net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 /* policy for the attributes */
 204 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 205         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 206         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 207                                       .len = 20-1 },
 208         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 209
 210         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 211         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 213         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 214         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 215
 216         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 217         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 218         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 219         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 220         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 221         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 222
 223         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 224         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 225         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 226
 227         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 228         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 229
 230         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 231         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 232                                     .len = WLAN_MAX_KEY_LEN },
 233         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 234         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 235         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 236         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 237         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 238
 239         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 240         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 241         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 244                                        .len = IEEE80211_MAX_DATA_LEN },
 245         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 247         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 248         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 249                                                .len = NL80211_MAX_SUPP_RATES },
 250         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 251         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 252         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 253         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 254                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 255         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 256
 257         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 258         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 259
 260         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 262         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 263         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 264                                            .len = NL80211_MAX_SUPP_RATES },
 265         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 266
 267         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 268         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 269
 270         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 271
 272         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 273         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 274                               .len = IEEE80211_MAX_DATA_LEN },
 275         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 276         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 277
 278         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 279                                 .len = IEEE80211_MAX_SSID_LEN },
 280         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 281         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 282         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 283         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 284         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 285         [NL80211_ATTR_STA_FLAGS2] = {
 286                 .len = sizeof(struct nl80211_sta_flag_update),
 287         },
 288         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 290         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 291         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 292         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 293         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 294         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 295         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 296         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 297         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 298         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 299         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 300         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 301         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 302                                  .len = IEEE80211_MAX_DATA_LEN },
 303         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 304         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 305         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 306         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 307         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 308         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 309         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 310         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 311         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 312         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 313         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 315         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 316         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 317         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 318         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 319         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 321         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 322         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 323                                          .len = IEEE80211_MAX_DATA_LEN },
 324         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 325                                          .len = IEEE80211_MAX_DATA_LEN },
 326         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 328         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 329         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 330         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 331         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 332         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 334         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 336         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 337                                       .len = IEEE80211_MAX_DATA_LEN },
 338         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 339         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 341                 .len = NL80211_HT_CAPABILITY_LEN
 342         },
 343         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 344         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 345         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 346         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 347         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 348         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 349         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 350         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 351         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 352         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 353         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 354         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 355         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 356         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 357         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 358         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 359         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 360         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 361                 .len = NL80211_VHT_CAPABILITY_LEN,
 362         },
 363         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 365                                   .len = IEEE80211_MAX_DATA_LEN },
 366         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 367         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 368         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 369         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 370         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 372         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 373         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 374         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 375         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 376         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 377         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 378         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 379         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 380                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 381         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 382         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 383         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 384         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 385         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 386         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 387         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 388         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 389         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 390         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 391         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 392         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 394         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 395         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 397         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 398         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 399         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 400                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 401         },
 402         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 403         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 404         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 405         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 406         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 407                                     .len = FILS_MAX_KEK_LEN },
 408         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 409         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 410         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 411         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 412         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 413                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 414         },
 415         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 416         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 417                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 418         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 419                                           .len = FILS_ERP_MAX_REALM_LEN },
 420         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 421         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 422                                         .len = FILS_ERP_MAX_RRK_LEN },
 423         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 424         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 425         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 426         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 427
 428         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 429         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 430         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 431         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 432                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 433 };
 434
 435 /* policy for the key attributes */
 436 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 437         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 438         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 439         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 440         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 441         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 442         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 443         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 444         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 445 };
 446
 447 /* policy for the key default flags */
 448 static const struct nla_policy
 449 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 450         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 451         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 452 };
 453
 454 #ifdef CONFIG_PM
 455 /* policy for WoWLAN attributes */
 456 static const struct nla_policy
 457 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 458         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 459         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 460         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 461         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 462         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 463         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 464         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 465         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 466         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 467         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 468 };
 469
 470 static const struct nla_policy
 471 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 472         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 473         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 474         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 475         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 476         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 477         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 478         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 479                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 480         },
 481         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 482                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 483         },
 484         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 485         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 486         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 487 };
 488 #endif /* CONFIG_PM */
 489
 490 /* policy for coalesce rule attributes */
 491 static const struct nla_policy
 492 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 493         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 494         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 495         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 496 };
 497
 498 /* policy for GTK rekey offload attributes */
 499 static const struct nla_policy
 500 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 501         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 502         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 503         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 504 };
 505
 506 static const struct nla_policy
 507 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 508         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 509                                                  .len = IEEE80211_MAX_SSID_LEN },
 510         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 511         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 512 };
 513
 514 static const struct nla_policy
 515 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 516         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 517         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 518 };
 519
 520 static const struct nla_policy
 521 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 522         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 523         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 524         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 525                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 526         },
 527 };
 528
 529 /* policy for NAN function attributes */
 530 static const struct nla_policy
 531 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 532         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 533         [NL80211_NAN_FUNC_SERVICE_ID] = {
 534                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 535         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 536         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 537         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 538         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 539         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 540         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 541         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 542         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 543         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 544                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 545         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 546         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 547         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 548         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 549         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 550 };
 551
 552 /* policy for Service Response Filter attributes */
 553 static const struct nla_policy
 554 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 555         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 556         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 557                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 558         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 559         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 560 };
 561
 562 /* policy for packet pattern attributes */
 563 static const struct nla_policy
 564 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 565         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 566         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 567         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 568 };
 569
 570 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 571                                      struct netlink_callback *cb,
 572                                      struct cfg80211_registered_device **rdev,
 573                                      struct wireless_dev **wdev)
 574 {
 575         int err;
 576
 577         if (!cb->args[0]) {
 578                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 579                                   genl_family_attrbuf(&nl80211_fam),
 580                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 581                 if (err)
 582                         return err;
 583
 584                 *wdev = __cfg80211_wdev_from_attrs(
 585                                         sock_net(skb->sk),
 586                                         genl_family_attrbuf(&nl80211_fam));
 587                 if (IS_ERR(*wdev))
 588                         return PTR_ERR(*wdev);
 589                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 590                 /* 0 is the first index - add 1 to parse only once */
 591                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 592                 cb->args[1] = (*wdev)->identifier;
 593         } else {
 594                 /* subtract the 1 again here */
 595                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 596                 struct wireless_dev *tmp;
 597
 598                 if (!wiphy)
 599                         return -ENODEV;
 600                 *rdev = wiphy_to_rdev(wiphy);
 601                 *wdev = NULL;
 602
 603                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 604                         if (tmp->identifier == cb->args[1]) {
 605                                 *wdev = tmp;
 606                                 break;
 607                         }
 608                 }
 609
 610                 if (!*wdev)
 611                         return -ENODEV;
 612         }
 613
 614         return 0;
 615 }
 616
 617 /* IE validation */
 618 static bool is_valid_ie_attr(const struct nlattr *attr)
 619 {
 620         const u8 *pos;
 621         int len;
 622
 623         if (!attr)
 624                 return true;
 625
 626         pos = nla_data(attr);
 627         len = nla_len(attr);
 628
 629         while (len) {
 630                 u8 elemlen;
 631
 632                 if (len < 2)
 633                         return false;
 634                 len -= 2;
 635
 636                 elemlen = pos[1];
 637                 if (elemlen > len)
 638                         return false;
 639
 640                 len -= elemlen;
 641                 pos += 2 + elemlen;
 642         }
 643
 644         return true;
 645 }
 646
 647 /* message building helper */
 648 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 649                                    int flags, u8 cmd)
 650 {
 651         /* since there is no private header just add the generic one */
 652         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 653 }
 654
 655 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 656                                      const struct ieee80211_reg_rule *rule)
 657 {
 658         int j;
 659         struct nlattr *nl_wmm_rules =
 660                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 661
 662         if (!nl_wmm_rules)
 663                 goto nla_put_failure;
 664
 665         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 666                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 667
 668                 if (!nl_wmm_rule)
 669                         goto nla_put_failure;
 670
 671                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 672                                 rule->wmm_rule.client[j].cw_min) ||
 673                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 674                                 rule->wmm_rule.client[j].cw_max) ||
 675                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 676                                rule->wmm_rule.client[j].aifsn) ||
 677                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 678                                 rule->wmm_rule.client[j].cot))
 679                         goto nla_put_failure;
 680
 681                 nla_nest_end(msg, nl_wmm_rule);
 682         }
 683         nla_nest_end(msg, nl_wmm_rules);
 684
 685         return 0;
 686
 687 nla_put_failure:
 688         return -ENOBUFS;
 689 }
 690
 691 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 692                                    struct ieee80211_channel *chan,
 693                                    bool large)
 694 {
 695         /* Some channels must be completely excluded from the
 696          * list to protect old user-space tools from breaking
 697          */
 698         if (!large && chan->flags &
 699             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 700                 return 0;
 701
 702         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 703                         chan->center_freq))
 704                 goto nla_put_failure;
 705
 706         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 707             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 708                 goto nla_put_failure;
 709         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 710                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 711                         goto nla_put_failure;
