                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
5402                                              NL80211_CMD_START_AP))
5403                         return -EINVAL;
5404         } else
5405                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5406
5407         err = nl80211_crypto_settings(rdev, info, &params.crypto,
5408                                       NL80211_MAX_NR_CIPHER_SUITES);
5409         if (err)
5410                 return err;
5411
5412         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
5413                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
5414                         return -EOPNOTSUPP;
5415                 params.inactivity_timeout = nla_get_u16(
5416                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
5417         }
5418
5419         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5420                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5421                         return -EINVAL;
5422                 params.p2p_ctwindow =
5423                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5424                 if (params.p2p_ctwindow != 0 &&
5425                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5426                         return -EINVAL;
5427         }
5428
5429         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5430                 u8 tmp;
5431
5432                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5433                         return -EINVAL;
5434                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5435                 params.p2p_opp_ps = tmp;
5436                 if (params.p2p_opp_ps != 0 &&
5437                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5438                         return -EINVAL;
5439         }
5440
5441         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
5442                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
5443                 if (err)
5444                         return err;
5445         } else if (wdev->preset_chandef.chan) {
5446                 params.chandef = wdev->preset_chandef;
5447         } else if (!nl80211_get_ap_channel(rdev, &params))
5448                 return -EINVAL;
5449
5450         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
5451                                            wdev->iftype))
5452                 return -EINVAL;
5453
5454         if (info->attrs[NL80211_ATTR_TX_RATES]) {
5455                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
5456                                                     NL80211_ATTR_TX_RATES,
5457                                                     &params.beacon_rate,
5458                                                     dev, false);
5459                 if (err)
5460                         return err;
5461
5462                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
5463                                               &params.beacon_rate);
5464                 if (err)
5465                         return err;
5466         }
5467
5468         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
5469                 params.smps_mode =
5470                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
5471                 switch (params.smps_mode) {
5472                 case NL80211_SMPS_OFF:
5473                         break;
5474                 case NL80211_SMPS_STATIC:
5475                         if (!(rdev->wiphy.features &
5476                               NL80211_FEATURE_STATIC_SMPS))
5477                                 return -EINVAL;
5478                         break;
5479                 case NL80211_SMPS_DYNAMIC:
5480                         if (!(rdev->wiphy.features &
5481                               NL80211_FEATURE_DYNAMIC_SMPS))
5482                                 return -EINVAL;
5483                         break;
5484                 default:
5485                         return -EINVAL;
5486                 }
5487         } else {
5488                 params.smps_mode = NL80211_SMPS_OFF;
5489         }
5490
5491         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
5492         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
5493                 return -EOPNOTSUPP;
5494
5495         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
5496                 params.acl = parse_acl_data(&rdev->wiphy, info);
5497                 if (IS_ERR(params.acl))
5498                         return PTR_ERR(params.acl);
5499         }
5500
5501         params.twt_responder =
5502                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
5503
5504         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
5505                 err = nl80211_parse_he_obss_pd(
5506                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
5507                                         &params.he_obss_pd);
5508                 if (err)
5509                         goto out;
5510         }
5511
5512         if (info->attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5513                 err = nl80211_parse_he_bss_color(
5514                                         info->attrs[NL80211_ATTR_HE_BSS_COLOR],
5515                                         &params.he_bss_color);
5516                 if (err)
5517                         goto out;
5518         }
5519
5520         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
5521                 err = nl80211_parse_fils_discovery(rdev,
5522                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
5523                                                    &params);
5524                 if (err)
5525                         goto out;
5526         }
5527
5528         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
5529                 err = nl80211_parse_unsol_bcast_probe_resp(
5530                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
5531                         &params);
5532                 if (err)
5533                         goto out;
5534         }
5535
5536         nl80211_calculate_ap_params(&params);
5537
5538         if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
5539                 params.flags |= AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
5540
5541         wdev_lock(wdev);
5542         err = rdev_start_ap(rdev, dev, &params);
5543         if (!err) {
5544                 wdev->preset_chandef = params.chandef;
5545                 wdev->beacon_interval = params.beacon_interval;
5546                 wdev->chandef = params.chandef;
5547                 wdev->ssid_len = params.ssid_len;
5548                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
5549
5550                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
5551                         wdev->conn_owner_nlportid = info->snd_portid;
5552         }
5553         wdev_unlock(wdev);
5554
5555 out:
5556         kfree(params.acl);
5557
5558         return err;
5559 }
5560
5561 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
5562 {
5563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5564         struct net_device *dev = info->user_ptr[1];
5565         struct wireless_dev *wdev = dev->ieee80211_ptr;
5566         struct cfg80211_beacon_data params;
5567         int err;
5568
5569         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5570             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5571                 return -EOPNOTSUPP;
5572
5573         if (!rdev->ops->change_beacon)
5574                 return -EOPNOTSUPP;
5575
5576         if (!wdev->beacon_interval)
5577                 return -EINVAL;
5578
5579         err = nl80211_parse_beacon(rdev, info->attrs, &params);
5580         if (err)
5581                 return err;
5582
5583         wdev_lock(wdev);
5584         err = rdev_change_beacon(rdev, dev, &params);
5585         wdev_unlock(wdev);
5586
5587         return err;
5588 }
5589
5590 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
5591 {
5592         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5593         struct net_device *dev = info->user_ptr[1];
5594
5595         return cfg80211_stop_ap(rdev, dev, false);
5596 }
5597
5598 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
5599         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
5600         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
5601         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
5602         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
5603         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
5604         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
5605 };
5606
5607 static int parse_station_flags(struct genl_info *info,
5608                                enum nl80211_iftype iftype,
5609                                struct station_parameters *params)
5610 {
5611         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
5612         struct nlattr *nla;
5613         int flag;
5614
5615         /*
5616          * Try parsing the new attribute first so userspace
5617          * can specify both for older kernels.
5618          */
5619         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
5620         if (nla) {
5621                 struct nl80211_sta_flag_update *sta_flags;
5622
5623                 sta_flags = nla_data(nla);
5624                 params->sta_flags_mask = sta_flags->mask;
5625                 params->sta_flags_set = sta_flags->set;
5626                 params->sta_flags_set &= params->sta_flags_mask;
5627                 if ((params->sta_flags_mask |
5628                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
5629                         return -EINVAL;
5630                 return 0;
5631         }
5632
5633         /* if present, parse the old attribute */
5634
5635         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
5636         if (!nla)
5637                 return 0;
5638
5639         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
5640                 return -EINVAL;
5641
5642         /*
5643          * Only allow certain flags for interface types so that
5644          * other attributes are silently ignored. Remember that
5645          * this is backward compatibility code with old userspace
5646          * and shouldn't be hit in other cases anyway.
5647          */
5648         switch (iftype) {
5649         case NL80211_IFTYPE_AP:
5650         case NL80211_IFTYPE_AP_VLAN:
5651         case NL80211_IFTYPE_P2P_GO:
5652                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5653                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5654                                          BIT(NL80211_STA_FLAG_WME) |
5655                                          BIT(NL80211_STA_FLAG_MFP);
5656                 break;
5657         case NL80211_IFTYPE_P2P_CLIENT:
5658         case NL80211_IFTYPE_STATION:
5659                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
5660                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
5661                 break;
5662         case NL80211_IFTYPE_MESH_POINT:
5663                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5664                                          BIT(NL80211_STA_FLAG_MFP) |
5665                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
5666                 break;
5667         default:
5668                 return -EINVAL;
5669         }
5670
5671         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
5672                 if (flags[flag]) {
5673                         params->sta_flags_set |= (1<<flag);
5674
5675                         /* no longer support new API additions in old API */
5676                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
5677                                 return -EINVAL;
5678                 }
5679         }
5680
5681         return 0;
5682 }
5683
5684 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
5685 {
5686         struct nlattr *rate;
5687         u32 bitrate;
5688         u16 bitrate_compat;
5689         enum nl80211_rate_info rate_flg;
5690
5691         rate = nla_nest_start_noflag(msg, attr);
5692         if (!rate)
5693                 return false;
5694
5695         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
5696         bitrate = cfg80211_calculate_bitrate(info);
5697         /* report 16-bit bitrate only if we can */
5698         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
5699         if (bitrate > 0 &&
5700             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
5701                 return false;
5702         if (bitrate_compat > 0 &&
5703             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
5704                 return false;
5705
5706         switch (info->bw) {
5707         case RATE_INFO_BW_5:
5708                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
5709                 break;
5710         case RATE_INFO_BW_10:
5711                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
5712                 break;
5713         default:
5714                 WARN_ON(1);
5715                 fallthrough;
5716         case RATE_INFO_BW_20:
5717                 rate_flg = 0;
5718                 break;
5719         case RATE_INFO_BW_40:
5720                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
5721                 break;
5722         case RATE_INFO_BW_80:
5723                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
5724                 break;
5725         case RATE_INFO_BW_160:
5726                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
5727                 break;
5728         case RATE_INFO_BW_HE_RU:
5729                 rate_flg = 0;
5730                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
5731         }
5732
5733         if (rate_flg && nla_put_flag(msg, rate_flg))
5734                 return false;
5735
5736         if (info->flags & RATE_INFO_FLAGS_MCS) {
5737                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
5738                         return false;
5739                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5740                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5741                         return false;
5742         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
5743                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
5744                         return false;
5745                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
5746                         return false;
5747                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
5748                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
5749                         return false;
5750         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
5751                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
5752                         return false;
5753                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
5754                         return false;
5755                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
5756                         return false;
5757                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
5758                         return false;
5759                 if (info->bw == RATE_INFO_BW_HE_RU &&
5760                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
5761                                info->he_ru_alloc))
5762                         return false;
5763         }
5764
5765         nla_nest_end(msg, rate);
5766         return true;
5767 }
5768
5769 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
5770                                int id)
5771 {
5772         void *attr;
5773         int i = 0;
5774
5775         if (!mask)
5776                 return true;
5777
5778         attr = nla_nest_start_noflag(msg, id);
5779         if (!attr)
5780                 return false;
5781
5782         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
5783                 if (!(mask & BIT(i)))
5784                         continue;
5785
5786                 if (nla_put_u8(msg, i, signal[i]))
5787                         return false;
5788         }
5789
5790         nla_nest_end(msg, attr);
5791
5792         return true;
5793 }
5794
5795 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
5796                                 u32 seq, int flags,
5797                                 struct cfg80211_registered_device *rdev,
5798                                 struct net_device *dev,
5799                                 const u8 *mac_addr, struct station_info *sinfo)
5800 {
5801         void *hdr;
5802         struct nlattr *sinfoattr, *bss_param;
5803
5804         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
5805         if (!hdr) {
5806                 cfg80211_sinfo_release_content(sinfo);
5807                 return -1;
5808         }
5809
5810         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5811             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
5812             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
5813                 goto nla_put_failure;
5814
5815         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
5816         if (!sinfoattr)
5817                 goto nla_put_failure;
5818
5819 #define PUT_SINFO(attr, memb, type) do {                                \
5820         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
5821         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5822             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
5823                              sinfo->memb))                              \
5824                 goto nla_put_failure;                                   \
5825         } while (0)
5826 #define PUT_SINFO_U64(attr, memb) do {                                  \
5827         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
5828             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
5829                               sinfo->memb, NL80211_STA_INFO_PAD))       \
5830                 goto nla_put_failure;                                   \
5831         } while (0)
5832
5833         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
5834         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
5835         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
5836
5837         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
5838                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
5839             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
5840                         (u32)sinfo->rx_bytes))
5841                 goto nla_put_failure;
5842
5843         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
5844                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
5845             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
5846                         (u32)sinfo->tx_bytes))
5847                 goto nla_put_failure;
5848
5849         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
5850         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
5851         PUT_SINFO(LLID, llid, u16);
5852         PUT_SINFO(PLID, plid, u16);
5853         PUT_SINFO(PLINK_STATE, plink_state, u8);
5854         PUT_SINFO_U64(RX_DURATION, rx_duration);
5855         PUT_SINFO_U64(TX_DURATION, tx_duration);
5856
5857         if (wiphy_ext_feature_isset(&rdev->wiphy,
5858                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
5859                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
5860
5861         switch (rdev->wiphy.signal_type) {
5862         case CFG80211_SIGNAL_TYPE_MBM:
5863                 PUT_SINFO(SIGNAL, signal, u8);
5864                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
5865                 break;
5866         default:
5867                 break;
5868         }
5869         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
5870                 if (!nl80211_put_signal(msg, sinfo->chains,
5871                                         sinfo->chain_signal,
5872                                         NL80211_STA_INFO_CHAIN_SIGNAL))
5873                         goto nla_put_failure;
5874         }
5875         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
5876                 if (!nl80211_put_signal(msg, sinfo->chains,
5877                                         sinfo->chain_signal_avg,
5878                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
5879                         goto nla_put_failure;
5880         }
5881         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
5882                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
5883                                           NL80211_STA_INFO_TX_BITRATE))
5884                         goto nla_put_failure;
5885         }
5886         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
5887                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
5888                                           NL80211_STA_INFO_RX_BITRATE))
5889                         goto nla_put_failure;
5890         }
5891
5892         PUT_SINFO(RX_PACKETS, rx_packets, u32);
5893         PUT_SINFO(TX_PACKETS, tx_packets, u32);
5894         PUT_SINFO(TX_RETRIES, tx_retries, u32);
5895         PUT_SINFO(TX_FAILED, tx_failed, u32);
5896         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
5897         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
5898         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
5899         PUT_SINFO(LOCAL_PM, local_pm, u32);
5900         PUT_SINFO(PEER_PM, peer_pm, u32);
5901         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
5902         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
5903         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
5904
5905         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
5906                 bss_param = nla_nest_start_noflag(msg,
5907                                                   NL80211_STA_INFO_BSS_PARAM);
5908                 if (!bss_param)
5909                         goto nla_put_failure;
5910
5911                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
5912                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
5913                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
5914                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
5915                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
5916                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
5917                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
5918                                sinfo->bss_param.dtim_period) ||
5919                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
5920                                 sinfo->bss_param.beacon_interval))
5921                         goto nla_put_failure;
5922
5923                 nla_nest_end(msg, bss_param);
5924         }
5925         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
5926             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
5927                     sizeof(struct nl80211_sta_flag_update),
5928                     &sinfo->sta_flags))
5929                 goto nla_put_failure;
5930
5931         PUT_SINFO_U64(T_OFFSET, t_offset);
5932         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
5933         PUT_SINFO_U64(BEACON_RX, rx_beacon);
5934         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
5935         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
5936         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
5937         if (wiphy_ext_feature_isset(&rdev->wiphy,
5938                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
5939                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
5940                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
5941         }
5942
5943 #undef PUT_SINFO
5944 #undef PUT_SINFO_U64
5945
5946         if (sinfo->pertid) {
5947                 struct nlattr *tidsattr;
5948                 int tid;
5949
5950                 tidsattr = nla_nest_start_noflag(msg,
5951                                                  NL80211_STA_INFO_TID_STATS);
5952                 if (!tidsattr)
5953                         goto nla_put_failure;
5954
5955                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
5956                         struct cfg80211_tid_stats *tidstats;
5957                         struct nlattr *tidattr;
5958
5959                         tidstats = &sinfo->pertid[tid];
5960
5961                         if (!tidstats->filled)
5962                                 continue;
5963
5964                         tidattr = nla_nest_start_noflag(msg, tid + 1);
5965                         if (!tidattr)
5966                                 goto nla_put_failure;
5967
5968 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
5969         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
5970             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
5971                               tidstats->memb, NL80211_TID_STATS_PAD))   \
5972                 goto nla_put_failure;                                   \
5973         } while (0)
5974
5975                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
5976                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
5977                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
5978                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
5979
5980 #undef PUT_TIDVAL_U64
5981                         if ((tidstats->filled &
5982                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
5983                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
5984                                                    NL80211_TID_STATS_TXQ_STATS))
5985                                 goto nla_put_failure;
5986
5987                         nla_nest_end(msg, tidattr);
5988                 }
5989
5990                 nla_nest_end(msg, tidsattr);
5991         }
5992
5993         nla_nest_end(msg, sinfoattr);
5994
5995         if (sinfo->assoc_req_ies_len &&
5996             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
5997                     sinfo->assoc_req_ies))
5998                 goto nla_put_failure;
5999
6000         cfg80211_sinfo_release_content(sinfo);
6001         genlmsg_end(msg, hdr);
6002         return 0;
6003
6004  nla_put_failure:
6005         cfg80211_sinfo_release_content(sinfo);
6006         genlmsg_cancel(msg, hdr);
6007         return -EMSGSIZE;
6008 }
6009
6010 static int nl80211_dump_station(struct sk_buff *skb,
6011                                 struct netlink_callback *cb)
6012 {
6013         struct station_info sinfo;
6014         struct cfg80211_registered_device *rdev;
6015         struct wireless_dev *wdev;
6016         u8 mac_addr[ETH_ALEN];
6017         int sta_idx = cb->args[2];
6018         int err;
6019
6020         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6021         if (err)
6022                 return err;
6023         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6024         __acquire(&rdev->wiphy.mtx);
6025
6026         if (!wdev->netdev) {
6027                 err = -EINVAL;
6028                 goto out_err;
6029         }
6030
6031         if (!rdev->ops->dump_station) {
6032                 err = -EOPNOTSUPP;
6033                 goto out_err;
6034         }
6035
6036         while (1) {
6037                 memset(&sinfo, 0, sizeof(sinfo));
6038                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6039                                         mac_addr, &sinfo);
6040                 if (err == -ENOENT)
6041                         break;
6042                 if (err)
6043                         goto out_err;
6044
6045                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6046                                 NETLINK_CB(cb->skb).portid,
6047                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6048                                 rdev, wdev->netdev, mac_addr,
6049                                 &sinfo) < 0)
6050                         goto out;
6051
6052                 sta_idx++;
6053         }
6054
6055  out:
6056         cb->args[2] = sta_idx;
6057         err = skb->len;
6058  out_err:
6059         wiphy_unlock(&rdev->wiphy);
6060
6061         return err;
6062 }
6063
6064 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6065 {
6066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6067         struct net_device *dev = info->user_ptr[1];
6068         struct station_info sinfo;
6069         struct sk_buff *msg;
6070         u8 *mac_addr = NULL;
6071         int err;
6072
6073         memset(&sinfo, 0, sizeof(sinfo));
6074
6075         if (!info->attrs[NL80211_ATTR_MAC])
6076                 return -EINVAL;
6077
6078         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6079
6080         if (!rdev->ops->get_station)
6081                 return -EOPNOTSUPP;
6082
6083         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6084         if (err)
6085                 return err;
6086
6087         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6088         if (!msg) {
6089                 cfg80211_sinfo_release_content(&sinfo);
6090                 return -ENOMEM;
6091         }
6092
6093         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6094                                  info->snd_portid, info->snd_seq, 0,
6095                                  rdev, dev, mac_addr, &sinfo) < 0) {
6096                 nlmsg_free(msg);
6097                 return -ENOBUFS;
6098         }
6099
6100         return genlmsg_reply(msg, info);
6101 }
6102
6103 int cfg80211_check_station_change(struct wiphy *wiphy,
6104                                   struct station_parameters *params,
6105                                   enum cfg80211_station_type statype)
6106 {
6107         if (params->listen_interval != -1 &&
6108             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6109                 return -EINVAL;
6110
6111         if (params->support_p2p_ps != -1 &&
6112             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6113                 return -EINVAL;
6114
6115         if (params->aid &&
6116             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6117             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6118                 return -EINVAL;
6119
6120         /* When you run into this, adjust the code below for the new flag */
6121         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6122
6123         switch (statype) {
6124         case CFG80211_STA_MESH_PEER_KERNEL:
6125         case CFG80211_STA_MESH_PEER_USER:
6126                 /*
6127                  * No ignoring the TDLS flag here -- the userspace mesh
6128                  * code doesn't have the bug of including TDLS in the
6129                  * mask everywhere.
6130                  */
6131                 if (params->sta_flags_mask &
6132                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6133                                   BIT(NL80211_STA_FLAG_MFP) |
6134                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6135                         return -EINVAL;
6136                 break;
6137         case CFG80211_STA_TDLS_PEER_SETUP:
6138         case CFG80211_STA_TDLS_PEER_ACTIVE:
6139                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6140                         return -EINVAL;
6141                 /* ignore since it can't change */
6142                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6143                 break;
6144         default:
6145                 /* disallow mesh-specific things */
6146                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6147                         return -EINVAL;
6148                 if (params->local_pm)
6149                         return -EINVAL;
6150                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6151                         return -EINVAL;
6152         }
6153
6154         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6155             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6156                 /* TDLS can't be set, ... */
6157                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6158                         return -EINVAL;
6159                 /*
6160                  * ... but don't bother the driver with it. This works around
6161                  * a hostapd/wpa_supplicant issue -- it always includes the
6162                  * TLDS_PEER flag in the mask even for AP mode.
6163                  */
6164                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6165         }
6166
6167         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6168             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6169                 /* reject other things that can't change */
6170                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6171                         return -EINVAL;
6172                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6173                         return -EINVAL;
6174                 if (params->supported_rates)
6175                         return -EINVAL;
6176                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
6177                     params->he_capa)
6178                         return -EINVAL;
6179         }
6180
6181         if (statype != CFG80211_STA_AP_CLIENT &&
6182             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6183                 if (params->vlan)
6184                         return -EINVAL;
6185         }
6186
6187         switch (statype) {
6188         case CFG80211_STA_AP_MLME_CLIENT:
6189                 /* Use this only for authorizing/unauthorizing a station */
6190                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6191                         return -EOPNOTSUPP;
6192                 break;
6193         case CFG80211_STA_AP_CLIENT:
6194         case CFG80211_STA_AP_CLIENT_UNASSOC:
6195                 /* accept only the listed bits */
6196                 if (params->sta_flags_mask &
6197                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6198                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6199                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6200                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6201                                   BIT(NL80211_STA_FLAG_WME) |
6202                                   BIT(NL80211_STA_FLAG_MFP)))
6203                         return -EINVAL;
6204
6205                 /* but authenticated/associated only if driver handles it */
6206                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6207                     params->sta_flags_mask &
6208                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6209                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6210                         return -EINVAL;
6211                 break;
6212         case CFG80211_STA_IBSS:
6213         case CFG80211_STA_AP_STA:
6214                 /* reject any changes other than AUTHORIZED */
6215                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6216                         return -EINVAL;
6217                 break;
6218         case CFG80211_STA_TDLS_PEER_SETUP:
6219                 /* reject any changes other than AUTHORIZED or WME */
6220                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6221                                                BIT(NL80211_STA_FLAG_WME)))
6222                         return -EINVAL;
6223                 /* force (at least) rates when authorizing */
6224                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6225                     !params->supported_rates)
6226                         return -EINVAL;
6227                 break;
6228         case CFG80211_STA_TDLS_PEER_ACTIVE:
6229                 /* reject any changes */
6230                 return -EINVAL;
6231         case CFG80211_STA_MESH_PEER_KERNEL:
6232                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6233                         return -EINVAL;
6234                 break;
6235         case CFG80211_STA_MESH_PEER_USER:
6236                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6237                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6238                         return -EINVAL;
6239                 break;
6240         }
6241
6242         /*
6243          * Older kernel versions ignored this attribute entirely, so don't
6244          * reject attempts to update it but mark it as unused instead so the
6245          * driver won't look at the data.
6246          */
6247         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6248             statype != CFG80211_STA_TDLS_PEER_SETUP)
6249                 params->opmode_notif_used = false;
6250
6251         return 0;
6252 }
6253 EXPORT_SYMBOL(cfg80211_check_station_change);
6254
6255 /*
6256  * Get vlan interface making sure it is running and on the right wiphy.
6257  */
6258 static struct net_device *get_vlan(struct genl_info *info,
6259                                    struct cfg80211_registered_device *rdev)
6260 {
6261         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6262         struct net_device *v;
6263         int ret;
6264
6265         if (!vlanattr)
6266                 return NULL;
6267
6268         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6269         if (!v)
6270                 return ERR_PTR(-ENODEV);
6271
6272         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6273                 ret = -EINVAL;
6274                 goto error;
6275         }
6276
6277         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6278             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6279             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6280                 ret = -EINVAL;
6281                 goto error;
6282         }
6283
6284         if (!netif_running(v)) {
6285                 ret = -ENETDOWN;
6286                 goto error;
6287         }
6288
6289         return v;
6290  error:
6291         dev_put(v);
6292         return ERR_PTR(ret);
6293 }
6294
6295 static const struct nla_policy
6296 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
6297         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
6298         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
6299 };
6300
6301 static int nl80211_parse_sta_wme(struct genl_info *info,
6302                                  struct station_parameters *params)
6303 {
6304         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6305         struct nlattr *nla;
6306         int err;
6307
6308         /* parse WME attributes if present */
6309         if (!info->attrs[NL80211_ATTR_STA_WME])
6310                 return 0;
6311
6312         nla = info->attrs[NL80211_ATTR_STA_WME];
6313         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
6314                                           nl80211_sta_wme_policy,
6315                                           info->extack);
6316         if (err)
6317                 return err;
6318
6319         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
6320                 params->uapsd_queues = nla_get_u8(
6321                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
6322         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
6323                 return -EINVAL;
6324
6325         if (tb[NL80211_STA_WME_MAX_SP])
6326                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
6327
6328         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
6329                 return -EINVAL;
6330
6331         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
6332
6333         return 0;
6334 }
6335
6336 static int nl80211_parse_sta_channel_info(struct genl_info *info,
6337                                       struct station_parameters *params)
6338 {
6339         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
6340                 params->supported_channels =
6341                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6342                 params->supported_channels_len =
6343                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
6344                 /*
6345                  * Need to include at least one (first channel, number of
6346                  * channels) tuple for each subband (checked in policy),
6347                  * and must have proper tuples for the rest of the data as well.
6348                  */
6349                 if (params->supported_channels_len % 2)
6350                         return -EINVAL;
6351         }
6352
6353         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
6354                 params->supported_oper_classes =
6355                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6356                 params->supported_oper_classes_len =
6357                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
6358         }
6359         return 0;
6360 }
6361
6362 static int nl80211_set_station_tdls(struct genl_info *info,
6363                                     struct station_parameters *params)
6364 {
6365         int err;
6366         /* Dummy STA entry gets updated once the peer capabilities are known */
6367         if (info->attrs[NL80211_ATTR_PEER_AID])
6368                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6369         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6370                 params->ht_capa =
6371                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6372         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6373                 params->vht_capa =
6374                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6375         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6376                 params->he_capa =
6377                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6378                 params->he_capa_len =
6379                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6380         }
6381
6382         err = nl80211_parse_sta_channel_info(info, params);
6383         if (err)
6384                 return err;
6385
6386         return nl80211_parse_sta_wme(info, params);
6387 }
6388
6389 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
6390                                              struct station_parameters *params)
6391 {
6392         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6393         int idx;
6394
6395         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
6396                 if (!rdev->ops->set_tx_power ||
6397                     !wiphy_ext_feature_isset(&rdev->wiphy,
6398                                          NL80211_EXT_FEATURE_STA_TX_PWR))
6399                         return -EOPNOTSUPP;
6400
6401                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
6402                 params->txpwr.type = nla_get_u8(info->attrs[idx]);
6403
6404                 if (params->txpwr.type == NL80211_TX_POWER_LIMITED) {
6405                         idx = NL80211_ATTR_STA_TX_POWER;
6406
6407                         if (info->attrs[idx])
6408                                 params->txpwr.power =
6409                                         nla_get_s16(info->attrs[idx]);
6410                         else
6411                                 return -EINVAL;
6412                 }
6413                 params->sta_modify_mask |= STATION_PARAM_APPLY_STA_TXPOWER;
6414         }
6415
6416         return 0;
6417 }
6418
6419 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
6420 {
6421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6422         struct net_device *dev = info->user_ptr[1];
6423         struct station_parameters params;
6424         u8 *mac_addr;
6425         int err;
6426
6427         memset(&params, 0, sizeof(params));
6428
6429         if (!rdev->ops->change_station)
6430                 return -EOPNOTSUPP;
6431
6432         /*
6433          * AID and listen_interval properties can be set only for unassociated
6434          * station. Include these parameters here and will check them in
6435          * cfg80211_check_station_change().
6436          */
6437         if (info->attrs[NL80211_ATTR_STA_AID])
6438                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6439
6440         if (info->attrs[NL80211_ATTR_VLAN_ID])
6441                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6442
6443         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6444                 params.listen_interval =
6445                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6446         else
6447                 params.listen_interval = -1;
6448
6449         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
6450                 params.support_p2p_ps =
6451                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6452         else
6453                 params.support_p2p_ps = -1;
6454
6455         if (!info->attrs[NL80211_ATTR_MAC])
6456                 return -EINVAL;
6457
6458         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6459
6460         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
6461                 params.supported_rates =
6462                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6463                 params.supported_rates_len =
6464                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6465         }
6466
6467         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6468                 params.capability =
6469                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6470                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6471         }
6472
6473         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6474                 params.ext_capab =
6475                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6476                 params.ext_capab_len =
6477                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6478         }
6479
6480         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6481                 return -EINVAL;
6482
6483         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6484                 params.plink_action =
6485                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6486
6487         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
6488                 params.plink_state =
6489                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
6490                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
6491                         params.peer_aid = nla_get_u16(
6492                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
6493                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
6494         }
6495
6496         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
6497                 params.local_pm = nla_get_u32(
6498                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
6499
6500         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6501                 params.opmode_notif_used = true;
6502                 params.opmode_notif =
6503                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6504         }
6505
6506         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6507                 params.he_6ghz_capa =
6508                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6509
6510         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6511                 params.airtime_weight =
6512                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6513
6514         if (params.airtime_weight &&
6515             !wiphy_ext_feature_isset(&rdev->wiphy,
6516                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6517                 return -EOPNOTSUPP;
6518
6519         err = nl80211_parse_sta_txpower_setting(info, &params);
6520         if (err)
6521                 return err;
6522
6523         /* Include parameters for TDLS peer (will check later) */
6524         err = nl80211_set_station_tdls(info, &params);
6525         if (err)
6526                 return err;
6527
6528         params.vlan = get_vlan(info, rdev);
6529         if (IS_ERR(params.vlan))
6530                 return PTR_ERR(params.vlan);
6531
6532         switch (dev->ieee80211_ptr->iftype) {
6533         case NL80211_IFTYPE_AP:
6534         case NL80211_IFTYPE_AP_VLAN:
6535         case NL80211_IFTYPE_P2P_GO:
6536         case NL80211_IFTYPE_P2P_CLIENT:
6537         case NL80211_IFTYPE_STATION:
6538         case NL80211_IFTYPE_ADHOC:
6539         case NL80211_IFTYPE_MESH_POINT:
6540                 break;
6541         default:
6542                 err = -EOPNOTSUPP;
6543                 goto out_put_vlan;
6544         }
6545
6546         /* driver will call cfg80211_check_station_change() */
6547         err = rdev_change_station(rdev, dev, mac_addr, &params);
6548
6549  out_put_vlan:
6550         dev_put(params.vlan);
6551
6552         return err;
6553 }
6554
6555 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
6556 {
6557         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6558         int err;
6559         struct net_device *dev = info->user_ptr[1];
6560         struct station_parameters params;
6561         u8 *mac_addr = NULL;
6562         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6563                          BIT(NL80211_STA_FLAG_ASSOCIATED);
6564
6565         memset(&params, 0, sizeof(params));
6566
6567         if (!rdev->ops->add_station)
6568                 return -EOPNOTSUPP;
6569
6570         if (!info->attrs[NL80211_ATTR_MAC])
6571                 return -EINVAL;
6572
6573         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
6574                 return -EINVAL;
6575
6576         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
6577                 return -EINVAL;
6578
6579         if (!info->attrs[NL80211_ATTR_STA_AID] &&
6580             !info->attrs[NL80211_ATTR_PEER_AID])
6581                 return -EINVAL;
6582
6583         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6584         params.supported_rates =
6585                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6586         params.supported_rates_len =
6587                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
6588         params.listen_interval =
6589                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
6590
6591         if (info->attrs[NL80211_ATTR_VLAN_ID])
6592                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
6593
6594         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
6595                 params.support_p2p_ps =
6596                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
6597         } else {
6598                 /*
6599                  * if not specified, assume it's supported for P2P GO interface,
6600                  * and is NOT supported for AP interface
6601                  */
6602                 params.support_p2p_ps =
6603                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
6604         }
6605
6606         if (info->attrs[NL80211_ATTR_PEER_AID])
6607                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
6608         else
6609                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
6610
6611         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
6612                 params.capability =
6613                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
6614                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
6615         }
6616
6617         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
6618                 params.ext_capab =
6619                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6620                 params.ext_capab_len =
6621                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
6622         }
6623
6624         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
6625                 params.ht_capa =
6626                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
6627
6628         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
6629                 params.vht_capa =
6630                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
6631
6632         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
6633                 params.he_capa =
6634                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6635                 params.he_capa_len =
6636                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
6637         }
6638
6639         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
6640                 params.he_6ghz_capa =
6641                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
6642
6643         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
6644                 params.opmode_notif_used = true;
6645                 params.opmode_notif =
6646                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
6647         }
6648
6649         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
6650                 params.plink_action =
6651                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
6652
6653         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
6654                 params.airtime_weight =
6655                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
6656
6657         if (params.airtime_weight &&
6658             !wiphy_ext_feature_isset(&rdev->wiphy,
6659                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6660                 return -EOPNOTSUPP;
6661
6662         err = nl80211_parse_sta_txpower_setting(info, &params);
6663         if (err)
6664                 return err;
6665
6666         err = nl80211_parse_sta_channel_info(info, &params);
6667         if (err)
6668                 return err;
6669
6670         err = nl80211_parse_sta_wme(info, &params);
6671         if (err)
6672                 return err;
6673
6674         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
6675                 return -EINVAL;
6676
6677         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
6678          * as userspace might just pass through the capabilities from the IEs
6679          * directly, rather than enforcing this restriction and returning an
6680          * error in this case.
6681          */
6682         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
6683                 params.ht_capa = NULL;
6684                 params.vht_capa = NULL;
6685
6686                 /* HE requires WME */
6687                 if (params.he_capa_len || params.he_6ghz_capa)
6688                         return -EINVAL;
6689         }
6690
6691         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
6692         if (params.he_6ghz_capa && (params.ht_capa || params.vht_capa))
6693                 return -EINVAL;
6694
6695         /* When you run into this, adjust the code below for the new flag */
6696         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6697
6698         switch (dev->ieee80211_ptr->iftype) {
6699         case NL80211_IFTYPE_AP:
6700         case NL80211_IFTYPE_AP_VLAN:
6701         case NL80211_IFTYPE_P2P_GO:
6702                 /* ignore WME attributes if iface/sta is not capable */
6703                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
6704                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
6705                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6706
6707                 /* TDLS peers cannot be added */
6708                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6709                     info->attrs[NL80211_ATTR_PEER_AID])
6710                         return -EINVAL;
6711                 /* but don't bother the driver with it */
6712                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6713
6714                 /* allow authenticated/associated only if driver handles it */
6715                 if (!(rdev->wiphy.features &
6716                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6717                     params.sta_flags_mask & auth_assoc)
6718                         return -EINVAL;
6719
6720                 /* Older userspace, or userspace wanting to be compatible with
6721                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
6722                  * and assoc flags in the mask, but assumes the station will be
6723                  * added as associated anyway since this was the required driver
6724                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
6725                  * introduced.
6726                  * In order to not bother drivers with this quirk in the API
6727                  * set the flags in both the mask and set for new stations in
6728                  * this case.
6729                  */
6730                 if (!(params.sta_flags_mask & auth_assoc)) {
6731                         params.sta_flags_mask |= auth_assoc;
6732                         params.sta_flags_set |= auth_assoc;
6733                 }
6734
6735                 /* must be last in here for error handling */
6736                 params.vlan = get_vlan(info, rdev);
6737                 if (IS_ERR(params.vlan))
6738                         return PTR_ERR(params.vlan);
6739                 break;
6740         case NL80211_IFTYPE_MESH_POINT:
6741                 /* ignore uAPSD data */
6742                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6743
6744                 /* associated is disallowed */
6745                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
6746                         return -EINVAL;
6747                 /* TDLS peers cannot be added */
6748                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
6749                     info->attrs[NL80211_ATTR_PEER_AID])
6750                         return -EINVAL;
6751                 break;
6752         case NL80211_IFTYPE_STATION:
6753         case NL80211_IFTYPE_P2P_CLIENT:
6754                 /* ignore uAPSD data */
6755                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
6756
6757                 /* these are disallowed */
6758                 if (params.sta_flags_mask &
6759                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
6760                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
6761                         return -EINVAL;
6762                 /* Only TDLS peers can be added */
6763                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6764                         return -EINVAL;
6765                 /* Can only add if TDLS ... */
6766                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
6767                         return -EOPNOTSUPP;
6768                 /* ... with external setup is supported */
6769                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
6770                         return -EOPNOTSUPP;
6771                 /*
6772                  * Older wpa_supplicant versions always mark the TDLS peer
6773                  * as authorized, but it shouldn't yet be.