 712                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 713                         goto nla_put_failure;
 714         }
 715         if (chan->flags & IEEE80211_CHAN_RADAR) {
 716                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 717                         goto nla_put_failure;
 718                 if (large) {
 719                         u32 time;
 720
 721                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 722
 723                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 724                                         chan->dfs_state))
 725                                 goto nla_put_failure;
 726                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 727                                         time))
 728                                 goto nla_put_failure;
 729                         if (nla_put_u32(msg,
 730                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 731                                         chan->dfs_cac_ms))
 732                                 goto nla_put_failure;
 733                 }
 734         }
 735
 736         if (large) {
 737                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 738                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 739                         goto nla_put_failure;
 740                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 741                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 742                         goto nla_put_failure;
 743                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 744                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 745                         goto nla_put_failure;
 746                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 747                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 748                         goto nla_put_failure;
 749                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 750                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 751                         goto nla_put_failure;
 752                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 753                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 754                         goto nla_put_failure;
 755                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 756                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 757                         goto nla_put_failure;
 758                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 759                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 760                         goto nla_put_failure;
 761         }
 762
 763         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 764                         DBM_TO_MBM(chan->max_power)))
 765                 goto nla_put_failure;
 766
 767         if (large) {
 768                 const struct ieee80211_reg_rule *rule =
 769                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 770
 771                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 772                         if (nl80211_msg_put_wmm_rules(msg, rule))
 773                                 goto nla_put_failure;
 774                 }
 775         }
 776
 777         return 0;
 778
 779  nla_put_failure:
 780         return -ENOBUFS;
 781 }
 782
 783 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 784                                   struct cfg80211_txq_stats *txqstats,
 785                                   int attrtype)
 786 {
 787         struct nlattr *txqattr;
 788
 789 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 790         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 791             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 792                 return false;                                             \
 793         } while (0)
 794
 795         txqattr = nla_nest_start(msg, attrtype);
 796         if (!txqattr)
 797                 return false;
 798
 799         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 800         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 801         PUT_TXQVAL_U32(FLOWS, flows);
 802         PUT_TXQVAL_U32(DROPS, drops);
 803         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 804         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 805         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 806         PUT_TXQVAL_U32(COLLISIONS, collisions);
 807         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 808         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 809         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 810         nla_nest_end(msg, txqattr);
 811
 812 #undef PUT_TXQVAL_U32
 813         return true;
 814 }
 815
 816 /* netlink command implementations */
 817
 818 struct key_parse {
 819         struct key_params p;
 820         int idx;
 821         int type;
 822         bool def, defmgmt;
 823         bool def_uni, def_multi;
 824 };
 825
 826 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 827                                  struct key_parse *k)
 828 {
 829         struct nlattr *tb[NL80211_KEY_MAX + 1];
 830         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 831                                    nl80211_key_policy, info->extack);
 832         if (err)
 833                 return err;
 834
 835         k->def = !!tb[NL80211_KEY_DEFAULT];
 836         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 837
 838         if (k->def) {
 839                 k->def_uni = true;
 840                 k->def_multi = true;
 841         }
 842         if (k->defmgmt)
 843                 k->def_multi = true;
 844
 845         if (tb[NL80211_KEY_IDX])
 846                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 847
 848         if (tb[NL80211_KEY_DATA]) {
 849                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 850                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 851         }
 852
 853         if (tb[NL80211_KEY_SEQ]) {
 854                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 855                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 856         }
 857
 858         if (tb[NL80211_KEY_CIPHER])
 859                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 860
 861         if (tb[NL80211_KEY_TYPE]) {
 862                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 863                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 864                         return genl_err_attr(info, -EINVAL,
 865                                              tb[NL80211_KEY_TYPE]);
 866         }
 867
 868         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 869                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 870
 871                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 872                                        tb[NL80211_KEY_DEFAULT_TYPES],
 873                                        nl80211_key_default_policy,
 874                                        info->extack);
 875                 if (err)
 876                         return err;
 877
 878                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 879                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 880         }
 881
 882         return 0;
 883 }
 884
 885 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 886 {
 887         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 888                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 889                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 890         }
 891
 892         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 893                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 894                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 895         }
 896
 897         if (info->attrs[NL80211_ATTR_KEY_IDX])
 898                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 899
 900         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 901                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 902
 903         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 904         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 905
 906         if (k->def) {
 907                 k->def_uni = true;
 908                 k->def_multi = true;
 909         }
 910         if (k->defmgmt)
 911                 k->def_multi = true;
 912
 913         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 914                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 915                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
 916                         GENL_SET_ERR_MSG(info, "key type out of range");
 917                         return -EINVAL;
 918                 }
 919         }
 920
 921         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 922                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 923                 int err = nla_parse_nested(kdt,
 924                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 925                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 926                                            nl80211_key_default_policy,
 927                                            info->extack);
 928                 if (err)
 929                         return err;
 930
 931                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 932                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 933         }
 934
 935         return 0;
 936 }
 937
 938 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 939 {
 940         int err;
 941
 942         memset(k, 0, sizeof(*k));
 943         k->idx = -1;
 944         k->type = -1;
 945
 946         if (info->attrs[NL80211_ATTR_KEY])
 947                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 948         else
 949                 err = nl80211_parse_key_old(info, k);
 950
 951         if (err)
 952                 return err;
 953
 954         if (k->def && k->defmgmt) {
 955                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 956                 return -EINVAL;
 957         }
 958
 959         if (k->defmgmt) {
 960                 if (k->def_uni || !k->def_multi) {
 961                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 962                         return -EINVAL;
 963                 }
 964         }
 965
 966         if (k->idx != -1) {
 967                 if (k->defmgmt) {
 968                         if (k->idx < 4 || k->idx > 5) {
 969                                 GENL_SET_ERR_MSG(info,
 970                                                  "defmgmt key idx not 4 or 5");
 971                                 return -EINVAL;
 972                         }
 973                 } else if (k->def) {
 974                         if (k->idx < 0 || k->idx > 3) {
 975                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
 976                                 return -EINVAL;
 977                         }
 978                 } else {
 979                         if (k->idx < 0 || k->idx > 5) {
 980                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
 981                                 return -EINVAL;
 982                         }
 983                 }
 984         }
 985
 986         return 0;
 987 }
 988
 989 static struct cfg80211_cached_keys *
 990 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 991                        struct genl_info *info, bool *no_ht)
 992 {
 993         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
 994         struct key_parse parse;
 995         struct nlattr *key;
 996         struct cfg80211_cached_keys *result;
 997         int rem, err, def = 0;
 998         bool have_key = false;
 999
1000         nla_for_each_nested(key, keys, rem) {
1001                 have_key = true;
1002                 break;
1003         }
1004
1005         if (!have_key)
1006                 return NULL;
1007
1008         result = kzalloc(sizeof(*result), GFP_KERNEL);
1009         if (!result)
1010                 return ERR_PTR(-ENOMEM);
1011
1012         result->def = -1;
1013
1014         nla_for_each_nested(key, keys, rem) {
1015                 memset(&parse, 0, sizeof(parse));
1016                 parse.idx = -1;
1017
1018                 err = nl80211_parse_key_new(info, key, &parse);
1019                 if (err)
1020                         goto error;
1021                 err = -EINVAL;
1022                 if (!parse.p.key)
1023                         goto error;
1024                 if (parse.idx < 0 || parse.idx > 3) {
1025                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1026                         goto error;
1027                 }
1028                 if (parse.def) {
1029                         if (def) {
1030                                 GENL_SET_ERR_MSG(info,
1031                                                  "only one key can be default");
1032                                 goto error;
1033                         }
1034                         def = 1;
1035                         result->def = parse.idx;
1036                         if (!parse.def_uni || !parse.def_multi)
1037                                 goto error;
1038                 } else if (parse.defmgmt)
1039                         goto error;
1040                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1041                                                      parse.idx, false, NULL);
1042                 if (err)
1043                         goto error;
1044                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1045                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1046                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1047                         err = -EINVAL;
1048                         goto error;
1049                 }
1050                 result->params[parse.idx].cipher = parse.p.cipher;
1051                 result->params[parse.idx].key_len = parse.p.key_len;
1052                 result->params[parse.idx].key = result->data[parse.idx];
1053                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1054
1055                 /* must be WEP key if we got here */
1056                 if (no_ht)
1057                         *no_ht = true;
1058         }
1059
1060         if (result->def < 0) {
1061                 err = -EINVAL;
1062                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1063                 goto error;
1064         }
1065
1066         return result;
1067  error:
1068         kfree(result);
1069         return ERR_PTR(err);
1070 }
1071
1072 static int nl80211_key_allowed(struct wireless_dev *wdev)
1073 {
1074         ASSERT_WDEV_LOCK(wdev);
1075
1076         switch (wdev->iftype) {
1077         case NL80211_IFTYPE_AP:
1078         case NL80211_IFTYPE_AP_VLAN:
1079         case NL80211_IFTYPE_P2P_GO:
1080         case NL80211_IFTYPE_MESH_POINT:
1081                 break;
1082         case NL80211_IFTYPE_ADHOC:
1083         case NL80211_IFTYPE_STATION:
1084         case NL80211_IFTYPE_P2P_CLIENT:
1085                 if (!wdev->current_bss)
1086                         return -ENOLINK;
1087                 break;
1088         case NL80211_IFTYPE_UNSPECIFIED:
1089         case NL80211_IFTYPE_OCB:
1090         case NL80211_IFTYPE_MONITOR:
1091         case NL80211_IFTYPE_NAN:
1092         case NL80211_IFTYPE_P2P_DEVICE:
1093         case NL80211_IFTYPE_WDS:
1094         case NUM_NL80211_IFTYPES:
1095                 return -EINVAL;
1096         }
1097
1098         return 0;
1099 }
1100
1101 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1102                                                         struct nlattr *tb)
1103 {
1104         struct ieee80211_channel *chan;
1105
1106         if (tb == NULL)
1107                 return NULL;
1108         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1109         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1110                 return NULL;
1111         return chan;
1112 }
1113
1114 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1115 {
1116         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1117         int i;
1118
1119         if (!nl_modes)
1120                 goto nla_put_failure;
1121
1122         i = 0;
1123         while (ifmodes) {
1124                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1125                         goto nla_put_failure;
1126                 ifmodes >>= 1;
1127                 i++;
1128         }
1129
1130         nla_nest_end(msg, nl_modes);
1131         return 0;
1132
1133 nla_put_failure:
1134         return -ENOBUFS;
1135 }
1136
1137 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1138                                           struct sk_buff *msg,
1139                                           bool large)
1140 {
1141         struct nlattr *nl_combis;
1142         int i, j;
1143
1144         nl_combis = nla_nest_start(msg,
1145                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1146         if (!nl_combis)
1147                 goto nla_put_failure;
1148
1149         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1150                 const struct ieee80211_iface_combination *c;
1151                 struct nlattr *nl_combi, *nl_limits;
1152
1153                 c = &wiphy->iface_combinations[i];
1154
1155                 nl_combi = nla_nest_start(msg, i + 1);
1156                 if (!nl_combi)
1157                         goto nla_put_failure;
1158
1159                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1160                 if (!nl_limits)
1161                         goto nla_put_failure;
1162
1163                 for (j = 0; j < c->n_limits; j++) {
1164                         struct nlattr *nl_limit;
1165
1166                         nl_limit = nla_nest_start(msg, j + 1);
1167                         if (!nl_limit)
1168                                 goto nla_put_failure;
1169                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1170                                         c->limits[j].max))
1171                                 goto nla_put_failure;
1172                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1173                                                 c->limits[j].types))
1174                                 goto nla_put_failure;
1175                         nla_nest_end(msg, nl_limit);
1176                 }
1177
1178                 nla_nest_end(msg, nl_limits);
1179
1180                 if (c->beacon_int_infra_match &&
1181                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1182                         goto nla_put_failure;
1183                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1184                                 c->num_different_channels) ||
1185                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1186                                 c->max_interfaces))
1187                         goto nla_put_failure;
1188                 if (large &&
1189                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1190                                 c->radar_detect_widths) ||
1191                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1192                                 c->radar_detect_regions)))
1193                         goto nla_put_failure;
1194                 if (c->beacon_int_min_gcd &&
1195                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1196                                 c->beacon_int_min_gcd))
1197                         goto nla_put_failure;
1198
1199                 nla_nest_end(msg, nl_combi);
1200         }
1201
1202         nla_nest_end(msg, nl_combis);
1203
1204         return 0;
1205 nla_put_failure:
1206         return -ENOBUFS;
1207 }
1208
1209 #ifdef CONFIG_PM
1210 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1211                                         struct sk_buff *msg)
1212 {
1213         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1214         struct nlattr *nl_tcp;
1215
1216         if (!tcp)
1217                 return 0;
1218
1219         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1220         if (!nl_tcp)
1221                 return -ENOBUFS;
1222
1223         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1224                         tcp->data_payload_max))
1225                 return -ENOBUFS;
1226
1227         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1228                         tcp->data_payload_max))
1229                 return -ENOBUFS;
1230
1231         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1232                 return -ENOBUFS;
1233
1234         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1235                                 sizeof(*tcp->tok), tcp->tok))
1236                 return -ENOBUFS;
1237
1238         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1239                         tcp->data_interval_max))
1240                 return -ENOBUFS;
1241
1242         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1243                         tcp->wake_payload_max))
1244                 return -ENOBUFS;
1245
1246         nla_nest_end(msg, nl_tcp);
1247         return 0;
1248 }
1249
1250 static int nl80211_send_wowlan(struct sk_buff *msg,
1251                                struct cfg80211_registered_device *rdev,
1252                                bool large)
1253 {
1254         struct nlattr *nl_wowlan;
1255
1256         if (!rdev->wiphy.wowlan)
1257                 return 0;
1258
1259         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1260         if (!nl_wowlan)
1261                 return -ENOBUFS;
1262
1263         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1264              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1265             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1266              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1267             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1268              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1269             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1270              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1271             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1272              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1273             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1274              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1275             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1276              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1277             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1278              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1279                 return -ENOBUFS;
1280
1281         if (rdev->wiphy.wowlan->n_patterns) {
1282                 struct nl80211_pattern_support pat = {
1283                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1284                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1285                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1286                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1287                 };
1288
1289                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1290                             sizeof(pat), &pat))
1291                         return -ENOBUFS;
1292         }
1293
1294         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1295             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1296                         rdev->wiphy.wowlan->max_nd_match_sets))
1297                 return -ENOBUFS;
1298
1299         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1300                 return -ENOBUFS;
1301
1302         nla_nest_end(msg, nl_wowlan);
1303
1304         return 0;
1305 }
1306 #endif
1307
1308 static int nl80211_send_coalesce(struct sk_buff *msg,
1309                                  struct cfg80211_registered_device *rdev)
1310 {
1311         struct nl80211_coalesce_rule_support rule;
1312
1313         if (!rdev->wiphy.coalesce)
1314                 return 0;
1315
1316         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1317         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1318         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1319         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1320         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1321         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1322
1323         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1324                 return -ENOBUFS;
1325
1326         return 0;
1327 }
1328
1329 static int
1330 nl80211_send_iftype_data(struct sk_buff *msg,
1331                          const struct ieee80211_sband_iftype_data *iftdata)
1332 {
1333         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1334