6774                  */
6775                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
6776                 break;
6777         default:
6778                 return -EOPNOTSUPP;
6779         }
6780
6781         /* be aware of params.vlan when changing code here */
6782
6783         err = rdev_add_station(rdev, dev, mac_addr, &params);
6784
6785         dev_put(params.vlan);
6786         return err;
6787 }
6788
6789 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
6790 {
6791         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6792         struct net_device *dev = info->user_ptr[1];
6793         struct station_del_parameters params;
6794
6795         memset(&params, 0, sizeof(params));
6796
6797         if (info->attrs[NL80211_ATTR_MAC])
6798                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
6799
6800         switch (dev->ieee80211_ptr->iftype) {
6801         case NL80211_IFTYPE_AP:
6802         case NL80211_IFTYPE_AP_VLAN:
6803         case NL80211_IFTYPE_MESH_POINT:
6804         case NL80211_IFTYPE_P2P_GO:
6805                 /* always accept these */
6806                 break;
6807         case NL80211_IFTYPE_ADHOC:
6808                 /* conditionally accept */
6809                 if (wiphy_ext_feature_isset(&rdev->wiphy,
6810                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
6811                         break;
6812                 return -EINVAL;
6813         default:
6814                 return -EINVAL;
6815         }
6816
6817         if (!rdev->ops->del_station)
6818                 return -EOPNOTSUPP;
6819
6820         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
6821                 params.subtype =
6822                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
6823                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
6824                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
6825                         return -EINVAL;
6826         } else {
6827                 /* Default to Deauthentication frame */
6828                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
6829         }
6830
6831         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
6832                 params.reason_code =
6833                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
6834                 if (params.reason_code == 0)
6835                         return -EINVAL; /* 0 is reserved */
6836         } else {
6837                 /* Default to reason code 2 */
6838                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
6839         }
6840
6841         return rdev_del_station(rdev, dev, &params);
6842 }
6843
6844 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
6845                                 int flags, struct net_device *dev,
6846                                 u8 *dst, u8 *next_hop,
6847                                 struct mpath_info *pinfo)
6848 {
6849         void *hdr;
6850         struct nlattr *pinfoattr;
6851
6852         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
6853         if (!hdr)
6854                 return -1;
6855
6856         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6857             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
6858             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
6859             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
6860                 goto nla_put_failure;
6861
6862         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
6863         if (!pinfoattr)
6864                 goto nla_put_failure;
6865         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
6866             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
6867                         pinfo->frame_qlen))
6868                 goto nla_put_failure;
6869         if (((pinfo->filled & MPATH_INFO_SN) &&
6870              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
6871             ((pinfo->filled & MPATH_INFO_METRIC) &&
6872              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
6873                          pinfo->metric)) ||
6874             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
6875              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
6876                          pinfo->exptime)) ||
6877             ((pinfo->filled & MPATH_INFO_FLAGS) &&
6878              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
6879                         pinfo->flags)) ||
6880             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
6881              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
6882                          pinfo->discovery_timeout)) ||
6883             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
6884              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
6885                         pinfo->discovery_retries)) ||
6886             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
6887              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
6888                         pinfo->hop_count)) ||
6889             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
6890              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
6891                          pinfo->path_change_count)))
6892                 goto nla_put_failure;
6893
6894         nla_nest_end(msg, pinfoattr);
6895
6896         genlmsg_end(msg, hdr);
6897         return 0;
6898
6899  nla_put_failure:
6900         genlmsg_cancel(msg, hdr);
6901         return -EMSGSIZE;
6902 }
6903
6904 static int nl80211_dump_mpath(struct sk_buff *skb,
6905                               struct netlink_callback *cb)
6906 {
6907         struct mpath_info pinfo;
6908         struct cfg80211_registered_device *rdev;
6909         struct wireless_dev *wdev;
6910         u8 dst[ETH_ALEN];
6911         u8 next_hop[ETH_ALEN];
6912         int path_idx = cb->args[2];
6913         int err;
6914
6915         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6916         if (err)
6917                 return err;
6918         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6919         __acquire(&rdev->wiphy.mtx);
6920
6921         if (!rdev->ops->dump_mpath) {
6922                 err = -EOPNOTSUPP;
6923                 goto out_err;
6924         }
6925
6926         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
6927                 err = -EOPNOTSUPP;
6928                 goto out_err;
6929         }
6930
6931         while (1) {
6932                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
6933                                       next_hop, &pinfo);
6934                 if (err == -ENOENT)
6935                         break;
6936                 if (err)
6937                         goto out_err;
6938
6939                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
6940                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
6941                                        wdev->netdev, dst, next_hop,
6942                                        &pinfo) < 0)
6943                         goto out;
6944
6945                 path_idx++;
6946         }
6947
6948  out:
6949         cb->args[2] = path_idx;
6950         err = skb->len;
6951  out_err:
6952         wiphy_unlock(&rdev->wiphy);
6953         return err;
6954 }
6955
6956 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
6957 {
6958         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6959         int err;
6960         struct net_device *dev = info->user_ptr[1];
6961         struct mpath_info pinfo;
6962         struct sk_buff *msg;
6963         u8 *dst = NULL;
6964         u8 next_hop[ETH_ALEN];
6965
6966         memset(&pinfo, 0, sizeof(pinfo));
6967
6968         if (!info->attrs[NL80211_ATTR_MAC])
6969                 return -EINVAL;
6970
6971         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
6972
6973         if (!rdev->ops->get_mpath)
6974                 return -EOPNOTSUPP;
6975
6976         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
6977                 return -EOPNOTSUPP;
6978
6979         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
6980         if (err)
6981                 return err;
6982
6983         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6984         if (!msg)
6985                 return -ENOMEM;
6986
6987         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
6988                                  dev, dst, next_hop, &pinfo) < 0) {
6989                 nlmsg_free(msg);
6990                 return -ENOBUFS;
6991         }
6992
6993         return genlmsg_reply(msg, info);
6994 }
6995
6996 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
6997 {
6998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6999         struct net_device *dev = info->user_ptr[1];
7000         u8 *dst = NULL;
7001         u8 *next_hop = NULL;
7002
7003         if (!info->attrs[NL80211_ATTR_MAC])
7004                 return -EINVAL;
7005
7006         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7007                 return -EINVAL;
7008
7009         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7010         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7011
7012         if (!rdev->ops->change_mpath)
7013                 return -EOPNOTSUPP;
7014
7015         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7016                 return -EOPNOTSUPP;
7017
7018         return rdev_change_mpath(rdev, dev, dst, next_hop);
7019 }
7020
7021 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7022 {
7023         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7024         struct net_device *dev = info->user_ptr[1];
7025         u8 *dst = NULL;
7026         u8 *next_hop = NULL;
7027
7028         if (!info->attrs[NL80211_ATTR_MAC])
7029                 return -EINVAL;
7030
7031         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7032                 return -EINVAL;
7033
7034         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7035         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7036
7037         if (!rdev->ops->add_mpath)
7038                 return -EOPNOTSUPP;
7039
7040         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7041                 return -EOPNOTSUPP;
7042
7043         return rdev_add_mpath(rdev, dev, dst, next_hop);
7044 }
7045
7046 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7047 {
7048         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7049         struct net_device *dev = info->user_ptr[1];
7050         u8 *dst = NULL;
7051
7052         if (info->attrs[NL80211_ATTR_MAC])
7053                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7054
7055         if (!rdev->ops->del_mpath)
7056                 return -EOPNOTSUPP;
7057
7058         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7059                 return -EOPNOTSUPP;
7060
7061         return rdev_del_mpath(rdev, dev, dst);
7062 }
7063
7064 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7065 {
7066         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7067         int err;
7068         struct net_device *dev = info->user_ptr[1];
7069         struct mpath_info pinfo;
7070         struct sk_buff *msg;
7071         u8 *dst = NULL;
7072         u8 mpp[ETH_ALEN];
7073
7074         memset(&pinfo, 0, sizeof(pinfo));
7075
7076         if (!info->attrs[NL80211_ATTR_MAC])
7077                 return -EINVAL;
7078
7079         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7080
7081         if (!rdev->ops->get_mpp)
7082                 return -EOPNOTSUPP;
7083
7084         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7085                 return -EOPNOTSUPP;
7086
7087         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7088         if (err)
7089                 return err;
7090
7091         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7092         if (!msg)
7093                 return -ENOMEM;
7094
7095         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7096                                dev, dst, mpp, &pinfo) < 0) {
7097                 nlmsg_free(msg);
7098                 return -ENOBUFS;
7099         }
7100
7101         return genlmsg_reply(msg, info);
7102 }
7103
7104 static int nl80211_dump_mpp(struct sk_buff *skb,
7105                             struct netlink_callback *cb)
7106 {
7107         struct mpath_info pinfo;
7108         struct cfg80211_registered_device *rdev;
7109         struct wireless_dev *wdev;
7110         u8 dst[ETH_ALEN];
7111         u8 mpp[ETH_ALEN];
7112         int path_idx = cb->args[2];
7113         int err;
7114
7115         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7116         if (err)
7117                 return err;
7118         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7119         __acquire(&rdev->wiphy.mtx);
7120
7121         if (!rdev->ops->dump_mpp) {
7122                 err = -EOPNOTSUPP;
7123                 goto out_err;
7124         }
7125
7126         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7127                 err = -EOPNOTSUPP;
7128                 goto out_err;
7129         }
7130
7131         while (1) {
7132                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7133                                     mpp, &pinfo);
7134                 if (err == -ENOENT)
7135                         break;
7136                 if (err)
7137                         goto out_err;
7138
7139                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7140                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7141                                        wdev->netdev, dst, mpp,
7142                                        &pinfo) < 0)
7143                         goto out;
7144
7145                 path_idx++;
7146         }
7147
7148  out:
7149         cb->args[2] = path_idx;
7150         err = skb->len;
7151  out_err:
7152         wiphy_unlock(&rdev->wiphy);
7153         return err;
7154 }
7155
7156 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7157 {
7158         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7159         struct net_device *dev = info->user_ptr[1];
7160         struct wireless_dev *wdev = dev->ieee80211_ptr;
7161         struct bss_parameters params;
7162         int err;
7163
7164         memset(&params, 0, sizeof(params));
7165         /* default to not changing parameters */
7166         params.use_cts_prot = -1;
7167         params.use_short_preamble = -1;
7168         params.use_short_slot_time = -1;
7169         params.ap_isolate = -1;
7170         params.ht_opmode = -1;
7171         params.p2p_ctwindow = -1;
7172         params.p2p_opp_ps = -1;
7173
7174         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7175                 params.use_cts_prot =
7176                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7177         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7178                 params.use_short_preamble =
7179                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7180         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7181                 params.use_short_slot_time =
7182                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7183         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7184                 params.basic_rates =
7185                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7186                 params.basic_rates_len =
7187                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7188         }
7189         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7190                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7191         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7192                 params.ht_opmode =
7193                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7194
7195         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7196                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7197                         return -EINVAL;
7198                 params.p2p_ctwindow =
7199                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7200                 if (params.p2p_ctwindow != 0 &&
7201                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7202                         return -EINVAL;
7203         }
7204
7205         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7206                 u8 tmp;
7207
7208                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7209                         return -EINVAL;
7210                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7211                 params.p2p_opp_ps = tmp;
7212                 if (params.p2p_opp_ps &&
7213                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
7214                         return -EINVAL;
7215         }
7216
7217         if (!rdev->ops->change_bss)
7218                 return -EOPNOTSUPP;
7219
7220         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7221             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7222                 return -EOPNOTSUPP;
7223
7224         wdev_lock(wdev);
7225         err = rdev_change_bss(rdev, dev, &params);
7226         wdev_unlock(wdev);
7227
7228         return err;
7229 }
7230
7231 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
7232 {
7233         char *data = NULL;
7234         bool is_indoor;
7235         enum nl80211_user_reg_hint_type user_reg_hint_type;
7236         u32 owner_nlportid;
7237
7238         /*
7239          * You should only get this when cfg80211 hasn't yet initialized
7240          * completely when built-in to the kernel right between the time
7241          * window between nl80211_init() and regulatory_init(), if that is
7242          * even possible.
7243          */
7244         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
7245                 return -EINPROGRESS;
7246
7247         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
7248                 user_reg_hint_type =
7249                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
7250         else
7251                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
7252
7253         switch (user_reg_hint_type) {
7254         case NL80211_USER_REG_HINT_USER:
7255         case NL80211_USER_REG_HINT_CELL_BASE:
7256                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7257                         return -EINVAL;
7258
7259                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7260                 return regulatory_hint_user(data, user_reg_hint_type);
7261         case NL80211_USER_REG_HINT_INDOOR:
7262                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
7263                         owner_nlportid = info->snd_portid;
7264                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
7265                 } else {
7266                         owner_nlportid = 0;
7267                         is_indoor = true;
7268                 }
7269
7270                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
7271         default:
7272                 return -EINVAL;
7273         }
7274 }
7275
7276 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
7277 {
7278         return reg_reload_regdb();
7279 }
7280
7281 static int nl80211_get_mesh_config(struct sk_buff *skb,
7282                                    struct genl_info *info)
7283 {
7284         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7285         struct net_device *dev = info->user_ptr[1];
7286         struct wireless_dev *wdev = dev->ieee80211_ptr;
7287         struct mesh_config cur_params;
7288         int err = 0;
7289         void *hdr;
7290         struct nlattr *pinfoattr;
7291         struct sk_buff *msg;
7292
7293         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7294                 return -EOPNOTSUPP;
7295
7296         if (!rdev->ops->get_mesh_config)
7297                 return -EOPNOTSUPP;
7298
7299         wdev_lock(wdev);
7300         /* If not connected, get default parameters */
7301         if (!wdev->mesh_id_len)
7302                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
7303         else
7304                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
7305         wdev_unlock(wdev);
7306
7307         if (err)
7308                 return err;
7309
7310         /* Draw up a netlink message to send back */
7311         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7312         if (!msg)
7313                 return -ENOMEM;
7314         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7315                              NL80211_CMD_GET_MESH_CONFIG);
7316         if (!hdr)
7317                 goto out;
7318         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
7319         if (!pinfoattr)
7320                 goto nla_put_failure;
7321         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7322             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
7323                         cur_params.dot11MeshRetryTimeout) ||
7324             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
7325                         cur_params.dot11MeshConfirmTimeout) ||
7326             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
7327                         cur_params.dot11MeshHoldingTimeout) ||
7328             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
7329                         cur_params.dot11MeshMaxPeerLinks) ||
7330             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
7331                        cur_params.dot11MeshMaxRetries) ||
7332             nla_put_u8(msg, NL80211_MESHCONF_TTL,
7333                        cur_params.dot11MeshTTL) ||
7334             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
7335                        cur_params.element_ttl) ||
7336             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7337                        cur_params.auto_open_plinks) ||
7338             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7339                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
7340             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7341                        cur_params.dot11MeshHWMPmaxPREQretries) ||
7342             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
7343                         cur_params.path_refresh_time) ||
7344             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7345                         cur_params.min_discovery_timeout) ||
7346             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7347                         cur_params.dot11MeshHWMPactivePathTimeout) ||
7348             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7349                         cur_params.dot11MeshHWMPpreqMinInterval) ||
7350             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7351                         cur_params.dot11MeshHWMPperrMinInterval) ||
7352             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7353                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
7354             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
7355                        cur_params.dot11MeshHWMPRootMode) ||
7356             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7357                         cur_params.dot11MeshHWMPRannInterval) ||
7358             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7359                        cur_params.dot11MeshGateAnnouncementProtocol) ||
7360             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
7361                        cur_params.dot11MeshForwarding) ||
7362             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
7363                         cur_params.rssi_threshold) ||
7364             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
7365                         cur_params.ht_opmode) ||
7366             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7367                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
7368             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7369                         cur_params.dot11MeshHWMProotInterval) ||
7370             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7371                         cur_params.dot11MeshHWMPconfirmationInterval) ||
7372             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
7373                         cur_params.power_mode) ||
7374             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
7375                         cur_params.dot11MeshAwakeWindowDuration) ||
7376             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
7377                         cur_params.plink_timeout) ||
7378             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
7379                        cur_params.dot11MeshConnectedToMeshGate) ||
7380             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
7381                        cur_params.dot11MeshNolearn) ||
7382             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
7383                        cur_params.dot11MeshConnectedToAuthServer))
7384                 goto nla_put_failure;
7385         nla_nest_end(msg, pinfoattr);
7386         genlmsg_end(msg, hdr);
7387         return genlmsg_reply(msg, info);
7388
7389  nla_put_failure:
7390  out:
7391         nlmsg_free(msg);
7392         return -ENOBUFS;
7393 }
7394
7395 static const struct nla_policy
7396 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
7397         [NL80211_MESHCONF_RETRY_TIMEOUT] =
7398                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7399         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
7400                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7401         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
7402                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
7403         [NL80211_MESHCONF_MAX_PEER_LINKS] =
7404                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
7405         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
7406         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7407         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
7408         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
7409         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
7410                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
7411         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
7412         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
7413         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
7414         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
7415         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
7416                 NLA_POLICY_MIN(NLA_U16, 1),
7417         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
7418                 NLA_POLICY_MIN(NLA_U16, 1),
7419         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
7420                 NLA_POLICY_MIN(NLA_U16, 1),
7421         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
7422         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
7423                 NLA_POLICY_MIN(NLA_U16, 1),
7424         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
7425         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
7426         [NL80211_MESHCONF_RSSI_THRESHOLD] =
7427                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
7428         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
7429         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
7430         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
7431                 NLA_POLICY_MIN(NLA_U16, 1),
7432         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
7433                 NLA_POLICY_MIN(NLA_U16, 1),
7434         [NL80211_MESHCONF_POWER_MODE] =
7435                 NLA_POLICY_RANGE(NLA_U32,
7436                                  NL80211_MESH_POWER_ACTIVE,
7437                                  NL80211_MESH_POWER_MAX),
7438         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
7439         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
7440         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7441         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7442         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
7443 };
7444
7445 static const struct nla_policy
7446         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
7447         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
7448         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
7449         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
7450         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
7451         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
7452         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
7453         [NL80211_MESH_SETUP_IE] =
7454                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
7455                                        IEEE80211_MAX_DATA_LEN),
7456         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
7457 };
7458
7459 static int nl80211_parse_mesh_config(struct genl_info *info,
7460                                      struct mesh_config *cfg,
7461                                      u32 *mask_out)
7462 {
7463         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
7464         u32 mask = 0;
7465         u16 ht_opmode;
7466
7467 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
7468 do {                                                                    \
7469         if (tb[attr]) {                                                 \
7470                 cfg->param = fn(tb[attr]);                              \
7471                 mask |= BIT((attr) - 1);                                \
7472         }                                                               \
7473 } while (0)
7474
7475         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
7476                 return -EINVAL;
7477         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
7478                 return -EINVAL;
7479
7480         /* This makes sure that there aren't more than 32 mesh config
7481          * parameters (otherwise our bitfield scheme would not work.) */
7482         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
7483
7484         /* Fill in the params struct */
7485         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
7486                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
7487         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
7488                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
7489                                   nla_get_u16);
7490         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
7491                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
7492                                   nla_get_u16);
7493         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
7494                                   NL80211_MESHCONF_MAX_PEER_LINKS,
7495                                   nla_get_u16);
7496         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
7497                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
7498         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
7499                                   NL80211_MESHCONF_TTL, nla_get_u8);
7500         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
7501                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
7502         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
7503                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
7504                                   nla_get_u8);
7505         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
7506                                   mask,
7507                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
7508                                   nla_get_u32);
7509         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
7510                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
7511                                   nla_get_u8);
7512         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
7513                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
7514                                   nla_get_u32);
7515         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
7516             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
7517                 return -EINVAL;
7518         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
7519                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
7520                                   nla_get_u16);
7521         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
7522                                   mask,
7523                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
7524                                   nla_get_u32);
7525         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
7526             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
7527              cfg->dot11MeshHWMPactivePathTimeout > 65535))
7528                 return -EINVAL;
7529         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
7530                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
7531                                   nla_get_u16);
7532         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
7533                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
7534                                   nla_get_u16);
7535         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7536                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
7537                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
7538                                   nla_get_u16);
7539         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
7540                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
7541         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
7542                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
7543                                   nla_get_u16);
7544         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
7545                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
7546                                   nla_get_u8);
7547         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
7548                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
7549         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
7550                                   NL80211_MESHCONF_RSSI_THRESHOLD,
7551                                   nla_get_s32);
7552         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
7553                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
7554                                   nla_get_u8);
7555         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
7556                                   NL80211_MESHCONF_CONNECTED_TO_AS,
7557                                   nla_get_u8);
7558         /*
7559          * Check HT operation mode based on
7560          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
7561          */
7562         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
7563                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
7564
7565                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
7566                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
7567                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
7568                         return -EINVAL;
7569
7570                 /* NON_HT_STA bit is reserved, but some programs set it */
7571                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
7572
7573                 cfg->ht_opmode = ht_opmode;
7574                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
7575         }
7576         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
7577                                   dot11MeshHWMPactivePathToRootTimeout, mask,
7578                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
7579                                   nla_get_u32);
7580         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
7581             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
7582              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
7583                 return -EINVAL;
7584         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
7585                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
7586                                   nla_get_u16);
7587         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
7588                                   mask,
7589                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
7590                                   nla_get_u16);
7591         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
7592                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
7593         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
7594                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
7595         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
7596                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
7597         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
7598                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
7599         if (mask_out)
7600                 *mask_out = mask;
7601
7602         return 0;
7603
7604 #undef FILL_IN_MESH_PARAM_IF_SET
7605 }
7606
7607 static int nl80211_parse_mesh_setup(struct genl_info *info,
7608                                      struct mesh_setup *setup)
7609 {
7610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7611         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
7612
7613         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
7614                 return -EINVAL;
7615         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
7616                 return -EINVAL;
7617
7618         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
7619                 setup->sync_method =
7620                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
7621                  IEEE80211_SYNC_METHOD_VENDOR :
7622                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
7623
7624         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
7625                 setup->path_sel_proto =
7626                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
7627                  IEEE80211_PATH_PROTOCOL_VENDOR :
7628                  IEEE80211_PATH_PROTOCOL_HWMP;
7629
7630         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
7631                 setup->path_metric =
7632                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
7633                  IEEE80211_PATH_METRIC_VENDOR :
7634                  IEEE80211_PATH_METRIC_AIRTIME;
7635
7636         if (tb[NL80211_MESH_SETUP_IE]) {
7637                 struct nlattr *ieattr =
7638                         tb[NL80211_MESH_SETUP_IE];
7639                 setup->ie = nla_data(ieattr);
7640                 setup->ie_len = nla_len(ieattr);
7641         }
7642         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
7643             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
7644                 return -EINVAL;
7645         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
7646         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
7647         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
7648         if (setup->is_secure)
7649                 setup->user_mpm = true;
7650
7651         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
7652                 if (!setup->user_mpm)
7653                         return -EINVAL;
7654                 setup->auth_id =
7655                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
7656         }
7657
7658         return 0;
7659 }
7660
7661 static int nl80211_update_mesh_config(struct sk_buff *skb,
7662                                       struct genl_info *info)
7663 {
7664         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7665         struct net_device *dev = info->user_ptr[1];
7666         struct wireless_dev *wdev = dev->ieee80211_ptr;
7667         struct mesh_config cfg = {};
7668         u32 mask;
7669         int err;
7670
7671         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
7672                 return -EOPNOTSUPP;
7673
7674         if (!rdev->ops->update_mesh_config)
7675                 return -EOPNOTSUPP;
7676
7677         err = nl80211_parse_mesh_config(info, &cfg, &mask);
7678         if (err)
7679                 return err;
7680
7681         wdev_lock(wdev);
7682         if (!wdev->mesh_id_len)
7683                 err = -ENOLINK;
7684
7685         if (!err)
7686                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
7687
7688         wdev_unlock(wdev);
7689
7690         return err;
7691 }
7692
7693 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
7694                               struct sk_buff *msg)
7695 {
7696         struct nlattr *nl_reg_rules;
7697         unsigned int i;
7698
7699         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
7700             (regdom->dfs_region &&
7701              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
7702                 goto nla_put_failure;
7703
7704         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
7705         if (!nl_reg_rules)
7706                 goto nla_put_failure;
7707
7708         for (i = 0; i < regdom->n_reg_rules; i++) {
7709                 struct nlattr *nl_reg_rule;
7710                 const struct ieee80211_reg_rule *reg_rule;
7711                 const struct ieee80211_freq_range *freq_range;
7712                 const struct ieee80211_power_rule *power_rule;
7713                 unsigned int max_bandwidth_khz;
7714
7715                 reg_rule = &regdom->reg_rules[i];
7716                 freq_range = &reg_rule->freq_range;
7717                 power_rule = &reg_rule->power_rule;
7718
7719                 nl_reg_rule = nla_nest_start_noflag(msg, i);
7720                 if (!nl_reg_rule)
7721                         goto nla_put_failure;
7722
7723                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
7724                 if (!max_bandwidth_khz)
7725                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
7726                                                                   reg_rule);
7727
7728                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
7729                                 reg_rule->flags) ||
7730                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
7731                                 freq_range->start_freq_khz) ||
7732                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
7733                                 freq_range->end_freq_khz) ||
7734                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
7735                                 max_bandwidth_khz) ||
7736                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
7737                                 power_rule->max_antenna_gain) ||
7738                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
7739                                 power_rule->max_eirp) ||
7740                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
7741                                 reg_rule->dfs_cac_ms))
7742                         goto nla_put_failure;
7743
7744                 nla_nest_end(msg, nl_reg_rule);
7745         }
7746
7747         nla_nest_end(msg, nl_reg_rules);
7748         return 0;
7749
7750 nla_put_failure:
7751         return -EMSGSIZE;
7752 }
7753
7754 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
7755 {
7756         const struct ieee80211_regdomain *regdom = NULL;
7757         struct cfg80211_registered_device *rdev;
7758         struct wiphy *wiphy = NULL;
7759         struct sk_buff *msg;
7760         void *hdr;
7761
7762         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7763         if (!msg)
7764                 return -ENOBUFS;
7765
7766         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
7767                              NL80211_CMD_GET_REG);
7768         if (!hdr)
7769                 goto put_failure;
7770
7771         rtnl_lock();
7772
7773         if (info->attrs[NL80211_ATTR_WIPHY]) {
7774                 bool self_managed;
7775
7776                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
7777                 if (IS_ERR(rdev)) {
7778                         nlmsg_free(msg);
7779                         rtnl_unlock();
7780                         return PTR_ERR(rdev);
7781                 }
7782
7783                 wiphy = &rdev->wiphy;
7784                 self_managed = wiphy->regulatory_flags &
7785                                REGULATORY_WIPHY_SELF_MANAGED;
7786                 regdom = get_wiphy_regdom(wiphy);
7787
7788                 /* a self-managed-reg device must have a private regdom */
7789                 if (WARN_ON(!regdom && self_managed)) {
7790                         nlmsg_free(msg);
7791                         rtnl_unlock();
7792                         return -EINVAL;
7793                 }
7794
7795                 if (regdom &&
7796                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7797                         goto nla_put_failure;
7798         }
7799
7800         if (!wiphy && reg_last_request_cell_base() &&
7801             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7802                         NL80211_USER_REG_HINT_CELL_BASE))
7803                 goto nla_put_failure;
7804
7805         rcu_read_lock();
7806
7807         if (!regdom)
7808                 regdom = rcu_dereference(cfg80211_regdomain);
7809
7810         if (nl80211_put_regdom(regdom, msg))
7811                 goto nla_put_failure_rcu;
7812
7813         rcu_read_unlock();
7814
7815         genlmsg_end(msg, hdr);
7816         rtnl_unlock();
7817         return genlmsg_reply(msg, info);
7818
7819 nla_put_failure_rcu:
7820         rcu_read_unlock();
7821 nla_put_failure:
7822         rtnl_unlock();
7823 put_failure:
7824         nlmsg_free(msg);
7825         return -EMSGSIZE;
7826 }
7827
7828 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
7829                                u32 seq, int flags, struct wiphy *wiphy,
7830                                const struct ieee80211_regdomain *regdom)
7831 {
7832         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7833                                    NL80211_CMD_GET_REG);
7834
7835         if (!hdr)
7836                 return -1;
7837
7838         genl_dump_check_consistent(cb, hdr);
7839
7840         if (nl80211_put_regdom(regdom, msg))
7841                 goto nla_put_failure;
7842
7843         if (!wiphy && reg_last_request_cell_base() &&
7844             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
7845                         NL80211_USER_REG_HINT_CELL_BASE))
7846                 goto nla_put_failure;
7847
7848         if (wiphy &&
7849             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
7850                 goto nla_put_failure;
7851
7852         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
7853             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
7854                 goto nla_put_failure;
7855
7856         genlmsg_end(msg, hdr);
7857         return 0;
7858
7859 nla_put_failure:
7860         genlmsg_cancel(msg, hdr);
7861         return -EMSGSIZE;
7862 }
7863
7864 static int nl80211_get_reg_dump(struct sk_buff *skb,
7865                                 struct netlink_callback *cb)
7866 {
7867         const struct ieee80211_regdomain *regdom = NULL;
7868         struct cfg80211_registered_device *rdev;
7869         int err, reg_idx, start = cb->args[2];
7870
7871         rtnl_lock();
7872
7873         if (cfg80211_regdomain && start == 0) {
7874                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7875                                           NLM_F_MULTI, NULL,
7876                                           rtnl_dereference(cfg80211_regdomain));
7877                 if (err < 0)
7878                         goto out_err;
7879         }
7880
7881         /* the global regdom is idx 0 */
7882         reg_idx = 1;
7883         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
7884                 regdom = get_wiphy_regdom(&rdev->wiphy);
7885                 if (!regdom)
7886                         continue;
7887
7888                 if (++reg_idx <= start)
7889                         continue;
7890
7891                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
7892                                           NLM_F_MULTI, &rdev->wiphy, regdom);
7893                 if (err < 0) {
7894                         reg_idx--;
7895                         break;
7896                 }
7897         }
7898
7899         cb->args[2] = reg_idx;
7900         err = skb->len;
7901 out_err:
7902         rtnl_unlock();
7903         return err;
7904 }
7905
7906 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
7907 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
7908         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
7909         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
7910         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
7911         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
7912         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
7913         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
7914         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
7915 };
7916
7917 static int parse_reg_rule(struct nlattr *tb[],
7918         struct ieee80211_reg_rule *reg_rule)
7919 {
7920         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
7921         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
7922
7923         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
7924                 return -EINVAL;
7925         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
7926                 return -EINVAL;
7927         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
7928                 return -EINVAL;
7929         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
7930                 return -EINVAL;
7931         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
7932                 return -EINVAL;
7933
7934         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
7935
7936         freq_range->start_freq_khz =
7937                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
7938         freq_range->end_freq_khz =
7939                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
7940         freq_range->max_bandwidth_khz =
7941                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
7942
7943         power_rule->max_eirp =
7944                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
7945
7946         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
7947                 power_rule->max_antenna_gain =
7948                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
7949
7950         if (tb[NL80211_ATTR_DFS_CAC_TIME])
7951                 reg_rule->dfs_cac_ms =
7952                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
7953
7954         return 0;
7955 }
7956
7957 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
7958 {
7959         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
7960         struct nlattr *nl_reg_rule;
7961         char *alpha2;
7962         int rem_reg_rules, r;
7963         u32 num_rules = 0, rule_idx = 0;
7964         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
7965         struct ieee80211_regdomain *rd;
7966
7967         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
7968                 return -EINVAL;
7969
7970         if (!info->attrs[NL80211_ATTR_REG_RULES])
7971                 return -EINVAL;
7972
7973         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
7974
7975         if (info->attrs[NL80211_ATTR_DFS_REGION])
7976                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
7977
7978         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
7979                             rem_reg_rules) {
7980                 num_rules++;
7981                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
7982                         return -EINVAL;
7983         }
7984
7985         rtnl_lock();
7986         if (!reg_is_valid_request(alpha2)) {
7987                 r = -EINVAL;
7988                 goto out;
7989         }
7990
7991         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
7992         if (!rd) {
7993                 r = -ENOMEM;
7994                 goto out;
7995         }
7996
7997         rd->n_reg_rules = num_rules;
7998         rd->alpha2[0] = alpha2[0];
7999         rd->alpha2[1] = alpha2[1];
8000
8001         /*
8002          * Disable DFS master mode if the DFS region was
8003          * not supported or known on this kernel.
8004          */
8005         if (reg_supported_dfs_region(dfs_region))
8006                 rd->dfs_region = dfs_region;
8007
8008         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8009                             rem_reg_rules) {
8010                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8011                                                 nl_reg_rule, reg_rule_policy,
8012                                                 info->extack);
8013                 if (r)
8014                         goto bad_reg;
8015                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8016                 if (r)
8017                         goto bad_reg;
8018
8019                 rule_idx++;
8020
8021                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8022                         r = -EINVAL;
8023                         goto bad_reg;
8024                 }
8025         }
8026
8027         r = set_regdom(rd, REGD_SOURCE_CRDA);
8028         /* set_regdom takes ownership of rd */
8029         rd = NULL;
8030  bad_reg:
8031         kfree(rd);
8032  out:
8033         rtnl_unlock();
8034         return r;
8035 }
8036 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8037
8038 static int validate_scan_freqs(struct nlattr *freqs)
8039 {
8040         struct nlattr *attr1, *attr2;
8041         int n_channels = 0, tmp1, tmp2;
8042
8043         nla_for_each_nested(attr1, freqs, tmp1)
8044                 if (nla_len(attr1) != sizeof(u32))
8045                         return 0;
8046
8047         nla_for_each_nested(attr1, freqs, tmp1) {
8048                 n_channels++;
8049                 /*
8050                  * Some hardware has a limited channel list for
8051                  * scanning, and it is pretty much nonsensical
8052                  * to scan for a channel twice, so disallow that
8053                  * and don't require drivers to check that the
8054                  * channel list they get isn't longer than what
8055                  * they can scan, as long as they can scan all
8056                  * the channels they registered at once.
8057                  */
8058                 nla_for_each_nested(attr2, freqs, tmp2)
8059                         if (attr1 != attr2 &&
8060                             nla_get_u32(attr1) == nla_get_u32(attr2))
8061                                 return 0;
8062         }
8063
8064         return n_channels;
8065 }
8066
8067 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8068 {
8069         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8070 }
8071
8072 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8073                             struct cfg80211_bss_selection *bss_select)
8074 {
8075         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8076         struct nlattr *nest;
8077         int err;
8078         bool found = false;
8079         int i;
8080
8081         /* only process one nested attribute */
8082         nest = nla_data(nla);
8083         if (!nla_ok(nest, nla_len(nest)))
8084                 return -EINVAL;
8085
8086         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8087                                           nest, nl80211_bss_select_policy,
8088                                           NULL);
8089         if (err)
8090                 return err;
8091
8092         /* only one attribute may be given */
8093         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8094                 if (attr[i]) {
8095                         if (found)
8096                                 return -EINVAL;
8097                         found = true;
8098                 }
8099         }
8100
8101         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8102
8103         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8104                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8105
8106         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8107                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8108                 bss_select->param.band_pref =
8109                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8110                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8111                         return -EINVAL;
8112         }
8113
8114         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8115                 struct nl80211_bss_select_rssi_adjust *adj_param;
8116
8117                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8118                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8119                 bss_select->param.adjust.band = adj_param->band;
8120                 bss_select->param.adjust.delta = adj_param->delta;
8121                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8122                         return -EINVAL;
8123         }
8124
8125         /* user-space did not provide behaviour attribute */
8126         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8127                 return -EINVAL;
8128
8129         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8130                 return -EINVAL;
8131
8132         return 0;
8133 }
8134
8135 int nl80211_parse_random_mac(struct nlattr **attrs,
8136                              u8 *mac_addr, u8 *mac_addr_mask)
8137 {
8138         int i;
8139
8140         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8141                 eth_zero_addr(mac_addr);
8142                 eth_zero_addr(mac_addr_mask);
8143                 mac_addr[0] = 0x2;
8144                 mac_addr_mask[0] = 0x3;
8145
8146                 return 0;
8147         }
8148
8149         /* need both or none */
8150         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8151                 return -EINVAL;
8152
8153         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8154         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8155
8156         /* don't allow or configure an mcast address */
8157         if (!is_multicast_ether_addr(mac_addr_mask) ||
8158             is_multicast_ether_addr(mac_addr))
8159                 return -EINVAL;
8160
8161         /*
8162          * allow users to pass a MAC address that has bits set outside
8163          * of the mask, but don't bother drivers with having to deal
8164          * with such bits
8165          */
8166         for (i = 0; i < ETH_ALEN; i++)
8167                 mac_addr[i] &= mac_addr_mask[i];
8168
8169         return 0;
8170 }
8171
8172 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
8173 {
8174         ASSERT_WDEV_LOCK(wdev);
8175
8176         if (!cfg80211_beaconing_iface_active(wdev))
8177                 return true;
8178
8179         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
8180                 return true;
8181
8182         return regulatory_pre_cac_allowed(wdev->wiphy);
8183 }
8184
8185 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
8186                                     enum nl80211_ext_feature_index feat)
8187 {
8188         if (!(flags & flag))
8189                 return true;
8190         if (wiphy_ext_feature_isset(wiphy, feat))
8191                 return true;
8192         return false;
8193 }
8194
8195 static int
8196 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
8197                          void *request, struct nlattr **attrs,
8198                          bool is_sched_scan)
8199 {
8200         u8 *mac_addr, *mac_addr_mask;
8201         u32 *flags;
8202         enum nl80211_feature_flags randomness_flag;
8203
8204         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
8205                 return 0;
8206
8207         if (is_sched_scan) {
8208                 struct cfg80211_sched_scan_request *req = request;
8209
8210                 randomness_flag = wdev ?
8211                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
8212                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
8213                 flags = &req->flags;
8214                 mac_addr = req->mac_addr;
8215                 mac_addr_mask = req->mac_addr_mask;
8216         } else {
8217                 struct cfg80211_scan_request *req = request;
8218
8219                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
8220                 flags = &req->flags;
8221                 mac_addr = req->mac_addr;
8222                 mac_addr_mask = req->mac_addr_mask;
8223         }
8224
8225         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
8226
8227         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
8228              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
8229             !nl80211_check_scan_feat(wiphy, *flags,
8230                                      NL80211_SCAN_FLAG_LOW_SPAN,
8231                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
8232             !nl80211_check_scan_feat(wiphy, *flags,
8233                                      NL80211_SCAN_FLAG_LOW_POWER,
8234                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
8235             !nl80211_check_scan_feat(wiphy, *flags,
8236                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
8237                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
8238             !nl80211_check_scan_feat(wiphy, *flags,
8239                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
8240                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
8241             !nl80211_check_scan_feat(wiphy, *flags,
8242                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
8243                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
8244             !nl80211_check_scan_feat(wiphy, *flags,
8245                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
8246                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
8247             !nl80211_check_scan_feat(wiphy, *flags,
8248                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
8249                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
8250             !nl80211_check_scan_feat(wiphy, *flags,
8251                                      NL80211_SCAN_FLAG_RANDOM_SN,
8252                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
8253             !nl80211_check_scan_feat(wiphy, *flags,
8254                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
8255                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
8256                 return -EOPNOTSUPP;
8257
8258         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
8259                 int err;
8260
8261                 if (!(wiphy->features & randomness_flag) ||
8262                     (wdev && wdev->current_bss))
8263                         return -EOPNOTSUPP;
8264
8265                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
8266                 if (err)
8267                         return err;
8268         }
8269
8270         return 0;
8271 }
8272
8273 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
8274 {
8275         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8276         struct wireless_dev *wdev = info->user_ptr[1];
8277         struct cfg80211_scan_request *request;
8278         struct nlattr *scan_freqs = NULL;
8279         bool scan_freqs_khz = false;
8280         struct nlattr *attr;
8281         struct wiphy *wiphy;
8282         int err, tmp, n_ssids = 0, n_channels, i;
8283         size_t ie_len;
8284
8285         wiphy = &rdev->wiphy;
8286
8287         if (wdev->iftype == NL80211_IFTYPE_NAN)
8288                 return -EOPNOTSUPP;
8289
8290         if (!rdev->ops->scan)
8291                 return -EOPNOTSUPP;
8292
8293         if (rdev->scan_req || rdev->scan_msg)
8294                 return -EBUSY;
8295
8296         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
8297                 if (!wiphy_ext_feature_isset(wiphy,
8298                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
8299                         return -EOPNOTSUPP;
8300                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
8301                 scan_freqs_khz = true;
8302         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
8303                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
8304
8305         if (scan_freqs) {
8306                 n_channels = validate_scan_freqs(scan_freqs);
8307                 if (!n_channels)
8308                         return -EINVAL;
8309         } else {
8310                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8311         }
8312
8313         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
8314                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
8315                         n_ssids++;
8316
8317         if (n_ssids > wiphy->max_scan_ssids)
8318                 return -EINVAL;
8319
8320         if (info->attrs[NL80211_ATTR_IE])
8321                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8322         else
8323                 ie_len = 0;
8324
8325         if (ie_len > wiphy->max_scan_ie_len)
8326                 return -EINVAL;
8327
8328         request = kzalloc(sizeof(*request)
8329                         + sizeof(*request->ssids) * n_ssids
8330                         + sizeof(*request->channels) * n_channels
8331                         + ie_len, GFP_KERNEL);
8332         if (!request)
8333                 return -ENOMEM;
8334
8335         if (n_ssids)
8336                 request->ssids = (void *)&request->channels[n_channels];
8337         request->n_ssids = n_ssids;
8338         if (ie_len) {
8339                 if (n_ssids)
8340                         request->ie = (void *)(request->ssids + n_ssids);
8341                 else
8342                         request->ie = (void *)(request->channels + n_channels);
8343         }
8344
8345         i = 0;
8346         if (scan_freqs) {
8347                 /* user specified, bail out if channel not found */
8348                 nla_for_each_nested(attr, scan_freqs, tmp) {
8349                         struct ieee80211_channel *chan;
8350                         int freq = nla_get_u32(attr);
8351
8352                         if (!scan_freqs_khz)
8353                                 freq = MHZ_TO_KHZ(freq);
8354
8355                         chan = ieee80211_get_channel_khz(wiphy, freq);
8356                         if (!chan) {
8357                                 err = -EINVAL;
8358                                 goto out_free;
8359                         }
8360
8361                         /* ignore disabled channels */
8362                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8363                                 continue;
8364
8365                         request->channels[i] = chan;
8366                         i++;
8367                 }
8368         } else {
8369                 enum nl80211_band band;
8370
8371                 /* all channels */
8372                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8373                         int j;
8374
8375                         if (!wiphy->bands[band])
8376                                 continue;
8377                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8378                                 struct ieee80211_channel *chan;
8379
8380                                 chan = &wiphy->bands[band]->channels[j];
8381
8382                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8383                                         continue;
8384
8385                                 request->channels[i] = chan;
8386                                 i++;
8387                         }
8388                 }
8389         }
8390
8391         if (!i) {
8392                 err = -EINVAL;
8393                 goto out_free;
8394         }
8395
8396         request->n_channels = i;
8397
8398         wdev_lock(wdev);
8399         if (!cfg80211_off_channel_oper_allowed(wdev)) {
8400                 struct ieee80211_channel *chan;
8401
8402                 if (request->n_channels != 1) {
8403                         wdev_unlock(wdev);
8404                         err = -EBUSY;
8405                         goto out_free;
8406                 }
8407
8408                 chan = request->channels[0];
8409                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
8410                         wdev_unlock(wdev);
8411                         err = -EBUSY;
8412                         goto out_free;
8413                 }
8414         }
8415         wdev_unlock(wdev);
8416
8417         i = 0;
8418         if (n_ssids) {
8419                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
8420                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8421                                 err = -EINVAL;
8422                                 goto out_free;
8423                         }
8424                         request->ssids[i].ssid_len = nla_len(attr);
8425                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
8426                         i++;
8427                 }
8428         }
8429
8430         if (info->attrs[NL80211_ATTR_IE]) {
8431                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8432                 memcpy((void *)request->ie,
8433                        nla_data(info->attrs[NL80211_ATTR_IE]),
8434                        request->ie_len);
8435         }
8436
8437         for (i = 0; i < NUM_NL80211_BANDS; i++)
8438                 if (wiphy->bands[i])
8439                         request->rates[i] =
8440                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
8441
8442         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
8443                 nla_for_each_nested(attr,
8444                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
8445                                     tmp) {
8446                         enum nl80211_band band = nla_type(attr);
8447
8448                         if (band < 0 || band >= NUM_NL80211_BANDS) {
8449                                 err = -EINVAL;
8450                                 goto out_free;
8451                         }
8452
8453                         if (!wiphy->bands[band])
8454                                 continue;
8455
8456                         err = ieee80211_get_ratemask(wiphy->bands[band],
8457                                                      nla_data(attr),
8458                                                      nla_len(attr),
8459                                                      &request->rates[band]);
8460                         if (err)
8461                                 goto out_free;
8462                 }
8463         }
8464
8465         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
8466                 request->duration =
8467                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
8468                 request->duration_mandatory =
8469                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
8470         }
8471
8472         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
8473                                        false);
8474         if (err)
8475                 goto out_free;
8476
8477         request->no_cck =
8478                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
8479
8480         /* Initial implementation used NL80211_ATTR_MAC to set the specific
8481          * BSSID to scan for. This was problematic because that same attribute
8482          * was already used for another purpose (local random MAC address). The
8483          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
8484          * compatibility with older userspace components, also use the
8485          * NL80211_ATTR_MAC value here if it can be determined to be used for
8486          * the specific BSSID use case instead of the random MAC address
8487          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
8488          */
8489         if (info->attrs[NL80211_ATTR_BSSID])
8490                 memcpy(request->bssid,
8491                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
8492         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
8493                  info->attrs[NL80211_ATTR_MAC])
8494                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
8495                        ETH_ALEN);
8496         else
8497                 eth_broadcast_addr(request->bssid);
8498
8499         request->wdev = wdev;
8500         request->wiphy = &rdev->wiphy;
8501         request->scan_start = jiffies;
8502
8503         rdev->scan_req = request;
8504         err = cfg80211_scan(rdev);
8505
8506         if (err)
8507                 goto out_free;
8508
8509         nl80211_send_scan_start(rdev, wdev);
8510         dev_hold(wdev->netdev);
8511
8512         return 0;
8513
8514  out_free:
8515         rdev->scan_req = NULL;
8516         kfree(request);
8517
8518         return err;
8519 }
8520
8521 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
8522 {
8523         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8524         struct wireless_dev *wdev = info->user_ptr[1];
8525
8526         if (!rdev->ops->abort_scan)
8527                 return -EOPNOTSUPP;
8528
8529         if (rdev->scan_msg)
8530                 return 0;
8531
8532         if (!rdev->scan_req)
8533                 return -ENOENT;
8534
8535         rdev_abort_scan(rdev, wdev);
8536         return 0;
8537 }
8538
8539 static int
8540 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
8541                                struct cfg80211_sched_scan_request *request,
8542                                struct nlattr **attrs)
8543 {
8544         int tmp, err, i = 0;
8545         struct nlattr *attr;
8546
8547         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8548                 u32 interval;
8549
8550                 /*
8551                  * If scan plans are not specified,
8552                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
8553                  * case one scan plan will be set with the specified scan
8554                  * interval and infinite number of iterations.
8555                  */
8556                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
8557                 if (!interval)
8558                         return -EINVAL;
8559
8560                 request->scan_plans[0].interval =
8561                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
8562                 if (!request->scan_plans[0].interval)
8563                         return -EINVAL;
8564
8565                 if (request->scan_plans[0].interval >
8566                     wiphy->max_sched_scan_plan_interval)
8567                         request->scan_plans[0].interval =
8568                                 wiphy->max_sched_scan_plan_interval;
8569
8570                 return 0;
8571         }
8572
8573         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
8574                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
8575
8576                 if (WARN_ON(i >= n_plans))
8577                         return -EINVAL;
8578
8579                 err = nla_parse_nested_deprecated(plan,
8580                                                   NL80211_SCHED_SCAN_PLAN_MAX,
8581                                                   attr, nl80211_plan_policy,
8582                                                   NULL);
8583                 if (err)
8584                         return err;
8585
8586                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
8587                         return -EINVAL;
8588
8589                 request->scan_plans[i].interval =
8590                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
8591                 if (!request->scan_plans[i].interval ||
8592                     request->scan_plans[i].interval >
8593                     wiphy->max_sched_scan_plan_interval)
8594                         return -EINVAL;
8595
8596                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
8597                         request->scan_plans[i].iterations =
8598                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
8599                         if (!request->scan_plans[i].iterations ||
8600                             (request->scan_plans[i].iterations >
8601                              wiphy->max_sched_scan_plan_iterations))
8602                                 return -EINVAL;
8603                 } else if (i < n_plans - 1) {
8604                         /*
8605                          * All scan plans but the last one must specify
8606                          * a finite number of iterations
8607                          */
8608                         return -EINVAL;
8609                 }
8610
8611                 i++;
8612         }
8613
8614         /*
8615          * The last scan plan must not specify the number of
8616          * iterations, it is supposed to run infinitely
8617          */
8618         if (request->scan_plans[n_plans - 1].iterations)
8619                 return  -EINVAL;
8620
8621         return 0;
8622 }
8623
8624 static int
8625 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
8626                                        struct cfg80211_match_set *match_sets,
8627                                        struct nlattr *tb_band_rssi,
8628                                        s32 rssi_thold)
8629 {
8630         struct nlattr *attr;
8631         int i, tmp, ret = 0;
8632
8633         if (!wiphy_ext_feature_isset(wiphy,
8634                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
8635                 if (tb_band_rssi)
8636                         ret = -EOPNOTSUPP;
8637                 else
8638                         for (i = 0; i < NUM_NL80211_BANDS; i++)
8639                                 match_sets->per_band_rssi_thold[i] =
8640                                         NL80211_SCAN_RSSI_THOLD_OFF;
8641                 return ret;
8642         }
8643
8644         for (i = 0; i < NUM_NL80211_BANDS; i++)
8645                 match_sets->per_band_rssi_thold[i] = rssi_thold;
8646
8647         nla_for_each_nested(attr, tb_band_rssi, tmp) {
8648                 enum nl80211_band band = nla_type(attr);
8649
8650                 if (band < 0 || band >= NUM_NL80211_BANDS)
8651                         return -EINVAL;
8652
8653                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
8654         }
8655
8656         return 0;
8657 }
8658
8659 static struct cfg80211_sched_scan_request *
8660 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
8661                          struct nlattr **attrs, int max_match_sets)
8662 {
8663         struct cfg80211_sched_scan_request *request;
8664         struct nlattr *attr;
8665         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
8666         enum nl80211_band band;
8667         size_t ie_len;
8668         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
8669         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
8670
8671         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8672                 n_channels = validate_scan_freqs(
8673                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
8674                 if (!n_channels)
8675                         return ERR_PTR(-EINVAL);
8676         } else {
8677                 n_channels = ieee80211_get_num_supported_channels(wiphy);
8678         }
8679
8680         if (attrs[NL80211_ATTR_SCAN_SSIDS])
8681                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8682                                     tmp)
8683                         n_ssids++;
8684
8685         if (n_ssids > wiphy->max_sched_scan_ssids)
8686                 return ERR_PTR(-EINVAL);
8687
8688         /*
8689          * First, count the number of 'real' matchsets. Due to an issue with
8690          * the old implementation, matchsets containing only the RSSI attribute
8691          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
8692          * RSSI for all matchsets, rather than their own matchset for reporting
8693          * all APs with a strong RSSI. This is needed to be compatible with
8694          * older userspace that treated a matchset with only the RSSI as the
8695          * global RSSI for all other matchsets - if there are other matchsets.
8696          */
8697         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8698                 nla_for_each_nested(attr,
8699                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8700                                     tmp) {
8701                         struct nlattr *rssi;
8702
8703                         err = nla_parse_nested_deprecated(tb,
8704                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8705                                                           attr,
8706                                                           nl80211_match_policy,
8707                                                           NULL);
8708                         if (err)
8709                                 return ERR_PTR(err);
8710
8711                         /* SSID and BSSID are mutually exclusive */
8712                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
8713                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
8714                                 return ERR_PTR(-EINVAL);
8715
8716                         /* add other standalone attributes here */
8717                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
8718                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
8719                                 n_match_sets++;
8720                                 continue;
8721                         }
8722                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8723                         if (rssi)
8724                                 default_match_rssi = nla_get_s32(rssi);
8725                 }
8726         }
8727
8728         /* However, if there's no other matchset, add the RSSI one */
8729         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
8730                 n_match_sets = 1;
8731
8732         if (n_match_sets > max_match_sets)
8733                 return ERR_PTR(-EINVAL);
8734
8735         if (attrs[NL80211_ATTR_IE])
8736                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
8737         else
8738                 ie_len = 0;
8739
8740         if (ie_len > wiphy->max_sched_scan_ie_len)
8741                 return ERR_PTR(-EINVAL);
8742
8743         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
8744                 /*
8745                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
8746                  * each scan plan already specifies its own interval
8747                  */
8748                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8749                         return ERR_PTR(-EINVAL);
8750
8751                 nla_for_each_nested(attr,
8752                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
8753                         n_plans++;
8754         } else {
8755                 /*
8756                  * The scan interval attribute is kept for backward
8757                  * compatibility. If no scan plans are specified and sched scan
8758                  * interval is specified, one scan plan will be set with this
8759                  * scan interval and infinite number of iterations.
8760                  */
8761                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
8762                         return ERR_PTR(-EINVAL);
8763
8764                 n_plans = 1;
8765         }
8766
8767         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
8768                 return ERR_PTR(-EINVAL);
8769
8770         if (!wiphy_ext_feature_isset(
8771                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
8772             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
8773              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
8774                 return ERR_PTR(-EINVAL);
8775
8776         request = kzalloc(sizeof(*request)
8777                         + sizeof(*request->ssids) * n_ssids
8778                         + sizeof(*request->match_sets) * n_match_sets
8779                         + sizeof(*request->scan_plans) * n_plans
8780                         + sizeof(*request->channels) * n_channels
8781                         + ie_len, GFP_KERNEL);
8782         if (!request)
8783                 return ERR_PTR(-ENOMEM);
8784
8785         if (n_ssids)
8786                 request->ssids = (void *)&request->channels[n_channels];
8787         request->n_ssids = n_ssids;
8788         if (ie_len) {
8789                 if (n_ssids)
8790                         request->ie = (void *)(request->ssids + n_ssids);
8791                 else
8792                         request->ie = (void *)(request->channels + n_channels);
8793         }
8794
8795         if (n_match_sets) {
8796                 if (request->ie)
8797                         request->match_sets = (void *)(request->ie + ie_len);
8798                 else if (n_ssids)
8799                         request->match_sets =
8800                                 (void *)(request->ssids + n_ssids);
8801                 else
8802                         request->match_sets =
8803                                 (void *)(request->channels + n_channels);
8804         }
8805         request->n_match_sets = n_match_sets;
8806
8807         if (n_match_sets)
8808                 request->scan_plans = (void *)(request->match_sets +
8809                                                n_match_sets);
8810         else if (request->ie)
8811                 request->scan_plans = (void *)(request->ie + ie_len);
8812         else if (n_ssids)
8813                 request->scan_plans = (void *)(request->ssids + n_ssids);
8814         else
8815                 request->scan_plans = (void *)(request->channels + n_channels);
8816
8817         request->n_scan_plans = n_plans;
8818
8819         i = 0;
8820         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
8821                 /* user specified, bail out if channel not found */
8822                 nla_for_each_nested(attr,
8823                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
8824                                     tmp) {
8825                         struct ieee80211_channel *chan;
8826
8827                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
8828
8829                         if (!chan) {
8830                                 err = -EINVAL;
8831                                 goto out_free;
8832                         }
8833
8834                         /* ignore disabled channels */
8835                         if (chan->flags & IEEE80211_CHAN_DISABLED)
8836                                 continue;
8837
8838                         request->channels[i] = chan;
8839                         i++;
8840                 }
8841         } else {
8842                 /* all channels */
8843                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
8844                         int j;
8845
8846                         if (!wiphy->bands[band])
8847                                 continue;
8848                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
8849                                 struct ieee80211_channel *chan;
8850
8851                                 chan = &wiphy->bands[band]->channels[j];
8852
8853                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
8854                                         continue;
8855
8856                                 request->channels[i] = chan;
8857                                 i++;
8858                         }
8859                 }
8860         }
8861
8862         if (!i) {
8863                 err = -EINVAL;
8864                 goto out_free;
8865         }
8866
8867         request->n_channels = i;
8868
8869         i = 0;
8870         if (n_ssids) {
8871                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
8872                                     tmp) {
8873                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
8874                                 err = -EINVAL;
8875                                 goto out_free;
8876                         }
8877                         request->ssids[i].ssid_len = nla_len(attr);
8878                         memcpy(request->ssids[i].ssid, nla_data(attr),
8879                                nla_len(attr));
8880                         i++;
8881                 }
8882         }
8883
8884         i = 0;
8885         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
8886                 nla_for_each_nested(attr,
8887                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
8888                                     tmp) {
8889                         struct nlattr *ssid, *bssid, *rssi;
8890
8891                         err = nla_parse_nested_deprecated(tb,
8892                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
8893                                                           attr,
8894                                                           nl80211_match_policy,
8895                                                           NULL);
8896                         if (err)
8897                                 goto out_free;
8898                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
8899                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
8900
8901                         if (!ssid && !bssid) {
8902                                 i++;
8903                                 continue;
8904                         }
8905
8906                         if (WARN_ON(i >= n_match_sets)) {
8907                                 /* this indicates a programming error,
8908                                  * the loop above should have verified
8909                                  * things properly
8910                                  */
8911                                 err = -EINVAL;
8912                                 goto out_free;
8913                         }
8914
8915                         if (ssid) {
8916                                 memcpy(request->match_sets[i].ssid.ssid,
8917                                        nla_data(ssid), nla_len(ssid));
8918                                 request->match_sets[i].ssid.ssid_len =
8919                                         nla_len(ssid);
8920                         }
8921                         if (bssid)
8922                                 memcpy(request->match_sets[i].bssid,
8923                                        nla_data(bssid), ETH_ALEN);
8924
8925                         /* special attribute - old implementation w/a */
8926                         request->match_sets[i].rssi_thold = default_match_rssi;
8927                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
8928                         if (rssi)
8929                                 request->match_sets[i].rssi_thold =
8930                                         nla_get_s32(rssi);
8931
8932                         /* Parse per band RSSI attribute */
8933                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
8934                                 &request->match_sets[i],
8935                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
8936                                 request->match_sets[i].rssi_thold);
8937                         if (err)
8938                                 goto out_free;
8939
8940                         i++;
8941                 }
8942
8943                 /* there was no other matchset, so the RSSI one is alone */
8944                 if (i == 0 && n_match_sets)
8945                         request->match_sets[0].rssi_thold = default_match_rssi;
8946
8947                 request->min_rssi_thold = INT_MAX;
8948                 for (i = 0; i < n_match_sets; i++)
8949                         request->min_rssi_thold =
8950                                 min(request->match_sets[i].rssi_thold,
8951                                     request->min_rssi_thold);
8952         } else {
8953                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
8954         }
8955
8956         if (ie_len) {
8957                 request->ie_len = ie_len;
8958                 memcpy((void *)request->ie,
8959                        nla_data(attrs[NL80211_ATTR_IE]),
8960                        request->ie_len);
8961         }
8962
8963         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
8964         if (err)
8965                 goto out_free;
8966
8967         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
8968                 request->delay =
8969                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
8970
8971         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
8972                 request->relative_rssi = nla_get_s8(
8973                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
8974                 request->relative_rssi_set = true;
8975         }
8976
8977         if (request->relative_rssi_set &&
8978             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
8979                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
8980
8981                 rssi_adjust = nla_data(
8982                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
8983                 request->rssi_adjust.band = rssi_adjust->band;
8984                 request->rssi_adjust.delta = rssi_adjust->delta;
8985                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
8986                         err = -EINVAL;
8987                         goto out_free;
8988                 }
8989         }
8990
8991         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
8992         if (err)
8993                 goto out_free;
8994
8995         request->scan_start = jiffies;
8996
8997         return request;
8998
8999 out_free:
9000         kfree(request);
9001         return ERR_PTR(err);
9002 }
9003
9004 static int nl80211_start_sched_scan(struct sk_buff *skb,
9005                                     struct genl_info *info)
9006 {
9007         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9008         struct net_device *dev = info->user_ptr[1];
9009         struct wireless_dev *wdev = dev->ieee80211_ptr;
9010         struct cfg80211_sched_scan_request *sched_scan_req;
9011         bool want_multi;
9012         int err;
9013
9014         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9015                 return -EOPNOTSUPP;
9016
9017         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9018         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9019         if (err)
9020                 return err;
9021
9022         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9023                                                   info->attrs,
9024                                                   rdev->wiphy.max_match_sets);
9025
9026         err = PTR_ERR_OR_ZERO(sched_scan_req);
9027         if (err)
9028                 goto out_err;
9029
9030         /* leave request id zero for legacy request
9031          * or if driver does not support multi-scheduled scan
9032          */
9033         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9034                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9035
9036         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9037         if (err)
9038                 goto out_free;
9039
9040         sched_scan_req->dev = dev;
9041         sched_scan_req->wiphy = &rdev->wiphy;
9042
9043         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9044                 sched_scan_req->owner_nlportid = info->snd_portid;
9045
9046         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9047
9048         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9049         return 0;
9050
9051 out_free:
9052         kfree(sched_scan_req);
9053 out_err:
9054         return err;
9055 }
9056
9057 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9058                                    struct genl_info *info)
9059 {
9060         struct cfg80211_sched_scan_request *req;
9061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9062         u64 cookie;
9063
9064         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9065                 return -EOPNOTSUPP;
9066
9067         if (info->attrs[NL80211_ATTR_COOKIE]) {
9068                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9069                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9070         }
9071
9072         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9073                                      struct cfg80211_sched_scan_request,
9074                                      list);
9075         if (!req || req->reqid ||
9076             (req->owner_nlportid &&
9077              req->owner_nlportid != info->snd_portid))
9078                 return -ENOENT;
9079
9080         return cfg80211_stop_sched_scan_req(rdev, req, false);
9081 }
9082
9083 static int nl80211_start_radar_detection(struct sk_buff *skb,
9084                                          struct genl_info *info)
9085 {
9086         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9087         struct net_device *dev = info->user_ptr[1];
9088         struct wireless_dev *wdev = dev->ieee80211_ptr;
9089         struct wiphy *wiphy = wdev->wiphy;
9090         struct cfg80211_chan_def chandef;
9091         enum nl80211_dfs_regions dfs_region;
9092         unsigned int cac_time_ms;
9093         int err;
9094
9095         dfs_region = reg_get_dfs_region(wiphy);
9096         if (dfs_region == NL80211_DFS_UNSET)
9097                 return -EINVAL;
9098
9099         err = nl80211_parse_chandef(rdev, info, &chandef);
9100         if (err)
9101                 return err;
9102
9103         if (netif_carrier_ok(dev))
9104                 return -EBUSY;
9105
9106         if (wdev->cac_started)
9107                 return -EBUSY;
9108
9109         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9110         if (err < 0)
9111                 return err;
9112
9113         if (err == 0)
9114                 return -EINVAL;
9115
9116         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
9117                 return -EINVAL;
9118
9119         /* CAC start is offloaded to HW and can't be started manually */
9120         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
9121                 return -EOPNOTSUPP;
9122
9123         if (!rdev->ops->start_radar_detection)
9124                 return -EOPNOTSUPP;
9125
9126         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9127         if (WARN_ON(!cac_time_ms))
9128                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9129
9130         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9131         if (!err) {
9132                 wdev->chandef = chandef;
9133                 wdev->cac_started = true;
9134                 wdev->cac_start_time = jiffies;
9135                 wdev->cac_time_ms = cac_time_ms;
9136         }
9137         return err;
9138 }
9139
9140 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9141                                           struct genl_info *info)
9142 {
9143         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9144         struct net_device *dev = info->user_ptr[1];
9145         struct wireless_dev *wdev = dev->ieee80211_ptr;
9146         struct wiphy *wiphy = wdev->wiphy;
9147         struct cfg80211_chan_def chandef;
9148         enum nl80211_dfs_regions dfs_region;
9149         int err;
9150
9151         dfs_region = reg_get_dfs_region(wiphy);
9152         if (dfs_region == NL80211_DFS_UNSET) {
9153                 GENL_SET_ERR_MSG(info,
9154                                  "DFS Region is not set. Unexpected Radar indication");
9155                 return -EINVAL;
9156         }
9157
9158         err = nl80211_parse_chandef(rdev, info, &chandef);
9159         if (err) {
9160                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
9161                 return err;
9162         }
9163
9164         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9165         if (err < 0) {
9166                 GENL_SET_ERR_MSG(info, "chandef is invalid");
9167                 return err;
9168         }
9169
9170         if (err == 0) {
9171                 GENL_SET_ERR_MSG(info,
9172                                  "Unexpected Radar indication for chandef/iftype");
9173                 return -EINVAL;
9174         }
9175
9176         /* Do not process this notification if radar is already detected
9177          * by kernel on this channel, and return success.
9178          */
9179         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
9180                 return 0;
9181
9182         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
9183
9184         cfg80211_sched_dfs_chan_update(rdev);
9185
9186         rdev->radar_chandef = chandef;
9187
9188         /* Propagate this notification to other radios as well */
9189         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
9190
9191         return 0;
9192 }
9193
9194 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
9195 {
9196         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9197         struct net_device *dev = info->user_ptr[1];
9198         struct wireless_dev *wdev = dev->ieee80211_ptr;
9199         struct cfg80211_csa_settings params;
9200         struct nlattr **csa_attrs = NULL;
9201         int err;
9202         bool need_new_beacon = false;
9203         bool need_handle_dfs_flag = true;
9204         int len, i;
9205         u32 cs_count;
9206
9207         if (!rdev->ops->channel_switch ||
9208             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
9209                 return -EOPNOTSUPP;
9210
9211         switch (dev->ieee80211_ptr->iftype) {
9212         case NL80211_IFTYPE_AP:
9213         case NL80211_IFTYPE_P2P_GO:
9214                 need_new_beacon = true;
9215                 /* For all modes except AP the handle_dfs flag needs to be
9216                  * supplied to tell the kernel that userspace will handle radar
9217                  * events when they happen. Otherwise a switch to a channel
9218                  * requiring DFS will be rejected.
9219                  */
9220                 need_handle_dfs_flag = false;
9221
9222                 /* useless if AP is not running */
9223                 if (!wdev->beacon_interval)
9224                         return -ENOTCONN;
9225                 break;
9226         case NL80211_IFTYPE_ADHOC:
9227                 if (!wdev->ssid_len)
9228                         return -ENOTCONN;
9229                 break;
9230         case NL80211_IFTYPE_MESH_POINT:
9231                 if (!wdev->mesh_id_len)
9232                         return -ENOTCONN;
9233                 break;
9234         default:
9235                 return -EOPNOTSUPP;
9236         }
9237
9238         memset(&params, 0, sizeof(params));
9239         params.beacon_csa.ftm_responder = -1;
9240
9241         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9242             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
9243                 return -EINVAL;
9244
9245         /* only important for AP, IBSS and mesh create IEs internally */
9246         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
9247                 return -EINVAL;
9248
9249         /* Even though the attribute is u32, the specification says
9250          * u8, so let's make sure we don't overflow.
9251          */
9252         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
9253         if (cs_count > 255)
9254                 return -EINVAL;
9255
9256         params.count = cs_count;
9257
9258         if (!need_new_beacon)
9259                 goto skip_beacons;
9260
9261         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
9262         if (err)
9263                 return err;
9264
9265         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
9266                             GFP_KERNEL);
9267         if (!csa_attrs)
9268                 return -ENOMEM;
9269
9270         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
9271                                           info->attrs[NL80211_ATTR_CSA_IES],
9272                                           nl80211_policy, info->extack);
9273         if (err)
9274                 goto free;
9275
9276         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
9277         if (err)
9278                 goto free;
9279
9280         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
9281                 err = -EINVAL;
9282                 goto free;
9283         }
9284
9285         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9286         if (!len || (len % sizeof(u16))) {
9287                 err = -EINVAL;
9288                 goto free;
9289         }
9290
9291         params.n_counter_offsets_beacon = len / sizeof(u16);
9292         if (rdev->wiphy.max_num_csa_counters &&
9293             (params.n_counter_offsets_beacon >
9294              rdev->wiphy.max_num_csa_counters)) {
9295                 err = -EINVAL;
9296                 goto free;
9297         }
9298
9299         params.counter_offsets_beacon =
9300                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
9301
9302         /* sanity checks - counters should fit and be the same */
9303         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
9304                 u16 offset = params.counter_offsets_beacon[i];
9305
9306                 if (offset >= params.beacon_csa.tail_len) {
9307                         err = -EINVAL;
9308                         goto free;
9309                 }
9310
9311                 if (params.beacon_csa.tail[offset] != params.count) {
9312                         err = -EINVAL;
9313                         goto free;
9314                 }
9315         }
9316
9317         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
9318                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9319                 if (!len || (len % sizeof(u16))) {
9320                         err = -EINVAL;
9321                         goto free;
9322                 }
9323
9324                 params.n_counter_offsets_presp = len / sizeof(u16);
9325                 if (rdev->wiphy.max_num_csa_counters &&
9326                     (params.n_counter_offsets_presp >
9327                      rdev->wiphy.max_num_csa_counters)) {
9328                         err = -EINVAL;
9329                         goto free;
9330                 }
9331
9332                 params.counter_offsets_presp =
9333                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
9334
9335                 /* sanity checks - counters should fit and be the same */
9336                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
9337                         u16 offset = params.counter_offsets_presp[i];
9338
9339                         if (offset >= params.beacon_csa.probe_resp_len) {
9340                                 err = -EINVAL;
9341                                 goto free;
9342                         }
9343
9344                         if (params.beacon_csa.probe_resp[offset] !=
9345                             params.count) {
9346                                 err = -EINVAL;
9347                                 goto free;
9348                         }
9349                 }
9350         }
9351
9352 skip_beacons:
9353         err = nl80211_parse_chandef(rdev, info, &params.chandef);
9354         if (err)
9355                 goto free;
9356
9357         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
9358                                            wdev->iftype)) {
9359                 err = -EINVAL;
9360                 goto free;
9361         }
9362
9363         err = cfg80211_chandef_dfs_required(wdev->wiphy,
9364                                             &params.chandef,
9365                                             wdev->iftype);
9366         if (err < 0)
9367                 goto free;
9368
9369         if (err > 0) {
9370                 params.radar_required = true;
9371                 if (need_handle_dfs_flag &&
9372                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
9373                         err = -EINVAL;
9374                         goto free;
9375                 }
9376         }
9377
9378         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
9379                 params.block_tx = true;
9380
9381         wdev_lock(wdev);
9382         err = rdev_channel_switch(rdev, dev, &params);
9383         wdev_unlock(wdev);
9384
9385 free:
9386         kfree(csa_attrs);
9387         return err;
9388 }
9389
9390 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
9391                             u32 seq, int flags,
9392                             struct cfg80211_registered_device *rdev,
9393                             struct wireless_dev *wdev,
9394                             struct cfg80211_internal_bss *intbss)
9395 {
9396         struct cfg80211_bss *res = &intbss->pub;
9397         const struct cfg80211_bss_ies *ies;
9398         void *hdr;
9399         struct nlattr *bss;
9400
9401         ASSERT_WDEV_LOCK(wdev);
9402
9403         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
9404                              NL80211_CMD_NEW_SCAN_RESULTS);
9405         if (!hdr)
9406                 return -1;
9407
9408         genl_dump_check_consistent(cb, hdr);
9409
9410         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
9411                 goto nla_put_failure;
9412         if (wdev->netdev &&
9413             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
9414                 goto nla_put_failure;
9415         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
9416                               NL80211_ATTR_PAD))
9417                 goto nla_put_failure;
9418
9419         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
9420         if (!bss)
9421                 goto nla_put_failure;
9422         if ((!is_zero_ether_addr(res->bssid) &&
9423              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
9424                 goto nla_put_failure;
9425
9426         rcu_read_lock();
9427         /* indicate whether we have probe response data or not */
9428         if (rcu_access_pointer(res->proberesp_ies) &&
9429             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
9430                 goto fail_unlock_rcu;
9431
9432         /* this pointer prefers to be pointed to probe response data
9433          * but is always valid
9434          */
9435         ies = rcu_dereference(res->ies);
9436         if (ies) {
9437                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
9438                                       NL80211_BSS_PAD))
9439                         goto fail_unlock_rcu;
9440                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
9441                                         ies->len, ies->data))
9442                         goto fail_unlock_rcu;
9443         }
9444
9445         /* and this pointer is always (unless driver didn't know) beacon data */
9446         ies = rcu_dereference(res->beacon_ies);
9447         if (ies && ies->from_beacon) {
9448                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
9449                                       NL80211_BSS_PAD))
9450                         goto fail_unlock_rcu;
9451                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
9452                                         ies->len, ies->data))
9453                         goto fail_unlock_rcu;
9454         }
9455         rcu_read_unlock();
9456
9457         if (res->beacon_interval &&
9458             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
9459                 goto nla_put_failure;
9460         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
9461             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
9462             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
9463                         res->channel->freq_offset) ||
9464             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
9465             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
9466                         jiffies_to_msecs(jiffies - intbss->ts)))
9467                 goto nla_put_failure;
9468
9469         if (intbss->parent_tsf &&
9470             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
9471                                intbss->parent_tsf, NL80211_BSS_PAD) ||
9472              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
9473                      intbss->parent_bssid)))
9474                 goto nla_put_failure;
9475
9476         if (intbss->ts_boottime &&
9477             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
9478                               intbss->ts_boottime, NL80211_BSS_PAD))
9479                 goto nla_put_failure;
9480
9481         if (!nl80211_put_signal(msg, intbss->pub.chains,
9482                                 intbss->pub.chain_signal,
9483                                 NL80211_BSS_CHAIN_SIGNAL))
9484                 goto nla_put_failure;
9485
9486         switch (rdev->wiphy.signal_type) {
9487         case CFG80211_SIGNAL_TYPE_MBM:
9488                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
9489                         goto nla_put_failure;
9490                 break;
9491         case CFG80211_SIGNAL_TYPE_UNSPEC:
9492                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
9493                         goto nla_put_failure;
9494                 break;
9495         default:
9496                 break;
9497         }
9498
9499         switch (wdev->iftype) {
9500         case NL80211_IFTYPE_P2P_CLIENT:
9501         case NL80211_IFTYPE_STATION:
9502                 if (intbss == wdev->current_bss &&
9503                     nla_put_u32(msg, NL80211_BSS_STATUS,
9504                                 NL80211_BSS_STATUS_ASSOCIATED))
9505                         goto nla_put_failure;
9506                 break;
9507         case NL80211_IFTYPE_ADHOC:
9508                 if (intbss == wdev->current_bss &&
9509                     nla_put_u32(msg, NL80211_BSS_STATUS,
9510                                 NL80211_BSS_STATUS_IBSS_JOINED))
9511                         goto nla_put_failure;
9512                 break;
9513         default:
9514                 break;
9515         }
9516
9517         nla_nest_end(msg, bss);
9518
9519         genlmsg_end(msg, hdr);
9520         return 0;
9521
9522  fail_unlock_rcu:
9523         rcu_read_unlock();
9524  nla_put_failure:
9525         genlmsg_cancel(msg, hdr);
9526         return -EMSGSIZE;
9527 }
9528
9529 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
9530 {
9531         struct cfg80211_registered_device *rdev;
9532         struct cfg80211_internal_bss *scan;
9533         struct wireless_dev *wdev;
9534         int start = cb->args[2], idx = 0;
9535         int err;
9536
9537         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
9538         if (err)
9539                 return err;
9540         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9541         __acquire(&rdev->wiphy.mtx);
9542
9543         wdev_lock(wdev);
9544         spin_lock_bh(&rdev->bss_lock);
9545
9546         /*
9547          * dump_scan will be called multiple times to break up the scan results
9548          * into multiple messages.  It is unlikely that any more bss-es will be
9549          * expired after the first call, so only call only call this on the
9550          * first dump_scan invocation.
9551          */
9552         if (start == 0)
9553                 cfg80211_bss_expire(rdev);
9554
9555         cb->seq = rdev->bss_generation;
9556
9557         list_for_each_entry(scan, &rdev->bss_list, list) {
9558                 if (++idx <= start)
9559                         continue;
9560                 if (nl80211_send_bss(skb, cb,
9561                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9562                                 rdev, wdev, scan) < 0) {
9563                         idx--;
9564                         break;
9565                 }
9566         }
9567
9568         spin_unlock_bh(&rdev->bss_lock);
9569         wdev_unlock(wdev);
9570
9571         cb->args[2] = idx;
9572         wiphy_unlock(&rdev->wiphy);
9573
9574         return skb->len;
9575 }
9576
9577 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
9578                                int flags, struct net_device *dev,
9579                                bool allow_radio_stats,
9580                                struct survey_info *survey)
9581 {
9582         void *hdr;
9583         struct nlattr *infoattr;
9584
9585         /* skip radio stats if userspace didn't request them */
9586         if (!survey->channel && !allow_radio_stats)
9587                 return 0;
9588
9589         hdr = nl80211hdr_put(msg, portid, seq, flags,
9590                              NL80211_CMD_NEW_SURVEY_RESULTS);
9591         if (!hdr)
9592                 return -ENOMEM;
9593
9594         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
9595                 goto nla_put_failure;
9596
9597         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
9598         if (!infoattr)
9599                 goto nla_put_failure;
9600
9601         if (survey->channel &&
9602             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
9603                         survey->channel->center_freq))
9604                 goto nla_put_failure;
9605
9606         if (survey->channel && survey->channel->freq_offset &&
9607             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
9608                         survey->channel->freq_offset))
9609                 goto nla_put_failure;
9610
9611         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
9612             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
9613                 goto nla_put_failure;
9614         if ((survey->filled & SURVEY_INFO_IN_USE) &&
9615             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
9616                 goto nla_put_failure;
9617         if ((survey->filled & SURVEY_INFO_TIME) &&
9618             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
9619                         survey->time, NL80211_SURVEY_INFO_PAD))
9620                 goto nla_put_failure;
9621         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
9622             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
9623                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
9624                 goto nla_put_failure;
9625         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
9626             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
9627                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
9628                 goto nla_put_failure;
9629         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
9630             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
9631                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
9632                 goto nla_put_failure;
9633         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
9634             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
9635                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
9636                 goto nla_put_failure;
9637         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
9638             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
9639                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
9640                 goto nla_put_failure;
9641         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
9642             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
9643                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
9644                 goto nla_put_failure;
9645
9646         nla_nest_end(msg, infoattr);
9647
9648         genlmsg_end(msg, hdr);
9649         return 0;
9650
9651  nla_put_failure:
9652         genlmsg_cancel(msg, hdr);
9653         return -EMSGSIZE;
9654 }
9655
9656 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
9657 {
9658         struct nlattr **attrbuf;
9659         struct survey_info survey;
9660         struct cfg80211_registered_device *rdev;
9661         struct wireless_dev *wdev;
9662         int survey_idx = cb->args[2];
9663         int res;
9664         bool radio_stats;
9665
9666         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
9667         if (!attrbuf)
9668                 return -ENOMEM;
9669
9670         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
9671         if (res) {
9672                 kfree(attrbuf);
9673                 return res;
9674         }
9675         /* nl80211_prepare_wdev_dump acquired it in the successful case */
9676         __acquire(&rdev->wiphy.mtx);
9677
9678         /* prepare_wdev_dump parsed the attributes */
9679         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
9680
9681         if (!wdev->netdev) {
9682                 res = -EINVAL;
9683                 goto out_err;
9684         }
9685
9686         if (!rdev->ops->dump_survey) {
9687                 res = -EOPNOTSUPP;
9688                 goto out_err;
9689         }
9690
9691         while (1) {
9692                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
9693                 if (res == -ENOENT)
9694                         break;
9695                 if (res)
9696                         goto out_err;
9697
9698                 /* don't send disabled channels, but do send non-channel data */
9699                 if (survey.channel &&
9700                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
9701                         survey_idx++;
9702                         continue;
9703                 }
9704
9705                 if (nl80211_send_survey(skb,
9706                                 NETLINK_CB(cb->skb).portid,
9707                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
9708                                 wdev->netdev, radio_stats, &survey) < 0)
9709                         goto out;
9710                 survey_idx++;
9711         }
9712
9713  out:
9714         cb->args[2] = survey_idx;
9715         res = skb->len;
9716  out_err:
9717         kfree(attrbuf);
9718         wiphy_unlock(&rdev->wiphy);
9719         return res;
9720 }
9721
9722 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
9723 {
9724         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
9725                                   NL80211_WPA_VERSION_2 |
9726                                   NL80211_WPA_VERSION_3));
9727 }
9728
9729 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
9730 {
9731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9732         struct net_device *dev = info->user_ptr[1];
9733         struct ieee80211_channel *chan;
9734         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
9735         int err, ssid_len, ie_len = 0, auth_data_len = 0;
9736         enum nl80211_auth_type auth_type;
9737         struct key_parse key;
9738         bool local_state_change;
9739         u32 freq;
9740
9741         if (!info->attrs[NL80211_ATTR_MAC])
9742                 return -EINVAL;
9743
9744         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
9745                 return -EINVAL;
9746
9747         if (!info->attrs[NL80211_ATTR_SSID])
9748                 return -EINVAL;
9749
9750         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9751                 return -EINVAL;
9752
9753         err = nl80211_parse_key(info, &key);
9754         if (err)
9755                 return err;
9756
9757         if (key.idx >= 0) {
9758                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
9759                         return -EINVAL;
9760                 if (!key.p.key || !key.p.key_len)
9761                         return -EINVAL;
9762                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
9763                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
9764                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
9765                      key.p.key_len != WLAN_KEY_LEN_WEP104))
9766                         return -EINVAL;
9767                 if (key.idx > 3)
9768                         return -EINVAL;
9769         } else {
9770                 key.p.key_len = 0;
9771                 key.p.key = NULL;
9772         }
9773
9774         if (key.idx >= 0) {
9775                 int i;
9776                 bool ok = false;
9777
9778                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
9779                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
9780                                 ok = true;
9781                                 break;
9782                         }
9783                 }
9784                 if (!ok)
9785                         return -EINVAL;
9786         }
9787
9788         if (!rdev->ops->auth)
9789                 return -EOPNOTSUPP;
9790
9791         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9792             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9793                 return -EOPNOTSUPP;
9794
9795         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9796         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
9797         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
9798                 freq +=
9799                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
9800
9801         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
9802         if (!chan)
9803                 return -EINVAL;
9804
9805         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9806         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9807
9808         if (info->attrs[NL80211_ATTR_IE]) {
9809                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9810                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9811         }
9812
9813         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9814         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
9815                 return -EINVAL;
9816
9817         if ((auth_type == NL80211_AUTHTYPE_SAE ||
9818              auth_type == NL80211_AUTHTYPE_FILS_SK ||
9819              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
9820              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
9821             !info->attrs[NL80211_ATTR_AUTH_DATA])
9822                 return -EINVAL;
9823
9824         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
9825                 if (auth_type != NL80211_AUTHTYPE_SAE &&
9826                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
9827                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
9828                     auth_type != NL80211_AUTHTYPE_FILS_PK)
9829                         return -EINVAL;
9830                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
9831                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
9832         }
9833
9834         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
9835
9836         /*
9837          * Since we no longer track auth state, ignore
9838          * requests to only change local state.