1335         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1336                                 iftdata->types_mask))
1337                 return -ENOBUFS;
1338
1339         if (he_cap->has_he) {
1340                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1341                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1342                             he_cap->he_cap_elem.mac_cap_info) ||
1343                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1344                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1345                             he_cap->he_cap_elem.phy_cap_info) ||
1346                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1347                             sizeof(he_cap->he_mcs_nss_supp),
1348                             &he_cap->he_mcs_nss_supp) ||
1349                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1350                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1351                         return -ENOBUFS;
1352         }
1353
1354         return 0;
1355 }
1356
1357 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1358                                       struct ieee80211_supported_band *sband)
1359 {
1360         struct nlattr *nl_rates, *nl_rate;
1361         struct ieee80211_rate *rate;
1362         int i;
1363
1364         /* add HT info */
1365         if (sband->ht_cap.ht_supported &&
1366             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1367                      sizeof(sband->ht_cap.mcs),
1368                      &sband->ht_cap.mcs) ||
1369              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1370                          sband->ht_cap.cap) ||
1371              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1372                         sband->ht_cap.ampdu_factor) ||
1373              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1374                         sband->ht_cap.ampdu_density)))
1375                 return -ENOBUFS;
1376
1377         /* add VHT info */
1378         if (sband->vht_cap.vht_supported &&
1379             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1380                      sizeof(sband->vht_cap.vht_mcs),
1381                      &sband->vht_cap.vht_mcs) ||
1382              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1383                          sband->vht_cap.cap)))
1384                 return -ENOBUFS;
1385
1386         if (sband->n_iftype_data) {
1387                 struct nlattr *nl_iftype_data =
1388                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1389                 int err;
1390
1391                 if (!nl_iftype_data)
1392                         return -ENOBUFS;
1393
1394                 for (i = 0; i < sband->n_iftype_data; i++) {
1395                         struct nlattr *iftdata;
1396
1397                         iftdata = nla_nest_start(msg, i + 1);
1398                         if (!iftdata)
1399                                 return -ENOBUFS;
1400
1401                         err = nl80211_send_iftype_data(msg,
1402                                                        &sband->iftype_data[i]);
1403                         if (err)
1404                                 return err;
1405
1406                         nla_nest_end(msg, iftdata);
1407                 }
1408
1409                 nla_nest_end(msg, nl_iftype_data);
1410         }
1411
1412         /* add bitrates */
1413         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1414         if (!nl_rates)
1415                 return -ENOBUFS;
1416
1417         for (i = 0; i < sband->n_bitrates; i++) {
1418                 nl_rate = nla_nest_start(msg, i);
1419                 if (!nl_rate)
1420                         return -ENOBUFS;
1421
1422                 rate = &sband->bitrates[i];
1423                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1424                                 rate->bitrate))
1425                         return -ENOBUFS;
1426                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1427                     nla_put_flag(msg,
1428                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1429                         return -ENOBUFS;
1430
1431                 nla_nest_end(msg, nl_rate);
1432         }
1433
1434         nla_nest_end(msg, nl_rates);
1435
1436         return 0;
1437 }
1438
1439 static int
1440 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1441                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1442 {
1443         u16 stypes;
1444         struct nlattr *nl_ftypes, *nl_ifs;
1445         enum nl80211_iftype ift;
1446         int i;
1447
1448         if (!mgmt_stypes)
1449                 return 0;
1450
1451         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1452         if (!nl_ifs)
1453                 return -ENOBUFS;
1454
1455         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1456                 nl_ftypes = nla_nest_start(msg, ift);
1457                 if (!nl_ftypes)
1458                         return -ENOBUFS;
1459                 i = 0;
1460                 stypes = mgmt_stypes[ift].tx;
1461                 while (stypes) {
1462                         if ((stypes & 1) &&
1463                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1464                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1465                                 return -ENOBUFS;
1466                         stypes >>= 1;
1467                         i++;
1468                 }
1469                 nla_nest_end(msg, nl_ftypes);
1470         }
1471
1472         nla_nest_end(msg, nl_ifs);
1473
1474         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1475         if (!nl_ifs)
1476                 return -ENOBUFS;
1477
1478         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1479                 nl_ftypes = nla_nest_start(msg, ift);
1480                 if (!nl_ftypes)
1481                         return -ENOBUFS;
1482                 i = 0;
1483                 stypes = mgmt_stypes[ift].rx;
1484                 while (stypes) {
1485                         if ((stypes & 1) &&
1486                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1487                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1488                                 return -ENOBUFS;
1489                         stypes >>= 1;
1490                         i++;
1491                 }
1492                 nla_nest_end(msg, nl_ftypes);
1493         }
1494         nla_nest_end(msg, nl_ifs);
1495
1496         return 0;
1497 }
1498
1499 #define CMD(op, n)                                                      \
1500          do {                                                           \
1501                 if (rdev->ops->op) {                                    \
1502                         i++;                                            \
1503                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1504                                 goto nla_put_failure;                   \
1505                 }                                                       \
1506         } while (0)
1507
1508 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1509                                         struct sk_buff *msg)
1510 {
1511         int i = 0;
1512
1513         /*
1514          * do *NOT* add anything into this function, new things need to be
1515          * advertised only to new versions of userspace that can deal with
1516          * the split (and they can't possibly care about new features...
1517          */
1518         CMD(add_virtual_intf, NEW_INTERFACE);
1519         CMD(change_virtual_intf, SET_INTERFACE);
1520         CMD(add_key, NEW_KEY);
1521         CMD(start_ap, START_AP);
1522         CMD(add_station, NEW_STATION);
1523         CMD(add_mpath, NEW_MPATH);
1524         CMD(update_mesh_config, SET_MESH_CONFIG);
1525         CMD(change_bss, SET_BSS);
1526         CMD(auth, AUTHENTICATE);
1527         CMD(assoc, ASSOCIATE);
1528         CMD(deauth, DEAUTHENTICATE);
1529         CMD(disassoc, DISASSOCIATE);
1530         CMD(join_ibss, JOIN_IBSS);
1531         CMD(join_mesh, JOIN_MESH);
1532         CMD(set_pmksa, SET_PMKSA);
1533         CMD(del_pmksa, DEL_PMKSA);
1534         CMD(flush_pmksa, FLUSH_PMKSA);
1535         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1536                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1537         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1538         CMD(mgmt_tx, FRAME);
1539         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1540         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1541                 i++;
1542                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1543                         goto nla_put_failure;
1544         }
1545         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1546             rdev->ops->join_mesh) {
1547                 i++;
1548                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1549                         goto nla_put_failure;
1550         }
1551         CMD(set_wds_peer, SET_WDS_PEER);
1552         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1553                 CMD(tdls_mgmt, TDLS_MGMT);
1554                 CMD(tdls_oper, TDLS_OPER);
1555         }
1556         if (rdev->wiphy.max_sched_scan_reqs)
1557                 CMD(sched_scan_start, START_SCHED_SCAN);
1558         CMD(probe_client, PROBE_CLIENT);
1559         CMD(set_noack_map, SET_NOACK_MAP);
1560         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1561                 i++;
1562                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1563                         goto nla_put_failure;
1564         }
1565         CMD(start_p2p_device, START_P2P_DEVICE);
1566         CMD(set_mcast_rate, SET_MCAST_RATE);
1567 #ifdef CONFIG_NL80211_TESTMODE
1568         CMD(testmode_cmd, TESTMODE);
1569 #endif
1570
1571         if (rdev->ops->connect || rdev->ops->auth) {
1572                 i++;
1573                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1574                         goto nla_put_failure;
1575         }
1576
1577         if (rdev->ops->disconnect || rdev->ops->deauth) {
1578                 i++;
1579                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1580                         goto nla_put_failure;
1581         }
1582
1583         return i;
1584  nla_put_failure:
1585         return -ENOBUFS;
1586 }
1587
1588 struct nl80211_dump_wiphy_state {
1589         s64 filter_wiphy;
1590         long start;
1591         long split_start, band_start, chan_start, capa_start;
1592         bool split;
1593 };
1594
1595 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1596                               enum nl80211_commands cmd,
1597                               struct sk_buff *msg, u32 portid, u32 seq,
1598                               int flags, struct nl80211_dump_wiphy_state *state)
1599 {
1600         void *hdr;
1601         struct nlattr *nl_bands, *nl_band;
1602         struct nlattr *nl_freqs, *nl_freq;
1603         struct nlattr *nl_cmds;
1604         enum nl80211_band band;
1605         struct ieee80211_channel *chan;
1606         int i;
1607         const struct ieee80211_txrx_stypes *mgmt_stypes =
1608                                 rdev->wiphy.mgmt_stypes;
1609         u32 features;
1610
1611         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1612         if (!hdr)
1613                 return -ENOBUFS;
1614
1615         if (WARN_ON(!state))
1616                 return -EINVAL;
1617
1618         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1619             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1620                            wiphy_name(&rdev->wiphy)) ||
1621             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1622                         cfg80211_rdev_list_generation))
1623                 goto nla_put_failure;
1624
1625         if (cmd != NL80211_CMD_NEW_WIPHY)
1626                 goto finish;
1627
1628         switch (state->split_start) {
1629         case 0:
1630                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1631                                rdev->wiphy.retry_short) ||
1632                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1633                                rdev->wiphy.retry_long) ||
1634                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1635                                 rdev->wiphy.frag_threshold) ||
1636                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1637                                 rdev->wiphy.rts_threshold) ||
1638                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1639                                rdev->wiphy.coverage_class) ||
1640                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1641                                rdev->wiphy.max_scan_ssids) ||
1642                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1643                                rdev->wiphy.max_sched_scan_ssids) ||
1644                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1645                                 rdev->wiphy.max_scan_ie_len) ||
1646                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1647                                 rdev->wiphy.max_sched_scan_ie_len) ||
1648                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1649                                rdev->wiphy.max_match_sets) ||
1650                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1651                                 rdev->wiphy.max_sched_scan_plans) ||
1652                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1653                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1654                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1655                                 rdev->wiphy.max_sched_scan_plan_iterations))
1656                         goto nla_put_failure;
1657
1658                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1659                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1660                         goto nla_put_failure;
1661                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1662                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1663                         goto nla_put_failure;
1664                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1665                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1666                         goto nla_put_failure;
1667                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1668                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1669                         goto nla_put_failure;
1670                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1671                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1672                         goto nla_put_failure;
1673                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1674                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1675                         goto nla_put_failure;
1676                 state->split_start++;
1677                 if (state->split)
1678                         break;
1679         case 1:
1680                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1681                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1682                             rdev->wiphy.cipher_suites))
1683                         goto nla_put_failure;
1684
1685                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1686                                rdev->wiphy.max_num_pmkids))
1687                         goto nla_put_failure;
1688
1689                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1690                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1691                         goto nla_put_failure;
1692
1693                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1694                                 rdev->wiphy.available_antennas_tx) ||
1695                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1696                                 rdev->wiphy.available_antennas_rx))
1697                         goto nla_put_failure;
1698
1699                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1700                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1701                                 rdev->wiphy.probe_resp_offload))
1702                         goto nla_put_failure;
1703
1704                 if ((rdev->wiphy.available_antennas_tx ||
1705                      rdev->wiphy.available_antennas_rx) &&
1706                     rdev->ops->get_antenna) {
1707                         u32 tx_ant = 0, rx_ant = 0;
1708                         int res;
1709
1710                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1711                         if (!res) {
1712                                 if (nla_put_u32(msg,
1713                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1714                                                 tx_ant) ||
1715                                     nla_put_u32(msg,
1716                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1717                                                 rx_ant))
1718                                         goto nla_put_failure;
1719                         }
1720                 }
1721
1722                 state->split_start++;
1723                 if (state->split)
1724                         break;
1725         case 2:
1726                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1727                                         rdev->wiphy.interface_modes))
1728                                 goto nla_put_failure;
1729                 state->split_start++;
1730                 if (state->split)
1731                         break;
1732         case 3:
1733                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1734                 if (!nl_bands)
1735                         goto nla_put_failure;
1736
1737                 for (band = state->band_start;
1738                      band < NUM_NL80211_BANDS; band++) {
1739                         struct ieee80211_supported_band *sband;
1740
1741                         sband = rdev->wiphy.bands[band];
1742
1743                         if (!sband)
1744                                 continue;
1745
1746                         nl_band = nla_nest_start(msg, band);
1747                         if (!nl_band)
1748                                 goto nla_put_failure;
1749
1750                         switch (state->chan_start) {
1751                         case 0:
1752                                 if (nl80211_send_band_rateinfo(msg, sband))
1753                                         goto nla_put_failure;
1754                                 state->chan_start++;
1755                                 if (state->split)
1756                                         break;
1757                         default:
1758                                 /* add frequencies */
1759                                 nl_freqs = nla_nest_start(
1760                                         msg, NL80211_BAND_ATTR_FREQS);
1761                                 if (!nl_freqs)
1762                                         goto nla_put_failure;
1763
1764                                 for (i = state->chan_start - 1;
1765                                      i < sband->n_channels;
1766                                      i++) {
1767                                         nl_freq = nla_nest_start(msg, i);
1768                                         if (!nl_freq)
1769                                                 goto nla_put_failure;
1770
1771                                         chan = &sband->channels[i];
1772
1773                                         if (nl80211_msg_put_channel(
1774                                                         msg, &rdev->wiphy, chan,
1775                                                         state->split))
1776                                                 goto nla_put_failure;
1777
1778                                         nla_nest_end(msg, nl_freq);
1779                                         if (state->split)
1780                                                 break;
1781                                 }
1782                                 if (i < sband->n_channels)
1783                                         state->chan_start = i + 2;
1784                                 else
1785                                         state->chan_start = 0;
1786                                 nla_nest_end(msg, nl_freqs);
1787                         }
1788
1789                         nla_nest_end(msg, nl_band);
1790
1791                         if (state->split) {
1792                                 /* start again here */
1793                                 if (state->chan_start)
1794                                         band--;
1795                                 break;
1796                         }
1797                 }
1798                 nla_nest_end(msg, nl_bands);
1799
1800                 if (band < NUM_NL80211_BANDS)
1801                         state->band_start = band + 1;
1802                 else
1803                         state->band_start = 0;
1804
1805                 /* if bands & channels are done, continue outside */
1806                 if (state->band_start == 0 && state->chan_start == 0)
1807                         state->split_start++;
1808                 if (state->split)
1809                         break;
1810         case 4:
1811                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1812                 if (!nl_cmds)
1813                         goto nla_put_failure;
1814
1815                 i = nl80211_add_commands_unsplit(rdev, msg);
1816                 if (i < 0)
1817                         goto nla_put_failure;
1818                 if (state->split) {
1819                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1820                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1821                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1822                                 CMD(channel_switch, CHANNEL_SWITCH);
1823                         CMD(set_qos_map, SET_QOS_MAP);
1824                         if (rdev->wiphy.features &
1825                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1826                                 CMD(add_tx_ts, ADD_TX_TS);
1827                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1828                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1829                 }
1830 #undef CMD
1831
1832                 nla_nest_end(msg, nl_cmds);
1833                 state->split_start++;
1834                 if (state->split)
1835                         break;
1836         case 5:
1837                 if (rdev->ops->remain_on_channel &&
1838                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1839                     nla_put_u32(msg,
1840                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1841                                 rdev->wiphy.max_remain_on_channel_duration))
1842                         goto nla_put_failure;
1843
1844                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1845                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1846                         goto nla_put_failure;
1847
1848                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1849                         goto nla_put_failure;
1850                 state->split_start++;
1851                 if (state->split)
1852                         break;
1853         case 6:
1854 #ifdef CONFIG_PM
1855                 if (nl80211_send_wowlan(msg, rdev, state->split))
1856                         goto nla_put_failure;
1857                 state->split_start++;
1858                 if (state->split)
1859                         break;
1860 #else
1861                 state->split_start++;
1862 #endif
1863         case 7:
1864                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1865                                         rdev->wiphy.software_iftypes))
1866                         goto nla_put_failure;
1867
1868                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1869                                                    state->split))
1870                         goto nla_put_failure;
1871
1872                 state->split_start++;
1873                 if (state->split)
1874                         break;
1875         case 8:
1876                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1877                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1878                                 rdev->wiphy.ap_sme_capa))
1879                         goto nla_put_failure;
1880
1881                 features = rdev->wiphy.features;
1882                 /*
1883                  * We can only add the per-channel limit information if the
1884                  * dump is split, otherwise it makes it too big. Therefore
1885                  * only advertise it in that case.
1886                  */
1887                 if (state->split)
1888                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1889                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1890                         goto nla_put_failure;
1891
1892                 if (rdev->wiphy.ht_capa_mod_mask &&
1893                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1894                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1895                             rdev->wiphy.ht_capa_mod_mask))
1896                         goto nla_put_failure;
1897
1898                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1899                     rdev->wiphy.max_acl_mac_addrs &&
1900                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1901                                 rdev->wiphy.max_acl_mac_addrs))
1902                         goto nla_put_failure;
1903
1904                 /*
1905                  * Any information below this point is only available to
1906                  * applications that can deal with it being split. This
1907                  * helps ensure that newly added capabilities don't break
1908                  * older tools by overrunning their buffers.
1909                  *
1910                  * We still increment split_start so that in the split
1911                  * case we'll continue with more data in the next round,
1912                  * but break unconditionally so unsplit data stops here.
1913                  */
1914                 state->split_start++;
1915                 break;
1916         case 9:
1917                 if (rdev->wiphy.extended_capabilities &&
1918                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1919                              rdev->wiphy.extended_capabilities_len,
1920                              rdev->wiphy.extended_capabilities) ||
1921                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1922                              rdev->wiphy.extended_capabilities_len,
1923                              rdev->wiphy.extended_capabilities_mask)))
1924                         goto nla_put_failure;
1925
1926                 if (rdev->wiphy.vht_capa_mod_mask &&
1927                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1928                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1929                             rdev->wiphy.vht_capa_mod_mask))
1930                         goto nla_put_failure;
1931
1932                 state->split_start++;
1933                 break;
1934         case 10:
1935                 if (nl80211_send_coalesce(msg, rdev))
1936                         goto nla_put_failure;
1937
1938                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1939                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1940                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1941                         goto nla_put_failure;
1942
1943                 if (rdev->wiphy.max_ap_assoc_sta &&
1944                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1945                                 rdev->wiphy.max_ap_assoc_sta))
1946                         goto nla_put_failure;
1947
1948                 state->split_start++;
1949                 break;
1950         case 11:
1951                 if (rdev->wiphy.n_vendor_commands) {
1952                         const struct nl80211_vendor_cmd_info *info;
1953                         struct nlattr *nested;
1954
1955                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1956                         if (!nested)
1957                                 goto nla_put_failure;
1958
1959                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1960                                 info = &rdev->wiphy.vendor_commands[i].info;
1961                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1962                                         goto nla_put_failure;
1963                         }
1964                         nla_nest_end(msg, nested);
1965                 }
1966
1967                 if (rdev->wiphy.n_vendor_events) {
1968                         const struct nl80211_vendor_cmd_info *info;
1969                         struct nlattr *nested;
1970
1971                         nested = nla_nest_start(msg,
1972                                                 NL80211_ATTR_VENDOR_EVENTS);
1973                         if (!nested)
1974                                 goto nla_put_failure;
1975
1976                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1977                                 info = &rdev->wiphy.vendor_events[i];
1978                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1979                                         goto nla_put_failure;
1980                         }
1981                         nla_nest_end(msg, nested);
1982                 }
1983                 state->split_start++;
1984                 break;
1985         case 12:
1986                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1987                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1988                                rdev->wiphy.max_num_csa_counters))
1989                         goto nla_put_failure;
1990
1991                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1992                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1993                         goto nla_put_failure;
1994
1995                 if (rdev->wiphy.max_sched_scan_reqs &&
1996                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1997                                 rdev->wiphy.max_sched_scan_reqs))
1998                         goto nla_put_failure;
1999
2000                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2001                             sizeof(rdev->wiphy.ext_features),
2002                             rdev->wiphy.ext_features))
2003                         goto nla_put_failure;
2004
2005                 if (rdev->wiphy.bss_select_support) {
2006                         struct nlattr *nested;
2007                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2008
2009                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2010                         if (!nested)
2011                                 goto nla_put_failure;
2012
2013                         i = 0;
2014                         while (bss_select_support) {
2015                                 if ((bss_select_support & 1) &&
2016                                     nla_put_flag(msg, i))
2017                                         goto nla_put_failure;
2018                                 i++;
2019                                 bss_select_support >>= 1;
2020                         }
2021                         nla_nest_end(msg, nested);
2022                 }
2023
2024                 state->split_start++;
2025                 break;
2026         case 13:
2027                 if (rdev->wiphy.num_iftype_ext_capab &&
2028                     rdev->wiphy.iftype_ext_capab) {
2029                         struct nlattr *nested_ext_capab, *nested;
2030
2031                         nested = nla_nest_start(msg,
2032                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2033                         if (!nested)
2034                                 goto nla_put_failure;
2035
2036                         for (i = state->capa_start;
2037                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2038                                 const struct wiphy_iftype_ext_capab *capab;
2039
2040                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2041
2042                                 nested_ext_capab = nla_nest_start(msg, i);
2043                                 if (!nested_ext_capab ||
2044                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2045                                                 capab->iftype) ||
2046                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2047                                             capab->extended_capabilities_len,
2048                                             capab->extended_capabilities) ||
2049                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2050                                             capab->extended_capabilities_len,
2051                                             capab->extended_capabilities_mask))
2052                                         goto nla_put_failure;
2053
2054                                 nla_nest_end(msg, nested_ext_capab);
2055                                 if (state->split)
2056                                         break;
2057                         }
2058                         nla_nest_end(msg, nested);
2059                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2060                                 state->capa_start = i + 1;
2061                                 break;
2062                         }
2063                 }
2064
2065                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2066                                 rdev->wiphy.nan_supported_bands))
2067                         goto nla_put_failure;
2068
2069                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2070                                             NL80211_EXT_FEATURE_TXQS)) {
2071                         struct cfg80211_txq_stats txqstats = {};
2072                         int res;
2073
2074                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2075                         if (!res &&
2076                             !nl80211_put_txq_stats(msg, &txqstats,
2077                                                    NL80211_ATTR_TXQ_STATS))
2078                                 goto nla_put_failure;
2079
2080                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2081                                         rdev->wiphy.txq_limit))
2082                                 goto nla_put_failure;
2083                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2084                                         rdev->wiphy.txq_memory_limit))
2085                                 goto nla_put_failure;
2086                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2087                                         rdev->wiphy.txq_quantum))
2088                                 goto nla_put_failure;
2089                 }
2090
2091                 /* done */
2092                 state->split_start = 0;
2093                 break;
2094         }
2095  finish:
2096         genlmsg_end(msg, hdr);
2097         return 0;
2098
2099  nla_put_failure:
2100         genlmsg_cancel(msg, hdr);
2101         return -EMSGSIZE;
2102 }
2103
2104 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2105                                     struct netlink_callback *cb,
2106                                     struct nl80211_dump_wiphy_state *state)
2107 {
2108         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2109         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2110                               nl80211_fam.maxattr, nl80211_policy, NULL);
2111         /* ignore parse errors for backward compatibility */
2112         if (ret)
2113                 return 0;
2114
2115         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2116         if (tb[NL80211_ATTR_WIPHY])
2117                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2118         if (tb[NL80211_ATTR_WDEV])
2119                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2120         if (tb[NL80211_ATTR_IFINDEX]) {
2121                 struct net_device *netdev;
2122                 struct cfg80211_registered_device *rdev;
2123                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2124
2125                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2126                 if (!netdev)
2127                         return -ENODEV;
2128                 if (netdev->ieee80211_ptr) {
2129                         rdev = wiphy_to_rdev(
2130                                 netdev->ieee80211_ptr->wiphy);
2131                         state->filter_wiphy = rdev->wiphy_idx;
2132                 }
2133         }
2134
2135         return 0;
2136 }
2137
2138 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2139 {
2140         int idx = 0, ret;
2141         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2142         struct cfg80211_registered_device *rdev;
2143
2144         rtnl_lock();
2145         if (!state) {
2146                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2147                 if (!state) {
2148                         rtnl_unlock();
2149                         return -ENOMEM;
2150                 }
2151                 state->filter_wiphy = -1;
2152                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2153                 if (ret) {
2154                         kfree(state);
2155                         rtnl_unlock();
2156                         return ret;
2157                 }
2158                 cb->args[0] = (long)state;
2159         }
2160
2161         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2162                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2163                         continue;
2164                 if (++idx <= state->start)
2165                         continue;
2166                 if (state->filter_wiphy != -1 &&
2167                     state->filter_wiphy != rdev->wiphy_idx)
2168                         continue;
2169                 /* attempt to fit multiple wiphy data chunks into the skb */
2170                 do {
2171                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2172                                                  skb,
2173                                                  NETLINK_CB(cb->skb).portid,
2174                                                  cb->nlh->nlmsg_seq,
2175                                                  NLM_F_MULTI, state);
2176                         if (ret < 0) {
2177                                 /*
2178                                  * If sending the wiphy data didn't fit (ENOBUFS
2179                                  * or EMSGSIZE returned), this SKB is still
2180                                  * empty (so it's not too big because another
2181                                  * wiphy dataset is already in the skb) and
2182                                  * we've not tried to adjust the dump allocation
2183                                  * yet ... then adjust the alloc size to be
2184                                  * bigger, and return 1 but with the empty skb.