9839          */
9840         if (local_state_change)
9841                 return 0;
9842
9843         wdev_lock(dev->ieee80211_ptr);
9844         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
9845                                  ssid, ssid_len, ie, ie_len,
9846                                  key.p.key, key.p.key_len, key.idx,
9847                                  auth_data, auth_data_len);
9848         wdev_unlock(dev->ieee80211_ptr);
9849         return err;
9850 }
9851
9852 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
9853                                      struct genl_info *info)
9854 {
9855         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9856                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
9857                 return -EINVAL;
9858         }
9859
9860         if (!rdev->ops->tx_control_port ||
9861             !wiphy_ext_feature_isset(&rdev->wiphy,
9862                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
9863                 return -EOPNOTSUPP;
9864
9865         return 0;
9866 }
9867
9868 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
9869                                    struct genl_info *info,
9870                                    struct cfg80211_crypto_settings *settings,
9871                                    int cipher_limit)
9872 {
9873         memset(settings, 0, sizeof(*settings));
9874
9875         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
9876
9877         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
9878                 u16 proto;
9879
9880                 proto = nla_get_u16(
9881                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
9882                 settings->control_port_ethertype = cpu_to_be16(proto);
9883                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
9884                     proto != ETH_P_PAE)
9885                         return -EINVAL;
9886                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
9887                         settings->control_port_no_encrypt = true;
9888         } else
9889                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
9890
9891         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9892                 int r = validate_pae_over_nl80211(rdev, info);
9893
9894                 if (r < 0)
9895                         return r;
9896
9897                 settings->control_port_over_nl80211 = true;
9898
9899                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
9900                         settings->control_port_no_preauth = true;
9901         }
9902
9903         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
9904                 void *data;
9905                 int len, i;
9906
9907                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9908                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
9909                 settings->n_ciphers_pairwise = len / sizeof(u32);
9910
9911                 if (len % sizeof(u32))
9912                         return -EINVAL;
9913
9914                 if (settings->n_ciphers_pairwise > cipher_limit)
9915                         return -EINVAL;
9916
9917                 memcpy(settings->ciphers_pairwise, data, len);
9918
9919                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
9920                         if (!cfg80211_supported_cipher_suite(
9921                                         &rdev->wiphy,
9922                                         settings->ciphers_pairwise[i]))
9923                                 return -EINVAL;
9924         }
9925
9926         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
9927                 settings->cipher_group =
9928                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
9929                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
9930                                                      settings->cipher_group))
9931                         return -EINVAL;
9932         }
9933
9934         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
9935                 settings->wpa_versions =
9936                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
9937                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
9938                         return -EINVAL;
9939         }
9940
9941         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
9942                 void *data;
9943                 int len;
9944
9945                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
9946                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
9947                 settings->n_akm_suites = len / sizeof(u32);
9948
9949                 if (len % sizeof(u32))
9950                         return -EINVAL;
9951
9952                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
9953                         return -EINVAL;
9954
9955                 memcpy(settings->akm_suites, data, len);
9956         }
9957
9958         if (info->attrs[NL80211_ATTR_PMK]) {
9959                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
9960                         return -EINVAL;
9961                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9962                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
9963                     !wiphy_ext_feature_isset(&rdev->wiphy,
9964                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
9965                         return -EINVAL;
9966                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9967         }
9968
9969         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
9970                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
9971                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
9972                     !wiphy_ext_feature_isset(&rdev->wiphy,
9973                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
9974                         return -EINVAL;
9975                 settings->sae_pwd =
9976                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9977                 settings->sae_pwd_len =
9978                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
9979         }
9980
9981         if (info->attrs[NL80211_ATTR_SAE_PWE])
9982                 settings->sae_pwe =
9983                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
9984         else
9985                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
9986
9987         return 0;
9988 }
9989
9990 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
9991 {
9992         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9993         struct net_device *dev = info->user_ptr[1];
9994         struct ieee80211_channel *chan;
9995         struct cfg80211_assoc_request req = {};
9996         const u8 *bssid, *ssid;
9997         int err, ssid_len = 0;
9998         u32 freq;
9999
10000         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10001             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10002                 return -EPERM;
10003
10004         if (!info->attrs[NL80211_ATTR_MAC] ||
10005             !info->attrs[NL80211_ATTR_SSID] ||
10006             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
10007                 return -EINVAL;
10008
10009         if (!rdev->ops->assoc)
10010                 return -EOPNOTSUPP;
10011
10012         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10013             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10014                 return -EOPNOTSUPP;
10015
10016         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10017
10018         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10019         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10020                 freq +=
10021                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10022         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10023         if (!chan)
10024                 return -EINVAL;
10025
10026         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10027         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10028
10029         if (info->attrs[NL80211_ATTR_IE]) {
10030                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10031                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10032         }
10033
10034         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10035                 enum nl80211_mfp mfp =
10036                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10037                 if (mfp == NL80211_MFP_REQUIRED)
10038                         req.use_mfp = true;
10039                 else if (mfp != NL80211_MFP_NO)
10040                         return -EINVAL;
10041         }
10042
10043         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10044                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10045
10046         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10047                 req.flags |= ASSOC_REQ_DISABLE_HT;
10048
10049         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10050                 memcpy(&req.ht_capa_mask,
10051                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10052                        sizeof(req.ht_capa_mask));
10053
10054         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10055                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10056                         return -EINVAL;
10057                 memcpy(&req.ht_capa,
10058                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10059                        sizeof(req.ht_capa));
10060         }
10061
10062         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10063                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10064
10065         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10066                 req.flags |= ASSOC_REQ_DISABLE_HE;
10067
10068         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10069                 memcpy(&req.vht_capa_mask,
10070                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10071                        sizeof(req.vht_capa_mask));
10072
10073         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10074                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10075                         return -EINVAL;
10076                 memcpy(&req.vht_capa,
10077                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10078                        sizeof(req.vht_capa));
10079         }
10080
10081         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10082                 if (!((rdev->wiphy.features &
10083                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10084                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10085                     !wiphy_ext_feature_isset(&rdev->wiphy,
10086                                              NL80211_EXT_FEATURE_RRM))
10087                         return -EINVAL;
10088                 req.flags |= ASSOC_REQ_USE_RRM;
10089         }
10090
10091         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
10092                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
10093                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
10094                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
10095                         return -EINVAL;
10096                 req.fils_nonces =
10097                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
10098         }
10099
10100         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
10101                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
10102                         return -EINVAL;
10103                 memcpy(&req.s1g_capa_mask,
10104                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
10105                        sizeof(req.s1g_capa_mask));
10106         }
10107
10108         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
10109                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
10110                         return -EINVAL;
10111                 memcpy(&req.s1g_capa,
10112                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
10113                        sizeof(req.s1g_capa));
10114         }
10115
10116         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
10117         if (!err) {
10118                 wdev_lock(dev->ieee80211_ptr);
10119
10120                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
10121                                           ssid, ssid_len, &req);
10122
10123                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10124                         dev->ieee80211_ptr->conn_owner_nlportid =
10125                                 info->snd_portid;
10126                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10127                                bssid, ETH_ALEN);
10128                 }
10129
10130                 wdev_unlock(dev->ieee80211_ptr);
10131         }
10132
10133         return err;
10134 }
10135
10136 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
10137 {
10138         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10139         struct net_device *dev = info->user_ptr[1];
10140         const u8 *ie = NULL, *bssid;
10141         int ie_len = 0, err;
10142         u16 reason_code;
10143         bool local_state_change;
10144
10145         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10146             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10147                 return -EPERM;
10148
10149         if (!info->attrs[NL80211_ATTR_MAC])
10150                 return -EINVAL;
10151
10152         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10153                 return -EINVAL;
10154
10155         if (!rdev->ops->deauth)
10156                 return -EOPNOTSUPP;
10157
10158         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10159             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10160                 return -EOPNOTSUPP;
10161
10162         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10163
10164         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10165         if (reason_code == 0) {
10166                 /* Reason Code 0 is reserved */
10167                 return -EINVAL;
10168         }
10169
10170         if (info->attrs[NL80211_ATTR_IE]) {
10171                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10172                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10173         }
10174
10175         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10176
10177         wdev_lock(dev->ieee80211_ptr);
10178         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
10179                                    local_state_change);
10180         wdev_unlock(dev->ieee80211_ptr);
10181         return err;
10182 }
10183
10184 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
10185 {
10186         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10187         struct net_device *dev = info->user_ptr[1];
10188         const u8 *ie = NULL, *bssid;
10189         int ie_len = 0, err;
10190         u16 reason_code;
10191         bool local_state_change;
10192
10193         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10194             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10195                 return -EPERM;
10196
10197         if (!info->attrs[NL80211_ATTR_MAC])
10198                 return -EINVAL;
10199
10200         if (!info->attrs[NL80211_ATTR_REASON_CODE])
10201                 return -EINVAL;
10202
10203         if (!rdev->ops->disassoc)
10204                 return -EOPNOTSUPP;
10205
10206         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10207             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10208                 return -EOPNOTSUPP;
10209
10210         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10211
10212         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
10213         if (reason_code == 0) {
10214                 /* Reason Code 0 is reserved */
10215                 return -EINVAL;
10216         }
10217
10218         if (info->attrs[NL80211_ATTR_IE]) {
10219                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10220                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10221         }
10222
10223         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10224
10225         wdev_lock(dev->ieee80211_ptr);
10226         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
10227                                      local_state_change);
10228         wdev_unlock(dev->ieee80211_ptr);
10229         return err;
10230 }
10231
10232 static bool
10233 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
10234                          int mcast_rate[NUM_NL80211_BANDS],
10235                          int rateval)
10236 {
10237         struct wiphy *wiphy = &rdev->wiphy;
10238         bool found = false;
10239         int band, i;
10240
10241         for (band = 0; band < NUM_NL80211_BANDS; band++) {
10242                 struct ieee80211_supported_band *sband;
10243
10244                 sband = wiphy->bands[band];
10245                 if (!sband)
10246                         continue;
10247
10248                 for (i = 0; i < sband->n_bitrates; i++) {
10249                         if (sband->bitrates[i].bitrate == rateval) {
10250                                 mcast_rate[band] = i + 1;
10251                                 found = true;
10252                                 break;
10253                         }
10254                 }
10255         }
10256
10257         return found;
10258 }
10259
10260 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
10261 {
10262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10263         struct net_device *dev = info->user_ptr[1];
10264         struct cfg80211_ibss_params ibss;
10265         struct wiphy *wiphy;
10266         struct cfg80211_cached_keys *connkeys = NULL;
10267         int err;
10268
10269         memset(&ibss, 0, sizeof(ibss));
10270
10271         if (!info->attrs[NL80211_ATTR_SSID] ||
10272             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10273                 return -EINVAL;
10274
10275         ibss.beacon_interval = 100;
10276
10277         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
10278                 ibss.beacon_interval =
10279                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10280
10281         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
10282                                            ibss.beacon_interval);
10283         if (err)
10284                 return err;
10285
10286         if (!rdev->ops->join_ibss)
10287                 return -EOPNOTSUPP;
10288
10289         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10290                 return -EOPNOTSUPP;
10291
10292         wiphy = &rdev->wiphy;
10293
10294         if (info->attrs[NL80211_ATTR_MAC]) {
10295                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10296
10297                 if (!is_valid_ether_addr(ibss.bssid))
10298                         return -EINVAL;
10299         }
10300         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10301         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10302
10303         if (info->attrs[NL80211_ATTR_IE]) {
10304                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10305                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10306         }
10307
10308         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
10309         if (err)
10310                 return err;
10311
10312         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
10313                                      NL80211_IFTYPE_ADHOC))
10314                 return -EINVAL;
10315
10316         switch (ibss.chandef.width) {
10317         case NL80211_CHAN_WIDTH_5:
10318         case NL80211_CHAN_WIDTH_10:
10319         case NL80211_CHAN_WIDTH_20_NOHT:
10320                 break;
10321         case NL80211_CHAN_WIDTH_20:
10322         case NL80211_CHAN_WIDTH_40:
10323                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10324                         return -EINVAL;
10325                 break;
10326         case NL80211_CHAN_WIDTH_80:
10327         case NL80211_CHAN_WIDTH_80P80:
10328         case NL80211_CHAN_WIDTH_160:
10329                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
10330                         return -EINVAL;
10331                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10332                                              NL80211_EXT_FEATURE_VHT_IBSS))
10333                         return -EINVAL;
10334                 break;
10335         default:
10336                 return -EINVAL;
10337         }
10338
10339         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
10340         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
10341
10342         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10343                 u8 *rates =
10344                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10345                 int n_rates =
10346                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10347                 struct ieee80211_supported_band *sband =
10348                         wiphy->bands[ibss.chandef.chan->band];
10349
10350                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10351                                              &ibss.basic_rates);
10352                 if (err)
10353                         return err;
10354         }
10355
10356         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10357                 memcpy(&ibss.ht_capa_mask,
10358                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10359                        sizeof(ibss.ht_capa_mask));
10360
10361         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10362                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10363                         return -EINVAL;
10364                 memcpy(&ibss.ht_capa,
10365                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10366                        sizeof(ibss.ht_capa));
10367         }
10368
10369         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10370             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
10371                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10372                 return -EINVAL;
10373
10374         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10375                 bool no_ht = false;
10376
10377                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
10378                 if (IS_ERR(connkeys))
10379                         return PTR_ERR(connkeys);
10380
10381                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
10382                     no_ht) {
10383                         kfree_sensitive(connkeys);
10384                         return -EINVAL;
10385                 }
10386         }
10387
10388         ibss.control_port =
10389                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
10390
10391         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10392                 int r = validate_pae_over_nl80211(rdev, info);
10393
10394                 if (r < 0) {
10395                         kfree_sensitive(connkeys);
10396                         return r;
10397                 }
10398
10399                 ibss.control_port_over_nl80211 = true;
10400         }
10401
10402         ibss.userspace_handles_dfs =
10403                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10404
10405         wdev_lock(dev->ieee80211_ptr);
10406         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
10407         if (err)
10408                 kfree_sensitive(connkeys);
10409         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
10410                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10411         wdev_unlock(dev->ieee80211_ptr);
10412
10413         return err;
10414 }
10415
10416 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
10417 {
10418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10419         struct net_device *dev = info->user_ptr[1];
10420
10421         if (!rdev->ops->leave_ibss)
10422                 return -EOPNOTSUPP;
10423
10424         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
10425                 return -EOPNOTSUPP;
10426
10427         return cfg80211_leave_ibss(rdev, dev, false);
10428 }
10429
10430 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
10431 {
10432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10433         struct net_device *dev = info->user_ptr[1];
10434         int mcast_rate[NUM_NL80211_BANDS];
10435         u32 nla_rate;
10436         int err;
10437
10438         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
10439             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
10440             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
10441                 return -EOPNOTSUPP;
10442
10443         if (!rdev->ops->set_mcast_rate)
10444                 return -EOPNOTSUPP;
10445
10446         memset(mcast_rate, 0, sizeof(mcast_rate));
10447
10448         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
10449                 return -EINVAL;
10450
10451         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
10452         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
10453                 return -EINVAL;
10454
10455         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
10456
10457         return err;
10458 }
10459
10460 static struct sk_buff *
10461 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
10462                             struct wireless_dev *wdev, int approxlen,
10463                             u32 portid, u32 seq, enum nl80211_commands cmd,
10464                             enum nl80211_attrs attr,
10465                             const struct nl80211_vendor_cmd_info *info,
10466                             gfp_t gfp)
10467 {
10468         struct sk_buff *skb;
10469         void *hdr;
10470         struct nlattr *data;
10471
10472         skb = nlmsg_new(approxlen + 100, gfp);
10473         if (!skb)
10474                 return NULL;
10475
10476         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
10477         if (!hdr) {
10478                 kfree_skb(skb);
10479                 return NULL;
10480         }
10481
10482         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
10483                 goto nla_put_failure;
10484
10485         if (info) {
10486                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
10487                                 info->vendor_id))
10488                         goto nla_put_failure;
10489                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
10490                                 info->subcmd))
10491                         goto nla_put_failure;
10492         }
10493
10494         if (wdev) {
10495                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
10496                                       wdev_id(wdev), NL80211_ATTR_PAD))
10497                         goto nla_put_failure;
10498                 if (wdev->netdev &&
10499                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
10500                                 wdev->netdev->ifindex))
10501                         goto nla_put_failure;
10502         }
10503
10504         data = nla_nest_start_noflag(skb, attr);
10505         if (!data)
10506                 goto nla_put_failure;
10507
10508         ((void **)skb->cb)[0] = rdev;
10509         ((void **)skb->cb)[1] = hdr;
10510         ((void **)skb->cb)[2] = data;
10511
10512         return skb;
10513
10514  nla_put_failure:
10515         kfree_skb(skb);
10516         return NULL;
10517 }
10518
10519 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
10520                                            struct wireless_dev *wdev,
10521                                            enum nl80211_commands cmd,
10522                                            enum nl80211_attrs attr,
10523                                            unsigned int portid,
10524                                            int vendor_event_idx,
10525                                            int approxlen, gfp_t gfp)
10526 {
10527         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
10528         const struct nl80211_vendor_cmd_info *info;
10529
10530         switch (cmd) {
10531         case NL80211_CMD_TESTMODE:
10532                 if (WARN_ON(vendor_event_idx != -1))
10533                         return NULL;
10534                 info = NULL;
10535                 break;
10536         case NL80211_CMD_VENDOR:
10537                 if (WARN_ON(vendor_event_idx < 0 ||
10538                             vendor_event_idx >= wiphy->n_vendor_events))
10539                         return NULL;
10540                 info = &wiphy->vendor_events[vendor_event_idx];
10541                 break;
10542         default:
10543                 WARN_ON(1);
10544                 return NULL;
10545         }
10546
10547         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
10548                                            cmd, attr, info, gfp);
10549 }
10550 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
10551
10552 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
10553 {
10554         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
10555         void *hdr = ((void **)skb->cb)[1];
10556         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
10557         struct nlattr *data = ((void **)skb->cb)[2];
10558         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
10559
10560         /* clear CB data for netlink core to own from now on */
10561         memset(skb->cb, 0, sizeof(skb->cb));
10562
10563         nla_nest_end(skb, data);
10564         genlmsg_end(skb, hdr);
10565
10566         if (nlhdr->nlmsg_pid) {
10567                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
10568                                 nlhdr->nlmsg_pid);
10569         } else {
10570                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
10571                         mcgrp = NL80211_MCGRP_VENDOR;
10572
10573                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
10574                                         skb, 0, mcgrp, gfp);
10575         }
10576 }
10577 EXPORT_SYMBOL(__cfg80211_send_event_skb);
10578
10579 #ifdef CONFIG_NL80211_TESTMODE
10580 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
10581 {
10582         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10583         struct wireless_dev *wdev;
10584         int err;
10585
10586         lockdep_assert_held(&rdev->wiphy.mtx);
10587
10588         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
10589                                           info->attrs);
10590
10591         if (!rdev->ops->testmode_cmd)
10592                 return -EOPNOTSUPP;
10593
10594         if (IS_ERR(wdev)) {
10595                 err = PTR_ERR(wdev);
10596                 if (err != -EINVAL)
10597                         return err;
10598                 wdev = NULL;
10599         } else if (wdev->wiphy != &rdev->wiphy) {
10600                 return -EINVAL;
10601         }
10602
10603         if (!info->attrs[NL80211_ATTR_TESTDATA])
10604                 return -EINVAL;
10605
10606         rdev->cur_cmd_info = info;
10607         err = rdev_testmode_cmd(rdev, wdev,
10608                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
10609                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
10610         rdev->cur_cmd_info = NULL;
10611
10612         return err;
10613 }
10614
10615 static int nl80211_testmode_dump(struct sk_buff *skb,
10616                                  struct netlink_callback *cb)
10617 {
10618         struct cfg80211_registered_device *rdev;
10619         struct nlattr **attrbuf = NULL;
10620         int err;
10621         long phy_idx;
10622         void *data = NULL;
10623         int data_len = 0;
10624
10625         rtnl_lock();
10626
10627         if (cb->args[0]) {
10628                 /*
10629                  * 0 is a valid index, but not valid for args[0],
10630                  * so we need to offset by 1.
10631                  */
10632                 phy_idx = cb->args[0] - 1;
10633
10634                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
10635                 if (!rdev) {
10636                         err = -ENOENT;
10637                         goto out_err;
10638                 }
10639         } else {
10640                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
10641                                   GFP_KERNEL);
10642                 if (!attrbuf) {
10643                         err = -ENOMEM;
10644                         goto out_err;
10645                 }
10646
10647                 err = nlmsg_parse_deprecated(cb->nlh,
10648                                              GENL_HDRLEN + nl80211_fam.hdrsize,
10649                                              attrbuf, nl80211_fam.maxattr,
10650                                              nl80211_policy, NULL);
10651                 if (err)
10652                         goto out_err;
10653
10654                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
10655                 if (IS_ERR(rdev)) {
10656                         err = PTR_ERR(rdev);
10657                         goto out_err;
10658                 }
10659                 phy_idx = rdev->wiphy_idx;
10660
10661                 if (attrbuf[NL80211_ATTR_TESTDATA])
10662                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
10663         }
10664
10665         if (cb->args[1]) {
10666                 data = nla_data((void *)cb->args[1]);
10667                 data_len = nla_len((void *)cb->args[1]);
10668         }
10669
10670         if (!rdev->ops->testmode_dump) {
10671                 err = -EOPNOTSUPP;
10672                 goto out_err;
10673         }
10674
10675         while (1) {
10676                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
10677                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
10678                                            NL80211_CMD_TESTMODE);
10679                 struct nlattr *tmdata;
10680
10681                 if (!hdr)
10682                         break;
10683
10684                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
10685                         genlmsg_cancel(skb, hdr);
10686                         break;
10687                 }
10688
10689                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
10690                 if (!tmdata) {
10691                         genlmsg_cancel(skb, hdr);
10692                         break;
10693                 }
10694                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
10695                 nla_nest_end(skb, tmdata);
10696
10697                 if (err == -ENOBUFS || err == -ENOENT) {
10698                         genlmsg_cancel(skb, hdr);
10699                         break;
10700                 } else if (err) {
10701                         genlmsg_cancel(skb, hdr);
10702                         goto out_err;
10703                 }
10704
10705                 genlmsg_end(skb, hdr);
10706         }
10707
10708         err = skb->len;
10709         /* see above */
10710         cb->args[0] = phy_idx + 1;
10711  out_err:
10712         kfree(attrbuf);
10713         rtnl_unlock();
10714         return err;
10715 }
10716 #endif
10717
10718 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
10719 {
10720         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10721         struct net_device *dev = info->user_ptr[1];
10722         struct cfg80211_connect_params connect;
10723         struct wiphy *wiphy;
10724         struct cfg80211_cached_keys *connkeys = NULL;
10725         u32 freq = 0;
10726         int err;
10727
10728         memset(&connect, 0, sizeof(connect));
10729
10730         if (!info->attrs[NL80211_ATTR_SSID] ||
10731             !nla_len(info->attrs[NL80211_ATTR_SSID]))
10732                 return -EINVAL;
10733
10734         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
10735                 connect.auth_type =
10736                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10737                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
10738                                              NL80211_CMD_CONNECT))
10739                         return -EINVAL;
10740         } else
10741                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
10742
10743         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
10744
10745         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
10746             !wiphy_ext_feature_isset(&rdev->wiphy,
10747                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
10748                 return -EINVAL;
10749         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
10750
10751         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
10752                                       NL80211_MAX_NR_CIPHER_SUITES);
10753         if (err)
10754                 return err;
10755
10756         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10757             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10758                 return -EOPNOTSUPP;
10759
10760         wiphy = &rdev->wiphy;
10761
10762         connect.bg_scan_period = -1;
10763         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
10764                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
10765                 connect.bg_scan_period =
10766                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
10767         }
10768
10769         if (info->attrs[NL80211_ATTR_MAC])
10770                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10771         else if (info->attrs[NL80211_ATTR_MAC_HINT])
10772                 connect.bssid_hint =
10773                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
10774         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10775         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10776
10777         if (info->attrs[NL80211_ATTR_IE]) {
10778                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10779                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10780         }
10781
10782         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10783                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10784                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
10785                     !wiphy_ext_feature_isset(&rdev->wiphy,
10786                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
10787                         return -EOPNOTSUPP;
10788         } else {
10789                 connect.mfp = NL80211_MFP_NO;
10790         }
10791
10792         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10793                 connect.prev_bssid =
10794                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10795
10796         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
10797                 freq = MHZ_TO_KHZ(nla_get_u32(
10798                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10799         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10800                 freq +=
10801                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10802
10803         if (freq) {
10804                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
10805                 if (!connect.channel)
10806                         return -EINVAL;
10807         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
10808                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
10809                 freq = MHZ_TO_KHZ(freq);
10810                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
10811                 if (!connect.channel_hint)
10812                         return -EINVAL;
10813         }
10814
10815         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
10816                 connect.edmg.channels =
10817                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
10818
10819                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
10820                         connect.edmg.bw_config =
10821                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
10822         }
10823
10824         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
10825                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
10826                 if (IS_ERR(connkeys))
10827                         return PTR_ERR(connkeys);
10828         }
10829
10830         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10831                 connect.flags |= ASSOC_REQ_DISABLE_HT;
10832
10833         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10834                 memcpy(&connect.ht_capa_mask,
10835                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10836                        sizeof(connect.ht_capa_mask));
10837
10838         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10839                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
10840                         kfree_sensitive(connkeys);
10841                         return -EINVAL;
10842                 }
10843                 memcpy(&connect.ht_capa,
10844                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10845                        sizeof(connect.ht_capa));
10846         }
10847
10848         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10849                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
10850
10851         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10852                 connect.flags |= ASSOC_REQ_DISABLE_HE;
10853
10854         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10855                 memcpy(&connect.vht_capa_mask,
10856                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10857                        sizeof(connect.vht_capa_mask));
10858
10859         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10860                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
10861                         kfree_sensitive(connkeys);
10862                         return -EINVAL;
10863                 }
10864                 memcpy(&connect.vht_capa,
10865                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
10866                        sizeof(connect.vht_capa));
10867         }
10868
10869         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
10870                 if (!((rdev->wiphy.features &
10871                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
10872                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
10873                     !wiphy_ext_feature_isset(&rdev->wiphy,
10874                                              NL80211_EXT_FEATURE_RRM)) {
10875                         kfree_sensitive(connkeys);
10876                         return -EINVAL;
10877                 }
10878                 connect.flags |= ASSOC_REQ_USE_RRM;
10879         }
10880
10881         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
10882         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
10883                 kfree_sensitive(connkeys);
10884                 return -EOPNOTSUPP;
10885         }
10886
10887         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
10888                 /* bss selection makes no sense if bssid is set */
10889                 if (connect.bssid) {
10890                         kfree_sensitive(connkeys);
10891                         return -EINVAL;
10892                 }
10893
10894                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
10895                                        wiphy, &connect.bss_select);
10896                 if (err) {
10897                         kfree_sensitive(connkeys);
10898                         return err;
10899                 }
10900         }
10901
10902         if (wiphy_ext_feature_isset(&rdev->wiphy,
10903                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
10904             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10905             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10906             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10907             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10908                 connect.fils_erp_username =
10909                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10910                 connect.fils_erp_username_len =
10911                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10912                 connect.fils_erp_realm =
10913                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10914                 connect.fils_erp_realm_len =
10915                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
10916                 connect.fils_erp_next_seq_num =
10917                         nla_get_u16(
10918                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
10919                 connect.fils_erp_rrk =
10920                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10921                 connect.fils_erp_rrk_len =
10922                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
10923         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
10924                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
10925                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
10926                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10927                 kfree_sensitive(connkeys);
10928                 return -EINVAL;
10929         }
10930
10931         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
10932                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10933                         kfree_sensitive(connkeys);
10934                         GENL_SET_ERR_MSG(info,
10935                                          "external auth requires connection ownership");
10936                         return -EINVAL;
10937                 }
10938                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
10939         }
10940
10941         wdev_lock(dev->ieee80211_ptr);
10942
10943         err = cfg80211_connect(rdev, dev, &connect, connkeys,
10944                                connect.prev_bssid);
10945         if (err)
10946                 kfree_sensitive(connkeys);
10947
10948         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10949                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10950                 if (connect.bssid)
10951                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
10952                                connect.bssid, ETH_ALEN);
10953                 else
10954                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
10955         }
10956
10957         wdev_unlock(dev->ieee80211_ptr);
10958
10959         return err;
10960 }
10961
10962 static int nl80211_update_connect_params(struct sk_buff *skb,
10963                                          struct genl_info *info)
10964 {
10965         struct cfg80211_connect_params connect = {};
10966         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10967         struct net_device *dev = info->user_ptr[1];
10968         struct wireless_dev *wdev = dev->ieee80211_ptr;
10969         bool fils_sk_offload;
10970         u32 auth_type;
10971         u32 changed = 0;
10972         int ret;
10973
10974         if (!rdev->ops->update_connect_params)
10975                 return -EOPNOTSUPP;
10976
10977         if (info->attrs[NL80211_ATTR_IE]) {
10978                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10979                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10980                 changed |= UPDATE_ASSOC_IES;
10981         }
10982
10983         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
10984                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
10985
10986         /*
10987          * when driver supports fils-sk offload all attributes must be
10988          * provided. So the else covers "fils-sk-not-all" and
10989          * "no-fils-sk-any".
10990          */
10991         if (fils_sk_offload &&
10992             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
10993             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
10994             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
10995             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
10996                 connect.fils_erp_username =
10997                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
10998                 connect.fils_erp_username_len =
10999                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11000                 connect.fils_erp_realm =
11001                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11002                 connect.fils_erp_realm_len =
11003                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11004                 connect.fils_erp_next_seq_num =
11005                         nla_get_u16(
11006                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11007                 connect.fils_erp_rrk =
11008                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11009                 connect.fils_erp_rrk_len =
11010                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11011                 changed |= UPDATE_FILS_ERP_INFO;
11012         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11013                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11014                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11015                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11016                 return -EINVAL;
11017         }
11018
11019         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11020                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11021                 if (!nl80211_valid_auth_type(rdev, auth_type,
11022                                              NL80211_CMD_CONNECT))
11023                         return -EINVAL;
11024
11025                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
11026                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
11027                         return -EINVAL;
11028
11029                 connect.auth_type = auth_type;
11030                 changed |= UPDATE_AUTH_TYPE;
11031         }
11032
11033         wdev_lock(dev->ieee80211_ptr);
11034         if (!wdev->current_bss)
11035                 ret = -ENOLINK;
11036         else
11037                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
11038         wdev_unlock(dev->ieee80211_ptr);
11039
11040         return ret;
11041 }
11042
11043 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
11044 {
11045         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11046         struct net_device *dev = info->user_ptr[1];
11047         u16 reason;
11048         int ret;
11049
11050         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11051             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11052                 return -EPERM;
11053
11054         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11055                 reason = WLAN_REASON_DEAUTH_LEAVING;
11056         else
11057                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11058
11059         if (reason == 0)
11060                 return -EINVAL;
11061
11062         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11063             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11064                 return -EOPNOTSUPP;
11065
11066         wdev_lock(dev->ieee80211_ptr);
11067         ret = cfg80211_disconnect(rdev, dev, reason, true);
11068         wdev_unlock(dev->ieee80211_ptr);
11069         return ret;
11070 }
11071
11072 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
11073 {
11074         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11075         struct net *net;
11076         int err;
11077
11078         if (info->attrs[NL80211_ATTR_PID]) {
11079                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
11080
11081                 net = get_net_ns_by_pid(pid);
11082         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
11083                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
11084
11085                 net = get_net_ns_by_fd(fd);
11086         } else {
11087                 return -EINVAL;
11088         }
11089
11090         if (IS_ERR(net))
11091                 return PTR_ERR(net);
11092
11093         err = 0;
11094
11095         /* check if anything to do */
11096         if (!net_eq(wiphy_net(&rdev->wiphy), net))
11097                 err = cfg80211_switch_netns(rdev, net);
11098
11099         put_net(net);
11100         return err;
11101 }
11102
11103 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
11104 {
11105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11106         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
11107                         struct cfg80211_pmksa *pmksa) = NULL;
11108         struct net_device *dev = info->user_ptr[1];
11109         struct cfg80211_pmksa pmksa;
11110
11111         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
11112
11113         if (!info->attrs[NL80211_ATTR_PMKID])
11114                 return -EINVAL;
11115
11116         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
11117
11118         if (info->attrs[NL80211_ATTR_MAC]) {
11119                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11120         } else if (info->attrs[NL80211_ATTR_SSID] &&
11121                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
11122                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
11123                     info->attrs[NL80211_ATTR_PMK])) {
11124                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11125                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11126                 pmksa.cache_id =
11127                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
11128         } else {
11129                 return -EINVAL;
11130         }
11131         if (info->attrs[NL80211_ATTR_PMK]) {
11132                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
11133                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
11134         }
11135
11136         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
11137                 pmksa.pmk_lifetime =
11138                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
11139
11140         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
11141                 pmksa.pmk_reauth_threshold =
11142                         nla_get_u8(
11143                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
11144
11145         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11146             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
11147             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
11148               wiphy_ext_feature_isset(&rdev->wiphy,
11149                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
11150                 return -EOPNOTSUPP;
11151
11152         switch (info->genlhdr->cmd) {
11153         case NL80211_CMD_SET_PMKSA:
11154                 rdev_ops = rdev->ops->set_pmksa;
11155                 break;
11156         case NL80211_CMD_DEL_PMKSA:
11157                 rdev_ops = rdev->ops->del_pmksa;
11158                 break;
11159         default:
11160                 WARN_ON(1);
11161                 break;
11162         }
11163
11164         if (!rdev_ops)
11165                 return -EOPNOTSUPP;
11166
11167         return rdev_ops(&rdev->wiphy, dev, &pmksa);
11168 }
11169
11170 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
11171 {
11172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11173         struct net_device *dev = info->user_ptr[1];
11174
11175         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11176             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11177                 return -EOPNOTSUPP;
11178
11179         if (!rdev->ops->flush_pmksa)
11180                 return -EOPNOTSUPP;
11181
11182         return rdev_flush_pmksa(rdev, dev);
11183 }
11184
11185 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
11186 {
11187         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11188         struct net_device *dev = info->user_ptr[1];
11189         u8 action_code, dialog_token;
11190         u32 peer_capability = 0;
11191         u16 status_code;
11192         u8 *peer;
11193         bool initiator;
11194
11195         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11196             !rdev->ops->tdls_mgmt)
11197                 return -EOPNOTSUPP;
11198
11199         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
11200             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
11201             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
11202             !info->attrs[NL80211_ATTR_IE] ||
11203             !info->attrs[NL80211_ATTR_MAC])
11204                 return -EINVAL;
11205
11206         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11207         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
11208         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
11209         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
11210         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
11211         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
11212                 peer_capability =
11213                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
11214
11215         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
11216                               dialog_token, status_code, peer_capability,
11217                               initiator,
11218                               nla_data(info->attrs[NL80211_ATTR_IE]),
11219                               nla_len(info->attrs[NL80211_ATTR_IE]));
11220 }
11221
11222 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
11223 {
11224         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11225         struct net_device *dev = info->user_ptr[1];
11226         enum nl80211_tdls_operation operation;
11227         u8 *peer;
11228
11229         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
11230             !rdev->ops->tdls_oper)
11231                 return -EOPNOTSUPP;
11232
11233         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
11234             !info->attrs[NL80211_ATTR_MAC])
11235                 return -EINVAL;
11236
11237         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
11238         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
11239
11240         return rdev_tdls_oper(rdev, dev, peer, operation);
11241 }
11242
11243 static int nl80211_remain_on_channel(struct sk_buff *skb,
11244                                      struct genl_info *info)
11245 {
11246         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11247         struct wireless_dev *wdev = info->user_ptr[1];
11248         struct cfg80211_chan_def chandef;
11249         const struct cfg80211_chan_def *compat_chandef;
11250         struct sk_buff *msg;
11251         void *hdr;
11252         u64 cookie;
11253         u32 duration;
11254         int err;
11255
11256         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11257             !info->attrs[NL80211_ATTR_DURATION])
11258                 return -EINVAL;
11259
11260         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11261
11262         if (!rdev->ops->remain_on_channel ||
11263             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
11264                 return -EOPNOTSUPP;
11265
11266         /*
11267          * We should be on that channel for at least a minimum amount of
11268          * time (10ms) but no longer than the driver supports.
11269          */
11270         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11271             duration > rdev->wiphy.max_remain_on_channel_duration)
11272                 return -EINVAL;
11273
11274         err = nl80211_parse_chandef(rdev, info, &chandef);
11275         if (err)
11276                 return err;
11277
11278         wdev_lock(wdev);
11279         if (!cfg80211_off_channel_oper_allowed(wdev) &&
11280             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
11281                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
11282                                                              &chandef);
11283                 if (compat_chandef != &chandef) {
11284                         wdev_unlock(wdev);
11285                         return -EBUSY;
11286                 }
11287         }
11288         wdev_unlock(wdev);
11289
11290         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11291         if (!msg)
11292                 return -ENOMEM;
11293
11294         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11295                              NL80211_CMD_REMAIN_ON_CHANNEL);
11296         if (!hdr) {
11297                 err = -ENOBUFS;
11298                 goto free_msg;
11299         }
11300
11301         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
11302                                      duration, &cookie);
11303
11304         if (err)
11305                 goto free_msg;
11306
11307         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11308                               NL80211_ATTR_PAD))
11309                 goto nla_put_failure;
11310
11311         genlmsg_end(msg, hdr);
11312
11313         return genlmsg_reply(msg, info);
11314
11315  nla_put_failure:
11316         err = -ENOBUFS;
11317  free_msg:
11318         nlmsg_free(msg);
11319         return err;
11320 }
11321
11322 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
11323                                             struct genl_info *info)
11324 {
11325         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11326         struct wireless_dev *wdev = info->user_ptr[1];
11327         u64 cookie;
11328
11329         if (!info->attrs[NL80211_ATTR_COOKIE])
11330                 return -EINVAL;
11331
11332         if (!rdev->ops->cancel_remain_on_channel)
11333                 return -EOPNOTSUPP;
11334
11335         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11336
11337         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
11338 }
11339
11340 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
11341                                        struct genl_info *info)
11342 {
11343         struct cfg80211_bitrate_mask mask;
11344         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11345         struct net_device *dev = info->user_ptr[1];
11346         struct wireless_dev *wdev = dev->ieee80211_ptr;
11347         int err;
11348
11349         if (!rdev->ops->set_bitrate_mask)
11350                 return -EOPNOTSUPP;
11351
11352         wdev_lock(wdev);
11353         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11354                                             NL80211_ATTR_TX_RATES, &mask,
11355                                             dev, true);
11356         if (err)
11357                 goto out;
11358
11359         err = rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
11360 out:
11361         wdev_unlock(wdev);
11362         return err;
11363 }
11364
11365 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
11366 {
11367         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11368         struct wireless_dev *wdev = info->user_ptr[1];
11369         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
11370
11371         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
11372                 return -EINVAL;
11373
11374         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
11375                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
11376
11377         switch (wdev->iftype) {
11378         case NL80211_IFTYPE_STATION:
11379         case NL80211_IFTYPE_ADHOC:
11380         case NL80211_IFTYPE_P2P_CLIENT:
11381         case NL80211_IFTYPE_AP:
11382         case NL80211_IFTYPE_AP_VLAN:
11383         case NL80211_IFTYPE_MESH_POINT:
11384         case NL80211_IFTYPE_P2P_GO:
11385         case NL80211_IFTYPE_P2P_DEVICE:
11386                 break;
11387         case NL80211_IFTYPE_NAN:
11388         default:
11389                 return -EOPNOTSUPP;
11390         }
11391
11392         /* not much point in registering if we can't reply */
11393         if (!rdev->ops->mgmt_tx)
11394                 return -EOPNOTSUPP;
11395
11396         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
11397             !wiphy_ext_feature_isset(&rdev->wiphy,
11398                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
11399                 GENL_SET_ERR_MSG(info,
11400                                  "multicast RX registrations are not supported");
11401                 return -EOPNOTSUPP;
11402         }
11403
11404         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
11405                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11406                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
11407                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
11408                                            info->extack);
11409 }
11410
11411 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
11412 {
11413         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11414         struct wireless_dev *wdev = info->user_ptr[1];
11415         struct cfg80211_chan_def chandef;
11416         int err;
11417         void *hdr = NULL;
11418         u64 cookie;
11419         struct sk_buff *msg = NULL;
11420         struct cfg80211_mgmt_tx_params params = {
11421                 .dont_wait_for_ack =
11422                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
11423         };
11424
11425         if (!info->attrs[NL80211_ATTR_FRAME])
11426                 return -EINVAL;
11427
11428         if (!rdev->ops->mgmt_tx)
11429                 return -EOPNOTSUPP;
11430
11431         switch (wdev->iftype) {
11432         case NL80211_IFTYPE_P2P_DEVICE:
11433                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
11434                         return -EINVAL;
11435                 break;
11436         case NL80211_IFTYPE_STATION:
11437         case NL80211_IFTYPE_ADHOC:
11438         case NL80211_IFTYPE_P2P_CLIENT:
11439         case NL80211_IFTYPE_AP:
11440         case NL80211_IFTYPE_AP_VLAN:
11441         case NL80211_IFTYPE_MESH_POINT:
11442         case NL80211_IFTYPE_P2P_GO:
11443                 break;
11444         case NL80211_IFTYPE_NAN:
11445         default:
11446                 return -EOPNOTSUPP;
11447         }
11448
11449         if (info->attrs[NL80211_ATTR_DURATION]) {
11450                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11451                         return -EINVAL;
11452                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
11453
11454                 /*
11455                  * We should wait on the channel for at least a minimum amount
11456                  * of time (10ms) but no longer than the driver supports.
11457                  */
11458                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
11459                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
11460                         return -EINVAL;
11461         }
11462
11463         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
11464
11465         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
11466                 return -EINVAL;
11467
11468         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
11469
11470         /* get the channel if any has been specified, otherwise pass NULL to
11471          * the driver. The latter will use the current one
11472          */
11473         chandef.chan = NULL;
11474         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11475                 err = nl80211_parse_chandef(rdev, info, &chandef);
11476                 if (err)
11477                         return err;
11478         }
11479
11480         if (!chandef.chan && params.offchan)
11481                 return -EINVAL;
11482
11483         wdev_lock(wdev);
11484         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
11485                 wdev_unlock(wdev);
11486                 return -EBUSY;
11487         }
11488         wdev_unlock(wdev);
11489
11490         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
11491         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
11492
11493         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
11494                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11495                 int i;
11496
11497                 if (len % sizeof(u16))
11498                         return -EINVAL;
11499
11500                 params.n_csa_offsets = len / sizeof(u16);
11501                 params.csa_offsets =
11502                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
11503
11504                 /* check that all the offsets fit the frame */
11505                 for (i = 0; i < params.n_csa_offsets; i++) {
11506                         if (params.csa_offsets[i] >= params.len)
11507                                 return -EINVAL;
11508                 }
11509         }
11510
11511         if (!params.dont_wait_for_ack) {
11512                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11513                 if (!msg)
11514                         return -ENOMEM;
11515
11516                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11517                                      NL80211_CMD_FRAME);
11518                 if (!hdr) {
11519                         err = -ENOBUFS;
11520                         goto free_msg;
11521                 }
11522         }
11523
11524         params.chan = chandef.chan;
11525         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
11526         if (err)
11527                 goto free_msg;
11528
11529         if (msg) {
11530                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11531                                       NL80211_ATTR_PAD))
11532                         goto nla_put_failure;
11533
11534                 genlmsg_end(msg, hdr);
11535                 return genlmsg_reply(msg, info);
11536         }
11537
11538         return 0;
11539
11540  nla_put_failure:
11541         err = -ENOBUFS;
11542  free_msg:
11543         nlmsg_free(msg);
11544         return err;
11545 }
11546
11547 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
11548 {
11549         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11550         struct wireless_dev *wdev = info->user_ptr[1];
11551         u64 cookie;
11552
11553         if (!info->attrs[NL80211_ATTR_COOKIE])
11554                 return -EINVAL;
11555
11556         if (!rdev->ops->mgmt_tx_cancel_wait)
11557                 return -EOPNOTSUPP;
11558
11559         switch (wdev->iftype) {
11560         case NL80211_IFTYPE_STATION:
11561         case NL80211_IFTYPE_ADHOC:
11562         case NL80211_IFTYPE_P2P_CLIENT:
11563         case NL80211_IFTYPE_AP:
11564         case NL80211_IFTYPE_AP_VLAN:
11565         case NL80211_IFTYPE_P2P_GO:
11566         case NL80211_IFTYPE_P2P_DEVICE:
11567                 break;
11568         case NL80211_IFTYPE_NAN:
11569         default:
11570                 return -EOPNOTSUPP;
11571         }
11572
11573         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11574
11575         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
11576 }
11577
11578 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
11579 {
11580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11581         struct wireless_dev *wdev;
11582         struct net_device *dev = info->user_ptr[1];
11583         u8 ps_state;
11584         bool state;
11585         int err;
11586
11587         if (!info->attrs[NL80211_ATTR_PS_STATE])
11588                 return -EINVAL;
11589
11590         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
11591
11592         wdev = dev->ieee80211_ptr;
11593
11594         if (!rdev->ops->set_power_mgmt)
11595                 return -EOPNOTSUPP;
11596
11597         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
11598
11599         if (state == wdev->ps)
11600                 return 0;
11601
11602         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
11603         if (!err)
11604                 wdev->ps = state;
11605         return err;
11606 }
11607
11608 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
11609 {
11610         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11611         enum nl80211_ps_state ps_state;
11612         struct wireless_dev *wdev;
11613         struct net_device *dev = info->user_ptr[1];
11614         struct sk_buff *msg;
11615         void *hdr;
11616         int err;
11617
11618         wdev = dev->ieee80211_ptr;
11619
11620         if (!rdev->ops->set_power_mgmt)
11621                 return -EOPNOTSUPP;
11622
11623         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11624         if (!msg)
11625                 return -ENOMEM;
11626
11627         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11628                              NL80211_CMD_GET_POWER_SAVE);
11629         if (!hdr) {
11630                 err = -ENOBUFS;
11631                 goto free_msg;
11632         }
11633
11634         if (wdev->ps)
11635                 ps_state = NL80211_PS_ENABLED;
11636         else
11637                 ps_state = NL80211_PS_DISABLED;
11638
11639         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
11640                 goto nla_put_failure;
11641
11642         genlmsg_end(msg, hdr);
11643         return genlmsg_reply(msg, info);
11644
11645  nla_put_failure:
11646         err = -ENOBUFS;
11647  free_msg:
11648         nlmsg_free(msg);
11649         return err;
11650 }
11651
11652 static const struct nla_policy
11653 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
11654         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
11655         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
11656         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
11657         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
11658         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
11659         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
11660         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
11661 };
11662
11663 static int nl80211_set_cqm_txe(struct genl_info *info,
11664                                u32 rate, u32 pkts, u32 intvl)
11665 {
11666         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11667         struct net_device *dev = info->user_ptr[1];
11668         struct wireless_dev *wdev = dev->ieee80211_ptr;
11669
11670         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
11671                 return -EINVAL;
11672
11673         if (!rdev->ops->set_cqm_txe_config)
11674                 return -EOPNOTSUPP;
11675
11676         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11677             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11678                 return -EOPNOTSUPP;
11679
11680         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
11681 }
11682
11683 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
11684                                     struct net_device *dev)
11685 {
11686         struct wireless_dev *wdev = dev->ieee80211_ptr;
11687         s32 last, low, high;
11688         u32 hyst;
11689         int i, n, low_index;
11690         int err;
11691
11692         /* RSSI reporting disabled? */
11693         if (!wdev->cqm_config)
11694                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
11695
11696         /*
11697          * Obtain current RSSI value if possible, if not and no RSSI threshold
11698          * event has been received yet, we should receive an event after a
11699          * connection is established and enough beacons received to calculate
11700          * the average.