2185                                  * This results in an empty message being RX'ed
2186                                  * in userspace, but that is ignored.
2187                                  *
2188                                  * We can then retry with the larger buffer.
2189                                  */
2190                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2191                                     !skb->len && !state->split &&
2192                                     cb->min_dump_alloc < 4096) {
2193                                         cb->min_dump_alloc = 4096;
2194                                         state->split_start = 0;
2195                                         rtnl_unlock();
2196                                         return 1;
2197                                 }
2198                                 idx--;
2199                                 break;
2200                         }
2201                 } while (state->split_start > 0);
2202                 break;
2203         }
2204         rtnl_unlock();
2205
2206         state->start = idx;
2207
2208         return skb->len;
2209 }
2210
2211 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2212 {
2213         kfree((void *)cb->args[0]);
2214         return 0;
2215 }
2216
2217 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2218 {
2219         struct sk_buff *msg;
2220         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2221         struct nl80211_dump_wiphy_state state = {};
2222
2223         msg = nlmsg_new(4096, GFP_KERNEL);
2224         if (!msg)
2225                 return -ENOMEM;
2226
2227         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2228                                info->snd_portid, info->snd_seq, 0,
2229                                &state) < 0) {
2230                 nlmsg_free(msg);
2231                 return -ENOBUFS;
2232         }
2233
2234         return genlmsg_reply(msg, info);
2235 }
2236
2237 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2238         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2239         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2240         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2241         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2242         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2243 };
2244
2245 static int parse_txq_params(struct nlattr *tb[],
2246                             struct ieee80211_txq_params *txq_params)
2247 {
2248         u8 ac;
2249
2250         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2251             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2252             !tb[NL80211_TXQ_ATTR_AIFS])
2253                 return -EINVAL;
2254
2255         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2256         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2257         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2258         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2259         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2260
2261         if (ac >= NL80211_NUM_ACS)
2262                 return -EINVAL;
2263         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2264         return 0;
2265 }
2266
2267 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2268 {
2269         /*
2270          * You can only set the channel explicitly for WDS interfaces,
2271          * all others have their channel managed via their respective
2272          * "establish a connection" command (connect, join, ...)
2273          *
2274          * For AP/GO and mesh mode, the channel can be set with the
2275          * channel userspace API, but is only stored and passed to the
2276          * low-level driver when the AP starts or the mesh is joined.
2277          * This is for backward compatibility, userspace can also give
2278          * the channel in the start-ap or join-mesh commands instead.
2279          *
2280          * Monitors are special as they are normally slaved to
2281          * whatever else is going on, so they have their own special
2282          * operation to set the monitor channel if possible.
2283          */
2284         return !wdev ||
2285                 wdev->iftype == NL80211_IFTYPE_AP ||
2286                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2287                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2288                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2289 }
2290
2291 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2292                                  struct genl_info *info,
2293                                  struct cfg80211_chan_def *chandef)
2294 {
2295         u32 control_freq;
2296
2297         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2298                 return -EINVAL;
2299
2300         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2301
2302         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2303         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2304         chandef->center_freq1 = control_freq;
2305         chandef->center_freq2 = 0;
2306
2307         /* Primary channel not allowed */
2308         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2309                 return -EINVAL;
2310
2311         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2312                 enum nl80211_channel_type chantype;
2313
2314                 chantype = nla_get_u32(
2315                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2316
2317                 switch (chantype) {
2318                 case NL80211_CHAN_NO_HT:
2319                 case NL80211_CHAN_HT20:
2320                 case NL80211_CHAN_HT40PLUS:
2321                 case NL80211_CHAN_HT40MINUS:
2322                         cfg80211_chandef_create(chandef, chandef->chan,
2323                                                 chantype);
2324                         /* user input for center_freq is incorrect */
2325                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2326                             chandef->center_freq1 != nla_get_u32(
2327                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2328                                 return -EINVAL;
2329                         /* center_freq2 must be zero */
2330                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2331                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2332                                 return -EINVAL;
2333                         break;
2334                 default:
2335                         return -EINVAL;
2336                 }
2337         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2338                 chandef->width =
2339                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2340                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2341                         chandef->center_freq1 =
2342                                 nla_get_u32(
2343                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2344                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2345                         chandef->center_freq2 =
2346                                 nla_get_u32(
2347                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2348         }
2349
2350         if (!cfg80211_chandef_valid(chandef))
2351                 return -EINVAL;
2352
2353         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2354                                      IEEE80211_CHAN_DISABLED))
2355                 return -EINVAL;
2356
2357         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2358              chandef->width == NL80211_CHAN_WIDTH_10) &&
2359             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2360                 return -EINVAL;
2361
2362         return 0;
2363 }
2364
2365 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2366                                  struct net_device *dev,
2367                                  struct genl_info *info)
2368 {
2369         struct cfg80211_chan_def chandef;
2370         int result;
2371         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2372         struct wireless_dev *wdev = NULL;
2373
2374         if (dev)
2375                 wdev = dev->ieee80211_ptr;
2376         if (!nl80211_can_set_dev_channel(wdev))
2377                 return -EOPNOTSUPP;
2378         if (wdev)
2379                 iftype = wdev->iftype;
2380
2381         result = nl80211_parse_chandef(rdev, info, &chandef);
2382         if (result)
2383                 return result;
2384
2385         switch (iftype) {
2386         case NL80211_IFTYPE_AP:
2387         case NL80211_IFTYPE_P2P_GO:
2388                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2389                                                    iftype)) {
2390                         result = -EINVAL;
2391                         break;
2392                 }
2393                 if (wdev->beacon_interval) {
2394                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2395                             !(rdev->wiphy.features &
2396                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2397                                 result = -EBUSY;
2398                                 break;
2399                         }
2400
2401                         /* Only allow dynamic channel width changes */
2402                         if (chandef.chan != wdev->preset_chandef.chan) {
2403                                 result = -EBUSY;
2404                                 break;
2405                         }
2406                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2407                         if (result)
2408                                 break;
2409                 }
2410                 wdev->preset_chandef = chandef;
2411                 result = 0;
2412                 break;
2413         case NL80211_IFTYPE_MESH_POINT:
2414                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2415                 break;
2416         case NL80211_IFTYPE_MONITOR:
2417                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2418                 break;
2419         default:
2420                 result = -EINVAL;
2421         }
2422
2423         return result;
2424 }
2425
2426 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2427 {
2428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2429         struct net_device *netdev = info->user_ptr[1];
2430
2431         return __nl80211_set_channel(rdev, netdev, info);
2432 }
2433
2434 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2435 {
2436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2437         struct net_device *dev = info->user_ptr[1];
2438         struct wireless_dev *wdev = dev->ieee80211_ptr;
2439         const u8 *bssid;
2440
2441         if (!info->attrs[NL80211_ATTR_MAC])
2442                 return -EINVAL;
2443
2444         if (netif_running(dev))
2445                 return -EBUSY;
2446
2447         if (!rdev->ops->set_wds_peer)
2448                 return -EOPNOTSUPP;
2449
2450         if (wdev->iftype != NL80211_IFTYPE_WDS)
2451                 return -EOPNOTSUPP;
2452
2453         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2454         return rdev_set_wds_peer(rdev, dev, bssid);
2455 }
2456
2457 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2458 {
2459         struct cfg80211_registered_device *rdev;
2460         struct net_device *netdev = NULL;
2461         struct wireless_dev *wdev;
2462         int result = 0, rem_txq_params = 0;
2463         struct nlattr *nl_txq_params;
2464         u32 changed;
2465         u8 retry_short = 0, retry_long = 0;
2466         u32 frag_threshold = 0, rts_threshold = 0;
2467         u8 coverage_class = 0;
2468         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2469
2470         ASSERT_RTNL();
2471
2472         /*
2473          * Try to find the wiphy and netdev. Normally this
2474          * function shouldn't need the netdev, but this is
2475          * done for backward compatibility -- previously
2476          * setting the channel was done per wiphy, but now
2477          * it is per netdev. Previous userland like hostapd
2478          * also passed a netdev to set_wiphy, so that it is
2479          * possible to let that go to the right netdev!
2480          */
2481
2482         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2483                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2484
2485                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2486                 if (netdev && netdev->ieee80211_ptr)
2487                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2488                 else
2489                         netdev = NULL;
2490         }
2491
2492         if (!netdev) {
2493                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2494                                                   info->attrs);
2495                 if (IS_ERR(rdev))
2496                         return PTR_ERR(rdev);
2497                 wdev = NULL;
2498                 netdev = NULL;
2499                 result = 0;
2500         } else
2501                 wdev = netdev->ieee80211_ptr;
2502
2503         /*
2504          * end workaround code, by now the rdev is available
2505          * and locked, and wdev may or may not be NULL.
2506          */
2507
2508         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2509                 result = cfg80211_dev_rename(
2510                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2511
2512         if (result)
2513                 return result;
2514
2515         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2516                 struct ieee80211_txq_params txq_params;
2517                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2518
2519                 if (!rdev->ops->set_txq_params)
2520                         return -EOPNOTSUPP;
2521
2522                 if (!netdev)
2523                         return -EINVAL;
2524
2525                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2526                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2527                         return -EINVAL;
2528
2529                 if (!netif_running(netdev))
2530                         return -ENETDOWN;
2531
2532                 nla_for_each_nested(nl_txq_params,
2533                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2534                                     rem_txq_params) {
2535                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2536                                                   nl_txq_params,
2537                                                   txq_params_policy,
2538                                                   info->extack);
2539                         if (result)
2540                                 return result;
2541                         result = parse_txq_params(tb, &txq_params);
2542                         if (result)
2543                                 return result;
2544
2545                         result = rdev_set_txq_params(rdev, netdev,
2546                                                      &txq_params);
2547                         if (result)
2548                                 return result;
2549                 }
2550         }
2551
2552         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2553                 result = __nl80211_set_channel(
2554                         rdev,
2555                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2556                         info);
2557                 if (result)
2558                         return result;
2559         }
2560
2561         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2562                 struct wireless_dev *txp_wdev = wdev;
2563                 enum nl80211_tx_power_setting type;
2564                 int idx, mbm = 0;
2565
2566                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2567                         txp_wdev = NULL;
2568
2569                 if (!rdev->ops->set_tx_power)
2570                         return -EOPNOTSUPP;
2571
2572                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2573                 type = nla_get_u32(info->attrs[idx]);
2574
2575                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2576                     (type != NL80211_TX_POWER_AUTOMATIC))
2577                         return -EINVAL;
2578
2579                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2580                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2581                         mbm = nla_get_u32(info->attrs[idx]);
2582                 }
2583
2584                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2585                 if (result)
2586                         return result;
2587         }
2588
2589         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2590             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2591                 u32 tx_ant, rx_ant;
2592
2593                 if ((!rdev->wiphy.available_antennas_tx &&
2594                      !rdev->wiphy.available_antennas_rx) ||
2595                     !rdev->ops->set_antenna)
2596                         return -EOPNOTSUPP;
2597
2598                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2599                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2600
2601                 /* reject antenna configurations which don't match the
2602                  * available antenna masks, except for the "all" mask */
2603                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2604                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2605                         return -EINVAL;
2606
2607                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2608                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2609
2610                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2611                 if (result)
2612                         return result;
2613         }
2614
2615         changed = 0;
2616
2617         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2618                 retry_short = nla_get_u8(
2619                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2620                 if (retry_short == 0)
2621                         return -EINVAL;
2622
2623                 changed |= WIPHY_PARAM_RETRY_SHORT;
2624         }
2625
2626         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2627                 retry_long = nla_get_u8(
2628                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2629                 if (retry_long == 0)
2630                         return -EINVAL;
2631
2632                 changed |= WIPHY_PARAM_RETRY_LONG;
2633         }
2634
2635         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2636                 frag_threshold = nla_get_u32(
2637                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2638                 if (frag_threshold < 256)
2639                         return -EINVAL;
2640
2641                 if (frag_threshold != (u32) -1) {
2642                         /*
2643                          * Fragments (apart from the last one) are required to
2644                          * have even length. Make the fragmentation code
2645                          * simpler by stripping LSB should someone try to use
2646                          * odd threshold value.