11701          */
11702         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
11703             rdev->ops->get_station) {
11704                 struct station_info sinfo = {};
11705                 u8 *mac_addr;
11706
11707                 mac_addr = wdev->current_bss->pub.bssid;
11708
11709                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
11710                 if (err)
11711                         return err;
11712
11713                 cfg80211_sinfo_release_content(&sinfo);
11714                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
11715                         wdev->cqm_config->last_rssi_event_value =
11716                                 (s8) sinfo.rx_beacon_signal_avg;
11717         }
11718
11719         last = wdev->cqm_config->last_rssi_event_value;
11720         hyst = wdev->cqm_config->rssi_hyst;
11721         n = wdev->cqm_config->n_rssi_thresholds;
11722
11723         for (i = 0; i < n; i++) {
11724                 i = array_index_nospec(i, n);
11725                 if (last < wdev->cqm_config->rssi_thresholds[i])
11726                         break;
11727         }
11728
11729         low_index = i - 1;
11730         if (low_index >= 0) {
11731                 low_index = array_index_nospec(low_index, n);
11732                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
11733         } else {
11734                 low = S32_MIN;
11735         }
11736         if (i < n) {
11737                 i = array_index_nospec(i, n);
11738                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
11739         } else {
11740                 high = S32_MAX;
11741         }
11742
11743         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
11744 }
11745
11746 static int nl80211_set_cqm_rssi(struct genl_info *info,
11747                                 const s32 *thresholds, int n_thresholds,
11748                                 u32 hysteresis)
11749 {
11750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11751         struct net_device *dev = info->user_ptr[1];
11752         struct wireless_dev *wdev = dev->ieee80211_ptr;
11753         int i, err;
11754         s32 prev = S32_MIN;
11755
11756         /* Check all values negative and sorted */
11757         for (i = 0; i < n_thresholds; i++) {
11758                 if (thresholds[i] > 0 || thresholds[i] <= prev)
11759                         return -EINVAL;
11760
11761                 prev = thresholds[i];
11762         }
11763
11764         if (wdev->iftype != NL80211_IFTYPE_STATION &&
11765             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
11766                 return -EOPNOTSUPP;
11767
11768         wdev_lock(wdev);
11769         cfg80211_cqm_config_free(wdev);
11770         wdev_unlock(wdev);
11771
11772         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
11773                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
11774                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
11775
11776                 return rdev_set_cqm_rssi_config(rdev, dev,
11777                                                 thresholds[0], hysteresis);
11778         }
11779
11780         if (!wiphy_ext_feature_isset(&rdev->wiphy,
11781                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
11782                 return -EOPNOTSUPP;
11783
11784         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
11785                 n_thresholds = 0;
11786
11787         wdev_lock(wdev);
11788         if (n_thresholds) {
11789                 struct cfg80211_cqm_config *cqm_config;
11790
11791                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
11792                                      n_thresholds * sizeof(s32), GFP_KERNEL);
11793                 if (!cqm_config) {
11794                         err = -ENOMEM;
11795                         goto unlock;
11796                 }
11797
11798                 cqm_config->rssi_hyst = hysteresis;
11799                 cqm_config->n_rssi_thresholds = n_thresholds;
11800                 memcpy(cqm_config->rssi_thresholds, thresholds,
11801                        n_thresholds * sizeof(s32));
11802
11803                 wdev->cqm_config = cqm_config;
11804         }
11805
11806         err = cfg80211_cqm_rssi_update(rdev, dev);
11807
11808 unlock:
11809         wdev_unlock(wdev);
11810
11811         return err;
11812 }
11813
11814 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
11815 {
11816         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
11817         struct nlattr *cqm;
11818         int err;
11819
11820         cqm = info->attrs[NL80211_ATTR_CQM];
11821         if (!cqm)
11822                 return -EINVAL;
11823
11824         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
11825                                           nl80211_attr_cqm_policy,
11826                                           info->extack);
11827         if (err)
11828                 return err;
11829
11830         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
11831             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
11832                 const s32 *thresholds =
11833                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11834                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
11835                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
11836
11837                 if (len % 4)
11838                         return -EINVAL;
11839
11840                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
11841                                             hysteresis);
11842         }
11843
11844         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
11845             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
11846             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
11847                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
11848                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
11849                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
11850
11851                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
11852         }
11853
11854         return -EINVAL;
11855 }
11856
11857 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
11858 {
11859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11860         struct net_device *dev = info->user_ptr[1];
11861         struct ocb_setup setup = {};
11862         int err;
11863
11864         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11865         if (err)
11866                 return err;
11867
11868         return cfg80211_join_ocb(rdev, dev, &setup);
11869 }
11870
11871 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
11872 {
11873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11874         struct net_device *dev = info->user_ptr[1];
11875
11876         return cfg80211_leave_ocb(rdev, dev);
11877 }
11878
11879 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
11880 {
11881         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11882         struct net_device *dev = info->user_ptr[1];
11883         struct mesh_config cfg;
11884         struct mesh_setup setup;
11885         int err;
11886
11887         /* start with default */
11888         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
11889         memcpy(&setup, &default_mesh_setup, sizeof(setup));
11890
11891         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
11892                 /* and parse parameters if given */
11893                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
11894                 if (err)
11895                         return err;
11896         }
11897
11898         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
11899             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
11900                 return -EINVAL;
11901
11902         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
11903         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
11904
11905         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11906             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
11907                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11908                         return -EINVAL;
11909
11910         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
11911                 setup.beacon_interval =
11912                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11913
11914                 err = cfg80211_validate_beacon_int(rdev,
11915                                                    NL80211_IFTYPE_MESH_POINT,
11916                                                    setup.beacon_interval);
11917                 if (err)
11918                         return err;
11919         }
11920
11921         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
11922                 setup.dtim_period =
11923                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
11924                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
11925                         return -EINVAL;
11926         }
11927
11928         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
11929                 /* parse additional setup parameters if given */
11930                 err = nl80211_parse_mesh_setup(info, &setup);
11931                 if (err)
11932                         return err;
11933         }
11934
11935         if (setup.user_mpm)
11936                 cfg.auto_open_plinks = false;
11937
11938         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
11939                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
11940                 if (err)
11941                         return err;
11942         } else {
11943                 /* __cfg80211_join_mesh() will sort it out */
11944                 setup.chandef.chan = NULL;
11945         }
11946
11947         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11948                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11949                 int n_rates =
11950                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11951                 struct ieee80211_supported_band *sband;
11952
11953                 if (!setup.chandef.chan)
11954                         return -EINVAL;
11955
11956                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
11957
11958                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11959                                              &setup.basic_rates);
11960                 if (err)
11961                         return err;
11962         }
11963
11964         if (info->attrs[NL80211_ATTR_TX_RATES]) {
11965                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
11966                                                     NL80211_ATTR_TX_RATES,
11967                                                     &setup.beacon_rate,
11968                                                     dev, false);
11969                 if (err)
11970                         return err;
11971
11972                 if (!setup.chandef.chan)
11973                         return -EINVAL;
11974
11975                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
11976                                               &setup.beacon_rate);
11977                 if (err)
11978                         return err;
11979         }
11980
11981         setup.userspace_handles_dfs =
11982                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11983
11984         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11985                 int r = validate_pae_over_nl80211(rdev, info);
11986
11987                 if (r < 0)
11988                         return r;
11989
11990                 setup.control_port_over_nl80211 = true;
11991         }
11992
11993         wdev_lock(dev->ieee80211_ptr);
11994         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
11995         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
11996                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11997         wdev_unlock(dev->ieee80211_ptr);
11998
11999         return err;
12000 }
12001
12002 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
12003 {
12004         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12005         struct net_device *dev = info->user_ptr[1];
12006
12007         return cfg80211_leave_mesh(rdev, dev);
12008 }
12009
12010 #ifdef CONFIG_PM
12011 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
12012                                         struct cfg80211_registered_device *rdev)
12013 {
12014         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
12015         struct nlattr *nl_pats, *nl_pat;
12016         int i, pat_len;
12017
12018         if (!wowlan->n_patterns)
12019                 return 0;
12020
12021         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
12022         if (!nl_pats)
12023                 return -ENOBUFS;
12024
12025         for (i = 0; i < wowlan->n_patterns; i++) {
12026                 nl_pat = nla_nest_start_noflag(msg, i + 1);
12027                 if (!nl_pat)
12028                         return -ENOBUFS;
12029                 pat_len = wowlan->patterns[i].pattern_len;
12030                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
12031                             wowlan->patterns[i].mask) ||
12032                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12033                             wowlan->patterns[i].pattern) ||
12034                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12035                                 wowlan->patterns[i].pkt_offset))
12036                         return -ENOBUFS;
12037                 nla_nest_end(msg, nl_pat);
12038         }
12039         nla_nest_end(msg, nl_pats);
12040
12041         return 0;
12042 }
12043
12044 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
12045                                    struct cfg80211_wowlan_tcp *tcp)
12046 {
12047         struct nlattr *nl_tcp;
12048
12049         if (!tcp)
12050                 return 0;
12051
12052         nl_tcp = nla_nest_start_noflag(msg,
12053                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
12054         if (!nl_tcp)
12055                 return -ENOBUFS;
12056
12057         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
12058             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
12059             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
12060             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
12061             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
12062             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
12063                     tcp->payload_len, tcp->payload) ||
12064             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
12065                         tcp->data_interval) ||
12066             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
12067                     tcp->wake_len, tcp->wake_data) ||
12068             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
12069                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
12070                 return -ENOBUFS;
12071
12072         if (tcp->payload_seq.len &&
12073             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
12074                     sizeof(tcp->payload_seq), &tcp->payload_seq))
12075                 return -ENOBUFS;
12076
12077         if (tcp->payload_tok.len &&
12078             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
12079                     sizeof(tcp->payload_tok) + tcp->tokens_size,
12080                     &tcp->payload_tok))
12081                 return -ENOBUFS;
12082
12083         nla_nest_end(msg, nl_tcp);
12084
12085         return 0;
12086 }
12087
12088 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
12089                                   struct cfg80211_sched_scan_request *req)
12090 {
12091         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
12092         int i;
12093
12094         if (!req)
12095                 return 0;
12096
12097         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
12098         if (!nd)
12099                 return -ENOBUFS;
12100
12101         if (req->n_scan_plans == 1 &&
12102             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
12103                         req->scan_plans[0].interval * 1000))
12104                 return -ENOBUFS;
12105
12106         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
12107                 return -ENOBUFS;
12108
12109         if (req->relative_rssi_set) {
12110                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
12111
12112                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
12113                                req->relative_rssi))
12114                         return -ENOBUFS;
12115
12116                 rssi_adjust.band = req->rssi_adjust.band;
12117                 rssi_adjust.delta = req->rssi_adjust.delta;
12118                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
12119                             sizeof(rssi_adjust), &rssi_adjust))
12120                         return -ENOBUFS;
12121         }
12122
12123         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
12124         if (!freqs)
12125                 return -ENOBUFS;
12126
12127         for (i = 0; i < req->n_channels; i++) {
12128                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
12129                         return -ENOBUFS;
12130         }
12131
12132         nla_nest_end(msg, freqs);
12133
12134         if (req->n_match_sets) {
12135                 matches = nla_nest_start_noflag(msg,
12136                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
12137                 if (!matches)
12138                         return -ENOBUFS;
12139
12140                 for (i = 0; i < req->n_match_sets; i++) {
12141                         match = nla_nest_start_noflag(msg, i);
12142                         if (!match)
12143                                 return -ENOBUFS;
12144
12145                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
12146                                     req->match_sets[i].ssid.ssid_len,
12147                                     req->match_sets[i].ssid.ssid))
12148                                 return -ENOBUFS;
12149                         nla_nest_end(msg, match);
12150                 }
12151                 nla_nest_end(msg, matches);
12152         }
12153
12154         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
12155         if (!scan_plans)
12156                 return -ENOBUFS;
12157
12158         for (i = 0; i < req->n_scan_plans; i++) {
12159                 scan_plan = nla_nest_start_noflag(msg, i + 1);
12160                 if (!scan_plan)
12161                         return -ENOBUFS;
12162
12163                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
12164                                 req->scan_plans[i].interval) ||
12165                     (req->scan_plans[i].iterations &&
12166                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
12167                                  req->scan_plans[i].iterations)))
12168                         return -ENOBUFS;
12169                 nla_nest_end(msg, scan_plan);
12170         }
12171         nla_nest_end(msg, scan_plans);
12172
12173         nla_nest_end(msg, nd);
12174
12175         return 0;
12176 }
12177
12178 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
12179 {
12180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12181         struct sk_buff *msg;
12182         void *hdr;
12183         u32 size = NLMSG_DEFAULT_SIZE;
12184
12185         if (!rdev->wiphy.wowlan)
12186                 return -EOPNOTSUPP;
12187
12188         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
12189                 /* adjust size to have room for all the data */
12190                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
12191                         rdev->wiphy.wowlan_config->tcp->payload_len +
12192                         rdev->wiphy.wowlan_config->tcp->wake_len +
12193                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
12194         }
12195
12196         msg = nlmsg_new(size, GFP_KERNEL);
12197         if (!msg)
12198                 return -ENOMEM;
12199
12200         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12201                              NL80211_CMD_GET_WOWLAN);
12202         if (!hdr)
12203                 goto nla_put_failure;
12204
12205         if (rdev->wiphy.wowlan_config) {
12206                 struct nlattr *nl_wowlan;
12207
12208                 nl_wowlan = nla_nest_start_noflag(msg,
12209                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
12210                 if (!nl_wowlan)
12211                         goto nla_put_failure;
12212
12213                 if ((rdev->wiphy.wowlan_config->any &&
12214                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
12215                     (rdev->wiphy.wowlan_config->disconnect &&
12216                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
12217                     (rdev->wiphy.wowlan_config->magic_pkt &&
12218                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
12219                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
12220                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
12221                     (rdev->wiphy.wowlan_config->eap_identity_req &&
12222                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
12223                     (rdev->wiphy.wowlan_config->four_way_handshake &&
12224                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
12225                     (rdev->wiphy.wowlan_config->rfkill_release &&
12226                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
12227                         goto nla_put_failure;
12228
12229                 if (nl80211_send_wowlan_patterns(msg, rdev))
12230                         goto nla_put_failure;
12231
12232                 if (nl80211_send_wowlan_tcp(msg,
12233                                             rdev->wiphy.wowlan_config->tcp))
12234                         goto nla_put_failure;
12235
12236                 if (nl80211_send_wowlan_nd(
12237                             msg,
12238                             rdev->wiphy.wowlan_config->nd_config))
12239                         goto nla_put_failure;
12240
12241                 nla_nest_end(msg, nl_wowlan);
12242         }
12243
12244         genlmsg_end(msg, hdr);
12245         return genlmsg_reply(msg, info);
12246
12247 nla_put_failure:
12248         nlmsg_free(msg);
12249         return -ENOBUFS;
12250 }
12251
12252 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
12253                                     struct nlattr *attr,
12254                                     struct cfg80211_wowlan *trig)
12255 {
12256         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
12257         struct cfg80211_wowlan_tcp *cfg;
12258         struct nl80211_wowlan_tcp_data_token *tok = NULL;
12259         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
12260         u32 size;
12261         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
12262         int err, port;
12263
12264         if (!rdev->wiphy.wowlan->tcp)
12265                 return -EINVAL;
12266
12267         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
12268                                           nl80211_wowlan_tcp_policy, NULL);
12269         if (err)
12270                 return err;
12271
12272         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
12273             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
12274             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
12275             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
12276             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
12277             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
12278             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
12279             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
12280                 return -EINVAL;
12281
12282         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
12283         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
12284                 return -EINVAL;
12285
12286         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
12287                         rdev->wiphy.wowlan->tcp->data_interval_max ||
12288             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
12289                 return -EINVAL;
12290
12291         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
12292         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
12293                 return -EINVAL;
12294
12295         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
12296         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
12297                 return -EINVAL;
12298
12299         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
12300                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12301
12302                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
12303                 tokens_size = tokln - sizeof(*tok);
12304
12305                 if (!tok->len || tokens_size % tok->len)
12306                         return -EINVAL;
12307                 if (!rdev->wiphy.wowlan->tcp->tok)
12308                         return -EINVAL;
12309                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
12310                         return -EINVAL;
12311                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
12312                         return -EINVAL;
12313                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
12314                         return -EINVAL;
12315                 if (tok->offset + tok->len > data_size)
12316                         return -EINVAL;
12317         }
12318
12319         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
12320                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
12321                 if (!rdev->wiphy.wowlan->tcp->seq)
12322                         return -EINVAL;
12323                 if (seq->len == 0 || seq->len > 4)
12324                         return -EINVAL;
12325                 if (seq->len + seq->offset > data_size)
12326                         return -EINVAL;
12327         }
12328
12329         size = sizeof(*cfg);
12330         size += data_size;
12331         size += wake_size + wake_mask_size;
12332         size += tokens_size;
12333
12334         cfg = kzalloc(size, GFP_KERNEL);
12335         if (!cfg)
12336                 return -ENOMEM;
12337         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
12338         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
12339         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
12340                ETH_ALEN);
12341         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
12342                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
12343         else
12344                 port = 0;
12345 #ifdef CONFIG_INET
12346         /* allocate a socket and port for it and use it */
12347         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
12348                             IPPROTO_TCP, &cfg->sock, 1);
12349         if (err) {
12350                 kfree(cfg);
12351                 return err;
12352         }
12353         if (inet_csk_get_port(cfg->sock->sk, port)) {
12354                 sock_release(cfg->sock);
12355                 kfree(cfg);
12356                 return -EADDRINUSE;
12357         }
12358         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
12359 #else
12360         if (!port) {
12361                 kfree(cfg);
12362                 return -EINVAL;
12363         }
12364         cfg->src_port = port;
12365 #endif
12366
12367         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
12368         cfg->payload_len = data_size;
12369         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
12370         memcpy((void *)cfg->payload,
12371                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
12372                data_size);
12373         if (seq)
12374                 cfg->payload_seq = *seq;
12375         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
12376         cfg->wake_len = wake_size;
12377         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
12378         memcpy((void *)cfg->wake_data,
12379                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
12380                wake_size);
12381         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
12382                          data_size + wake_size;
12383         memcpy((void *)cfg->wake_mask,
12384                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
12385                wake_mask_size);
12386         if (tok) {
12387                 cfg->tokens_size = tokens_size;
12388                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
12389         }
12390
12391         trig->tcp = cfg;
12392
12393         return 0;
12394 }
12395
12396 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
12397                                    const struct wiphy_wowlan_support *wowlan,
12398                                    struct nlattr *attr,
12399                                    struct cfg80211_wowlan *trig)
12400 {
12401         struct nlattr **tb;
12402         int err;
12403
12404         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
12405         if (!tb)
12406                 return -ENOMEM;
12407
12408         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
12409                 err = -EOPNOTSUPP;
12410                 goto out;
12411         }
12412
12413         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
12414                                           nl80211_policy, NULL);
12415         if (err)
12416                 goto out;
12417
12418         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
12419                                                    wowlan->max_nd_match_sets);
12420         err = PTR_ERR_OR_ZERO(trig->nd_config);
12421         if (err)
12422                 trig->nd_config = NULL;
12423
12424 out:
12425         kfree(tb);
12426         return err;
12427 }
12428
12429 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
12430 {
12431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12432         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
12433         struct cfg80211_wowlan new_triggers = {};
12434         struct cfg80211_wowlan *ntrig;
12435         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
12436         int err, i;
12437         bool prev_enabled = rdev->wiphy.wowlan_config;
12438         bool regular = false;
12439
12440         if (!wowlan)
12441                 return -EOPNOTSUPP;
12442
12443         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
12444                 cfg80211_rdev_free_wowlan(rdev);
12445                 rdev->wiphy.wowlan_config = NULL;
12446                 goto set_wakeup;
12447         }
12448
12449         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
12450                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
12451                                           nl80211_wowlan_policy, info->extack);
12452         if (err)
12453                 return err;
12454
12455         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
12456                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
12457                         return -EINVAL;
12458                 new_triggers.any = true;
12459         }
12460
12461         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
12462                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
12463                         return -EINVAL;
12464                 new_triggers.disconnect = true;
12465                 regular = true;
12466         }
12467
12468         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
12469                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
12470                         return -EINVAL;
12471                 new_triggers.magic_pkt = true;
12472                 regular = true;
12473         }
12474
12475         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
12476                 return -EINVAL;
12477
12478         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
12479                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
12480                         return -EINVAL;
12481                 new_triggers.gtk_rekey_failure = true;
12482                 regular = true;
12483         }
12484
12485         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
12486                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
12487                         return -EINVAL;
12488                 new_triggers.eap_identity_req = true;
12489                 regular = true;
12490         }
12491
12492         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
12493                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
12494                         return -EINVAL;
12495                 new_triggers.four_way_handshake = true;
12496                 regular = true;
12497         }
12498
12499         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
12500                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
12501                         return -EINVAL;
12502                 new_triggers.rfkill_release = true;
12503                 regular = true;
12504         }
12505
12506         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
12507                 struct nlattr *pat;
12508                 int n_patterns = 0;
12509                 int rem, pat_len, mask_len, pkt_offset;
12510                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12511
12512                 regular = true;
12513
12514                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12515                                     rem)
12516                         n_patterns++;
12517                 if (n_patterns > wowlan->n_patterns)
12518                         return -EINVAL;
12519
12520                 new_triggers.patterns = kcalloc(n_patterns,
12521                                                 sizeof(new_triggers.patterns[0]),
12522                                                 GFP_KERNEL);
12523                 if (!new_triggers.patterns)
12524                         return -ENOMEM;
12525
12526                 new_triggers.n_patterns = n_patterns;
12527                 i = 0;
12528
12529                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
12530                                     rem) {
12531                         u8 *mask_pat;
12532
12533                         err = nla_parse_nested_deprecated(pat_tb,
12534                                                           MAX_NL80211_PKTPAT,
12535                                                           pat,
12536                                                           nl80211_packet_pattern_policy,
12537                                                           info->extack);
12538                         if (err)
12539                                 goto error;
12540
12541                         err = -EINVAL;
12542                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
12543                             !pat_tb[NL80211_PKTPAT_PATTERN])
12544                                 goto error;
12545                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12546                         mask_len = DIV_ROUND_UP(pat_len, 8);
12547                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12548                                 goto error;
12549                         if (pat_len > wowlan->pattern_max_len ||
12550                             pat_len < wowlan->pattern_min_len)
12551                                 goto error;
12552
12553                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
12554                                 pkt_offset = 0;
12555                         else
12556                                 pkt_offset = nla_get_u32(
12557                                         pat_tb[NL80211_PKTPAT_OFFSET]);
12558                         if (pkt_offset > wowlan->max_pkt_offset)
12559                                 goto error;
12560                         new_triggers.patterns[i].pkt_offset = pkt_offset;
12561
12562                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12563                         if (!mask_pat) {
12564                                 err = -ENOMEM;
12565                                 goto error;
12566                         }
12567                         new_triggers.patterns[i].mask = mask_pat;
12568                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12569                                mask_len);
12570                         mask_pat += mask_len;
12571                         new_triggers.patterns[i].pattern = mask_pat;
12572                         new_triggers.patterns[i].pattern_len = pat_len;
12573                         memcpy(mask_pat,
12574                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12575                                pat_len);
12576                         i++;
12577                 }
12578         }
12579
12580         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
12581                 regular = true;
12582                 err = nl80211_parse_wowlan_tcp(
12583                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
12584                         &new_triggers);
12585                 if (err)
12586                         goto error;
12587         }
12588
12589         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
12590                 regular = true;
12591                 err = nl80211_parse_wowlan_nd(
12592                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
12593                         &new_triggers);
12594                 if (err)
12595                         goto error;
12596         }
12597
12598         /* The 'any' trigger means the device continues operating more or less
12599          * as in its normal operation mode and wakes up the host on most of the
12600          * normal interrupts (like packet RX, ...)
12601          * It therefore makes little sense to combine with the more constrained
12602          * wakeup trigger modes.
12603          */
12604         if (new_triggers.any && regular) {
12605                 err = -EINVAL;
12606                 goto error;
12607         }
12608
12609         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
12610         if (!ntrig) {
12611                 err = -ENOMEM;
12612                 goto error;
12613         }
12614         cfg80211_rdev_free_wowlan(rdev);
12615         rdev->wiphy.wowlan_config = ntrig;
12616
12617  set_wakeup:
12618         if (rdev->ops->set_wakeup &&
12619             prev_enabled != !!rdev->wiphy.wowlan_config)
12620                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
12621
12622         return 0;
12623  error:
12624         for (i = 0; i < new_triggers.n_patterns; i++)
12625                 kfree(new_triggers.patterns[i].mask);
12626         kfree(new_triggers.patterns);
12627         if (new_triggers.tcp && new_triggers.tcp->sock)
12628                 sock_release(new_triggers.tcp->sock);
12629         kfree(new_triggers.tcp);
12630         kfree(new_triggers.nd_config);
12631         return err;
12632 }
12633 #endif
12634
12635 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
12636                                        struct cfg80211_registered_device *rdev)
12637 {
12638         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
12639         int i, j, pat_len;
12640         struct cfg80211_coalesce_rules *rule;
12641
12642         if (!rdev->coalesce->n_rules)
12643                 return 0;
12644
12645         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
12646         if (!nl_rules)
12647                 return -ENOBUFS;
12648
12649         for (i = 0; i < rdev->coalesce->n_rules; i++) {
12650                 nl_rule = nla_nest_start_noflag(msg, i + 1);
12651                 if (!nl_rule)
12652                         return -ENOBUFS;
12653
12654                 rule = &rdev->coalesce->rules[i];
12655                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
12656                                 rule->delay))
12657                         return -ENOBUFS;
12658
12659                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
12660                                 rule->condition))
12661                         return -ENOBUFS;
12662
12663                 nl_pats = nla_nest_start_noflag(msg,
12664                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
12665                 if (!nl_pats)
12666                         return -ENOBUFS;
12667
12668                 for (j = 0; j < rule->n_patterns; j++) {
12669                         nl_pat = nla_nest_start_noflag(msg, j + 1);
12670                         if (!nl_pat)
12671                                 return -ENOBUFS;
12672                         pat_len = rule->patterns[j].pattern_len;
12673                         if (nla_put(msg, NL80211_PKTPAT_MASK,
12674                                     DIV_ROUND_UP(pat_len, 8),
12675                                     rule->patterns[j].mask) ||
12676                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
12677                                     rule->patterns[j].pattern) ||
12678                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
12679                                         rule->patterns[j].pkt_offset))
12680                                 return -ENOBUFS;
12681                         nla_nest_end(msg, nl_pat);
12682                 }
12683                 nla_nest_end(msg, nl_pats);
12684                 nla_nest_end(msg, nl_rule);
12685         }
12686         nla_nest_end(msg, nl_rules);
12687
12688         return 0;
12689 }
12690
12691 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
12692 {
12693         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12694         struct sk_buff *msg;
12695         void *hdr;
12696
12697         if (!rdev->wiphy.coalesce)
12698                 return -EOPNOTSUPP;
12699
12700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12701         if (!msg)
12702                 return -ENOMEM;
12703
12704         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12705                              NL80211_CMD_GET_COALESCE);
12706         if (!hdr)
12707                 goto nla_put_failure;
12708
12709         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
12710                 goto nla_put_failure;
12711
12712         genlmsg_end(msg, hdr);
12713         return genlmsg_reply(msg, info);
12714
12715 nla_put_failure:
12716         nlmsg_free(msg);
12717         return -ENOBUFS;
12718 }
12719
12720 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
12721 {
12722         struct cfg80211_coalesce *coalesce = rdev->coalesce;
12723         int i, j;
12724         struct cfg80211_coalesce_rules *rule;
12725
12726         if (!coalesce)
12727                 return;
12728
12729         for (i = 0; i < coalesce->n_rules; i++) {
12730                 rule = &coalesce->rules[i];
12731                 for (j = 0; j < rule->n_patterns; j++)
12732                         kfree(rule->patterns[j].mask);
12733                 kfree(rule->patterns);
12734         }
12735         kfree(coalesce->rules);
12736         kfree(coalesce);
12737         rdev->coalesce = NULL;
12738 }
12739
12740 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
12741                                        struct nlattr *rule,
12742                                        struct cfg80211_coalesce_rules *new_rule)
12743 {
12744         int err, i;
12745         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12746         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
12747         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
12748         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
12749
12750         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
12751                                           rule, nl80211_coalesce_policy, NULL);
12752         if (err)
12753                 return err;
12754
12755         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
12756                 new_rule->delay =
12757                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
12758         if (new_rule->delay > coalesce->max_delay)
12759                 return -EINVAL;
12760
12761         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
12762                 new_rule->condition =
12763                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
12764
12765         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
12766                 return -EINVAL;
12767
12768         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12769                             rem)
12770                 n_patterns++;
12771         if (n_patterns > coalesce->n_patterns)
12772                 return -EINVAL;
12773
12774         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
12775                                      GFP_KERNEL);
12776         if (!new_rule->patterns)
12777                 return -ENOMEM;
12778
12779         new_rule->n_patterns = n_patterns;
12780         i = 0;
12781
12782         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
12783                             rem) {
12784                 u8 *mask_pat;
12785
12786                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
12787                                                   pat,
12788                                                   nl80211_packet_pattern_policy,
12789                                                   NULL);
12790                 if (err)
12791                         return err;
12792
12793                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
12794                     !pat_tb[NL80211_PKTPAT_PATTERN])
12795                         return -EINVAL;
12796                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
12797                 mask_len = DIV_ROUND_UP(pat_len, 8);
12798                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
12799                         return -EINVAL;
12800                 if (pat_len > coalesce->pattern_max_len ||
12801                     pat_len < coalesce->pattern_min_len)
12802                         return -EINVAL;
12803
12804                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
12805                         pkt_offset = 0;
12806                 else
12807                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
12808                 if (pkt_offset > coalesce->max_pkt_offset)
12809                         return -EINVAL;
12810                 new_rule->patterns[i].pkt_offset = pkt_offset;
12811
12812                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
12813                 if (!mask_pat)
12814                         return -ENOMEM;
12815
12816                 new_rule->patterns[i].mask = mask_pat;
12817                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
12818                        mask_len);
12819
12820                 mask_pat += mask_len;
12821                 new_rule->patterns[i].pattern = mask_pat;
12822                 new_rule->patterns[i].pattern_len = pat_len;
12823                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
12824                        pat_len);
12825                 i++;
12826         }
12827
12828         return 0;
12829 }
12830
12831 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
12832 {
12833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12834         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
12835         struct cfg80211_coalesce new_coalesce = {};
12836         struct cfg80211_coalesce *n_coalesce;
12837         int err, rem_rule, n_rules = 0, i, j;
12838         struct nlattr *rule;
12839         struct cfg80211_coalesce_rules *tmp_rule;
12840
12841         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
12842                 return -EOPNOTSUPP;
12843
12844         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
12845                 cfg80211_rdev_free_coalesce(rdev);
12846                 rdev_set_coalesce(rdev, NULL);
12847                 return 0;
12848         }
12849
12850         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12851                             rem_rule)
12852                 n_rules++;
12853         if (n_rules > coalesce->n_rules)
12854                 return -EINVAL;
12855
12856         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
12857                                      GFP_KERNEL);
12858         if (!new_coalesce.rules)
12859                 return -ENOMEM;
12860
12861         new_coalesce.n_rules = n_rules;
12862         i = 0;
12863
12864         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
12865                             rem_rule) {
12866                 err = nl80211_parse_coalesce_rule(rdev, rule,
12867                                                   &new_coalesce.rules[i]);
12868                 if (err)
12869                         goto error;
12870
12871                 i++;
12872         }
12873
12874         err = rdev_set_coalesce(rdev, &new_coalesce);
12875         if (err)
12876                 goto error;
12877
12878         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
12879         if (!n_coalesce) {
12880                 err = -ENOMEM;
12881                 goto error;
12882         }
12883         cfg80211_rdev_free_coalesce(rdev);
12884         rdev->coalesce = n_coalesce;
12885
12886         return 0;
12887 error:
12888         for (i = 0; i < new_coalesce.n_rules; i++) {
12889                 tmp_rule = &new_coalesce.rules[i];
12890                 for (j = 0; j < tmp_rule->n_patterns; j++)
12891                         kfree(tmp_rule->patterns[j].mask);
12892                 kfree(tmp_rule->patterns);
12893         }
12894         kfree(new_coalesce.rules);
12895
12896         return err;
12897 }
12898
12899 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
12900 {
12901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12902         struct net_device *dev = info->user_ptr[1];
12903         struct wireless_dev *wdev = dev->ieee80211_ptr;
12904         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
12905         struct cfg80211_gtk_rekey_data rekey_data = {};
12906         int err;
12907
12908         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
12909                 return -EINVAL;
12910
12911         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
12912                                           info->attrs[NL80211_ATTR_REKEY_DATA],
12913                                           nl80211_rekey_policy, info->extack);
12914         if (err)
12915                 return err;
12916
12917         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
12918             !tb[NL80211_REKEY_DATA_KCK])
12919                 return -EINVAL;
12920         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
12921             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12922               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
12923                 return -ERANGE;
12924         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
12925             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
12926               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN))
12927                 return -ERANGE;
12928
12929         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
12930         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
12931         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
12932         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
12933         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
12934         if (tb[NL80211_REKEY_DATA_AKM])
12935                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
12936
12937         wdev_lock(wdev);
12938         if (!wdev->current_bss) {
12939                 err = -ENOTCONN;
12940                 goto out;
12941         }
12942
12943         if (!rdev->ops->set_rekey_data) {
12944                 err = -EOPNOTSUPP;
12945                 goto out;
12946         }
12947
12948         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
12949  out:
12950         wdev_unlock(wdev);
12951         return err;
12952 }
12953
12954 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
12955                                              struct genl_info *info)
12956 {
12957         struct net_device *dev = info->user_ptr[1];
12958         struct wireless_dev *wdev = dev->ieee80211_ptr;
12959
12960         if (wdev->iftype != NL80211_IFTYPE_AP &&
12961             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12962                 return -EINVAL;
12963
12964         if (wdev->ap_unexpected_nlportid)
12965                 return -EBUSY;
12966
12967         wdev->ap_unexpected_nlportid = info->snd_portid;
12968         return 0;
12969 }
12970
12971 static int nl80211_probe_client(struct sk_buff *skb,
12972                                 struct genl_info *info)
12973 {
12974         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12975         struct net_device *dev = info->user_ptr[1];
12976         struct wireless_dev *wdev = dev->ieee80211_ptr;
12977         struct sk_buff *msg;
12978         void *hdr;
12979         const u8 *addr;
12980         u64 cookie;
12981         int err;
12982
12983         if (wdev->iftype != NL80211_IFTYPE_AP &&
12984             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12985                 return -EOPNOTSUPP;
12986
12987         if (!info->attrs[NL80211_ATTR_MAC])
12988                 return -EINVAL;
12989
12990         if (!rdev->ops->probe_client)
12991                 return -EOPNOTSUPP;
12992
12993         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12994         if (!msg)
12995                 return -ENOMEM;
12996
12997         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12998                              NL80211_CMD_PROBE_CLIENT);
12999         if (!hdr) {
13000                 err = -ENOBUFS;
13001                 goto free_msg;
13002         }
13003
13004         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
13005
13006         err = rdev_probe_client(rdev, dev, addr, &cookie);
13007         if (err)
13008                 goto free_msg;
13009
13010         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13011                               NL80211_ATTR_PAD))
13012                 goto nla_put_failure;
13013
13014         genlmsg_end(msg, hdr);
13015
13016         return genlmsg_reply(msg, info);
13017
13018  nla_put_failure:
13019         err = -ENOBUFS;
13020  free_msg:
13021         nlmsg_free(msg);
13022         return err;
13023 }
13024
13025 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
13026 {
13027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13028         struct cfg80211_beacon_registration *reg, *nreg;
13029         int rv;
13030
13031         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
13032                 return -EOPNOTSUPP;
13033
13034         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
13035         if (!nreg)
13036                 return -ENOMEM;
13037
13038         /* First, check if already registered. */
13039         spin_lock_bh(&rdev->beacon_registrations_lock);
13040         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
13041                 if (reg->nlportid == info->snd_portid) {
13042                         rv = -EALREADY;
13043                         goto out_err;
13044                 }
13045         }
13046         /* Add it to the list */
13047         nreg->nlportid = info->snd_portid;
13048         list_add(&nreg->list, &rdev->beacon_registrations);
13049
13050         spin_unlock_bh(&rdev->beacon_registrations_lock);
13051
13052         return 0;
13053 out_err:
13054         spin_unlock_bh(&rdev->beacon_registrations_lock);
13055         kfree(nreg);
13056         return rv;
13057 }
13058
13059 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
13060 {
13061         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13062         struct wireless_dev *wdev = info->user_ptr[1];
13063         int err;
13064
13065         if (!rdev->ops->start_p2p_device)
13066                 return -EOPNOTSUPP;
13067
13068         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13069                 return -EOPNOTSUPP;
13070
13071         if (wdev_running(wdev))
13072                 return 0;
13073
13074         if (rfkill_blocked(rdev->wiphy.rfkill))
13075                 return -ERFKILL;
13076
13077         err = rdev_start_p2p_device(rdev, wdev);
13078         if (err)
13079                 return err;
13080
13081         wdev->is_running = true;
13082         rdev->opencount++;
13083
13084         return 0;
13085 }
13086
13087 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
13088 {
13089         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13090         struct wireless_dev *wdev = info->user_ptr[1];
13091
13092         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
13093                 return -EOPNOTSUPP;
13094
13095         if (!rdev->ops->stop_p2p_device)
13096                 return -EOPNOTSUPP;
13097
13098         cfg80211_stop_p2p_device(rdev, wdev);
13099
13100         return 0;
13101 }
13102
13103 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
13104 {
13105         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13106         struct wireless_dev *wdev = info->user_ptr[1];
13107         struct cfg80211_nan_conf conf = {};
13108         int err;
13109
13110         if (wdev->iftype != NL80211_IFTYPE_NAN)
13111                 return -EOPNOTSUPP;
13112
13113         if (wdev_running(wdev))
13114                 return -EEXIST;
13115
13116         if (rfkill_blocked(rdev->wiphy.rfkill))
13117                 return -ERFKILL;
13118
13119         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
13120                 return -EINVAL;
13121
13122         conf.master_pref =
13123                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13124
13125         if (info->attrs[NL80211_ATTR_BANDS]) {
13126                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13127
13128                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13129                         return -EOPNOTSUPP;
13130
13131                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13132                         return -EINVAL;
13133
13134                 conf.bands = bands;
13135         }
13136
13137         err = rdev_start_nan(rdev, wdev, &conf);
13138         if (err)
13139                 return err;
13140
13141         wdev->is_running = true;
13142         rdev->opencount++;
13143
13144         return 0;
13145 }
13146
13147 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
13148 {
13149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13150         struct wireless_dev *wdev = info->user_ptr[1];
13151
13152         if (wdev->iftype != NL80211_IFTYPE_NAN)
13153                 return -EOPNOTSUPP;
13154
13155         cfg80211_stop_nan(rdev, wdev);
13156
13157         return 0;
13158 }
13159
13160 static int validate_nan_filter(struct nlattr *filter_attr)
13161 {
13162         struct nlattr *attr;
13163         int len = 0, n_entries = 0, rem;
13164
13165         nla_for_each_nested(attr, filter_attr, rem) {
13166                 len += nla_len(attr);
13167                 n_entries++;
13168         }
13169
13170         if (len >= U8_MAX)
13171                 return -EINVAL;
13172
13173         return n_entries;
13174 }
13175
13176 static int handle_nan_filter(struct nlattr *attr_filter,
13177                              struct cfg80211_nan_func *func,
13178                              bool tx)
13179 {
13180         struct nlattr *attr;
13181         int n_entries, rem, i;
13182         struct cfg80211_nan_func_filter *filter;
13183
13184         n_entries = validate_nan_filter(attr_filter);
13185         if (n_entries < 0)
13186                 return n_entries;
13187
13188         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
13189
13190         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
13191         if (!filter)
13192                 return -ENOMEM;
13193
13194         i = 0;
13195         nla_for_each_nested(attr, attr_filter, rem) {
13196                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
13197                 if (!filter[i].filter)
13198                         goto err;
13199
13200                 filter[i].len = nla_len(attr);
13201                 i++;
13202         }
13203         if (tx) {
13204                 func->num_tx_filters = n_entries;
13205                 func->tx_filters = filter;
13206         } else {
13207                 func->num_rx_filters = n_entries;
13208                 func->rx_filters = filter;
13209         }
13210
13211         return 0;
13212
13213 err:
13214         i = 0;
13215         nla_for_each_nested(attr, attr_filter, rem) {
13216                 kfree(filter[i].filter);
13217                 i++;
13218         }
13219         kfree(filter);
13220         return -ENOMEM;
13221 }
13222
13223 static int nl80211_nan_add_func(struct sk_buff *skb,
13224                                 struct genl_info *info)
13225 {
13226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13227         struct wireless_dev *wdev = info->user_ptr[1];
13228         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
13229         struct cfg80211_nan_func *func;
13230         struct sk_buff *msg = NULL;
13231         void *hdr = NULL;
13232         int err = 0;
13233
13234         if (wdev->iftype != NL80211_IFTYPE_NAN)
13235                 return -EOPNOTSUPP;
13236
13237         if (!wdev_running(wdev))
13238                 return -ENOTCONN;
13239
13240         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
13241                 return -EINVAL;
13242
13243         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
13244                                           info->attrs[NL80211_ATTR_NAN_FUNC],
13245                                           nl80211_nan_func_policy,
13246                                           info->extack);
13247         if (err)
13248                 return err;
13249
13250         func = kzalloc(sizeof(*func), GFP_KERNEL);
13251         if (!func)
13252                 return -ENOMEM;
13253
13254         func->cookie = cfg80211_assign_cookie(rdev);
13255
13256         if (!tb[NL80211_NAN_FUNC_TYPE]) {
13257                 err = -EINVAL;
13258                 goto out;
13259         }
13260
13261
13262         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
13263
13264         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
13265                 err = -EINVAL;
13266                 goto out;
13267         }
13268
13269         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
13270                sizeof(func->service_id));
13271
13272         func->close_range =
13273                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
13274
13275         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
13276                 func->serv_spec_info_len =
13277                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
13278                 func->serv_spec_info =
13279                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
13280                                 func->serv_spec_info_len,
13281                                 GFP_KERNEL);
13282                 if (!func->serv_spec_info) {
13283                         err = -ENOMEM;
13284                         goto out;
13285                 }
13286         }
13287
13288         if (tb[NL80211_NAN_FUNC_TTL])
13289                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
13290
13291         switch (func->type) {
13292         case NL80211_NAN_FUNC_PUBLISH:
13293                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
13294                         err = -EINVAL;
13295                         goto out;
13296                 }
13297
13298                 func->publish_type =
13299                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
13300                 func->publish_bcast =
13301                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
13302
13303                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
13304                         func->publish_bcast) {
13305                         err = -EINVAL;
13306                         goto out;
13307                 }
13308                 break;
13309         case NL80211_NAN_FUNC_SUBSCRIBE:
13310                 func->subscribe_active =
13311                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
13312                 break;
13313         case NL80211_NAN_FUNC_FOLLOW_UP:
13314                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
13315                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
13316                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
13317                         err = -EINVAL;
13318                         goto out;
13319                 }
13320
13321                 func->followup_id =
13322                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
13323                 func->followup_reqid =
13324                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
13325                 memcpy(func->followup_dest.addr,
13326                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
13327                        sizeof(func->followup_dest.addr));
13328                 if (func->ttl) {
13329                         err = -EINVAL;
13330                         goto out;
13331                 }
13332                 break;
13333         default:
13334                 err = -EINVAL;
13335                 goto out;
13336         }
13337
13338         if (tb[NL80211_NAN_FUNC_SRF]) {
13339                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
13340
13341                 err = nla_parse_nested_deprecated(srf_tb,
13342                                                   NL80211_NAN_SRF_ATTR_MAX,
13343                                                   tb[NL80211_NAN_FUNC_SRF],
13344                                                   nl80211_nan_srf_policy,
13345                                                   info->extack);
13346                 if (err)
13347                         goto out;
13348
13349                 func->srf_include =
13350                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
13351
13352                 if (srf_tb[NL80211_NAN_SRF_BF]) {
13353                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
13354                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
13355                                 err = -EINVAL;
13356                                 goto out;
13357                         }
13358
13359                         func->srf_bf_len =
13360                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
13361                         func->srf_bf =
13362                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
13363                                         func->srf_bf_len, GFP_KERNEL);
13364                         if (!func->srf_bf) {
13365                                 err = -ENOMEM;
13366                                 goto out;
13367                         }
13368
13369                         func->srf_bf_idx =
13370                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
13371                 } else {
13372                         struct nlattr *attr, *mac_attr =
13373                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
13374                         int n_entries, rem, i = 0;
13375
13376                         if (!mac_attr) {
13377                                 err = -EINVAL;
13378                                 goto out;
13379                         }
13380
13381                         n_entries = validate_acl_mac_addrs(mac_attr);
13382                         if (n_entries <= 0) {
13383                                 err = -EINVAL;
13384                                 goto out;
13385                         }
13386
13387                         func->srf_num_macs = n_entries;
13388                         func->srf_macs =
13389                                 kcalloc(n_entries, sizeof(*func->srf_macs),
13390                                         GFP_KERNEL);
13391                         if (!func->srf_macs) {
13392                                 err = -ENOMEM;
13393                                 goto out;
13394                         }
13395
13396                         nla_for_each_nested(attr, mac_attr, rem)
13397                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
13398                                        sizeof(*func->srf_macs));
13399                 }
13400         }
13401
13402         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
13403                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
13404                                         func, true);
13405                 if (err)
13406                         goto out;
13407         }
13408
13409         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
13410                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
13411                                         func, false);
13412                 if (err)
13413                         goto out;
13414         }
13415
13416         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13417         if (!msg) {
13418                 err = -ENOMEM;
13419                 goto out;
13420         }
13421
13422         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13423                              NL80211_CMD_ADD_NAN_FUNCTION);
13424         /* This can't really happen - we just allocated 4KB */
13425         if (WARN_ON(!hdr)) {
13426                 err = -ENOMEM;
13427                 goto out;
13428         }
13429
13430         err = rdev_add_nan_func(rdev, wdev, func);
13431 out:
13432         if (err < 0) {
13433                 cfg80211_free_nan_func(func);
13434                 nlmsg_free(msg);
13435                 return err;
13436         }
13437
13438         /* propagate the instance id and cookie to userspace  */
13439         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
13440                               NL80211_ATTR_PAD))
13441                 goto nla_put_failure;
13442
13443         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13444         if (!func_attr)
13445                 goto nla_put_failure;
13446
13447         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
13448                        func->instance_id))
13449                 goto nla_put_failure;
13450
13451         nla_nest_end(msg, func_attr);
13452
13453         genlmsg_end(msg, hdr);
13454         return genlmsg_reply(msg, info);
13455
13456 nla_put_failure:
13457         nlmsg_free(msg);
13458         return -ENOBUFS;
13459 }
13460
13461 static int nl80211_nan_del_func(struct sk_buff *skb,
13462                                struct genl_info *info)
13463 {
13464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13465         struct wireless_dev *wdev = info->user_ptr[1];
13466         u64 cookie;
13467
13468         if (wdev->iftype != NL80211_IFTYPE_NAN)
13469                 return -EOPNOTSUPP;
13470
13471         if (!wdev_running(wdev))
13472                 return -ENOTCONN;
13473
13474         if (!info->attrs[NL80211_ATTR_COOKIE])
13475                 return -EINVAL;
13476
13477         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
13478
13479         rdev_del_nan_func(rdev, wdev, cookie);
13480
13481         return 0;
13482 }
13483
13484 static int nl80211_nan_change_config(struct sk_buff *skb,
13485                                      struct genl_info *info)
13486 {
13487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13488         struct wireless_dev *wdev = info->user_ptr[1];
13489         struct cfg80211_nan_conf conf = {};
13490         u32 changed = 0;
13491
13492         if (wdev->iftype != NL80211_IFTYPE_NAN)
13493                 return -EOPNOTSUPP;
13494
13495         if (!wdev_running(wdev))
13496                 return -ENOTCONN;
13497
13498         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
13499                 conf.master_pref =
13500                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
13501                 if (conf.master_pref <= 1 || conf.master_pref == 255)
13502                         return -EINVAL;
13503
13504                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
13505         }
13506
13507         if (info->attrs[NL80211_ATTR_BANDS]) {
13508                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
13509
13510                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
13511                         return -EOPNOTSUPP;
13512
13513                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
13514                         return -EINVAL;
13515
13516                 conf.bands = bands;
13517                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
13518         }
13519
13520         if (!changed)
13521                 return -EINVAL;
13522
13523         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
13524 }
13525
13526 void cfg80211_nan_match(struct wireless_dev *wdev,
13527                         struct cfg80211_nan_match_params *match, gfp_t gfp)
13528 {
13529         struct wiphy *wiphy = wdev->wiphy;
13530         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13531         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
13532         struct sk_buff *msg;
13533         void *hdr;
13534
13535         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
13536                 return;
13537
13538         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13539         if (!msg)
13540                 return;
13541
13542         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
13543         if (!hdr) {
13544                 nlmsg_free(msg);
13545                 return;
13546         }
13547
13548         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13549             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13550                                          wdev->netdev->ifindex)) ||
13551             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13552                               NL80211_ATTR_PAD))
13553                 goto nla_put_failure;
13554
13555         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
13556                               NL80211_ATTR_PAD) ||
13557             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
13558                 goto nla_put_failure;
13559
13560         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
13561         if (!match_attr)
13562                 goto nla_put_failure;
13563
13564         local_func_attr = nla_nest_start_noflag(msg,
13565                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
13566         if (!local_func_attr)
13567                 goto nla_put_failure;
13568
13569         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
13570                 goto nla_put_failure;
13571
13572         nla_nest_end(msg, local_func_attr);
13573
13574         peer_func_attr = nla_nest_start_noflag(msg,
13575                                                NL80211_NAN_MATCH_FUNC_PEER);
13576         if (!peer_func_attr)
13577                 goto nla_put_failure;
13578
13579         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
13580             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
13581                 goto nla_put_failure;
13582
13583         if (match->info && match->info_len &&
13584             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
13585                     match->info))
13586                 goto nla_put_failure;
13587
13588         nla_nest_end(msg, peer_func_attr);
13589         nla_nest_end(msg, match_attr);
13590         genlmsg_end(msg, hdr);
13591
13592         if (!wdev->owner_nlportid)
13593                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13594                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13595         else
13596                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13597                                 wdev->owner_nlportid);
13598
13599         return;
13600
13601 nla_put_failure:
13602         nlmsg_free(msg);
13603 }
13604 EXPORT_SYMBOL(cfg80211_nan_match);
13605
13606 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
13607                                   u8 inst_id,
13608                                   enum nl80211_nan_func_term_reason reason,
13609                                   u64 cookie, gfp_t gfp)
13610 {
13611         struct wiphy *wiphy = wdev->wiphy;
13612         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13613         struct sk_buff *msg;
13614         struct nlattr *func_attr;
13615         void *hdr;
13616
13617         if (WARN_ON(!inst_id))
13618                 return;
13619
13620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13621         if (!msg)
13622                 return;
13623
13624         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
13625         if (!hdr) {
13626                 nlmsg_free(msg);
13627                 return;
13628         }
13629
13630         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13631             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13632                                          wdev->netdev->ifindex)) ||
13633             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13634                               NL80211_ATTR_PAD))
13635                 goto nla_put_failure;
13636
13637         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
13638                               NL80211_ATTR_PAD))
13639                 goto nla_put_failure;
13640
13641         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
13642         if (!func_attr)
13643                 goto nla_put_failure;
13644
13645         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
13646             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
13647                 goto nla_put_failure;
13648
13649         nla_nest_end(msg, func_attr);
13650         genlmsg_end(msg, hdr);
13651
13652         if (!wdev->owner_nlportid)
13653                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
13654                                         msg, 0, NL80211_MCGRP_NAN, gfp);
13655         else
13656                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
13657                                 wdev->owner_nlportid);
13658
13659         return;
13660
13661 nla_put_failure:
13662         nlmsg_free(msg);
13663 }
13664 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
13665
13666 static int nl80211_get_protocol_features(struct sk_buff *skb,
13667                                          struct genl_info *info)
13668 {
13669         void *hdr;
13670         struct sk_buff *msg;
13671
13672         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13673         if (!msg)
13674                 return -ENOMEM;
13675
13676         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13677                              NL80211_CMD_GET_PROTOCOL_FEATURES);
13678         if (!hdr)
13679                 goto nla_put_failure;
13680
13681         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
13682                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
13683                 goto nla_put_failure;
13684
13685         genlmsg_end(msg, hdr);
13686         return genlmsg_reply(msg, info);
13687
13688  nla_put_failure:
13689         kfree_skb(msg);
13690         return -ENOBUFS;
13691 }
13692
13693 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
13694 {
13695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13696         struct cfg80211_update_ft_ies_params ft_params;
13697         struct net_device *dev = info->user_ptr[1];
13698
13699         if (!rdev->ops->update_ft_ies)
13700                 return -EOPNOTSUPP;
13701
13702         if (!info->attrs[NL80211_ATTR_MDID] ||
13703             !info->attrs[NL80211_ATTR_IE])
13704                 return -EINVAL;
13705
13706         memset(&ft_params, 0, sizeof(ft_params));
13707         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
13708         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
13709         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
13710
13711         return rdev_update_ft_ies(rdev, dev, &ft_params);
13712 }
13713
13714 static int nl80211_crit_protocol_start(struct sk_buff *skb,
13715                                        struct genl_info *info)
13716 {
13717         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13718         struct wireless_dev *wdev = info->user_ptr[1];
13719         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
13720         u16 duration;
13721         int ret;
13722
13723         if (!rdev->ops->crit_proto_start)
13724                 return -EOPNOTSUPP;
13725
13726         if (WARN_ON(!rdev->ops->crit_proto_stop))
13727                 return -EINVAL;
13728
13729         if (rdev->crit_proto_nlportid)
13730                 return -EBUSY;
13731
13732         /* determine protocol if provided */
13733         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
13734                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
13735
13736         if (proto >= NUM_NL80211_CRIT_PROTO)
13737                 return -EINVAL;
13738
13739         /* timeout must be provided */
13740         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
13741                 return -EINVAL;
13742
13743         duration =
13744                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
13745
13746         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
13747         if (!ret)
13748                 rdev->crit_proto_nlportid = info->snd_portid;
13749
13750         return ret;
13751 }
13752
13753 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
13754                                       struct genl_info *info)
13755 {
13756         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13757         struct wireless_dev *wdev = info->user_ptr[1];
13758
13759         if (!rdev->ops->crit_proto_stop)
13760                 return -EOPNOTSUPP;
13761
13762         if (rdev->crit_proto_nlportid) {
13763                 rdev->crit_proto_nlportid = 0;
13764                 rdev_crit_proto_stop(rdev, wdev);
13765         }
13766         return 0;
13767 }
13768
13769 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
13770                                        struct nlattr *attr,
13771                                        struct netlink_ext_ack *extack)
13772 {
13773         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
13774                 if (attr->nla_type & NLA_F_NESTED) {
13775                         NL_SET_ERR_MSG_ATTR(extack, attr,
13776                                             "unexpected nested data");
13777                         return -EINVAL;
13778                 }
13779
13780                 return 0;
13781         }
13782
13783         if (!(attr->nla_type & NLA_F_NESTED)) {
13784                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
13785                 return -EINVAL;
13786         }
13787
13788         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
13789 }
13790
13791 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
13792 {
13793         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13794         struct wireless_dev *wdev =
13795                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
13796                                            info->attrs);
13797         int i, err;
13798         u32 vid, subcmd;
13799
13800         if (!rdev->wiphy.vendor_commands)
13801                 return -EOPNOTSUPP;
13802
13803         if (IS_ERR(wdev)) {
13804                 err = PTR_ERR(wdev);
13805                 if (err != -EINVAL)
13806                         return err;
13807                 wdev = NULL;
13808         } else if (wdev->wiphy != &rdev->wiphy) {
13809                 return -EINVAL;
13810         }
13811
13812         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
13813             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
13814                 return -EINVAL;
13815
13816         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
13817         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
13818         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
13819                 const struct wiphy_vendor_command *vcmd;
13820                 void *data = NULL;
13821                 int len = 0;
13822
13823                 vcmd = &rdev->wiphy.vendor_commands[i];
13824
13825                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13826                         continue;
13827
13828                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
13829                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
13830                         if (!wdev)
13831                                 return -EINVAL;
13832                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
13833                             !wdev->netdev)
13834                                 return -EINVAL;
13835
13836                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
13837                                 if (!wdev_running(wdev))
13838                                         return -ENETDOWN;
13839                         }
13840                 } else {
13841                         wdev = NULL;
13842                 }
13843
13844                 if (!vcmd->doit)
13845                         return -EOPNOTSUPP;
13846
13847                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
13848                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13849                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
13850
13851                         err = nl80211_vendor_check_policy(vcmd,
13852                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
13853                                         info->extack);
13854                         if (err)
13855                                 return err;
13856                 }
13857
13858                 rdev->cur_cmd_info = info;
13859                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
13860                 rdev->cur_cmd_info = NULL;
13861                 return err;
13862         }
13863
13864         return -EOPNOTSUPP;
13865 }
13866
13867 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
13868                                        struct netlink_callback *cb,
13869                                        struct cfg80211_registered_device **rdev,
13870                                        struct wireless_dev **wdev)
13871 {
13872         struct nlattr **attrbuf;
13873         u32 vid, subcmd;
13874         unsigned int i;
13875         int vcmd_idx = -1;
13876         int err;
13877         void *data = NULL;
13878         unsigned int data_len = 0;
13879
13880         if (cb->args[0]) {
13881                 /* subtract the 1 again here */
13882                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
13883                 struct wireless_dev *tmp;
13884
13885                 if (!wiphy)
13886                         return -ENODEV;
13887                 *rdev = wiphy_to_rdev(wiphy);
13888                 *wdev = NULL;
13889
13890                 if (cb->args[1]) {
13891                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
13892                                 if (tmp->identifier == cb->args[1] - 1) {
13893                                         *wdev = tmp;
13894                                         break;
13895                                 }
13896                         }
13897                 }
13898
13899                 /* keep rtnl locked in successful case */
13900                 return 0;
13901         }
13902
13903         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
13904         if (!attrbuf)
13905                 return -ENOMEM;
13906
13907         err = nlmsg_parse_deprecated(cb->nlh,
13908                                      GENL_HDRLEN + nl80211_fam.hdrsize,
13909                                      attrbuf, nl80211_fam.maxattr,
13910                                      nl80211_policy, NULL);
13911         if (err)
13912                 goto out;
13913
13914         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
13915             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
13916                 err = -EINVAL;
13917                 goto out;
13918         }
13919
13920         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
13921         if (IS_ERR(*wdev))
13922                 *wdev = NULL;
13923
13924         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
13925         if (IS_ERR(*rdev)) {
13926                 err = PTR_ERR(*rdev);
13927                 goto out;
13928         }
13929
13930         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
13931         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
13932
13933         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
13934                 const struct wiphy_vendor_command *vcmd;
13935
13936                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
13937
13938                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
13939                         continue;
13940
13941                 if (!vcmd->dumpit) {
13942                         err = -EOPNOTSUPP;
13943                         goto out;
13944                 }
13945
13946                 vcmd_idx = i;
13947                 break;
13948         }
13949
13950         if (vcmd_idx < 0) {
13951                 err = -EOPNOTSUPP;
13952                 goto out;
13953         }
13954
13955         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
13956                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13957                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
13958
13959                 err = nl80211_vendor_check_policy(
13960                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
13961                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
13962                                 cb->extack);
13963                 if (err)
13964                         goto out;
13965         }
13966
13967         /* 0 is the first index - add 1 to parse only once */
13968         cb->args[0] = (*rdev)->wiphy_idx + 1;
13969         /* add 1 to know if it was NULL */
13970         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
13971         cb->args[2] = vcmd_idx;
13972         cb->args[3] = (unsigned long)data;
13973         cb->args[4] = data_len;
13974
13975         /* keep rtnl locked in successful case */
13976         err = 0;
13977 out:
13978         kfree(attrbuf);
13979         return err;
13980 }
13981
13982 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
13983                                    struct netlink_callback *cb)
13984 {
13985         struct cfg80211_registered_device *rdev;
13986         struct wireless_dev *wdev;
13987         unsigned int vcmd_idx;
13988         const struct wiphy_vendor_command *vcmd;
13989         void *data;
13990         int data_len;
13991         int err;
13992         struct nlattr *vendor_data;
13993
13994         rtnl_lock();
13995         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
13996         if (err)
13997                 goto out;
13998
13999         vcmd_idx = cb->args[2];
14000         data = (void *)cb->args[3];
14001         data_len = cb->args[4];
14002         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
14003
14004         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14005                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14006                 if (!wdev) {
14007                         err = -EINVAL;
14008                         goto out;
14009                 }
14010                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14011                     !wdev->netdev) {
14012                         err = -EINVAL;
14013                         goto out;
14014                 }
14015
14016                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14017                         if (!wdev_running(wdev)) {
14018                                 err = -ENETDOWN;
14019                                 goto out;
14020                         }
14021                 }
14022         }
14023
14024         while (1) {
14025                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
14026                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
14027                                            NL80211_CMD_VENDOR);
14028                 if (!hdr)
14029                         break;
14030
14031                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14032                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
14033                                                wdev_id(wdev),
14034                                                NL80211_ATTR_PAD))) {
14035                         genlmsg_cancel(skb, hdr);
14036                         break;
14037                 }
14038
14039                 vendor_data = nla_nest_start_noflag(skb,
14040                                                     NL80211_ATTR_VENDOR_DATA);
14041                 if (!vendor_data) {
14042                         genlmsg_cancel(skb, hdr);
14043                         break;
14044                 }
14045
14046                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
14047                                    (unsigned long *)&cb->args[5]);
14048                 nla_nest_end(skb, vendor_data);
14049
14050                 if (err == -ENOBUFS || err == -ENOENT) {
14051                         genlmsg_cancel(skb, hdr);
14052                         break;
14053                 } else if (err <= 0) {
14054                         genlmsg_cancel(skb, hdr);
14055                         goto out;
14056                 }
14057
14058                 genlmsg_end(skb, hdr);
14059         }
14060
14061         err = skb->len;
14062  out:
14063         rtnl_unlock();
14064         return err;
14065 }
14066
14067 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
14068                                            enum nl80211_commands cmd,
14069                                            enum nl80211_attrs attr,
14070                                            int approxlen)
14071 {
14072         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14073
14074         if (WARN_ON(!rdev->cur_cmd_info))
14075                 return NULL;
14076
14077         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
14078                                            rdev->cur_cmd_info->snd_portid,
14079                                            rdev->cur_cmd_info->snd_seq,
14080                                            cmd, attr, NULL, GFP_KERNEL);
14081 }
14082 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
14083
14084 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
14085 {
14086         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
14087         void *hdr = ((void **)skb->cb)[1];
14088         struct nlattr *data = ((void **)skb->cb)[2];
14089
14090         /* clear CB data for netlink core to own from now on */
14091         memset(skb->cb, 0, sizeof(skb->cb));
14092
14093         if (WARN_ON(!rdev->cur_cmd_info)) {
14094                 kfree_skb(skb);
14095                 return -EINVAL;
14096         }
14097
14098         nla_nest_end(skb, data);
14099         genlmsg_end(skb, hdr);
14100         return genlmsg_reply(skb, rdev->cur_cmd_info);
14101 }
14102 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
14103
14104 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
14105 {
14106         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14107
14108         if (WARN_ON(!rdev->cur_cmd_info))
14109                 return 0;
14110
14111         return rdev->cur_cmd_info->snd_portid;
14112 }
14113 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
14114
14115 static int nl80211_set_qos_map(struct sk_buff *skb,
14116                                struct genl_info *info)
14117 {
14118         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14119         struct cfg80211_qos_map *qos_map = NULL;
14120         struct net_device *dev = info->user_ptr[1];
14121         u8 *pos, len, num_des, des_len, des;
14122         int ret;
14123
14124         if (!rdev->ops->set_qos_map)
14125                 return -EOPNOTSUPP;
14126
14127         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
14128                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
14129                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
14130
14131                 if (len % 2)
14132                         return -EINVAL;
14133
14134                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
14135                 if (!qos_map)
14136                         return -ENOMEM;
14137
14138                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
14139                 if (num_des) {
14140                         des_len = num_des *
14141                                 sizeof(struct cfg80211_dscp_exception);
14142                         memcpy(qos_map->dscp_exception, pos, des_len);
14143                         qos_map->num_des = num_des;
14144                         for (des = 0; des < num_des; des++) {
14145                                 if (qos_map->dscp_exception[des].up > 7) {
14146                                         kfree(qos_map);
14147                                         return -EINVAL;
14148                                 }
14149                         }
14150                         pos += des_len;
14151                 }
14152                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
14153         }
14154
14155         wdev_lock(dev->ieee80211_ptr);
14156         ret = nl80211_key_allowed(dev->ieee80211_ptr);
14157         if (!ret)
14158                 ret = rdev_set_qos_map(rdev, dev, qos_map);
14159         wdev_unlock(dev->ieee80211_ptr);
14160
14161         kfree(qos_map);
14162         return ret;
14163 }
14164
14165 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
14166 {
14167         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14168         struct net_device *dev = info->user_ptr[1];
14169         struct wireless_dev *wdev = dev->ieee80211_ptr;
14170         const u8 *peer;
14171         u8 tsid, up;
14172         u16 admitted_time = 0;
14173         int err;
14174
14175         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
14176                 return -EOPNOTSUPP;
14177
14178         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
14179             !info->attrs[NL80211_ATTR_USER_PRIO])
14180                 return -EINVAL;
14181
14182         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14183         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
14184
14185         /* WMM uses TIDs 0-7 even for TSPEC */
14186         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
14187                 /* TODO: handle 802.11 TSPEC/admission control
14188                  * need more attributes for that (e.g. BA session requirement);
14189                  * change the WMM adminssion test above to allow both then
14190                  */
14191                 return -EINVAL;
14192         }
14193
14194         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14195
14196         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
14197                 admitted_time =
14198                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
14199                 if (!admitted_time)
14200                         return -EINVAL;
14201         }
14202
14203         wdev_lock(wdev);
14204         switch (wdev->iftype) {
14205         case NL80211_IFTYPE_STATION:
14206         case NL80211_IFTYPE_P2P_CLIENT:
14207                 if (wdev->current_bss)
14208                         break;
14209                 err = -ENOTCONN;
14210                 goto out;
14211         default:
14212                 err = -EOPNOTSUPP;
14213                 goto out;
14214         }
14215
14216         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
14217
14218  out:
14219         wdev_unlock(wdev);
14220         return err;
14221 }
14222
14223 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
14224 {
14225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14226         struct net_device *dev = info->user_ptr[1];
14227         struct wireless_dev *wdev = dev->ieee80211_ptr;
14228         const u8 *peer;
14229         u8 tsid;
14230         int err;
14231
14232         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
14233                 return -EINVAL;
14234
14235         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
14236         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14237
14238         wdev_lock(wdev);
14239         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
14240         wdev_unlock(wdev);
14241
14242         return err;
14243 }
14244
14245 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
14246                                        struct genl_info *info)
14247 {
14248         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14249         struct net_device *dev = info->user_ptr[1];
14250         struct wireless_dev *wdev = dev->ieee80211_ptr;
14251         struct cfg80211_chan_def chandef = {};
14252         const u8 *addr;
14253         u8 oper_class;
14254         int err;
14255
14256         if (!rdev->ops->tdls_channel_switch ||
14257             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14258                 return -EOPNOTSUPP;
14259
14260         switch (dev->ieee80211_ptr->iftype) {
14261         case NL80211_IFTYPE_STATION:
14262         case NL80211_IFTYPE_P2P_CLIENT:
14263                 break;
14264         default:
14265                 return -EOPNOTSUPP;
14266         }
14267
14268         if (!info->attrs[NL80211_ATTR_MAC] ||
14269             !info->attrs[NL80211_ATTR_OPER_CLASS])
14270                 return -EINVAL;
14271
14272         err = nl80211_parse_chandef(rdev, info, &chandef);
14273         if (err)
14274                 return err;
14275
14276         /*
14277          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
14278          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
14279          * specification is not defined for them.
14280          */
14281         if (chandef.chan->band == NL80211_BAND_2GHZ &&
14282             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
14283             chandef.width != NL80211_CHAN_WIDTH_20)
14284                 return -EINVAL;
14285
14286         /* we will be active on the TDLS link */
14287         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
14288                                            wdev->iftype))
14289                 return -EINVAL;
14290
14291         /* don't allow switching to DFS channels */
14292         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
14293                 return -EINVAL;
14294
14295         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14296         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
14297
14298         wdev_lock(wdev);
14299         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
14300         wdev_unlock(wdev);
14301
14302         return err;
14303 }
14304
14305 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
14306                                               struct genl_info *info)
14307 {
14308         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14309         struct net_device *dev = info->user_ptr[1];
14310         struct wireless_dev *wdev = dev->ieee80211_ptr;
14311         const u8 *addr;
14312
14313         if (!rdev->ops->tdls_channel_switch ||
14314             !rdev->ops->tdls_cancel_channel_switch ||
14315             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
14316                 return -EOPNOTSUPP;
14317
14318         switch (dev->ieee80211_ptr->iftype) {
14319         case NL80211_IFTYPE_STATION:
14320         case NL80211_IFTYPE_P2P_CLIENT:
14321                 break;
14322         default:
14323                 return -EOPNOTSUPP;
14324         }
14325
14326         if (!info->attrs[NL80211_ATTR_MAC])
14327                 return -EINVAL;
14328
14329         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14330
14331         wdev_lock(wdev);
14332         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
14333         wdev_unlock(wdev);
14334
14335         return 0;
14336 }
14337
14338 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
14339                                             struct genl_info *info)
14340 {
14341         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14342         struct net_device *dev = info->user_ptr[1];
14343         struct wireless_dev *wdev = dev->ieee80211_ptr;
14344         const struct nlattr *nla;
14345         bool enabled;
14346
14347         if (!rdev->ops->set_multicast_to_unicast)
14348                 return -EOPNOTSUPP;
14349
14350         if (wdev->iftype != NL80211_IFTYPE_AP &&
14351             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14352                 return -EOPNOTSUPP;
14353
14354         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
14355         enabled = nla_get_flag(nla);
14356
14357         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
14358 }
14359
14360 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
14361 {
14362         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14363         struct net_device *dev = info->user_ptr[1];
14364         struct wireless_dev *wdev = dev->ieee80211_ptr;
14365         struct cfg80211_pmk_conf pmk_conf = {};
14366         int ret;
14367
14368         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14369             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14370                 return -EOPNOTSUPP;
14371
14372         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14373                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14374                 return -EOPNOTSUPP;
14375
14376         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
14377                 return -EINVAL;
14378
14379         wdev_lock(wdev);
14380         if (!wdev->current_bss) {
14381                 ret = -ENOTCONN;
14382                 goto out;
14383         }
14384
14385         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14386         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
14387                 ret = -EINVAL;
14388                 goto out;
14389         }
14390
14391         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
14392         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
14393         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
14394             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
14395                 ret = -EINVAL;
14396                 goto out;
14397         }
14398
14399         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
14400                 pmk_conf.pmk_r0_name =
14401                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
14402
14403         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
14404 out:
14405         wdev_unlock(wdev);
14406         return ret;
14407 }
14408
14409 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
14410 {
14411         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14412         struct net_device *dev = info->user_ptr[1];
14413         struct wireless_dev *wdev = dev->ieee80211_ptr;
14414         const u8 *aa;
14415         int ret;
14416
14417         if (wdev->iftype != NL80211_IFTYPE_STATION &&
14418             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
14419                 return -EOPNOTSUPP;
14420
14421         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14422                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
14423                 return -EOPNOTSUPP;
14424
14425         if (!info->attrs[NL80211_ATTR_MAC])
14426                 return -EINVAL;
14427
14428         wdev_lock(wdev);
14429         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
14430         ret = rdev_del_pmk(rdev, dev, aa);
14431         wdev_unlock(wdev);
14432
14433         return ret;
14434 }
14435
14436 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
14437 {
14438         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14439         struct net_device *dev = info->user_ptr[1];
14440         struct cfg80211_external_auth_params params;
14441
14442         if (!rdev->ops->external_auth)
14443                 return -EOPNOTSUPP;
14444
14445         if (!info->attrs[NL80211_ATTR_SSID] &&
14446             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
14447             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
14448                 return -EINVAL;
14449
14450         if (!info->attrs[NL80211_ATTR_BSSID])
14451                 return -EINVAL;
14452
14453         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
14454                 return -EINVAL;
14455
14456         memset(&params, 0, sizeof(params));
14457
14458         if (info->attrs[NL80211_ATTR_SSID]) {
14459                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
14460                 if (params.ssid.ssid_len == 0)
14461                         return -EINVAL;
14462                 memcpy(params.ssid.ssid,
14463                        nla_data(info->attrs[NL80211_ATTR_SSID]),
14464                        params.ssid.ssid_len);
14465         }
14466
14467         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
14468                ETH_ALEN);
14469
14470         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14471
14472         if (info->attrs[NL80211_ATTR_PMKID])
14473                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
14474
14475         return rdev_external_auth(rdev, dev, &params);
14476 }
14477
14478 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
14479 {
14480         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
14481         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14482         struct net_device *dev = info->user_ptr[1];
14483         struct wireless_dev *wdev = dev->ieee80211_ptr;
14484         const u8 *buf;
14485         size_t len;
14486         u8 *dest;
14487         u16 proto;
14488         bool noencrypt;
14489         u64 cookie = 0;
14490         int err;
14491
14492         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14493                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
14494                 return -EOPNOTSUPP;
14495
14496         if (!rdev->ops->tx_control_port)
14497                 return -EOPNOTSUPP;
14498
14499         if (!info->attrs[NL80211_ATTR_FRAME] ||
14500             !info->attrs[NL80211_ATTR_MAC] ||
14501             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
14502                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
14503                 return -EINVAL;
14504         }
14505
14506         wdev_lock(wdev);
14507
14508         switch (wdev->iftype) {
14509         case NL80211_IFTYPE_AP:
14510         case NL80211_IFTYPE_P2P_GO:
14511         case NL80211_IFTYPE_MESH_POINT:
14512                 break;
14513         case NL80211_IFTYPE_ADHOC:
14514         case NL80211_IFTYPE_STATION:
14515         case NL80211_IFTYPE_P2P_CLIENT:
14516                 if (wdev->current_bss)
14517                         break;
14518                 err = -ENOTCONN;
14519                 goto out;
14520         default:
14521                 err = -EOPNOTSUPP;
14522                 goto out;
14523         }
14524
14525         wdev_unlock(wdev);
14526
14527         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14528         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14529         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14530         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
14531         noencrypt =
14532                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
14533
14534         err = rdev_tx_control_port(rdev, dev, buf, len,
14535                                    dest, cpu_to_be16(proto), noencrypt,
14536                                    dont_wait_for_ack ? NULL : &cookie);
14537         if (!err && !dont_wait_for_ack)
14538                 nl_set_extack_cookie_u64(info->extack, cookie);
14539         return err;
14540  out:
14541         wdev_unlock(wdev);
14542         return err;
14543 }
14544
14545 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
14546                                            struct genl_info *info)
14547 {
14548         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14549         struct net_device *dev = info->user_ptr[1];
14550         struct wireless_dev *wdev = dev->ieee80211_ptr;
14551         struct cfg80211_ftm_responder_stats ftm_stats = {};
14552         struct sk_buff *msg;
14553         void *hdr;
14554         struct nlattr *ftm_stats_attr;
14555         int err;
14556
14557         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
14558                 return -EOPNOTSUPP;
14559
14560         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
14561         if (err)
14562                 return err;
14563
14564         if (!ftm_stats.filled)
14565                 return -ENODATA;
14566
14567         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14568         if (!msg)
14569                 return -ENOMEM;
14570
14571         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14572                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
14573         if (!hdr)
14574                 goto nla_put_failure;
14575
14576         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14577                 goto nla_put_failure;
14578
14579         ftm_stats_attr = nla_nest_start_noflag(msg,
14580                                                NL80211_ATTR_FTM_RESPONDER_STATS);
14581         if (!ftm_stats_attr)
14582                 goto nla_put_failure;
14583
14584 #define SET_FTM(field, name, type)                                       \
14585         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14586             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
14587                              ftm_stats.field))                           \
14588                 goto nla_put_failure; } while (0)
14589 #define SET_FTM_U64(field, name)                                         \
14590         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
14591             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
14592                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
14593                 goto nla_put_failure; } while (0)
14594
14595         SET_FTM(success_num, SUCCESS_NUM, u32);
14596         SET_FTM(partial_num, PARTIAL_NUM, u32);
14597         SET_FTM(failed_num, FAILED_NUM, u32);
14598         SET_FTM(asap_num, ASAP_NUM, u32);
14599         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
14600         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
14601         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
14602         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
14603         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
14604 #undef SET_FTM
14605
14606         nla_nest_end(msg, ftm_stats_attr);
14607
14608         genlmsg_end(msg, hdr);
14609         return genlmsg_reply(msg, info);
14610
14611 nla_put_failure:
14612         nlmsg_free(msg);
14613         return -ENOBUFS;
14614 }
14615
14616 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
14617 {
14618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14619         struct cfg80211_update_owe_info owe_info;
14620         struct net_device *dev = info->user_ptr[1];
14621
14622         if (!rdev->ops->update_owe_info)
14623                 return -EOPNOTSUPP;
14624
14625         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
14626             !info->attrs[NL80211_ATTR_MAC])
14627                 return -EINVAL;
14628
14629         memset(&owe_info, 0, sizeof(owe_info));
14630         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
14631         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
14632
14633         if (info->attrs[NL80211_ATTR_IE]) {
14634                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14635                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14636         }
14637
14638         return rdev_update_owe_info(rdev, dev, &owe_info);
14639 }
14640
14641 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
14642 {
14643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14644         struct net_device *dev = info->user_ptr[1];
14645         struct wireless_dev *wdev = dev->ieee80211_ptr;
14646         struct station_info sinfo = {};
14647         const u8 *buf;
14648         size_t len;
14649         u8 *dest;
14650         int err;
14651
14652         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
14653                 return -EOPNOTSUPP;
14654
14655         if (!info->attrs[NL80211_ATTR_MAC] ||
14656             !info->attrs[NL80211_ATTR_FRAME]) {
14657                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
14658                 return -EINVAL;
14659         }
14660
14661         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
14662                 return -EOPNOTSUPP;
14663
14664         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
14665         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
14666         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
14667
14668         if (len < sizeof(struct ethhdr))
14669                 return -EINVAL;
14670
14671         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
14672             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
14673                 return -EINVAL;
14674
14675         err = rdev_get_station(rdev, dev, dest, &sinfo);
14676         if (err)
14677                 return err;
14678
14679         cfg80211_sinfo_release_content(&sinfo);
14680
14681         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
14682 }
14683
14684 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
14685                           struct nlattr *attrs[], struct net_device *dev,
14686                           struct cfg80211_tid_cfg *tid_conf,
14687                           struct genl_info *info, const u8 *peer)
14688 {
14689         struct netlink_ext_ack *extack = info->extack;
14690         u64 mask;
14691         int err;
14692
14693         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
14694                 return -EINVAL;
14695
14696         tid_conf->config_override =
14697                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
14698         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
14699
14700         if (tid_conf->config_override) {
14701                 if (rdev->ops->reset_tid_config) {
14702                         err = rdev_reset_tid_config(rdev, dev, peer,
14703                                                     tid_conf->tids);
14704                         if (err)
14705                                 return err;
14706                 } else {
14707                         return -EINVAL;
14708                 }
14709         }
14710
14711         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
14712                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
14713                 tid_conf->noack =
14714                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
14715         }
14716
14717         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
14718                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
14719                 tid_conf->retry_short =
14720                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
14721
14722                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
14723                         return -EINVAL;
14724         }
14725
14726         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
14727                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
14728                 tid_conf->retry_long =
14729                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
14730
14731                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
14732                         return -EINVAL;
14733         }
14734
14735         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
14736                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
14737                 tid_conf->ampdu =
14738                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
14739         }
14740
14741         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
14742                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
14743                 tid_conf->rtscts =
14744                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
14745         }
14746
14747         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
14748                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
14749                 tid_conf->amsdu =
14750                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
14751         }
14752
14753         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
14754                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
14755
14756                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
14757
14758                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
14759                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
14760                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
14761                                                     &tid_conf->txrate_mask, dev,
14762                                                     true);
14763                         if (err)
14764                                 return err;
14765
14766                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
14767                 }
14768                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
14769         }
14770
14771         if (peer)
14772                 mask = rdev->wiphy.tid_config_support.peer;
14773         else
14774                 mask = rdev->wiphy.tid_config_support.vif;
14775
14776         if (tid_conf->mask & ~mask) {
14777                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
14778                 return -ENOTSUPP;
14779         }
14780
14781         return 0;
14782 }
14783
14784 static int nl80211_set_tid_config(struct sk_buff *skb,
14785                                   struct genl_info *info)
14786 {
14787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14788         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
14789         struct net_device *dev = info->user_ptr[1];
14790         struct cfg80211_tid_config *tid_config;
14791         struct nlattr *tid;
14792         int conf_idx = 0, rem_conf;
14793         int ret = -EINVAL;
14794         u32 num_conf = 0;
14795
14796         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
14797                 return -EINVAL;
14798
14799         if (!rdev->ops->set_tid_config)
14800                 return -EOPNOTSUPP;
14801
14802         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14803                             rem_conf)
14804                 num_conf++;
14805
14806         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
14807                              GFP_KERNEL);
14808         if (!tid_config)
14809                 return -ENOMEM;
14810
14811         tid_config->n_tid_conf = num_conf;
14812
14813         if (info->attrs[NL80211_ATTR_MAC])
14814                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
14815
14816         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
14817                             rem_conf) {
14818                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
14819                                        tid, NULL, NULL);
14820
14821                 if (ret)
14822                         goto bad_tid_conf;
14823
14824                 ret = parse_tid_conf(rdev, attrs, dev,
14825                                      &tid_config->tid_conf[conf_idx],
14826                                      info, tid_config->peer);
14827                 if (ret)
14828                         goto bad_tid_conf;
14829
14830                 conf_idx++;
14831         }
14832
14833         ret = rdev_set_tid_config(rdev, dev, tid_config);
14834
14835 bad_tid_conf:
14836         kfree(tid_config);
14837         return ret;
14838 }
14839
14840 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
14841 {
14842         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14843         struct cfg80211_color_change_settings params = {};
14844         struct net_device *dev = info->user_ptr[1];
14845         struct wireless_dev *wdev = dev->ieee80211_ptr;
14846         struct nlattr **tb;
14847         u16 offset;
14848         int err;
14849
14850         if (!rdev->ops->color_change)
14851                 return -EOPNOTSUPP;
14852
14853         if (!wiphy_ext_feature_isset(&rdev->wiphy,
14854                                      NL80211_EXT_FEATURE_BSS_COLOR))
14855                 return -EOPNOTSUPP;
14856
14857         if (wdev->iftype != NL80211_IFTYPE_AP)
14858                 return -EOPNOTSUPP;
14859
14860         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
14861             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
14862             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
14863                 return -EINVAL;
14864
14865         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
14866         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
14867
14868         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next);
14869         if (err)
14870                 return err;
14871
14872         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
14873         if (!tb)
14874                 return -ENOMEM;
14875
14876         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
14877                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
14878                                nl80211_policy, info->extack);
14879         if (err)
14880                 goto out;
14881
14882         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change);
14883         if (err)
14884                 goto out;
14885
14886         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
14887                 err = -EINVAL;
14888                 goto out;
14889         }
14890
14891         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
14892                 err = -EINVAL;
14893                 goto out;
14894         }
14895
14896         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
14897         if (offset >= params.beacon_color_change.tail_len) {
14898                 err = -EINVAL;
14899                 goto out;
14900         }
14901
14902         if (params.beacon_color_change.tail[offset] != params.count) {
14903                 err = -EINVAL;
14904                 goto out;
14905         }
14906
14907         params.counter_offset_beacon = offset;
14908
14909         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
14910                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
14911                     sizeof(u16)) {
14912                         err = -EINVAL;
14913                         goto out;
14914                 }
14915
14916                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
14917                 if (offset >= params.beacon_color_change.probe_resp_len) {
14918                         err = -EINVAL;
14919                         goto out;
14920                 }
14921
14922                 if (params.beacon_color_change.probe_resp[offset] !=
14923                     params.count) {
14924                         err = -EINVAL;
14925                         goto out;
14926                 }
14927
14928                 params.counter_offset_presp = offset;
14929         }
14930
14931         wdev_lock(wdev);
14932         err = rdev_color_change(rdev, dev, &params);
14933         wdev_unlock(wdev);
14934
14935 out:
14936         kfree(tb);
14937         return err;
14938 }
14939
14940 #define NL80211_FLAG_NEED_WIPHY         0x01
14941 #define NL80211_FLAG_NEED_NETDEV        0x02
14942 #define NL80211_FLAG_NEED_RTNL          0x04
14943 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
14944 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
14945                                          NL80211_FLAG_CHECK_NETDEV_UP)
14946 #define NL80211_FLAG_NEED_WDEV          0x10
14947 /* If a netdev is associated, it must be UP, P2P must be started */
14948 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
14949                                          NL80211_FLAG_CHECK_NETDEV_UP)
14950 #define NL80211_FLAG_CLEAR_SKB          0x20
14951 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
14952
14953 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
14954                             struct genl_info *info)
14955 {
14956         struct cfg80211_registered_device *rdev = NULL;
14957         struct wireless_dev *wdev;
14958         struct net_device *dev;
14959
14960         rtnl_lock();
14961         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
14962                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
14963                 if (IS_ERR(rdev)) {
14964                         rtnl_unlock();
14965                         return PTR_ERR(rdev);
14966                 }
14967                 info->user_ptr[0] = rdev;
14968         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
14969                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
14970                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
14971                                                   info->attrs);
14972                 if (IS_ERR(wdev)) {
14973                         rtnl_unlock();
14974                         return PTR_ERR(wdev);
14975                 }
14976
14977                 dev = wdev->netdev;
14978                 rdev = wiphy_to_rdev(wdev->wiphy);
14979
14980                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
14981                         if (!dev) {
14982                                 rtnl_unlock();
14983                                 return -EINVAL;
14984                         }
14985
14986                         info->user_ptr[1] = dev;
14987                 } else {
14988                         info->user_ptr[1] = wdev;
14989                 }
14990
14991                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
14992                     !wdev_running(wdev)) {
14993                         rtnl_unlock();
14994                         return -ENETDOWN;
14995                 }
14996
14997                 dev_hold(dev);
14998                 info->user_ptr[0] = rdev;
14999         }
15000
15001         if (rdev && !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
15002                 wiphy_lock(&rdev->wiphy);
15003                 /* we keep the mutex locked until post_doit */
15004                 __release(&rdev->wiphy.mtx);
15005         }
15006         if (!(ops->internal_flags & NL80211_FLAG_NEED_RTNL))
15007                 rtnl_unlock();
15008
15009         return 0;
15010 }
15011
15012 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
15013                               struct genl_info *info)
15014 {
15015         if (info->user_ptr[1]) {
15016                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
15017                         struct wireless_dev *wdev = info->user_ptr[1];
15018
15019                         dev_put(wdev->netdev);
15020                 } else {
15021                         dev_put(info->user_ptr[1]);
15022                 }
15023         }
15024
15025         if (info->user_ptr[0] &&
15026             !(ops->internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
15027                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
15028
15029                 /* we kept the mutex locked since pre_doit */
15030                 __acquire(&rdev->wiphy.mtx);
15031                 wiphy_unlock(&rdev->wiphy);
15032         }
15033
15034         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
15035                 rtnl_unlock();
15036
15037         /* If needed, clear the netlink message payload from the SKB
15038          * as it might contain key data that shouldn't stick around on
15039          * the heap after the SKB is freed. The netlink message header
15040          * is still needed for further processing, so leave it intact.