2647                          */
2648                         frag_threshold &= ~0x1;
2649                 }
2650                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2651         }
2652
2653         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2654                 rts_threshold = nla_get_u32(
2655                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2656                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2657         }
2658
2659         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2660                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2661                         return -EINVAL;
2662
2663                 coverage_class = nla_get_u8(
2664                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2665                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2666         }
2667
2668         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2669                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2670                         return -EOPNOTSUPP;
2671
2672                 changed |= WIPHY_PARAM_DYN_ACK;
2673         }
2674
2675         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2676                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2677                                              NL80211_EXT_FEATURE_TXQS))
2678                         return -EOPNOTSUPP;
2679                 txq_limit = nla_get_u32(
2680                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2681                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2682         }
2683
2684         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2685                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2686                                              NL80211_EXT_FEATURE_TXQS))
2687                         return -EOPNOTSUPP;
2688                 txq_memory_limit = nla_get_u32(
2689                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2690                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2691         }
2692
2693         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2694                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2695                                              NL80211_EXT_FEATURE_TXQS))
2696                         return -EOPNOTSUPP;
2697                 txq_quantum = nla_get_u32(
2698                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2699                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2700         }
2701
2702         if (changed) {
2703                 u8 old_retry_short, old_retry_long;
2704                 u32 old_frag_threshold, old_rts_threshold;
2705                 u8 old_coverage_class;
2706                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2707
2708                 if (!rdev->ops->set_wiphy_params)
2709                         return -EOPNOTSUPP;
2710
2711                 old_retry_short = rdev->wiphy.retry_short;
2712                 old_retry_long = rdev->wiphy.retry_long;
2713                 old_frag_threshold = rdev->wiphy.frag_threshold;
2714                 old_rts_threshold = rdev->wiphy.rts_threshold;
2715                 old_coverage_class = rdev->wiphy.coverage_class;
2716                 old_txq_limit = rdev->wiphy.txq_limit;
2717                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2718                 old_txq_quantum = rdev->wiphy.txq_quantum;
2719
2720                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2721                         rdev->wiphy.retry_short = retry_short;
2722                 if (changed & WIPHY_PARAM_RETRY_LONG)
2723                         rdev->wiphy.retry_long = retry_long;
2724                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2725                         rdev->wiphy.frag_threshold = frag_threshold;
2726                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2727                         rdev->wiphy.rts_threshold = rts_threshold;
2728                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2729                         rdev->wiphy.coverage_class = coverage_class;
2730                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2731                         rdev->wiphy.txq_limit = txq_limit;
2732                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2733                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2734                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2735                         rdev->wiphy.txq_quantum = txq_quantum;
2736
2737                 result = rdev_set_wiphy_params(rdev, changed);
2738                 if (result) {
2739                         rdev->wiphy.retry_short = old_retry_short;
2740                         rdev->wiphy.retry_long = old_retry_long;
2741                         rdev->wiphy.frag_threshold = old_frag_threshold;
2742                         rdev->wiphy.rts_threshold = old_rts_threshold;
2743                         rdev->wiphy.coverage_class = old_coverage_class;
2744                         rdev->wiphy.txq_limit = old_txq_limit;
2745                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2746                         rdev->wiphy.txq_quantum = old_txq_quantum;
2747                         return result;
2748                 }
2749         }
2750         return 0;
2751 }
2752
2753 static inline u64 wdev_id(struct wireless_dev *wdev)
2754 {
2755         return (u64)wdev->identifier |
2756                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2757 }
2758
2759 static int nl80211_send_chandef(struct sk_buff *msg,
2760                                 const struct cfg80211_chan_def *chandef)
2761 {
2762         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2763                 return -EINVAL;
2764
2765         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2766                         chandef->chan->center_freq))
2767                 return -ENOBUFS;
2768         switch (chandef->width) {
2769         case NL80211_CHAN_WIDTH_20_NOHT:
2770         case NL80211_CHAN_WIDTH_20:
2771         case NL80211_CHAN_WIDTH_40:
2772                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2773                                 cfg80211_get_chandef_type(chandef)))
2774                         return -ENOBUFS;
2775                 break;
2776         default:
2777                 break;
2778         }
2779         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2780                 return -ENOBUFS;
2781         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2782                 return -ENOBUFS;
2783         if (chandef->center_freq2 &&
2784             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2785                 return -ENOBUFS;
2786         return 0;
2787 }
2788
2789 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2790                               struct cfg80211_registered_device *rdev,
2791                               struct wireless_dev *wdev, bool removal)
2792 {
2793         struct net_device *dev = wdev->netdev;
2794         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2795         void *hdr;
2796
2797         if (removal)
2798                 cmd = NL80211_CMD_DEL_INTERFACE;
2799
2800         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2801         if (!hdr)
2802                 return -1;
2803
2804         if (dev &&
2805             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2806              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2807                 goto nla_put_failure;
2808
2809         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2810             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2811             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2812                               NL80211_ATTR_PAD) ||
2813             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2814             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2815                         rdev->devlist_generation ^
2816                         (cfg80211_rdev_list_generation << 2)) ||
2817             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2818                 goto nla_put_failure;
2819
2820         if (rdev->ops->get_channel) {
2821                 int ret;
2822                 struct cfg80211_chan_def chandef;
2823
2824                 ret = rdev_get_channel(rdev, wdev, &chandef);
2825                 if (ret == 0) {
2826                         if (nl80211_send_chandef(msg, &chandef))
2827                                 goto nla_put_failure;
2828                 }
2829         }
2830
2831         if (rdev->ops->get_tx_power) {
2832                 int dbm, ret;
2833
2834                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2835                 if (ret == 0 &&
2836                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2837                                 DBM_TO_MBM(dbm)))
2838                         goto nla_put_failure;
2839         }
2840
2841         wdev_lock(wdev);
2842         switch (wdev->iftype) {
2843         case NL80211_IFTYPE_AP:
2844                 if (wdev->ssid_len &&
2845                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2846                         goto nla_put_failure_locked;
2847                 break;
2848         case NL80211_IFTYPE_STATION:
2849         case NL80211_IFTYPE_P2P_CLIENT:
2850         case NL80211_IFTYPE_ADHOC: {
2851                 const u8 *ssid_ie;
2852                 if (!wdev->current_bss)
2853                         break;
2854                 rcu_read_lock();
2855                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2856                                                WLAN_EID_SSID);
2857                 if (ssid_ie &&
2858                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2859                         goto nla_put_failure_rcu_locked;
2860                 rcu_read_unlock();
2861                 break;
2862                 }
2863         default:
2864                 /* nothing */
2865                 break;
2866         }
2867         wdev_unlock(wdev);
2868
2869         if (rdev->ops->get_txq_stats) {
2870                 struct cfg80211_txq_stats txqstats = {};
2871                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2872
2873                 if (ret == 0 &&
2874                     !nl80211_put_txq_stats(msg, &txqstats,
2875                                            NL80211_ATTR_TXQ_STATS))
2876                         goto nla_put_failure;
2877         }
2878
2879         genlmsg_end(msg, hdr);
2880         return 0;
2881
2882  nla_put_failure_rcu_locked:
2883         rcu_read_unlock();
2884  nla_put_failure_locked:
2885         wdev_unlock(wdev);
2886  nla_put_failure:
2887         genlmsg_cancel(msg, hdr);
2888         return -EMSGSIZE;
2889 }
2890
2891 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2892 {
2893         int wp_idx = 0;
2894         int if_idx = 0;
2895         int wp_start = cb->args[0];
2896         int if_start = cb->args[1];
2897         int filter_wiphy = -1;
2898         struct cfg80211_registered_device *rdev;
2899         struct wireless_dev *wdev;
2900         int ret;
2901
2902         rtnl_lock();
2903         if (!cb->args[2]) {
2904                 struct nl80211_dump_wiphy_state state = {
2905                         .filter_wiphy = -1,
2906                 };
2907
2908                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2909                 if (ret)
2910                         goto out_unlock;
2911
2912                 filter_wiphy = state.filter_wiphy;
2913
2914                 /*
2915                  * if filtering, set cb->args[2] to +1 since 0 is the default
2916                  * value needed to determine that parsing is necessary.
2917                  */
2918                 if (filter_wiphy >= 0)
2919                         cb->args[2] = filter_wiphy + 1;
2920                 else
2921                         cb->args[2] = -1;
2922         } else if (cb->args[2] > 0) {
2923                 filter_wiphy = cb->args[2] - 1;
2924         }
2925
2926         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2927                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2928                         continue;
2929                 if (wp_idx < wp_start) {
2930                         wp_idx++;
2931                         continue;
2932                 }
2933
2934                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2935                         continue;
2936
2937                 if_idx = 0;
2938
2939                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2940                         if (if_idx < if_start) {
2941                                 if_idx++;
2942                                 continue;
2943                         }
2944                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2945                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2946                                                rdev, wdev, false) < 0) {
2947                                 goto out;
2948                         }
2949                         if_idx++;
2950                 }
2951
2952                 wp_idx++;
2953         }
2954  out:
2955         cb->args[0] = wp_idx;
2956         cb->args[1] = if_idx;
2957
2958         ret = skb->len;
2959  out_unlock:
2960         rtnl_unlock();
2961
2962         return ret;
2963 }
2964
2965 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2966 {
2967         struct sk_buff *msg;
2968         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2969         struct wireless_dev *wdev = info->user_ptr[1];
2970
2971         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2972         if (!msg)
2973                 return -ENOMEM;
2974
2975         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2976                                rdev, wdev, false) < 0) {
2977                 nlmsg_free(msg);
2978                 return -ENOBUFS;
2979         }
2980
2981         return genlmsg_reply(msg, info);
2982 }
2983
2984 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2985         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2986         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2987         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2988         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2989         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2990         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2991 };
2992
2993 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2994 {
2995         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2996         int flag;
2997
2998         *mntrflags = 0;
2999
3000         if (!nla)
3001                 return -EINVAL;
3002
3003         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3004                              mntr_flags_policy, NULL))
3005                 return -EINVAL;
3006
3007         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3008                 if (flags[flag])
3009                         *mntrflags |= (1<<flag);
3010
3011         *mntrflags |= MONITOR_FLAG_CHANGED;
3012
3013         return 0;
3014 }
3015
3016 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3017                                      enum nl80211_iftype type,
3018                                      struct genl_info *info,
3019                                      struct vif_params *params)
3020 {
3021         bool change = false;
3022         int err;
3023
3024         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3025                 if (type != NL80211_IFTYPE_MONITOR)
3026                         return -EINVAL;
3027
3028                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3029                                           &params->flags);
3030                 if (err)
3031                         return err;
3032
3033                 change = true;
3034         }
3035
3036         if (params->flags & MONITOR_FLAG_ACTIVE &&
3037             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3038                 return -EOPNOTSUPP;
3039
3040         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3041                 const u8 *mumimo_groups;
3042                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3043
3044                 if (type != NL80211_IFTYPE_MONITOR)
3045                         return -EINVAL;
3046
3047                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3048                         return -EOPNOTSUPP;
3049
3050                 mumimo_groups =
3051                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3052
3053                 /* bits 0 and 63 are reserved and must be zero */
3054                 if ((mumimo_groups[0] & BIT(0)) ||
3055                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3056                         return -EINVAL;
3057
3058                 params->vht_mumimo_groups = mumimo_groups;
3059                 change = true;
3060         }
3061
3062         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3063                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3064
3065                 if (type != NL80211_IFTYPE_MONITOR)
3066                         return -EINVAL;
3067
3068                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3069                         return -EOPNOTSUPP;
3070
3071                 params->vht_mumimo_follow_addr =
3072                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3073                 change = true;
3074         }
3075
3076         return change ? 1 : 0;
3077 }
3078
3079 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3080                                struct net_device *netdev, u8 use_4addr,
3081                                enum nl80211_iftype iftype)
3082 {
3083         if (!use_4addr) {
3084                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3085                         return -EBUSY;
3086                 return 0;
3087         }
3088
3089         switch (iftype) {
3090         case NL80211_IFTYPE_AP_VLAN:
3091                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3092                         return 0;
3093                 break;
3094         case NL80211_IFTYPE_STATION:
3095                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3096                         return 0;
3097                 break;
3098         default:
3099                 break;
3100         }
3101
3102         return -EOPNOTSUPP;
3103 }
3104
3105 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3106 {
3107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3108         struct vif_params params;
3109         int err;
3110         enum nl80211_iftype otype, ntype;
3111         struct net_device *dev = info->user_ptr[1];
3112         bool change = false;
3113
3114         memset(&params, 0, sizeof(params));
3115
3116         otype = ntype = dev->ieee80211_ptr->iftype;
3117
3118         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3119                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3120                 if (otype != ntype)
3121                         change = true;
3122                 if (ntype > NL80211_IFTYPE_MAX)
3123                         return -EINVAL;
3124         }
3125
3126         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3127                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3128
3129                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3130                         return -EINVAL;
3131                 if (netif_running(dev))
3132                         return -EBUSY;
3133
3134                 wdev_lock(wdev);
3135                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3136                              IEEE80211_MAX_MESH_ID_LEN);
3137                 wdev->mesh_id_up_len =
3138                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3139                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3140                        wdev->mesh_id_up_len);
3141                 wdev_unlock(wdev);
3142         }
3143
3144         if (info->attrs[NL80211_ATTR_4ADDR]) {
3145                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3146                 change = true;
3147                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3148                 if (err)
3149                         return err;
3150         } else {
3151                 params.use_4addr = -1;
3152         }
3153
3154         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3155         if (err < 0)
3156                 return err;
3157         if (err > 0)
3158                 change = true;
3159
3160         if (change)
3161                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3162         else
3163                 err = 0;
3164
3165         if (!err && params.use_4addr != -1)
3166                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3167
3168         return err;
3169 }
3170
3171 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3172 {
3173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3174         struct vif_params params;
3175         struct wireless_dev *wdev;
3176         struct sk_buff *msg;
3177         int err;
3178         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3179
3180         /* to avoid failing a new interface creation due to pending removal */
3181         cfg80211_destroy_ifaces(rdev);
3182
3183         memset(&params, 0, sizeof(params));
3184
3185         if (!info->attrs[NL80211_ATTR_IFNAME])
3186                 return -EINVAL;
3187
3188         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3189                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3190                 if (type > NL80211_IFTYPE_MAX)
3191                         return -EINVAL;
3192         }
3193
3194         if (!rdev->ops->add_virtual_intf ||
3195             !(rdev->wiphy.interface_modes & (1 << type)))
3196                 return -EOPNOTSUPP;
3197
3198         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3199              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3200             info->attrs[NL80211_ATTR_MAC]) {
3201                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3202                            ETH_ALEN);
3203                 if (!is_valid_ether_addr(params.macaddr))
3204                         return -EADDRNOTAVAIL;
3205         }
3206
3207         if (info->attrs[NL80211_ATTR_4ADDR]) {
3208                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3209                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3210                 if (err)
3211                         return err;
3212         }
3213
3214         err = nl80211_parse_mon_options(rdev, type, info, &params);
3215         if (err < 0)
3216                 return err;
3217
3218         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3219         if (!msg)
3220                 return -ENOMEM;
3221
3222         wdev = rdev_add_virtual_intf(rdev,
3223                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3224                                 NET_NAME_USER, type, &params);
3225         if (WARN_ON(!wdev)) {
3226                 nlmsg_free(msg);
3227                 return -EPROTO;
3228         } else if (IS_ERR(wdev)) {
3229                 nlmsg_free(msg);
3230                 return PTR_ERR(wdev);
3231         }
3232
3233         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3234                 wdev->owner_nlportid = info->snd_portid;
3235
3236         switch (type) {
3237         case NL80211_IFTYPE_MESH_POINT:
3238                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3239                         break;
3240                 wdev_lock(wdev);
3241                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3242                              IEEE80211_MAX_MESH_ID_LEN);
3243                 wdev->mesh_id_up_len =
3244                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3245                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3246                        wdev->mesh_id_up_len);
3247                 wdev_unlock(wdev);
3248                 break;
3249         case NL80211_IFTYPE_NAN:
3250         case NL80211_IFTYPE_P2P_DEVICE:
3251                 /*
3252                  * P2P Device and NAN do not have a netdev, so don't go
3253                  * through the netdev notifier and must be added here
3254                  */
3255                 mutex_init(&wdev->mtx);
3256                 INIT_LIST_HEAD(&wdev->event_list);
3257                 spin_lock_init(&wdev->event_lock);
3258                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3259                 spin_lock_init(&wdev->mgmt_registrations_lock);
3260
3261                 wdev->identifier = ++rdev->wdev_id;
3262                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3263                 rdev->devlist_generation++;
3264                 break;
3265         default:
3266                 break;
3267         }
3268
3269         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3270                                rdev, wdev, false) < 0) {
3271                 nlmsg_free(msg);
3272                 return -ENOBUFS;
3273         }
3274
3275         /*
3276          * For wdevs which have no associated netdev object (e.g. of type
3277          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3278          * For all other types, the event will be generated from the
3279          * netdev notifier
3280          */
3281         if (!wdev->netdev)
3282                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3283
3284         return genlmsg_reply(msg, info);
3285 }
3286
3287 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3288 {
3289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3290         struct wireless_dev *wdev = info->user_ptr[1];
3291
3292         if (!rdev->ops->del_virtual_intf)
3293                 return -EOPNOTSUPP;
3294
3295         /*
3296          * If we remove a wireless device without a netdev then clear
3297          * user_ptr[1] so that nl80211_post_doit won't dereference it
3298          * to check if it needs to do dev_put(). Otherwise it crashes
3299          * since the wdev has been freed, unlike with a netdev where
3300          * we need the dev_put() for the netdev to really be freed.
3301          */
3302         if (!wdev->netdev)
3303                 info->user_ptr[1] = NULL;
3304
3305         return rdev_del_virtual_intf(rdev, wdev);
3306 }
3307
3308 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3309 {
3310         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3311         struct net_device *dev = info->user_ptr[1];
3312         u16 noack_map;
3313
3314         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3315                 return -EINVAL;
3316
3317         if (!rdev->ops->set_noack_map)
3318                 return -EOPNOTSUPP;
3319
3320         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3321
3322         return rdev_set_noack_map(rdev, dev, noack_map);
3323 }
3324
3325 struct get_key_cookie {
3326         struct sk_buff *msg;
3327         int error;
3328         int idx;
3329 };
3330
3331 static void get_key_callback(void *c, struct key_params *params)
3332 {
3333         struct nlattr *key;
3334         struct get_key_cookie *cookie = c;
3335
3336         if ((params->key &&
3337              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3338                      params->key_len, params->key)) ||
3339             (params->seq &&
3340              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3341                      params->seq_len, params->seq)) ||
3342             (params->cipher &&
3343              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3344                          params->cipher)))
3345                 goto nla_put_failure;
3346
3347         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3348         if (!key)
3349                 goto nla_put_failure;
3350
3351         if ((params->key &&
3352              nla_put(cookie->msg, NL80211_KEY_DATA,
3353                      params->key_len, params->key)) ||
3354             (params->seq &&
3355              nla_put(cookie->msg, NL80211_KEY_SEQ,
3356                      params->seq_len, params->seq)) ||
3357             (params->cipher &&
3358              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3359                          params->cipher)))
3360                 goto nla_put_failure;
3361
3362         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3363                 goto nla_put_failure;
3364
3365         nla_nest_end(cookie->msg, key);
3366
3367         return;
3368  nla_put_failure:
3369         cookie->error = 1;
3370 }
3371
3372 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3373 {
3374         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3375         int err;
3376         struct net_device *dev = info->user_ptr[1];
3377         u8 key_idx = 0;
3378         const u8 *mac_addr = NULL;
3379         bool pairwise;
3380         struct get_key_cookie cookie = {
3381                 .error = 0,
3382         };
3383         void *hdr;
3384         struct sk_buff *msg;
3385
3386         if (info->attrs[NL80211_ATTR_KEY_IDX])
3387                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3388
3389         if (key_idx > 5)
3390                 return -EINVAL;
3391
3392         if (info->attrs[NL80211_ATTR_MAC])
3393                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3394
3395         pairwise = !!mac_addr;
3396         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3397                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3398
3399                 if (kt >= NUM_NL80211_KEYTYPES)
3400                         return -EINVAL;
3401                 if (kt != NL80211_KEYTYPE_GROUP &&
3402                     kt != NL80211_KEYTYPE_PAIRWISE)
3403                         return -EINVAL;
3404                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3405         }
3406
3407         if (!rdev->ops->get_key)
3408                 return -EOPNOTSUPP;
3409
3410         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3411                 return -ENOENT;
3412
3413         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3414         if (!msg)
3415                 return -ENOMEM;
3416
3417         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3418                              NL80211_CMD_NEW_KEY);
3419         if (!hdr)
3420                 goto nla_put_failure;
3421
3422         cookie.msg = msg;
3423         cookie.idx = key_idx;
3424
3425         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3426             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3427                 goto nla_put_failure;
3428         if (mac_addr &&
3429             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3430                 goto nla_put_failure;
3431
3432         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3433                            get_key_callback);
3434
3435         if (err)
3436                 goto free_msg;
3437
3438         if (cookie.error)
3439                 goto nla_put_failure;
3440
3441         genlmsg_end(msg, hdr);
3442         return genlmsg_reply(msg, info);
3443
3444  nla_put_failure:
3445         err = -ENOBUFS;
3446  free_msg:
3447         nlmsg_free(msg);
3448         return err;
3449 }
3450
3451 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3452 {
3453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3454         struct key_parse key;
3455         int err;
3456         struct net_device *dev = info->user_ptr[1];
3457
3458         err = nl80211_parse_key(info, &key);
3459         if (err)
3460                 return err;
3461
3462         if (key.idx < 0)
3463                 return -EINVAL;
3464
3465         /* only support setting default key */
3466         if (!key.def && !key.defmgmt)
3467                 return -EINVAL;
3468
3469         wdev_lock(dev->ieee80211_ptr);
3470
3471         if (key.def) {
3472                 if (!rdev->ops->set_default_key) {
3473                         err = -EOPNOTSUPP;
3474                         goto out;
3475                 }
3476
3477                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3478                 if (err)
3479                         goto out;
3480
3481                 err = rdev_set_default_key(rdev, dev, key.idx,
3482                                                  key.def_uni, key.def_multi);
3483
3484                 if (err)
3485                         goto out;
3486
3487 #ifdef CONFIG_CFG80211_WEXT
3488                 dev->ieee80211_ptr->wext.default_key = key.idx;
3489 #endif
3490         } else {
3491                 if (key.def_uni || !key.def_multi) {
3492                         err = -EINVAL;
3493                         goto out;
3494                 }
3495
3496                 if (!rdev->ops->set_default_mgmt_key) {
3497                         err = -EOPNOTSUPP;
3498                         goto out;
3499                 }
3500
3501                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3502                 if (err)
3503                         goto out;
3504
3505                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3506                 if (err)
3507                         goto out;
3508
3509 #ifdef CONFIG_CFG80211_WEXT
3510                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3511 #endif
3512         }
3513
3514  out:
3515         wdev_unlock(dev->ieee80211_ptr);
3516
3517         return err;
3518 }
3519
3520 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3521 {
3522         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3523         int err;
3524         struct net_device *dev = info->user_ptr[1];
3525         struct key_parse key;
3526         const u8 *mac_addr = NULL;
3527
3528         err = nl80211_parse_key(info, &key);
3529         if (err)
3530                 return err;
3531
3532         if (!key.p.key)
3533                 return -EINVAL;
3534
3535         if (info->attrs[NL80211_ATTR_MAC])
3536                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3537
3538         if (key.type == -1) {
3539                 if (mac_addr)
3540                         key.type = NL80211_KEYTYPE_PAIRWISE;
3541                 else
3542                         key.type = NL80211_KEYTYPE_GROUP;
3543         }
3544
3545         /* for now */
3546         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3547             key.type != NL80211_KEYTYPE_GROUP)
3548                 return -EINVAL;
3549
3550         if (!rdev->ops->add_key)
3551                 return -EOPNOTSUPP;
3552
3553         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3554                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3555                                            mac_addr))
3556                 return -EINVAL;
3557
3558         wdev_lock(dev->ieee80211_ptr);
3559         err = nl80211_key_allowed(dev->ieee80211_ptr);
3560         if (!err)
3561                 err = rdev_add_key(rdev, dev, key.idx,
3562                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3563                                     mac_addr, &key.p);
3564         wdev_unlock(dev->ieee80211_ptr);
3565
3566         return err;
3567 }
3568
3569 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3570 {
3571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3572         int err;
3573         struct net_device *dev = info->user_ptr[1];
3574         u8 *mac_addr = NULL;
3575         struct key_parse key;
3576
3577         err = nl80211_parse_key(info, &key);
3578         if (err)
3579                 return err;
3580
3581         if (info->attrs[NL80211_ATTR_MAC])
3582                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3583
3584         if (key.type == -1) {
3585                 if (mac_addr)
3586                         key.type = NL80211_KEYTYPE_PAIRWISE;
3587                 else
3588                         key.type = NL80211_KEYTYPE_GROUP;
3589         }
3590
3591         /* for now */
3592         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3593             key.type != NL80211_KEYTYPE_GROUP)
3594                 return -EINVAL;
3595
3596         if (!rdev->ops->del_key)
3597                 return -EOPNOTSUPP;
3598
3599         wdev_lock(dev->ieee80211_ptr);
3600         err = nl80211_key_allowed(dev->ieee80211_ptr);
3601
3602         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3603             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3604                 err = -ENOENT;
3605
3606         if (!err)
3607                 err = rdev_del_key(rdev, dev, key.idx,
3608                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3609                                    mac_addr);
3610
3611 #ifdef CONFIG_CFG80211_WEXT
3612         if (!err) {
3613                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3614                         dev->ieee80211_ptr->wext.default_key = -1;
3615                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3616                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3617         }
3618 #endif
3619         wdev_unlock(dev->ieee80211_ptr);
3620
3621         return err;
3622 }
3623
3624 /* This function returns an error or the number of nested attributes */
3625 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3626 {
3627         struct nlattr *attr;
3628         int n_entries = 0, tmp;
3629
3630         nla_for_each_nested(attr, nl_attr, tmp) {
3631                 if (nla_len(attr) != ETH_ALEN)
3632                         return -EINVAL;
3633
3634                 n_entries++;
3635         }
3636
3637         return n_entries;
3638 }
3639
3640 /*
3641  * This function parses ACL information and allocates memory for ACL data.