15041          */
15042         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
15043                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
15044
15045                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
15046         }
15047 }
15048
15049 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
15050                                      struct cfg80211_sar_specs *sar_specs,
15051                                      struct nlattr *spec[], int index)
15052 {
15053         u32 range_index, i;
15054
15055         if (!sar_specs || !spec)
15056                 return -EINVAL;
15057
15058         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
15059             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
15060                 return -EINVAL;
15061
15062         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
15063
15064         /* check if range_index exceeds num_freq_ranges */
15065         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
15066                 return -EINVAL;
15067
15068         /* check if range_index duplicates */
15069         for (i = 0; i < index; i++) {
15070                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
15071                         return -EINVAL;
15072         }
15073
15074         sar_specs->sub_specs[index].power =
15075                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
15076
15077         sar_specs->sub_specs[index].freq_range_index = range_index;
15078
15079         return 0;
15080 }
15081
15082 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
15083 {
15084         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15085         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
15086         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
15087         struct cfg80211_sar_specs *sar_spec;
15088         enum nl80211_sar_type type;
15089         struct nlattr *spec_list;
15090         u32 specs;
15091         int rem, err;
15092
15093         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
15094                 return -EOPNOTSUPP;
15095
15096         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
15097                 return -EINVAL;
15098
15099         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
15100                          info->attrs[NL80211_ATTR_SAR_SPEC],
15101                          NULL, NULL);
15102
15103         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
15104                 return -EINVAL;
15105
15106         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
15107         if (type != rdev->wiphy.sar_capa->type)
15108                 return -EINVAL;
15109
15110         specs = 0;
15111         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
15112                 specs++;
15113
15114         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
15115                 return -EINVAL;
15116
15117         sar_spec = kzalloc(sizeof(*sar_spec) +
15118                            specs * sizeof(struct cfg80211_sar_sub_specs),
15119                            GFP_KERNEL);
15120         if (!sar_spec)
15121                 return -ENOMEM;
15122
15123         sar_spec->type = type;
15124         specs = 0;
15125         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
15126                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
15127                                  spec_list, NULL, NULL);
15128
15129                 switch (type) {
15130                 case NL80211_SAR_TYPE_POWER:
15131                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
15132                                                       spec, specs)) {
15133                                 err = -EINVAL;
15134                                 goto error;
15135                         }
15136                         break;
15137                 default:
15138                         err = -EINVAL;
15139                         goto error;
15140                 }
15141                 specs++;
15142         }
15143
15144         sar_spec->num_sub_specs = specs;
15145
15146         rdev->cur_cmd_info = info;
15147         err = rdev_set_sar_specs(rdev, sar_spec);
15148         rdev->cur_cmd_info = NULL;
15149 error:
15150         kfree(sar_spec);
15151         return err;
15152 }
15153
15154 static const struct genl_ops nl80211_ops[] = {
15155         {
15156                 .cmd = NL80211_CMD_GET_WIPHY,
15157                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15158                 .doit = nl80211_get_wiphy,
15159                 .dumpit = nl80211_dump_wiphy,
15160                 .done = nl80211_dump_wiphy_done,
15161                 /* can be retrieved by unprivileged users */
15162                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15163         },
15164 };
15165
15166 static const struct genl_small_ops nl80211_small_ops[] = {
15167         {
15168                 .cmd = NL80211_CMD_SET_WIPHY,
15169                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15170                 .doit = nl80211_set_wiphy,
15171                 .flags = GENL_UNS_ADMIN_PERM,
15172         },
15173         {
15174                 .cmd = NL80211_CMD_GET_INTERFACE,
15175                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15176                 .doit = nl80211_get_interface,
15177                 .dumpit = nl80211_dump_interface,
15178                 /* can be retrieved by unprivileged users */
15179                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15180         },
15181         {
15182                 .cmd = NL80211_CMD_SET_INTERFACE,
15183                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15184                 .doit = nl80211_set_interface,
15185                 .flags = GENL_UNS_ADMIN_PERM,
15186                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
15187                                   NL80211_FLAG_NEED_RTNL,
15188         },
15189         {
15190                 .cmd = NL80211_CMD_NEW_INTERFACE,
15191                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15192                 .doit = nl80211_new_interface,
15193                 .flags = GENL_UNS_ADMIN_PERM,
15194                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15195                                   NL80211_FLAG_NEED_RTNL |
15196                                   /* we take the wiphy mutex later ourselves */
15197                                   NL80211_FLAG_NO_WIPHY_MTX,
15198         },
15199         {
15200                 .cmd = NL80211_CMD_DEL_INTERFACE,
15201                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15202                 .doit = nl80211_del_interface,
15203                 .flags = GENL_UNS_ADMIN_PERM,
15204                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15205                                   NL80211_FLAG_NEED_RTNL,
15206         },
15207         {
15208                 .cmd = NL80211_CMD_GET_KEY,
15209                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15210                 .doit = nl80211_get_key,
15211                 .flags = GENL_UNS_ADMIN_PERM,
15212                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15213         },
15214         {
15215                 .cmd = NL80211_CMD_SET_KEY,
15216                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15217                 .doit = nl80211_set_key,
15218                 .flags = GENL_UNS_ADMIN_PERM,
15219                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15220                                   NL80211_FLAG_CLEAR_SKB,
15221         },
15222         {
15223                 .cmd = NL80211_CMD_NEW_KEY,
15224                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15225                 .doit = nl80211_new_key,
15226                 .flags = GENL_UNS_ADMIN_PERM,
15227                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15228                                   NL80211_FLAG_CLEAR_SKB,
15229         },
15230         {
15231                 .cmd = NL80211_CMD_DEL_KEY,
15232                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15233                 .doit = nl80211_del_key,
15234                 .flags = GENL_UNS_ADMIN_PERM,
15235                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15236         },
15237         {
15238                 .cmd = NL80211_CMD_SET_BEACON,
15239                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15240                 .flags = GENL_UNS_ADMIN_PERM,
15241                 .doit = nl80211_set_beacon,
15242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15243         },
15244         {
15245                 .cmd = NL80211_CMD_START_AP,
15246                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15247                 .flags = GENL_UNS_ADMIN_PERM,
15248                 .doit = nl80211_start_ap,
15249                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15250         },
15251         {
15252                 .cmd = NL80211_CMD_STOP_AP,
15253                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15254                 .flags = GENL_UNS_ADMIN_PERM,
15255                 .doit = nl80211_stop_ap,
15256                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15257         },
15258         {
15259                 .cmd = NL80211_CMD_GET_STATION,
15260                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15261                 .doit = nl80211_get_station,
15262                 .dumpit = nl80211_dump_station,
15263                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15264         },
15265         {
15266                 .cmd = NL80211_CMD_SET_STATION,
15267                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15268                 .doit = nl80211_set_station,
15269                 .flags = GENL_UNS_ADMIN_PERM,
15270                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15271         },
15272         {
15273                 .cmd = NL80211_CMD_NEW_STATION,
15274                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15275                 .doit = nl80211_new_station,
15276                 .flags = GENL_UNS_ADMIN_PERM,
15277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15278         },
15279         {
15280                 .cmd = NL80211_CMD_DEL_STATION,
15281                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15282                 .doit = nl80211_del_station,
15283                 .flags = GENL_UNS_ADMIN_PERM,
15284                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15285         },
15286         {
15287                 .cmd = NL80211_CMD_GET_MPATH,
15288                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15289                 .doit = nl80211_get_mpath,
15290                 .dumpit = nl80211_dump_mpath,
15291                 .flags = GENL_UNS_ADMIN_PERM,
15292                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15293         },
15294         {
15295                 .cmd = NL80211_CMD_GET_MPP,
15296                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15297                 .doit = nl80211_get_mpp,
15298                 .dumpit = nl80211_dump_mpp,
15299                 .flags = GENL_UNS_ADMIN_PERM,
15300                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15301         },
15302         {
15303                 .cmd = NL80211_CMD_SET_MPATH,
15304                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15305                 .doit = nl80211_set_mpath,
15306                 .flags = GENL_UNS_ADMIN_PERM,
15307                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15308         },
15309         {
15310                 .cmd = NL80211_CMD_NEW_MPATH,
15311                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15312                 .doit = nl80211_new_mpath,
15313                 .flags = GENL_UNS_ADMIN_PERM,
15314                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15315         },
15316         {
15317                 .cmd = NL80211_CMD_DEL_MPATH,
15318                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15319                 .doit = nl80211_del_mpath,
15320                 .flags = GENL_UNS_ADMIN_PERM,
15321                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15322         },
15323         {
15324                 .cmd = NL80211_CMD_SET_BSS,
15325                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15326                 .doit = nl80211_set_bss,
15327                 .flags = GENL_UNS_ADMIN_PERM,
15328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15329         },
15330         {
15331                 .cmd = NL80211_CMD_GET_REG,
15332                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15333                 .doit = nl80211_get_reg_do,
15334                 .dumpit = nl80211_get_reg_dump,
15335                 .internal_flags = 0,
15336                 /* can be retrieved by unprivileged users */
15337         },
15338 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
15339         {
15340                 .cmd = NL80211_CMD_SET_REG,
15341                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15342                 .doit = nl80211_set_reg,
15343                 .flags = GENL_ADMIN_PERM,
15344                 .internal_flags = 0,
15345         },
15346 #endif
15347         {
15348                 .cmd = NL80211_CMD_REQ_SET_REG,
15349                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15350                 .doit = nl80211_req_set_reg,
15351                 .flags = GENL_ADMIN_PERM,
15352         },
15353         {
15354                 .cmd = NL80211_CMD_RELOAD_REGDB,
15355                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15356                 .doit = nl80211_reload_regdb,
15357                 .flags = GENL_ADMIN_PERM,
15358         },
15359         {
15360                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
15361                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15362                 .doit = nl80211_get_mesh_config,
15363                 /* can be retrieved by unprivileged users */
15364                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15365         },
15366         {
15367                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
15368                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15369                 .doit = nl80211_update_mesh_config,
15370                 .flags = GENL_UNS_ADMIN_PERM,
15371                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15372         },
15373         {
15374                 .cmd = NL80211_CMD_TRIGGER_SCAN,
15375                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15376                 .doit = nl80211_trigger_scan,
15377                 .flags = GENL_UNS_ADMIN_PERM,
15378                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15379         },
15380         {
15381                 .cmd = NL80211_CMD_ABORT_SCAN,
15382                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15383                 .doit = nl80211_abort_scan,
15384                 .flags = GENL_UNS_ADMIN_PERM,
15385                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15386         },
15387         {
15388                 .cmd = NL80211_CMD_GET_SCAN,
15389                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15390                 .dumpit = nl80211_dump_scan,
15391         },
15392         {
15393                 .cmd = NL80211_CMD_START_SCHED_SCAN,
15394                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15395                 .doit = nl80211_start_sched_scan,
15396                 .flags = GENL_UNS_ADMIN_PERM,
15397                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15398         },
15399         {
15400                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
15401                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15402                 .doit = nl80211_stop_sched_scan,
15403                 .flags = GENL_UNS_ADMIN_PERM,
15404                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15405         },
15406         {
15407                 .cmd = NL80211_CMD_AUTHENTICATE,
15408                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15409                 .doit = nl80211_authenticate,
15410                 .flags = GENL_UNS_ADMIN_PERM,
15411                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15412                                   0 |
15413                                   NL80211_FLAG_CLEAR_SKB,
15414         },
15415         {
15416                 .cmd = NL80211_CMD_ASSOCIATE,
15417                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15418                 .doit = nl80211_associate,
15419                 .flags = GENL_UNS_ADMIN_PERM,
15420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15421                                   0 |
15422                                   NL80211_FLAG_CLEAR_SKB,
15423         },
15424         {
15425                 .cmd = NL80211_CMD_DEAUTHENTICATE,
15426                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15427                 .doit = nl80211_deauthenticate,
15428                 .flags = GENL_UNS_ADMIN_PERM,
15429                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15430         },
15431         {
15432                 .cmd = NL80211_CMD_DISASSOCIATE,
15433                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15434                 .doit = nl80211_disassociate,
15435                 .flags = GENL_UNS_ADMIN_PERM,
15436                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15437         },
15438         {
15439                 .cmd = NL80211_CMD_JOIN_IBSS,
15440                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15441                 .doit = nl80211_join_ibss,
15442                 .flags = GENL_UNS_ADMIN_PERM,
15443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15444         },
15445         {
15446                 .cmd = NL80211_CMD_LEAVE_IBSS,
15447                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15448                 .doit = nl80211_leave_ibss,
15449                 .flags = GENL_UNS_ADMIN_PERM,
15450                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15451         },
15452 #ifdef CONFIG_NL80211_TESTMODE
15453         {
15454                 .cmd = NL80211_CMD_TESTMODE,
15455                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15456                 .doit = nl80211_testmode_do,
15457                 .dumpit = nl80211_testmode_dump,
15458                 .flags = GENL_UNS_ADMIN_PERM,
15459                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15460         },
15461 #endif
15462         {
15463                 .cmd = NL80211_CMD_CONNECT,
15464                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15465                 .doit = nl80211_connect,
15466                 .flags = GENL_UNS_ADMIN_PERM,
15467                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15468                                   0 |
15469                                   NL80211_FLAG_CLEAR_SKB,
15470         },
15471         {
15472                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
15473                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15474                 .doit = nl80211_update_connect_params,
15475                 .flags = GENL_ADMIN_PERM,
15476                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15477                                   0 |
15478                                   NL80211_FLAG_CLEAR_SKB,
15479         },
15480         {
15481                 .cmd = NL80211_CMD_DISCONNECT,
15482                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15483                 .doit = nl80211_disconnect,
15484                 .flags = GENL_UNS_ADMIN_PERM,
15485                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15486         },
15487         {
15488                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
15489                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15490                 .doit = nl80211_wiphy_netns,
15491                 .flags = GENL_UNS_ADMIN_PERM,
15492                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15493                                   NL80211_FLAG_NEED_RTNL |
15494                                   NL80211_FLAG_NO_WIPHY_MTX,
15495         },
15496         {
15497                 .cmd = NL80211_CMD_GET_SURVEY,
15498                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15499                 .dumpit = nl80211_dump_survey,
15500         },
15501         {
15502                 .cmd = NL80211_CMD_SET_PMKSA,
15503                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15504                 .doit = nl80211_setdel_pmksa,
15505                 .flags = GENL_UNS_ADMIN_PERM,
15506                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15507                                   0 |
15508                                   NL80211_FLAG_CLEAR_SKB,
15509         },
15510         {
15511                 .cmd = NL80211_CMD_DEL_PMKSA,
15512                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15513                 .doit = nl80211_setdel_pmksa,
15514                 .flags = GENL_UNS_ADMIN_PERM,
15515                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15516         },
15517         {
15518                 .cmd = NL80211_CMD_FLUSH_PMKSA,
15519                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15520                 .doit = nl80211_flush_pmksa,
15521                 .flags = GENL_UNS_ADMIN_PERM,
15522                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15523         },
15524         {
15525                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
15526                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15527                 .doit = nl80211_remain_on_channel,
15528                 .flags = GENL_UNS_ADMIN_PERM,
15529                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15530         },
15531         {
15532                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
15533                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15534                 .doit = nl80211_cancel_remain_on_channel,
15535                 .flags = GENL_UNS_ADMIN_PERM,
15536                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15537         },
15538         {
15539                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
15540                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15541                 .doit = nl80211_set_tx_bitrate_mask,
15542                 .flags = GENL_UNS_ADMIN_PERM,
15543                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15544         },
15545         {
15546                 .cmd = NL80211_CMD_REGISTER_FRAME,
15547                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15548                 .doit = nl80211_register_mgmt,
15549                 .flags = GENL_UNS_ADMIN_PERM,
15550                 .internal_flags = NL80211_FLAG_NEED_WDEV,
15551         },
15552         {
15553                 .cmd = NL80211_CMD_FRAME,
15554                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15555                 .doit = nl80211_tx_mgmt,
15556                 .flags = GENL_UNS_ADMIN_PERM,
15557                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15558         },
15559         {
15560                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
15561                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15562                 .doit = nl80211_tx_mgmt_cancel_wait,
15563                 .flags = GENL_UNS_ADMIN_PERM,
15564                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15565         },
15566         {
15567                 .cmd = NL80211_CMD_SET_POWER_SAVE,
15568                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15569                 .doit = nl80211_set_power_save,
15570                 .flags = GENL_UNS_ADMIN_PERM,
15571                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15572         },
15573         {
15574                 .cmd = NL80211_CMD_GET_POWER_SAVE,
15575                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15576                 .doit = nl80211_get_power_save,
15577                 /* can be retrieved by unprivileged users */
15578                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15579         },
15580         {
15581                 .cmd = NL80211_CMD_SET_CQM,
15582                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15583                 .doit = nl80211_set_cqm,
15584                 .flags = GENL_UNS_ADMIN_PERM,
15585                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15586         },
15587         {
15588                 .cmd = NL80211_CMD_SET_CHANNEL,
15589                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15590                 .doit = nl80211_set_channel,
15591                 .flags = GENL_UNS_ADMIN_PERM,
15592                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15593         },
15594         {
15595                 .cmd = NL80211_CMD_JOIN_MESH,
15596                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15597                 .doit = nl80211_join_mesh,
15598                 .flags = GENL_UNS_ADMIN_PERM,
15599                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15600         },
15601         {
15602                 .cmd = NL80211_CMD_LEAVE_MESH,
15603                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15604                 .doit = nl80211_leave_mesh,
15605                 .flags = GENL_UNS_ADMIN_PERM,
15606                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15607         },
15608         {
15609                 .cmd = NL80211_CMD_JOIN_OCB,
15610                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15611                 .doit = nl80211_join_ocb,
15612                 .flags = GENL_UNS_ADMIN_PERM,
15613                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15614         },
15615         {
15616                 .cmd = NL80211_CMD_LEAVE_OCB,
15617                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15618                 .doit = nl80211_leave_ocb,
15619                 .flags = GENL_UNS_ADMIN_PERM,
15620                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15621         },
15622 #ifdef CONFIG_PM
15623         {
15624                 .cmd = NL80211_CMD_GET_WOWLAN,
15625                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15626                 .doit = nl80211_get_wowlan,
15627                 /* can be retrieved by unprivileged users */
15628                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15629         },
15630         {
15631                 .cmd = NL80211_CMD_SET_WOWLAN,
15632                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15633                 .doit = nl80211_set_wowlan,
15634                 .flags = GENL_UNS_ADMIN_PERM,
15635                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15636         },
15637 #endif
15638         {
15639                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
15640                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15641                 .doit = nl80211_set_rekey_data,
15642                 .flags = GENL_UNS_ADMIN_PERM,
15643                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15644                                   0 |
15645                                   NL80211_FLAG_CLEAR_SKB,
15646         },
15647         {
15648                 .cmd = NL80211_CMD_TDLS_MGMT,
15649                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15650                 .doit = nl80211_tdls_mgmt,
15651                 .flags = GENL_UNS_ADMIN_PERM,
15652                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15653         },
15654         {
15655                 .cmd = NL80211_CMD_TDLS_OPER,
15656                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15657                 .doit = nl80211_tdls_oper,
15658                 .flags = GENL_UNS_ADMIN_PERM,
15659                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15660         },
15661         {
15662                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
15663                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15664                 .doit = nl80211_register_unexpected_frame,
15665                 .flags = GENL_UNS_ADMIN_PERM,
15666                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15667         },
15668         {
15669                 .cmd = NL80211_CMD_PROBE_CLIENT,
15670                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15671                 .doit = nl80211_probe_client,
15672                 .flags = GENL_UNS_ADMIN_PERM,
15673                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15674         },
15675         {
15676                 .cmd = NL80211_CMD_REGISTER_BEACONS,
15677                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15678                 .doit = nl80211_register_beacons,
15679                 .flags = GENL_UNS_ADMIN_PERM,
15680                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15681         },
15682         {
15683                 .cmd = NL80211_CMD_SET_NOACK_MAP,
15684                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15685                 .doit = nl80211_set_noack_map,
15686                 .flags = GENL_UNS_ADMIN_PERM,
15687                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15688         },
15689         {
15690                 .cmd = NL80211_CMD_START_P2P_DEVICE,
15691                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15692                 .doit = nl80211_start_p2p_device,
15693                 .flags = GENL_UNS_ADMIN_PERM,
15694                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15695                                   NL80211_FLAG_NEED_RTNL,
15696         },
15697         {
15698                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
15699                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15700                 .doit = nl80211_stop_p2p_device,
15701                 .flags = GENL_UNS_ADMIN_PERM,
15702                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15703                                   NL80211_FLAG_NEED_RTNL,
15704         },
15705         {
15706                 .cmd = NL80211_CMD_START_NAN,
15707                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15708                 .doit = nl80211_start_nan,
15709                 .flags = GENL_ADMIN_PERM,
15710                 .internal_flags = NL80211_FLAG_NEED_WDEV |
15711                                   NL80211_FLAG_NEED_RTNL,
15712         },
15713         {
15714                 .cmd = NL80211_CMD_STOP_NAN,
15715                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15716                 .doit = nl80211_stop_nan,
15717                 .flags = GENL_ADMIN_PERM,
15718                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
15719                                   NL80211_FLAG_NEED_RTNL,
15720         },
15721         {
15722                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
15723                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15724                 .doit = nl80211_nan_add_func,
15725                 .flags = GENL_ADMIN_PERM,
15726                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15727         },
15728         {
15729                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
15730                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15731                 .doit = nl80211_nan_del_func,
15732                 .flags = GENL_ADMIN_PERM,
15733                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15734         },
15735         {
15736                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
15737                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15738                 .doit = nl80211_nan_change_config,
15739                 .flags = GENL_ADMIN_PERM,
15740                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15741         },
15742         {
15743                 .cmd = NL80211_CMD_SET_MCAST_RATE,
15744                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15745                 .doit = nl80211_set_mcast_rate,
15746                 .flags = GENL_UNS_ADMIN_PERM,
15747                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15748         },
15749         {
15750                 .cmd = NL80211_CMD_SET_MAC_ACL,
15751                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15752                 .doit = nl80211_set_mac_acl,
15753                 .flags = GENL_UNS_ADMIN_PERM,
15754                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15755         },
15756         {
15757                 .cmd = NL80211_CMD_RADAR_DETECT,
15758                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15759                 .doit = nl80211_start_radar_detection,
15760                 .flags = GENL_UNS_ADMIN_PERM,
15761                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15762         },
15763         {
15764                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
15765                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15766                 .doit = nl80211_get_protocol_features,
15767         },
15768         {
15769                 .cmd = NL80211_CMD_UPDATE_FT_IES,
15770                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15771                 .doit = nl80211_update_ft_ies,
15772                 .flags = GENL_UNS_ADMIN_PERM,
15773                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15774         },
15775         {
15776                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
15777                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15778                 .doit = nl80211_crit_protocol_start,
15779                 .flags = GENL_UNS_ADMIN_PERM,
15780                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15781         },
15782         {
15783                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
15784                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15785                 .doit = nl80211_crit_protocol_stop,
15786                 .flags = GENL_UNS_ADMIN_PERM,
15787                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15788         },
15789         {
15790                 .cmd = NL80211_CMD_GET_COALESCE,
15791                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15792                 .doit = nl80211_get_coalesce,
15793                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15794         },
15795         {
15796                 .cmd = NL80211_CMD_SET_COALESCE,
15797                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15798                 .doit = nl80211_set_coalesce,
15799                 .flags = GENL_UNS_ADMIN_PERM,
15800                 .internal_flags = NL80211_FLAG_NEED_WIPHY,
15801         },
15802         {
15803                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
15804                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15805                 .doit = nl80211_channel_switch,
15806                 .flags = GENL_UNS_ADMIN_PERM,
15807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15808         },
15809         {
15810                 .cmd = NL80211_CMD_VENDOR,
15811                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15812                 .doit = nl80211_vendor_cmd,
15813                 .dumpit = nl80211_vendor_cmd_dump,
15814                 .flags = GENL_UNS_ADMIN_PERM,
15815                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15816                                   0 |
15817                                   NL80211_FLAG_CLEAR_SKB,
15818         },
15819         {
15820                 .cmd = NL80211_CMD_SET_QOS_MAP,
15821                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15822                 .doit = nl80211_set_qos_map,
15823                 .flags = GENL_UNS_ADMIN_PERM,
15824                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15825         },
15826         {
15827                 .cmd = NL80211_CMD_ADD_TX_TS,
15828                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15829                 .doit = nl80211_add_tx_ts,
15830                 .flags = GENL_UNS_ADMIN_PERM,
15831                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15832         },
15833         {
15834                 .cmd = NL80211_CMD_DEL_TX_TS,
15835                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15836                 .doit = nl80211_del_tx_ts,
15837                 .flags = GENL_UNS_ADMIN_PERM,
15838                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15839         },
15840         {
15841                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
15842                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15843                 .doit = nl80211_tdls_channel_switch,
15844                 .flags = GENL_UNS_ADMIN_PERM,
15845                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15846         },
15847         {
15848                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
15849                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15850                 .doit = nl80211_tdls_cancel_channel_switch,
15851                 .flags = GENL_UNS_ADMIN_PERM,
15852                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15853         },
15854         {
15855                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
15856                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15857                 .doit = nl80211_set_multicast_to_unicast,
15858                 .flags = GENL_UNS_ADMIN_PERM,
15859                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15860         },
15861         {
15862                 .cmd = NL80211_CMD_SET_PMK,
15863                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15864                 .doit = nl80211_set_pmk,
15865                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
15866                                   0 |
15867                                   NL80211_FLAG_CLEAR_SKB,
15868         },
15869         {
15870                 .cmd = NL80211_CMD_DEL_PMK,
15871                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15872                 .doit = nl80211_del_pmk,
15873                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15874         },
15875         {
15876                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
15877                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15878                 .doit = nl80211_external_auth,
15879                 .flags = GENL_ADMIN_PERM,
15880                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15881         },
15882         {
15883                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
15884                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15885                 .doit = nl80211_tx_control_port,
15886                 .flags = GENL_UNS_ADMIN_PERM,
15887                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15888         },
15889         {
15890                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
15891                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15892                 .doit = nl80211_get_ftm_responder_stats,
15893                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15894         },
15895         {
15896                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
15897                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15898                 .doit = nl80211_pmsr_start,
15899                 .flags = GENL_UNS_ADMIN_PERM,
15900                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP,
15901         },
15902         {
15903                 .cmd = NL80211_CMD_NOTIFY_RADAR,
15904                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15905                 .doit = nl80211_notify_radar_detection,
15906                 .flags = GENL_UNS_ADMIN_PERM,
15907                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15908         },
15909         {
15910                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
15911                 .doit = nl80211_update_owe_info,
15912                 .flags = GENL_ADMIN_PERM,
15913                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15914         },
15915         {
15916                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
15917                 .doit = nl80211_probe_mesh_link,
15918                 .flags = GENL_UNS_ADMIN_PERM,
15919                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15920         },
15921         {
15922                 .cmd = NL80211_CMD_SET_TID_CONFIG,
15923                 .doit = nl80211_set_tid_config,
15924                 .flags = GENL_UNS_ADMIN_PERM,
15925                 .internal_flags = NL80211_FLAG_NEED_NETDEV,
15926         },
15927         {
15928                 .cmd = NL80211_CMD_SET_SAR_SPECS,
15929                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15930                 .doit = nl80211_set_sar_specs,
15931                 .flags = GENL_UNS_ADMIN_PERM,
15932                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
15933                                   NL80211_FLAG_NEED_RTNL,
15934         },
15935         {
15936                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
15937                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
15938                 .doit = nl80211_color_change,
15939                 .flags = GENL_UNS_ADMIN_PERM,
15940                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP,
15941         },
15942 };
15943
15944 static struct genl_family nl80211_fam __ro_after_init = {
15945         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
15946         .hdrsize = 0,                   /* no private header */
15947         .version = 1,                   /* no particular meaning now */
15948         .maxattr = NL80211_ATTR_MAX,
15949         .policy = nl80211_policy,
15950         .netnsok = true,
15951         .pre_doit = nl80211_pre_doit,
15952         .post_doit = nl80211_post_doit,
15953         .module = THIS_MODULE,
15954         .ops = nl80211_ops,
15955         .n_ops = ARRAY_SIZE(nl80211_ops),
15956         .small_ops = nl80211_small_ops,
15957         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
15958         .mcgrps = nl80211_mcgrps,
15959         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
15960         .parallel_ops = true,
15961 };
15962
15963 /* notification functions */
15964
15965 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
15966                           enum nl80211_commands cmd)
15967 {
15968         struct sk_buff *msg;
15969         struct nl80211_dump_wiphy_state state = {};
15970
15971         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
15972                 cmd != NL80211_CMD_DEL_WIPHY);
15973
15974         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15975         if (!msg)
15976                 return;
15977
15978         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
15979                 nlmsg_free(msg);
15980                 return;
15981         }
15982
15983         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15984                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
15985 }
15986
15987 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
15988                                 struct wireless_dev *wdev,
15989                                 enum nl80211_commands cmd)
15990 {
15991         struct sk_buff *msg;
15992
15993         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15994         if (!msg)
15995                 return;
15996
15997         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
15998                 nlmsg_free(msg);
15999                 return;
16000         }
16001
16002         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16003                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
16004 }
16005
16006 static int nl80211_add_scan_req(struct sk_buff *msg,
16007                                 struct cfg80211_registered_device *rdev)
16008 {
16009         struct cfg80211_scan_request *req = rdev->scan_req;
16010         struct nlattr *nest;
16011         int i;
16012         struct cfg80211_scan_info *info;
16013
16014         if (WARN_ON(!req))
16015                 return 0;
16016
16017         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
16018         if (!nest)
16019                 goto nla_put_failure;
16020         for (i = 0; i < req->n_ssids; i++) {
16021                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
16022                         goto nla_put_failure;
16023         }
16024         nla_nest_end(msg, nest);
16025
16026         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
16027                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
16028                 if (!nest)
16029                         goto nla_put_failure;
16030                 for (i = 0; i < req->n_channels; i++) {
16031                         if (nla_put_u32(msg, i,
16032                                    ieee80211_channel_to_khz(req->channels[i])))
16033                                 goto nla_put_failure;
16034                 }
16035                 nla_nest_end(msg, nest);
16036         } else {
16037                 nest = nla_nest_start_noflag(msg,
16038                                              NL80211_ATTR_SCAN_FREQUENCIES);
16039                 if (!nest)
16040                         goto nla_put_failure;
16041                 for (i = 0; i < req->n_channels; i++) {
16042                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
16043                                 goto nla_put_failure;
16044                 }
16045                 nla_nest_end(msg, nest);
16046         }
16047
16048         if (req->ie &&
16049             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
16050                 goto nla_put_failure;
16051
16052         if (req->flags &&
16053             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
16054                 goto nla_put_failure;
16055
16056         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
16057                 &rdev->scan_req->info;
16058         if (info->scan_start_tsf &&
16059             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
16060                                info->scan_start_tsf, NL80211_BSS_PAD) ||
16061              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
16062                      info->tsf_bssid)))
16063                 goto nla_put_failure;
16064
16065         return 0;
16066  nla_put_failure:
16067         return -ENOBUFS;
16068 }
16069
16070 static int nl80211_prep_scan_msg(struct sk_buff *msg,
16071                                  struct cfg80211_registered_device *rdev,
16072                                  struct wireless_dev *wdev,
16073                                  u32 portid, u32 seq, int flags,
16074                                  u32 cmd)
16075 {
16076         void *hdr;
16077
16078         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
16079         if (!hdr)
16080                 return -1;
16081
16082         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16083             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16084                                          wdev->netdev->ifindex)) ||
16085             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16086                               NL80211_ATTR_PAD))
16087                 goto nla_put_failure;
16088
16089         /* ignore errors and send incomplete event anyway */
16090         nl80211_add_scan_req(msg, rdev);
16091
16092         genlmsg_end(msg, hdr);
16093         return 0;
16094
16095  nla_put_failure:
16096         genlmsg_cancel(msg, hdr);
16097         return -EMSGSIZE;
16098 }
16099
16100 static int
16101 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
16102                             struct cfg80211_sched_scan_request *req, u32 cmd)
16103 {
16104         void *hdr;
16105
16106         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16107         if (!hdr)
16108                 return -1;
16109
16110         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
16111                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
16112             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
16113             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
16114                               NL80211_ATTR_PAD))
16115                 goto nla_put_failure;
16116
16117         genlmsg_end(msg, hdr);
16118         return 0;
16119
16120  nla_put_failure:
16121         genlmsg_cancel(msg, hdr);
16122         return -EMSGSIZE;
16123 }
16124
16125 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
16126                              struct wireless_dev *wdev)
16127 {
16128         struct sk_buff *msg;
16129
16130         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16131         if (!msg)
16132                 return;
16133
16134         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
16135                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
16136                 nlmsg_free(msg);
16137                 return;
16138         }
16139
16140         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16141                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16142 }
16143
16144 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
16145                                        struct wireless_dev *wdev, bool aborted)
16146 {
16147         struct sk_buff *msg;
16148
16149         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16150         if (!msg)
16151                 return NULL;
16152
16153         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
16154                                   aborted ? NL80211_CMD_SCAN_ABORTED :
16155                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
16156                 nlmsg_free(msg);
16157                 return NULL;
16158         }
16159
16160         return msg;
16161 }
16162
16163 /* send message created by nl80211_build_scan_msg() */
16164 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
16165                            struct sk_buff *msg)
16166 {
16167         if (!msg)
16168                 return;
16169
16170         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16171                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16172 }
16173
16174 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
16175 {
16176         struct sk_buff *msg;
16177
16178         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16179         if (!msg)
16180                 return;
16181
16182         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
16183                 nlmsg_free(msg);
16184                 return;
16185         }
16186
16187         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
16188                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
16189 }
16190
16191 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
16192                                           struct regulatory_request *request)
16193 {
16194         /* Userspace can always count this one always being set */
16195         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
16196                 goto nla_put_failure;
16197
16198         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
16199                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16200                                NL80211_REGDOM_TYPE_WORLD))
16201                         goto nla_put_failure;
16202         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
16203                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16204                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
16205                         goto nla_put_failure;
16206         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
16207                    request->intersect) {
16208                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16209                                NL80211_REGDOM_TYPE_INTERSECTION))
16210                         goto nla_put_failure;
16211         } else {
16212                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
16213                                NL80211_REGDOM_TYPE_COUNTRY) ||
16214                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
16215                                    request->alpha2))
16216                         goto nla_put_failure;
16217         }
16218
16219         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
16220                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
16221
16222                 if (wiphy &&
16223                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
16224                         goto nla_put_failure;
16225
16226                 if (wiphy &&
16227                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
16228                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
16229                         goto nla_put_failure;
16230         }
16231
16232         return true;
16233
16234 nla_put_failure:
16235         return false;
16236 }
16237
16238 /*
16239  * This can happen on global regulatory changes or device specific settings
16240  * based on custom regulatory domains.
16241  */
16242 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
16243                                      struct regulatory_request *request)
16244 {
16245         struct sk_buff *msg;
16246         void *hdr;
16247
16248         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16249         if (!msg)
16250                 return;
16251
16252         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
16253         if (!hdr)
16254                 goto nla_put_failure;
16255
16256         if (!nl80211_reg_change_event_fill(msg, request))
16257                 goto nla_put_failure;
16258
16259         genlmsg_end(msg, hdr);
16260
16261         rcu_read_lock();
16262         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16263                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16264         rcu_read_unlock();
16265
16266         return;
16267
16268 nla_put_failure:
16269         nlmsg_free(msg);
16270 }
16271
16272 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
16273                                     struct net_device *netdev,
16274                                     const u8 *buf, size_t len,
16275                                     enum nl80211_commands cmd, gfp_t gfp,
16276                                     int uapsd_queues, const u8 *req_ies,
16277                                     size_t req_ies_len, bool reconnect)
16278 {
16279         struct sk_buff *msg;
16280         void *hdr;
16281
16282         msg = nlmsg_new(100 + len + req_ies_len, gfp);
16283         if (!msg)
16284                 return;
16285
16286         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16287         if (!hdr) {
16288                 nlmsg_free(msg);
16289                 return;
16290         }
16291
16292         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16293             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16294             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
16295             (req_ies &&
16296              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
16297                 goto nla_put_failure;
16298
16299         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
16300                 goto nla_put_failure;
16301
16302         if (uapsd_queues >= 0) {
16303                 struct nlattr *nla_wmm =
16304                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
16305                 if (!nla_wmm)
16306                         goto nla_put_failure;
16307
16308                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
16309                                uapsd_queues))
16310                         goto nla_put_failure;
16311
16312                 nla_nest_end(msg, nla_wmm);
16313         }
16314
16315         genlmsg_end(msg, hdr);
16316
16317         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16318                                 NL80211_MCGRP_MLME, gfp);
16319         return;
16320
16321  nla_put_failure:
16322         nlmsg_free(msg);
16323 }
16324
16325 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
16326                           struct net_device *netdev, const u8 *buf,
16327                           size_t len, gfp_t gfp)
16328 {
16329         nl80211_send_mlme_event(rdev, netdev, buf, len,
16330                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
16331                                 false);
16332 }
16333
16334 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
16335                            struct net_device *netdev, const u8 *buf,
16336                            size_t len, gfp_t gfp, int uapsd_queues,
16337                            const u8 *req_ies, size_t req_ies_len)
16338 {
16339         nl80211_send_mlme_event(rdev, netdev, buf, len,
16340                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues,
16341                                 req_ies, req_ies_len, false);
16342 }
16343
16344 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
16345                          struct net_device *netdev, const u8 *buf,
16346                          size_t len, bool reconnect, gfp_t gfp)
16347 {
16348         nl80211_send_mlme_event(rdev, netdev, buf, len,
16349                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
16350                                 reconnect);
16351 }
16352
16353 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
16354                            struct net_device *netdev, const u8 *buf,
16355                            size_t len, bool reconnect, gfp_t gfp)
16356 {
16357         nl80211_send_mlme_event(rdev, netdev, buf, len,
16358                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
16359                                 reconnect);
16360 }
16361
16362 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
16363                                   size_t len)
16364 {
16365         struct wireless_dev *wdev = dev->ieee80211_ptr;
16366         struct wiphy *wiphy = wdev->wiphy;
16367         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16368         const struct ieee80211_mgmt *mgmt = (void *)buf;
16369         u32 cmd;
16370
16371         if (WARN_ON(len < 2))
16372                 return;
16373
16374         if (ieee80211_is_deauth(mgmt->frame_control)) {
16375                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
16376         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
16377                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
16378         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
16379                 if (wdev->unprot_beacon_reported &&
16380                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
16381                         return;
16382                 cmd = NL80211_CMD_UNPROT_BEACON;
16383                 wdev->unprot_beacon_reported = jiffies;
16384         } else {
16385                 return;
16386         }
16387
16388         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
16389         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
16390                                 NULL, 0, false);
16391 }
16392 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
16393
16394 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
16395                                       struct net_device *netdev, int cmd,
16396                                       const u8 *addr, gfp_t gfp)
16397 {
16398         struct sk_buff *msg;
16399         void *hdr;
16400
16401         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16402         if (!msg)
16403                 return;
16404
16405         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16406         if (!hdr) {
16407                 nlmsg_free(msg);
16408                 return;
16409         }
16410
16411         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16412             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16413             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16414             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16415                 goto nla_put_failure;
16416
16417         genlmsg_end(msg, hdr);
16418
16419         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16420                                 NL80211_MCGRP_MLME, gfp);
16421         return;
16422
16423  nla_put_failure:
16424         nlmsg_free(msg);
16425 }
16426
16427 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
16428                                struct net_device *netdev, const u8 *addr,
16429                                gfp_t gfp)
16430 {
16431         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
16432                                   addr, gfp);
16433 }
16434
16435 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
16436                                 struct net_device *netdev, const u8 *addr,
16437                                 gfp_t gfp)
16438 {
16439         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
16440                                   addr, gfp);
16441 }
16442
16443 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
16444                                  struct net_device *netdev,
16445                                  struct cfg80211_connect_resp_params *cr,
16446                                  gfp_t gfp)
16447 {
16448         struct sk_buff *msg;
16449         void *hdr;
16450
16451         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
16452                         cr->fils.kek_len + cr->fils.pmk_len +
16453                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16454         if (!msg)
16455                 return;
16456
16457         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
16458         if (!hdr) {
16459                 nlmsg_free(msg);
16460                 return;
16461         }
16462
16463         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16464             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16465             (cr->bssid &&
16466              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
16467             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
16468                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
16469                         cr->status) ||
16470             (cr->status < 0 &&
16471              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
16472               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
16473                           cr->timeout_reason))) ||
16474             (cr->req_ie &&
16475              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
16476             (cr->resp_ie &&
16477              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
16478                      cr->resp_ie)) ||
16479             (cr->fils.update_erp_next_seq_num &&
16480              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16481                          cr->fils.erp_next_seq_num)) ||
16482             (cr->status == WLAN_STATUS_SUCCESS &&
16483              ((cr->fils.kek &&
16484                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
16485                        cr->fils.kek)) ||
16486               (cr->fils.pmk &&
16487                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
16488               (cr->fils.pmkid &&
16489                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
16490                 goto nla_put_failure;
16491
16492         genlmsg_end(msg, hdr);
16493
16494         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16495                                 NL80211_MCGRP_MLME, gfp);
16496         return;
16497
16498  nla_put_failure:
16499         nlmsg_free(msg);
16500 }
16501
16502 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
16503                          struct net_device *netdev,
16504                          struct cfg80211_roam_info *info, gfp_t gfp)
16505 {
16506         struct sk_buff *msg;
16507         void *hdr;
16508         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
16509
16510         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
16511                         info->fils.kek_len + info->fils.pmk_len +
16512                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
16513         if (!msg)
16514                 return;
16515
16516         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
16517         if (!hdr) {
16518                 nlmsg_free(msg);
16519                 return;
16520         }
16521
16522         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16523             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16524             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
16525             (info->req_ie &&
16526              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
16527                      info->req_ie)) ||
16528             (info->resp_ie &&
16529              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
16530                      info->resp_ie)) ||
16531             (info->fils.update_erp_next_seq_num &&
16532              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
16533                          info->fils.erp_next_seq_num)) ||
16534             (info->fils.kek &&
16535              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
16536                      info->fils.kek)) ||
16537             (info->fils.pmk &&
16538              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
16539             (info->fils.pmkid &&
16540              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
16541                 goto nla_put_failure;
16542
16543         genlmsg_end(msg, hdr);
16544
16545         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16546                                 NL80211_MCGRP_MLME, gfp);
16547         return;
16548
16549  nla_put_failure:
16550         nlmsg_free(msg);
16551 }
16552
16553 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
16554                                   struct net_device *netdev, const u8 *bssid)
16555 {
16556         struct sk_buff *msg;
16557         void *hdr;
16558
16559         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16560         if (!msg)
16561                 return;
16562
16563         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
16564         if (!hdr) {
16565                 nlmsg_free(msg);
16566                 return;
16567         }
16568
16569         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16570             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16571             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16572                 goto nla_put_failure;
16573
16574         genlmsg_end(msg, hdr);
16575
16576         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16577                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16578         return;
16579
16580  nla_put_failure:
16581         nlmsg_free(msg);
16582 }
16583
16584 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
16585                                struct net_device *netdev, u16 reason,
16586                                const u8 *ie, size_t ie_len, bool from_ap)
16587 {
16588         struct sk_buff *msg;
16589         void *hdr;
16590
16591         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
16592         if (!msg)
16593                 return;
16594
16595         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
16596         if (!hdr) {
16597                 nlmsg_free(msg);
16598                 return;
16599         }
16600
16601         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16602             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16603             (reason &&
16604              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
16605             (from_ap &&
16606              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
16607             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
16608                 goto nla_put_failure;
16609
16610         genlmsg_end(msg, hdr);
16611
16612         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16613                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16614         return;
16615
16616  nla_put_failure:
16617         nlmsg_free(msg);
16618 }
16619
16620 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
16621                              struct net_device *netdev, const u8 *bssid,
16622                              gfp_t gfp)
16623 {
16624         struct sk_buff *msg;
16625         void *hdr;
16626
16627         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16628         if (!msg)
16629                 return;
16630
16631         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
16632         if (!hdr) {
16633                 nlmsg_free(msg);
16634                 return;
16635         }
16636
16637         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16638             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16639             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
16640                 goto nla_put_failure;
16641
16642         genlmsg_end(msg, hdr);
16643
16644         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16645                                 NL80211_MCGRP_MLME, gfp);
16646         return;
16647
16648  nla_put_failure:
16649         nlmsg_free(msg);
16650 }
16651
16652 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
16653                                         const u8 *ie, u8 ie_len,
16654                                         int sig_dbm, gfp_t gfp)
16655 {
16656         struct wireless_dev *wdev = dev->ieee80211_ptr;
16657         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16658         struct sk_buff *msg;
16659         void *hdr;
16660
16661         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
16662                 return;
16663
16664         trace_cfg80211_notify_new_peer_candidate(dev, addr);
16665
16666         msg = nlmsg_new(100 + ie_len, gfp);
16667         if (!msg)
16668                 return;
16669
16670         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
16671         if (!hdr) {
16672                 nlmsg_free(msg);
16673                 return;
16674         }
16675
16676         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16677             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16678             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
16679             (ie_len && ie &&
16680              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
16681             (sig_dbm &&
16682              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
16683                 goto nla_put_failure;
16684
16685         genlmsg_end(msg, hdr);
16686
16687         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16688                                 NL80211_MCGRP_MLME, gfp);
16689         return;
16690
16691  nla_put_failure:
16692         nlmsg_free(msg);
16693 }
16694 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
16695
16696 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
16697                                  struct net_device *netdev, const u8 *addr,
16698                                  enum nl80211_key_type key_type, int key_id,
16699                                  const u8 *tsc, gfp_t gfp)
16700 {
16701         struct sk_buff *msg;
16702         void *hdr;
16703
16704         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16705         if (!msg)
16706                 return;
16707
16708         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
16709         if (!hdr) {
16710                 nlmsg_free(msg);
16711                 return;
16712         }
16713
16714         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16715             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16716             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
16717             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
16718             (key_id != -1 &&
16719              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
16720             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
16721                 goto nla_put_failure;
16722
16723         genlmsg_end(msg, hdr);
16724
16725         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16726                                 NL80211_MCGRP_MLME, gfp);
16727         return;
16728
16729  nla_put_failure:
16730         nlmsg_free(msg);
16731 }
16732
16733 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
16734                                     struct ieee80211_channel *channel_before,
16735                                     struct ieee80211_channel *channel_after)
16736 {
16737         struct sk_buff *msg;
16738         void *hdr;
16739         struct nlattr *nl_freq;
16740
16741         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
16742         if (!msg)
16743                 return;
16744
16745         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
16746         if (!hdr) {
16747                 nlmsg_free(msg);
16748                 return;
16749         }
16750
16751         /*
16752          * Since we are applying the beacon hint to a wiphy we know its
16753          * wiphy_idx is valid
16754          */
16755         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
16756                 goto nla_put_failure;
16757
16758         /* Before */
16759         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
16760         if (!nl_freq)
16761                 goto nla_put_failure;
16762
16763         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
16764                 goto nla_put_failure;
16765         nla_nest_end(msg, nl_freq);
16766
16767         /* After */
16768         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
16769         if (!nl_freq)
16770                 goto nla_put_failure;
16771
16772         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
16773                 goto nla_put_failure;
16774         nla_nest_end(msg, nl_freq);
16775
16776         genlmsg_end(msg, hdr);
16777
16778         rcu_read_lock();
16779         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
16780                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
16781         rcu_read_unlock();
16782
16783         return;
16784
16785 nla_put_failure:
16786         nlmsg_free(msg);
16787 }
16788
16789 static void nl80211_send_remain_on_chan_event(
16790         int cmd, struct cfg80211_registered_device *rdev,
16791         struct wireless_dev *wdev, u64 cookie,
16792         struct ieee80211_channel *chan,
16793         unsigned int duration, gfp_t gfp)
16794 {
16795         struct sk_buff *msg;
16796         void *hdr;
16797
16798         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16799         if (!msg)
16800                 return;
16801
16802         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16803         if (!hdr) {
16804                 nlmsg_free(msg);
16805                 return;
16806         }
16807
16808         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16809             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
16810                                          wdev->netdev->ifindex)) ||
16811             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16812                               NL80211_ATTR_PAD) ||
16813             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
16814             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
16815                         NL80211_CHAN_NO_HT) ||
16816             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
16817                               NL80211_ATTR_PAD))
16818                 goto nla_put_failure;
16819
16820         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
16821             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
16822                 goto nla_put_failure;
16823
16824         genlmsg_end(msg, hdr);
16825
16826         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16827                                 NL80211_MCGRP_MLME, gfp);
16828         return;
16829
16830  nla_put_failure:
16831         nlmsg_free(msg);
16832 }
16833
16834 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
16835                                struct ieee80211_channel *chan,
16836                                unsigned int duration, gfp_t gfp)
16837 {
16838         struct wiphy *wiphy = wdev->wiphy;
16839         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16840
16841         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
16842         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
16843                                           rdev, wdev, cookie, chan,
16844                                           duration, gfp);
16845 }
16846 EXPORT_SYMBOL(cfg80211_ready_on_channel);
16847
16848 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
16849                                         struct ieee80211_channel *chan,
16850                                         gfp_t gfp)
16851 {
16852         struct wiphy *wiphy = wdev->wiphy;
16853         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16854
16855         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
16856         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16857                                           rdev, wdev, cookie, chan, 0, gfp);
16858 }
16859 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
16860
16861 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
16862                                         struct ieee80211_channel *chan,
16863                                         gfp_t gfp)
16864 {
16865         struct wiphy *wiphy = wdev->wiphy;
16866         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16867
16868         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
16869         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
16870                                           rdev, wdev, cookie, chan, 0, gfp);
16871 }
16872 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
16873
16874 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
16875                       struct station_info *sinfo, gfp_t gfp)
16876 {
16877         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16878         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16879         struct sk_buff *msg;
16880
16881         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
16882
16883         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16884         if (!msg)
16885                 return;
16886
16887         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
16888                                  rdev, dev, mac_addr, sinfo) < 0) {
16889                 nlmsg_free(msg);
16890                 return;
16891         }
16892
16893         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16894                                 NL80211_MCGRP_MLME, gfp);
16895 }
16896 EXPORT_SYMBOL(cfg80211_new_sta);
16897
16898 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
16899                             struct station_info *sinfo, gfp_t gfp)
16900 {
16901         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16902         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16903         struct sk_buff *msg;
16904         struct station_info empty_sinfo = {};
16905
16906         if (!sinfo)
16907                 sinfo = &empty_sinfo;
16908
16909         trace_cfg80211_del_sta(dev, mac_addr);
16910
16911         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16912         if (!msg) {
16913                 cfg80211_sinfo_release_content(sinfo);
16914                 return;
16915         }
16916
16917         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
16918                                  rdev, dev, mac_addr, sinfo) < 0) {
16919                 nlmsg_free(msg);
16920                 return;
16921         }
16922
16923         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16924                                 NL80211_MCGRP_MLME, gfp);
16925 }
16926 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
16927
16928 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
16929                           enum nl80211_connect_failed_reason reason,
16930                           gfp_t gfp)
16931 {
16932         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
16933         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16934         struct sk_buff *msg;
16935         void *hdr;
16936
16937         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
16938         if (!msg)
16939                 return;
16940
16941         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
16942         if (!hdr) {
16943                 nlmsg_free(msg);
16944                 return;
16945         }
16946
16947         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16948             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
16949             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
16950                 goto nla_put_failure;
16951
16952         genlmsg_end(msg, hdr);
16953
16954         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16955                                 NL80211_MCGRP_MLME, gfp);
16956         return;
16957
16958  nla_put_failure:
16959         nlmsg_free(msg);
16960 }
16961 EXPORT_SYMBOL(cfg80211_conn_failed);
16962
16963 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
16964                                        const u8 *addr, gfp_t gfp)
16965 {
16966         struct wireless_dev *wdev = dev->ieee80211_ptr;
16967         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16968         struct sk_buff *msg;
16969         void *hdr;
16970         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
16971
16972         if (!nlportid)
16973                 return false;
16974
16975         msg = nlmsg_new(100, gfp);
16976         if (!msg)
16977                 return true;
16978
16979         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
16980         if (!hdr) {
16981                 nlmsg_free(msg);
16982                 return true;
16983         }
16984
16985         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16986             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16987             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
16988                 goto nla_put_failure;
16989
16990         genlmsg_end(msg, hdr);
16991         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16992         return true;
16993
16994  nla_put_failure:
16995         nlmsg_free(msg);
16996         return true;
16997 }
16998
16999 bool cfg80211_rx_spurious_frame(struct net_device *dev,
17000                                 const u8 *addr, gfp_t gfp)
17001 {
17002         struct wireless_dev *wdev = dev->ieee80211_ptr;
17003         bool ret;
17004
17005         trace_cfg80211_rx_spurious_frame(dev, addr);
17006
17007         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
17008                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
17009                 trace_cfg80211_return_bool(false);
17010                 return false;
17011         }
17012         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
17013                                          addr, gfp);
17014         trace_cfg80211_return_bool(ret);
17015         return ret;
17016 }
17017 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
17018
17019 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
17020                                         const u8 *addr, gfp_t gfp)
17021 {
17022         struct wireless_dev *wdev = dev->ieee80211_ptr;
17023         bool ret;
17024
17025         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
17026
17027         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
17028                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
17029                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
17030                 trace_cfg80211_return_bool(false);
17031                 return false;
17032         }
17033         ret = __nl80211_unexpected_frame(dev,
17034                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
17035                                          addr, gfp);
17036         trace_cfg80211_return_bool(ret);
17037         return ret;
17038 }
17039 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
17040
17041 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
17042                       struct wireless_dev *wdev, u32 nlportid,
17043                       int freq, int sig_dbm,
17044                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
17045 {
17046         struct net_device *netdev = wdev->netdev;
17047         struct sk_buff *msg;
17048         void *hdr;
17049
17050         msg = nlmsg_new(100 + len, gfp);
17051         if (!msg)
17052                 return -ENOMEM;
17053
17054         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17055         if (!hdr) {
17056                 nlmsg_free(msg);
17057                 return -ENOMEM;
17058         }
17059
17060         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17061             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17062                                         netdev->ifindex)) ||
17063             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17064                               NL80211_ATTR_PAD) ||
17065             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(freq)) ||
17066             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, freq % 1000) ||
17067             (sig_dbm &&
17068              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17069             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17070             (flags &&
17071              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
17072                 goto nla_put_failure;
17073
17074         genlmsg_end(msg, hdr);
17075
17076         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17077
17078  nla_put_failure:
17079         nlmsg_free(msg);
17080         return -ENOBUFS;
17081 }
17082
17083 static void nl80211_frame_tx_status(struct wireless_dev *wdev, u64 cookie,
17084                                     const u8 *buf, size_t len, bool ack,
17085                                     gfp_t gfp, enum nl80211_commands command)
17086 {
17087         struct wiphy *wiphy = wdev->wiphy;
17088         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17089         struct net_device *netdev = wdev->netdev;
17090         struct sk_buff *msg;
17091         void *hdr;
17092
17093         if (command == NL80211_CMD_FRAME_TX_STATUS)
17094                 trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
17095         else
17096                 trace_cfg80211_control_port_tx_status(wdev, cookie, ack);
17097
17098         msg = nlmsg_new(100 + len, gfp);
17099         if (!msg)
17100                 return;
17101
17102         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
17103         if (!hdr) {
17104                 nlmsg_free(msg);
17105                 return;
17106         }
17107
17108         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17109             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17110                                    netdev->ifindex)) ||
17111             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17112                               NL80211_ATTR_PAD) ||
17113             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17114             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17115                               NL80211_ATTR_PAD) ||
17116             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
17117                 goto nla_put_failure;
17118
17119         genlmsg_end(msg, hdr);
17120
17121         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17122                                 NL80211_MCGRP_MLME, gfp);
17123         return;
17124
17125 nla_put_failure:
17126         nlmsg_free(msg);
17127 }
17128
17129 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
17130                                      const u8 *buf, size_t len, bool ack,
17131                                      gfp_t gfp)
17132 {
17133         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
17134                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
17135 }
17136 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
17137
17138 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
17139                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
17140 {
17141         nl80211_frame_tx_status(wdev, cookie, buf, len, ack, gfp,
17142                                 NL80211_CMD_FRAME_TX_STATUS);
17143 }
17144 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
17145
17146 static int __nl80211_rx_control_port(struct net_device *dev,
17147                                      struct sk_buff *skb,
17148                                      bool unencrypted, gfp_t gfp)
17149 {
17150         struct wireless_dev *wdev = dev->ieee80211_ptr;
17151         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17152         struct ethhdr *ehdr = eth_hdr(skb);
17153         const u8 *addr = ehdr->h_source;
17154         u16 proto = be16_to_cpu(skb->protocol);
17155         struct sk_buff *msg;
17156         void *hdr;
17157         struct nlattr *frame;
17158
17159         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
17160
17161         if (!nlportid)
17162                 return -ENOENT;
17163
17164         msg = nlmsg_new(100 + skb->len, gfp);
17165         if (!msg)
17166                 return -ENOMEM;
17167
17168         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
17169         if (!hdr) {
17170                 nlmsg_free(msg);
17171                 return -ENOBUFS;
17172         }
17173
17174         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17175             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17176             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17177                               NL80211_ATTR_PAD) ||
17178             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17179             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
17180             (unencrypted && nla_put_flag(msg,
17181                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
17182                 goto nla_put_failure;
17183
17184         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
17185         if (!frame)
17186                 goto nla_put_failure;
17187
17188         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
17189         genlmsg_end(msg, hdr);
17190
17191         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
17192
17193  nla_put_failure:
17194         nlmsg_free(msg);
17195         return -ENOBUFS;
17196 }
17197
17198 bool cfg80211_rx_control_port(struct net_device *dev,
17199                               struct sk_buff *skb, bool unencrypted)
17200 {
17201         int ret;
17202
17203         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
17204         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
17205         trace_cfg80211_return_bool(ret == 0);
17206         return ret == 0;
17207 }
17208 EXPORT_SYMBOL(cfg80211_rx_control_port);
17209
17210 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
17211                                             const char *mac, gfp_t gfp)
17212 {
17213         struct wireless_dev *wdev = dev->ieee80211_ptr;
17214         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17215         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17216         void **cb;
17217
17218         if (!msg)
17219                 return NULL;
17220
17221         cb = (void **)msg->cb;
17222
17223         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
17224         if (!cb[0]) {
17225                 nlmsg_free(msg);
17226                 return NULL;
17227         }
17228
17229         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17230             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17231                 goto nla_put_failure;
17232
17233         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17234                 goto nla_put_failure;
17235
17236         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
17237         if (!cb[1])
17238                 goto nla_put_failure;
17239
17240         cb[2] = rdev;
17241
17242         return msg;
17243  nla_put_failure:
17244         nlmsg_free(msg);
17245         return NULL;
17246 }
17247
17248 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
17249 {
17250         void **cb = (void **)msg->cb;
17251         struct cfg80211_registered_device *rdev = cb[2];
17252
17253         nla_nest_end(msg, cb[1]);
17254         genlmsg_end(msg, cb[0]);
17255
17256         memset(msg->cb, 0, sizeof(msg->cb));
17257
17258         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17259                                 NL80211_MCGRP_MLME, gfp);
17260 }
17261
17262 void cfg80211_cqm_rssi_notify(struct net_device *dev,
17263                               enum nl80211_cqm_rssi_threshold_event rssi_event,
17264                               s32 rssi_level, gfp_t gfp)
17265 {
17266         struct sk_buff *msg;
17267         struct wireless_dev *wdev = dev->ieee80211_ptr;
17268         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17269
17270         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
17271
17272         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
17273                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
17274                 return;
17275
17276         if (wdev->cqm_config) {
17277                 wdev->cqm_config->last_rssi_event_value = rssi_level;
17278
17279                 cfg80211_cqm_rssi_update(rdev, dev);
17280
17281                 if (rssi_level == 0)
17282                         rssi_level = wdev->cqm_config->last_rssi_event_value;
17283         }
17284
17285         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17286         if (!msg)
17287                 return;
17288
17289         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
17290                         rssi_event))
17291                 goto nla_put_failure;
17292
17293         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
17294                                       rssi_level))
17295                 goto nla_put_failure;
17296
17297         cfg80211_send_cqm(msg, gfp);
17298
17299         return;
17300
17301  nla_put_failure:
17302         nlmsg_free(msg);
17303 }
17304 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
17305
17306 void cfg80211_cqm_txe_notify(struct net_device *dev,
17307                              const u8 *peer, u32 num_packets,
17308                              u32 rate, u32 intvl, gfp_t gfp)
17309 {
17310         struct sk_buff *msg;
17311
17312         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17313         if (!msg)
17314                 return;
17315
17316         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
17317                 goto nla_put_failure;
17318
17319         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
17320                 goto nla_put_failure;
17321
17322         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
17323                 goto nla_put_failure;
17324
17325         cfg80211_send_cqm(msg, gfp);
17326         return;
17327
17328  nla_put_failure:
17329         nlmsg_free(msg);
17330 }
17331 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
17332
17333 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
17334                                  const u8 *peer, u32 num_packets, gfp_t gfp)
17335 {
17336         struct sk_buff *msg;
17337
17338         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
17339
17340         msg = cfg80211_prepare_cqm(dev, peer, gfp);
17341         if (!msg)
17342                 return;
17343
17344         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
17345                 goto nla_put_failure;
17346
17347         cfg80211_send_cqm(msg, gfp);
17348         return;
17349
17350  nla_put_failure:
17351         nlmsg_free(msg);
17352 }
17353 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
17354
17355 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
17356 {
17357         struct sk_buff *msg;
17358
17359         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
17360         if (!msg)
17361                 return;
17362
17363         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
17364                 goto nla_put_failure;
17365
17366         cfg80211_send_cqm(msg, gfp);
17367         return;
17368
17369  nla_put_failure:
17370         nlmsg_free(msg);
17371 }
17372 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
17373
17374 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
17375                                      struct net_device *netdev, const u8 *bssid,
17376                                      const u8 *replay_ctr, gfp_t gfp)
17377 {
17378         struct sk_buff *msg;
17379         struct nlattr *rekey_attr;
17380         void *hdr;
17381
17382         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17383         if (!msg)
17384                 return;
17385
17386         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
17387         if (!hdr) {
17388                 nlmsg_free(msg);
17389                 return;
17390         }
17391
17392         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17393             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17394             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
17395                 goto nla_put_failure;
17396
17397         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
17398         if (!rekey_attr)
17399                 goto nla_put_failure;
17400
17401         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
17402                     NL80211_REPLAY_CTR_LEN, replay_ctr))
17403                 goto nla_put_failure;
17404
17405         nla_nest_end(msg, rekey_attr);
17406
17407         genlmsg_end(msg, hdr);
17408
17409         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17410                                 NL80211_MCGRP_MLME, gfp);
17411         return;
17412
17413  nla_put_failure:
17414         nlmsg_free(msg);
17415 }
17416
17417 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
17418                                const u8 *replay_ctr, gfp_t gfp)
17419 {
17420         struct wireless_dev *wdev = dev->ieee80211_ptr;
17421         struct wiphy *wiphy = wdev->wiphy;
17422         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17423
17424         trace_cfg80211_gtk_rekey_notify(dev, bssid);
17425         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
17426 }
17427 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
17428
17429 static void
17430 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
17431                                struct net_device *netdev, int index,
17432                                const u8 *bssid, bool preauth, gfp_t gfp)
17433 {
17434         struct sk_buff *msg;
17435         struct nlattr *attr;
17436         void *hdr;
17437
17438         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17439         if (!msg)
17440                 return;
17441
17442         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
17443         if (!hdr) {
17444                 nlmsg_free(msg);
17445                 return;
17446         }
17447
17448         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17449             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17450                 goto nla_put_failure;
17451
17452         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
17453         if (!attr)
17454                 goto nla_put_failure;
17455
17456         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
17457             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
17458             (preauth &&
17459              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
17460                 goto nla_put_failure;
17461
17462         nla_nest_end(msg, attr);
17463
17464         genlmsg_end(msg, hdr);
17465
17466         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17467                                 NL80211_MCGRP_MLME, gfp);
17468         return;
17469
17470  nla_put_failure:
17471         nlmsg_free(msg);
17472 }
17473
17474 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
17475                                      const u8 *bssid, bool preauth, gfp_t gfp)
17476 {
17477         struct wireless_dev *wdev = dev->ieee80211_ptr;
17478         struct wiphy *wiphy = wdev->wiphy;
17479         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17480
17481         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
17482         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
17483 }
17484 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
17485
17486 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
17487                                      struct net_device *netdev,
17488                                      struct cfg80211_chan_def *chandef,
17489                                      gfp_t gfp,
17490                                      enum nl80211_commands notif,
17491                                      u8 count, bool quiet)
17492 {
17493         struct sk_buff *msg;
17494         void *hdr;
17495
17496         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17497         if (!msg)
17498                 return;
17499
17500         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
17501         if (!hdr) {
17502                 nlmsg_free(msg);
17503                 return;
17504         }
17505
17506         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
17507                 goto nla_put_failure;
17508
17509         if (nl80211_send_chandef(msg, chandef))
17510                 goto nla_put_failure;
17511
17512         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
17513                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
17514                         goto nla_put_failure;
17515                 if (quiet &&
17516                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
17517                         goto nla_put_failure;
17518         }
17519
17520         genlmsg_end(msg, hdr);
17521
17522         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17523                                 NL80211_MCGRP_MLME, gfp);
17524         return;
17525
17526  nla_put_failure:
17527         nlmsg_free(msg);
17528 }
17529
17530 void cfg80211_ch_switch_notify(struct net_device *dev,
17531                                struct cfg80211_chan_def *chandef)
17532 {
17533         struct wireless_dev *wdev = dev->ieee80211_ptr;
17534         struct wiphy *wiphy = wdev->wiphy;
17535         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17536
17537         ASSERT_WDEV_LOCK(wdev);
17538
17539         trace_cfg80211_ch_switch_notify(dev, chandef);
17540
17541         wdev->chandef = *chandef;
17542         wdev->preset_chandef = *chandef;
17543
17544         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
17545              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
17546             !WARN_ON(!wdev->current_bss))
17547                 cfg80211_update_assoc_bss_entry(wdev, chandef->chan);
17548
17549         cfg80211_sched_dfs_chan_update(rdev);
17550
17551         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17552                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false);
17553 }
17554 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
17555
17556 void cfg80211_ch_switch_started_notify(struct net_device *dev,
17557                                        struct cfg80211_chan_def *chandef,
17558                                        u8 count, bool quiet)
17559 {
17560         struct wireless_dev *wdev = dev->ieee80211_ptr;
17561         struct wiphy *wiphy = wdev->wiphy;
17562         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17563
17564         trace_cfg80211_ch_switch_started_notify(dev, chandef);
17565
17566         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
17567                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
17568                                  count, quiet);
17569 }
17570 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
17571
17572 int cfg80211_bss_color_notify(struct net_device *dev, gfp_t gfp,
17573                               enum nl80211_commands cmd, u8 count,
17574                               u64 color_bitmap)
17575 {
17576         struct wireless_dev *wdev = dev->ieee80211_ptr;
17577         struct wiphy *wiphy = wdev->wiphy;
17578         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17579         struct sk_buff *msg;
17580         void *hdr;
17581
17582         ASSERT_WDEV_LOCK(wdev);
17583
17584         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
17585
17586         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17587         if (!msg)
17588                 return -ENOMEM;
17589
17590         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17591         if (!hdr)
17592                 goto nla_put_failure;
17593
17594         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17595                 goto nla_put_failure;
17596
17597         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
17598             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
17599                 goto nla_put_failure;
17600
17601         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
17602             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
17603                               color_bitmap, NL80211_ATTR_PAD))
17604                 goto nla_put_failure;
17605
17606         genlmsg_end(msg, hdr);
17607
17608         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
17609                                        msg, 0, NL80211_MCGRP_MLME, gfp);
17610
17611 nla_put_failure:
17612         nlmsg_free(msg);
17613         return -EINVAL;
17614 }
17615 EXPORT_SYMBOL(cfg80211_bss_color_notify);
17616
17617 void
17618 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
17619                      const struct cfg80211_chan_def *chandef,
17620                      enum nl80211_radar_event event,
17621                      struct net_device *netdev, gfp_t gfp)
17622 {
17623         struct sk_buff *msg;
17624         void *hdr;
17625
17626         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17627         if (!msg)
17628                 return;
17629
17630         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
17631         if (!hdr) {
17632                 nlmsg_free(msg);
17633                 return;
17634         }
17635
17636         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17637                 goto nla_put_failure;
17638
17639         /* NOP and radar events don't need a netdev parameter */
17640         if (netdev) {
17641                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
17642
17643                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17644                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17645                                       NL80211_ATTR_PAD))
17646                         goto nla_put_failure;
17647         }
17648
17649         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
17650                 goto nla_put_failure;
17651
17652         if (nl80211_send_chandef(msg, chandef))
17653                 goto nla_put_failure;
17654
17655         genlmsg_end(msg, hdr);
17656
17657         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17658                                 NL80211_MCGRP_MLME, gfp);
17659         return;
17660
17661  nla_put_failure:
17662         nlmsg_free(msg);
17663 }
17664
17665 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
17666                                        struct sta_opmode_info *sta_opmode,
17667                                        gfp_t gfp)
17668 {
17669         struct sk_buff *msg;
17670         struct wireless_dev *wdev = dev->ieee80211_ptr;
17671         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17672         void *hdr;
17673
17674         if (WARN_ON(!mac))
17675                 return;
17676
17677         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17678         if (!msg)
17679                 return;
17680
17681         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
17682         if (!hdr) {
17683                 nlmsg_free(msg);
17684                 return;
17685         }
17686
17687         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
17688                 goto nla_put_failure;
17689
17690         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
17691                 goto nla_put_failure;
17692
17693         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
17694                 goto nla_put_failure;
17695
17696         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
17697             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
17698                 goto nla_put_failure;
17699
17700         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
17701             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
17702                 goto nla_put_failure;
17703
17704         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
17705             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
17706                 goto nla_put_failure;
17707
17708         genlmsg_end(msg, hdr);
17709
17710         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17711                                 NL80211_MCGRP_MLME, gfp);
17712
17713         return;
17714
17715 nla_put_failure:
17716         nlmsg_free(msg);
17717 }
17718 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
17719
17720 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
17721                            u64 cookie, bool acked, s32 ack_signal,
17722                            bool is_valid_ack_signal, gfp_t gfp)
17723 {
17724         struct wireless_dev *wdev = dev->ieee80211_ptr;
17725         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17726         struct sk_buff *msg;
17727         void *hdr;
17728
17729         trace_cfg80211_probe_status(dev, addr, cookie, acked);
17730
17731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17732
17733         if (!msg)
17734                 return;
17735
17736         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
17737         if (!hdr) {
17738                 nlmsg_free(msg);
17739                 return;
17740         }
17741
17742         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17743             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
17744             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
17745             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
17746                               NL80211_ATTR_PAD) ||
17747             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
17748             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
17749                                                 ack_signal)))
17750                 goto nla_put_failure;
17751
17752         genlmsg_end(msg, hdr);
17753
17754         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17755                                 NL80211_MCGRP_MLME, gfp);
17756         return;
17757
17758  nla_put_failure:
17759         nlmsg_free(msg);
17760 }
17761 EXPORT_SYMBOL(cfg80211_probe_status);
17762
17763 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
17764                                      size_t len, int freq, int sig_dbm)
17765 {
17766         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17767         struct sk_buff *msg;
17768         void *hdr;
17769         struct cfg80211_beacon_registration *reg;
17770
17771         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
17772
17773         spin_lock_bh(&rdev->beacon_registrations_lock);
17774         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
17775                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
17776                 if (!msg) {
17777                         spin_unlock_bh(&rdev->beacon_registrations_lock);
17778                         return;
17779                 }
17780
17781                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
17782                 if (!hdr)
17783                         goto nla_put_failure;
17784
17785                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17786                     (freq &&
17787                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
17788                                   KHZ_TO_MHZ(freq)) ||
17789                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
17790                                   freq % 1000))) ||
17791                     (sig_dbm &&
17792                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
17793                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
17794                         goto nla_put_failure;
17795
17796                 genlmsg_end(msg, hdr);
17797
17798                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
17799         }
17800         spin_unlock_bh(&rdev->beacon_registrations_lock);
17801         return;
17802
17803  nla_put_failure:
17804         spin_unlock_bh(&rdev->beacon_registrations_lock);
17805         nlmsg_free(msg);
17806 }
17807 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
17808
17809 #ifdef CONFIG_PM
17810 static int cfg80211_net_detect_results(struct sk_buff *msg,
17811                                        struct cfg80211_wowlan_wakeup *wakeup)
17812 {
17813         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
17814         struct nlattr *nl_results, *nl_match, *nl_freqs;
17815         int i, j;
17816
17817         nl_results = nla_nest_start_noflag(msg,
17818                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
17819         if (!nl_results)
17820                 return -EMSGSIZE;
17821
17822         for (i = 0; i < nd->n_matches; i++) {
17823                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
17824
17825                 nl_match = nla_nest_start_noflag(msg, i);
17826                 if (!nl_match)
17827                         break;
17828
17829                 /* The SSID attribute is optional in nl80211, but for
17830                  * simplicity reasons it's always present in the
17831                  * cfg80211 structure.  If a driver can't pass the
17832                  * SSID, that needs to be changed.  A zero length SSID
17833                  * is still a valid SSID (wildcard), so it cannot be
17834                  * used for this purpose.
17835                  */
17836                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
17837                             match->ssid.ssid)) {
17838                         nla_nest_cancel(msg, nl_match);
17839                         goto out;
17840                 }
17841
17842                 if (match->n_channels) {
17843                         nl_freqs = nla_nest_start_noflag(msg,
17844                                                          NL80211_ATTR_SCAN_FREQUENCIES);
17845                         if (!nl_freqs) {
17846                                 nla_nest_cancel(msg, nl_match);
17847                                 goto out;
17848                         }
17849
17850                         for (j = 0; j < match->n_channels; j++) {
17851                                 if (nla_put_u32(msg, j, match->channels[j])) {
17852                                         nla_nest_cancel(msg, nl_freqs);
17853                                         nla_nest_cancel(msg, nl_match);
17854                                         goto out;
17855                                 }
17856                         }
17857
17858                         nla_nest_end(msg, nl_freqs);
17859                 }
17860
17861                 nla_nest_end(msg, nl_match);
17862         }
17863
17864 out:
17865         nla_nest_end(msg, nl_results);
17866         return 0;
17867 }
17868
17869 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
17870                                    struct cfg80211_wowlan_wakeup *wakeup,
17871                                    gfp_t gfp)
17872 {
17873         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17874         struct sk_buff *msg;
17875         void *hdr;
17876         int size = 200;
17877
17878         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
17879
17880         if (wakeup)
17881                 size += wakeup->packet_present_len;
17882
17883         msg = nlmsg_new(size, gfp);
17884         if (!msg)
17885                 return;
17886
17887         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
17888         if (!hdr)
17889                 goto free_msg;
17890
17891         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17892             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17893                               NL80211_ATTR_PAD))
17894                 goto free_msg;
17895
17896         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17897                                         wdev->netdev->ifindex))
17898                 goto free_msg;
17899
17900         if (wakeup) {
17901                 struct nlattr *reasons;
17902
17903                 reasons = nla_nest_start_noflag(msg,
17904                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
17905                 if (!reasons)
17906                         goto free_msg;
17907
17908                 if (wakeup->disconnect &&
17909                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
17910                         goto free_msg;
17911                 if (wakeup->magic_pkt &&
17912                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
17913                         goto free_msg;
17914                 if (wakeup->gtk_rekey_failure &&
17915                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
17916                         goto free_msg;
17917                 if (wakeup->eap_identity_req &&
17918                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
17919                         goto free_msg;
17920                 if (wakeup->four_way_handshake &&
17921                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
17922                         goto free_msg;
17923                 if (wakeup->rfkill_release &&
17924                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
17925                         goto free_msg;
17926
17927                 if (wakeup->pattern_idx >= 0 &&
17928                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
17929                                 wakeup->pattern_idx))
17930                         goto free_msg;
17931
17932                 if (wakeup->tcp_match &&
17933                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
17934                         goto free_msg;
17935
17936                 if (wakeup->tcp_connlost &&
17937                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
17938                         goto free_msg;
17939
17940                 if (wakeup->tcp_nomoretokens &&
17941                     nla_put_flag(msg,
17942                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
17943                         goto free_msg;
17944
17945                 if (wakeup->packet) {
17946                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
17947                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
17948
17949                         if (!wakeup->packet_80211) {
17950                                 pkt_attr =
17951                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
17952                                 len_attr =
17953                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
17954                         }
17955
17956                         if (wakeup->packet_len &&
17957                             nla_put_u32(msg, len_attr, wakeup->packet_len))
17958                                 goto free_msg;
17959
17960                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
17961                                     wakeup->packet))
17962                                 goto free_msg;
17963                 }
17964
17965                 if (wakeup->net_detect &&
17966                     cfg80211_net_detect_results(msg, wakeup))
17967                                 goto free_msg;
17968
17969                 nla_nest_end(msg, reasons);
17970         }
17971
17972         genlmsg_end(msg, hdr);
17973
17974         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17975                                 NL80211_MCGRP_MLME, gfp);
17976         return;
17977
17978  free_msg:
17979         nlmsg_free(msg);
17980 }
17981 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
17982 #endif
17983
17984 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
17985                                 enum nl80211_tdls_operation oper,
17986                                 u16 reason_code, gfp_t gfp)
17987 {
17988         struct wireless_dev *wdev = dev->ieee80211_ptr;
17989         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
17990         struct sk_buff *msg;
17991         void *hdr;
17992
17993         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
17994                                          reason_code);
17995
17996         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17997         if (!msg)
17998                 return;
17999
18000         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
18001         if (!hdr) {
18002                 nlmsg_free(msg);
18003                 return;
18004         }
18005
18006         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18007             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18008             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
18009             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
18010             (reason_code > 0 &&
18011              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
18012                 goto nla_put_failure;
18013
18014         genlmsg_end(msg, hdr);
18015
18016         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18017                                 NL80211_MCGRP_MLME, gfp);
18018         return;
18019
18020  nla_put_failure:
18021         nlmsg_free(msg);
18022 }
18023 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
18024
18025 static int nl80211_netlink_notify(struct notifier_block * nb,
18026                                   unsigned long state,
18027                                   void *_notify)
18028 {
18029         struct netlink_notify *notify = _notify;
18030         struct cfg80211_registered_device *rdev;
18031         struct wireless_dev *wdev;
18032         struct cfg80211_beacon_registration *reg, *tmp;
18033
18034         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
18035                 return NOTIFY_DONE;
18036
18037         rcu_read_lock();
18038
18039         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
18040                 struct cfg80211_sched_scan_request *sched_scan_req;
18041
18042                 list_for_each_entry_rcu(sched_scan_req,
18043                                         &rdev->sched_scan_req_list,
18044                                         list) {
18045                         if (sched_scan_req->owner_nlportid == notify->portid) {
18046                                 sched_scan_req->nl_owner_dead = true;
18047                                 schedule_work(&rdev->sched_scan_stop_wk);
18048                         }
18049                 }
18050
18051                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
18052                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
18053
18054                         if (wdev->owner_nlportid == notify->portid) {
18055                                 wdev->nl_owner_dead = true;
18056                                 schedule_work(&rdev->destroy_work);
18057                         } else if (wdev->conn_owner_nlportid == notify->portid) {
18058                                 schedule_work(&wdev->disconnect_wk);
18059                         }
18060
18061                         cfg80211_release_pmsr(wdev, notify->portid);
18062                 }
18063
18064                 spin_lock_bh(&rdev->beacon_registrations_lock);
18065                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
18066                                          list) {
18067                         if (reg->nlportid == notify->portid) {
18068                                 list_del(&reg->list);
18069                                 kfree(reg);
18070                                 break;
18071                         }
18072                 }
18073                 spin_unlock_bh(&rdev->beacon_registrations_lock);
18074         }
18075
18076         rcu_read_unlock();
18077
18078         /*
18079          * It is possible that the user space process that is controlling the
18080          * indoor setting disappeared, so notify the regulatory core.
18081          */
18082         regulatory_netlink_notify(notify->portid);
18083         return NOTIFY_OK;
18084 }
18085
18086 static struct notifier_block nl80211_netlink_notifier = {
18087         .notifier_call = nl80211_netlink_notify,
18088 };
18089
18090 void cfg80211_ft_event(struct net_device *netdev,
18091                        struct cfg80211_ft_event_params *ft_event)
18092 {
18093         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
18094         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18095         struct sk_buff *msg;
18096         void *hdr;
18097
18098         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
18099
18100         if (!ft_event->target_ap)
18101                 return;
18102
18103         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
18104                         GFP_KERNEL);
18105         if (!msg)
18106                 return;
18107
18108         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
18109         if (!hdr)
18110                 goto out;
18111
18112         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18113             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18114             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
18115                 goto out;
18116
18117         if (ft_event->ies &&
18118             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
18119                 goto out;
18120         if (ft_event->ric_ies &&
18121             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
18122                     ft_event->ric_ies))
18123                 goto out;
18124
18125         genlmsg_end(msg, hdr);
18126
18127         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18128                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18129         return;
18130  out:
18131         nlmsg_free(msg);
18132 }
18133 EXPORT_SYMBOL(cfg80211_ft_event);
18134
18135 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
18136 {
18137         struct cfg80211_registered_device *rdev;
18138         struct sk_buff *msg;
18139         void *hdr;
18140         u32 nlportid;
18141
18142         rdev = wiphy_to_rdev(wdev->wiphy);
18143         if (!rdev->crit_proto_nlportid)
18144                 return;
18145
18146         nlportid = rdev->crit_proto_nlportid;
18147         rdev->crit_proto_nlportid = 0;
18148
18149         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18150         if (!msg)
18151                 return;
18152
18153         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
18154         if (!hdr)
18155                 goto nla_put_failure;
18156
18157         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18158             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18159                               NL80211_ATTR_PAD))
18160                 goto nla_put_failure;
18161
18162         genlmsg_end(msg, hdr);
18163
18164         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18165         return;
18166
18167  nla_put_failure:
18168         nlmsg_free(msg);
18169 }
18170 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
18171
18172 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
18173 {
18174         struct wiphy *wiphy = wdev->wiphy;
18175         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18176         struct sk_buff *msg;
18177         void *hdr;
18178
18179         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18180         if (!msg)
18181                 return;
18182
18183         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
18184         if (!hdr)
18185                 goto out;
18186
18187         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18188             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
18189             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18190                               NL80211_ATTR_PAD))
18191                 goto out;
18192
18193         genlmsg_end(msg, hdr);
18194
18195         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
18196                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18197         return;
18198  out:
18199         nlmsg_free(msg);
18200 }
18201
18202 int cfg80211_external_auth_request(struct net_device *dev,
18203                                    struct cfg80211_external_auth_params *params,
18204                                    gfp_t gfp)
18205 {
18206         struct wireless_dev *wdev = dev->ieee80211_ptr;
18207         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18208         struct sk_buff *msg;
18209         void *hdr;
18210
18211         if (!wdev->conn_owner_nlportid)
18212                 return -EINVAL;
18213
18214         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18215         if (!msg)
18216                 return -ENOMEM;
18217
18218         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
18219         if (!hdr)
18220                 goto nla_put_failure;
18221
18222         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18223             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18224             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
18225             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
18226                         params->action) ||
18227             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
18228             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
18229                     params->ssid.ssid))
18230                 goto nla_put_failure;
18231
18232         genlmsg_end(msg, hdr);
18233         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
18234                         wdev->conn_owner_nlportid);
18235         return 0;
18236
18237  nla_put_failure:
18238         nlmsg_free(msg);
18239         return -ENOBUFS;
18240 }
18241 EXPORT_SYMBOL(cfg80211_external_auth_request);
18242
18243 void cfg80211_update_owe_info_event(struct net_device *netdev,
18244                                     struct cfg80211_update_owe_info *owe_info,
18245                                     gfp_t gfp)
18246 {
18247         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
18248         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18249         struct sk_buff *msg;
18250         void *hdr;
18251
18252         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
18253
18254         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18255         if (!msg)
18256                 return;
18257
18258         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
18259         if (!hdr)
18260                 goto nla_put_failure;
18261
18262         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18263             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18264             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
18265                 goto nla_put_failure;
18266
18267         if (!owe_info->ie_len ||
18268             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
18269                 goto nla_put_failure;
18270
18271         genlmsg_end(msg, hdr);
18272
18273         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18274                                 NL80211_MCGRP_MLME, gfp);
18275         return;
18276
18277 nla_put_failure:
18278         genlmsg_cancel(msg, hdr);
18279         nlmsg_free(msg);
18280 }
18281 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
18282
18283 /* initialisation/exit functions */
18284
18285 int __init nl80211_init(void)
18286 {
18287         int err;
18288
18289         err = genl_register_family(&nl80211_fam);
18290         if (err)
18291                 return err;
18292
18293         err = netlink_register_notifier(&nl80211_netlink_notifier);
18294         if (err)
18295                 goto err_out;
18296
18297         return 0;
18298  err_out:
18299         genl_unregister_family(&nl80211_fam);
18300         return err;
18301 }
18302
18303 void nl80211_exit(void)
18304 {
18305         netlink_unregister_notifier(&nl80211_netlink_notifier);
18306         genl_unregister_family(&nl80211_fam);
18307 }