3642  * On successful return, the calling function is responsible to free the
3643  * ACL buffer returned by this function.
3644  */
3645 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3646                                                 struct genl_info *info)
3647 {
3648         enum nl80211_acl_policy acl_policy;
3649         struct nlattr *attr;
3650         struct cfg80211_acl_data *acl;
3651         int i = 0, n_entries, tmp;
3652
3653         if (!wiphy->max_acl_mac_addrs)
3654                 return ERR_PTR(-EOPNOTSUPP);
3655
3656         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3657                 return ERR_PTR(-EINVAL);
3658
3659         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3660         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3661             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3662                 return ERR_PTR(-EINVAL);
3663
3664         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3665                 return ERR_PTR(-EINVAL);
3666
3667         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3668         if (n_entries < 0)
3669                 return ERR_PTR(n_entries);
3670
3671         if (n_entries > wiphy->max_acl_mac_addrs)
3672                 return ERR_PTR(-ENOTSUPP);
3673
3674         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3675                       GFP_KERNEL);
3676         if (!acl)
3677                 return ERR_PTR(-ENOMEM);
3678
3679         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3680                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3681                 i++;
3682         }
3683
3684         acl->n_acl_entries = n_entries;
3685         acl->acl_policy = acl_policy;
3686
3687         return acl;
3688 }
3689
3690 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3691 {
3692         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3693         struct net_device *dev = info->user_ptr[1];
3694         struct cfg80211_acl_data *acl;
3695         int err;
3696
3697         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3698             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3699                 return -EOPNOTSUPP;
3700
3701         if (!dev->ieee80211_ptr->beacon_interval)
3702                 return -EINVAL;
3703
3704         acl = parse_acl_data(&rdev->wiphy, info);
3705         if (IS_ERR(acl))
3706                 return PTR_ERR(acl);
3707
3708         err = rdev_set_mac_acl(rdev, dev, acl);
3709
3710         kfree(acl);
3711
3712         return err;
3713 }
3714
3715 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3716                            u8 *rates, u8 rates_len)
3717 {
3718         u8 i;
3719         u32 mask = 0;
3720
3721         for (i = 0; i < rates_len; i++) {
3722                 int rate = (rates[i] & 0x7f) * 5;
3723                 int ridx;
3724
3725                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3726                         struct ieee80211_rate *srate =
3727                                 &sband->bitrates[ridx];
3728                         if (rate == srate->bitrate) {
3729                                 mask |= 1 << ridx;
3730                                 break;
3731                         }
3732                 }
3733                 if (ridx == sband->n_bitrates)
3734                         return 0; /* rate not found */
3735         }
3736
3737         return mask;
3738 }
3739
3740 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3741                                u8 *rates, u8 rates_len,
3742                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3743 {
3744         u8 i;
3745
3746         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3747
3748         for (i = 0; i < rates_len; i++) {
3749                 int ridx, rbit;
3750
3751                 ridx = rates[i] / 8;
3752                 rbit = BIT(rates[i] % 8);
3753
3754                 /* check validity */
3755                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3756                         return false;
3757
3758                 /* check availability */
3759                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3760                         mcs[ridx] |= rbit;
3761                 else
3762                         return false;
3763         }
3764
3765         return true;
3766 }
3767
3768 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3769 {
3770         u16 mcs_mask = 0;
3771
3772         switch (vht_mcs_map) {
3773         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3774                 break;
3775         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3776                 mcs_mask = 0x00FF;
3777                 break;
3778         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3779                 mcs_mask = 0x01FF;
3780                 break;
3781         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3782                 mcs_mask = 0x03FF;
3783                 break;
3784         default:
3785                 break;
3786         }
3787
3788         return mcs_mask;
3789 }
3790
3791 static void vht_build_mcs_mask(u16 vht_mcs_map,
3792                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3793 {
3794         u8 nss;
3795
3796         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3797                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3798                 vht_mcs_map >>= 2;
3799         }
3800 }
3801
3802 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3803                              struct nl80211_txrate_vht *txrate,
3804                              u16 mcs[NL80211_VHT_NSS_MAX])
3805 {
3806         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3807         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3808         u8 i;
3809
3810         if (!sband->vht_cap.vht_supported)
3811                 return false;
3812
3813         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3814
3815         /* Build vht_mcs_mask from VHT capabilities */
3816         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3817
3818         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3819                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3820                         mcs[i] = txrate->mcs[i];
3821                 else
3822                         return false;
3823         }
3824
3825         return true;
3826 }
3827
3828 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3829         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3830                                     .len = NL80211_MAX_SUPP_RATES },
3831         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3832                                 .len = NL80211_MAX_SUPP_HT_RATES },
3833         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3834         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3835 };
3836
3837 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3838                                          struct cfg80211_bitrate_mask *mask)
3839 {
3840         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3841         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3842         int rem, i;
3843         struct nlattr *tx_rates;
3844         struct ieee80211_supported_band *sband;
3845         u16 vht_tx_mcs_map;
3846
3847         memset(mask, 0, sizeof(*mask));
3848         /* Default to all rates enabled */
3849         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3850                 sband = rdev->wiphy.bands[i];
3851
3852                 if (!sband)
3853                         continue;
3854
3855                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3856                 memcpy(mask->control[i].ht_mcs,
3857                        sband->ht_cap.mcs.rx_mask,
3858                        sizeof(mask->control[i].ht_mcs));
3859
3860                 if (!sband->vht_cap.vht_supported)
3861                         continue;
3862
3863                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3864                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3865         }
3866
3867         /* if no rates are given set it back to the defaults */
3868         if (!info->attrs[NL80211_ATTR_TX_RATES])
3869                 goto out;
3870
3871         /* The nested attribute uses enum nl80211_band as the index. This maps
3872          * directly to the enum nl80211_band values used in cfg80211.
3873          */
3874         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3875         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3876                 enum nl80211_band band = nla_type(tx_rates);
3877                 int err;
3878
3879                 if (band < 0 || band >= NUM_NL80211_BANDS)
3880                         return -EINVAL;
3881                 sband = rdev->wiphy.bands[band];
3882                 if (sband == NULL)
3883                         return -EINVAL;
3884                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3885                                        nl80211_txattr_policy, info->extack);
3886                 if (err)
3887                         return err;
3888                 if (tb[NL80211_TXRATE_LEGACY]) {
3889                         mask->control[band].legacy = rateset_to_mask(
3890                                 sband,
3891                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3892                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3893                         if ((mask->control[band].legacy == 0) &&
3894                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3895                                 return -EINVAL;
3896                 }
3897                 if (tb[NL80211_TXRATE_HT]) {
3898                         if (!ht_rateset_to_mask(
3899                                         sband,
3900                                         nla_data(tb[NL80211_TXRATE_HT]),
3901                                         nla_len(tb[NL80211_TXRATE_HT]),
3902                                         mask->control[band].ht_mcs))
3903                                 return -EINVAL;
3904                 }
3905                 if (tb[NL80211_TXRATE_VHT]) {
3906                         if (!vht_set_mcs_mask(
3907                                         sband,
3908                                         nla_data(tb[NL80211_TXRATE_VHT]),
3909                                         mask->control[band].vht_mcs))
3910                                 return -EINVAL;
3911                 }
3912                 if (tb[NL80211_TXRATE_GI]) {
3913                         mask->control[band].gi =
3914                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3915                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3916                                 return -EINVAL;
3917                 }
3918
3919                 if (mask->control[band].legacy == 0) {
3920                         /* don't allow empty legacy rates if HT or VHT
3921                          * are not even supported.
3922                          */
3923                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3924                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3925                                 return -EINVAL;
3926
3927                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3928                                 if (mask->control[band].ht_mcs[i])
3929                                         goto out;
3930
3931                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3932                                 if (mask->control[band].vht_mcs[i])
3933                                         goto out;
3934
3935                         /* legacy and mcs rates may not be both empty */
3936                         return -EINVAL;
3937                 }
3938         }
3939
3940 out:
3941         return 0;
3942 }
3943
3944 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3945                                    enum nl80211_band band,
3946                                    struct cfg80211_bitrate_mask *beacon_rate)
3947 {
3948         u32 count_ht, count_vht, i;
3949         u32 rate = beacon_rate->control[band].legacy;
3950
3951         /* Allow only one rate */
3952         if (hweight32(rate) > 1)
3953                 return -EINVAL;
3954
3955         count_ht = 0;
3956         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3957                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3958                         return -EINVAL;
3959                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3960                         count_ht++;
3961                         if (count_ht > 1)
3962                                 return -EINVAL;
3963                 }
3964                 if (count_ht && rate)
3965                         return -EINVAL;
3966         }
3967
3968         count_vht = 0;
3969         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3970                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3971                         return -EINVAL;
3972                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3973                         count_vht++;
3974                         if (count_vht > 1)
3975                                 return -EINVAL;
3976                 }
3977                 if (count_vht && rate)
3978                         return -EINVAL;
3979         }
3980
3981         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3982                 return -EINVAL;
3983
3984         if (rate &&
3985             !wiphy_ext_feature_isset(&rdev->wiphy,
3986                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3987                 return -EINVAL;
3988         if (count_ht &&
3989             !wiphy_ext_feature_isset(&rdev->wiphy,
3990                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3991                 return -EINVAL;
3992         if (count_vht &&
3993             !wiphy_ext_feature_isset(&rdev->wiphy,
3994                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3995                 return -EINVAL;
3996
3997         return 0;
3998 }
3999
4000 static int nl80211_parse_beacon(struct nlattr *attrs[],
4001                                 struct cfg80211_beacon_data *bcn)
4002 {
4003         bool haveinfo = false;
4004
4005         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
4006             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
4007             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
4008             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
4009                 return -EINVAL;
4010
4011         memset(bcn, 0, sizeof(*bcn));
4012
4013         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4014                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4015                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4016                 if (!bcn->head_len)
4017                         return -EINVAL;
4018                 haveinfo = true;
4019         }
4020
4021         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4022                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4023                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4024                 haveinfo = true;
4025         }
4026
4027         if (!haveinfo)
4028                 return -EINVAL;
4029
4030         if (attrs[NL80211_ATTR_IE]) {
4031                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4032                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4033         }
4034
4035         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4036                 bcn->proberesp_ies =
4037                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4038                 bcn->proberesp_ies_len =
4039                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4040         }
4041
4042         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4043                 bcn->assocresp_ies =
4044                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4045                 bcn->assocresp_ies_len =
4046                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4047         }
4048
4049         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4050                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4051                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4052         }
4053
4054         return 0;
4055 }
4056
4057 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4058                                             const u8 *rates)
4059 {
4060         int i;
4061
4062         if (!rates)
4063                 return;
4064
4065         for (i = 0; i < rates[1]; i++) {
4066                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4067                         params->ht_required = true;
4068                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4069                         params->vht_required = true;
4070         }
4071 }
4072
4073 /*
4074  * Since the nl80211 API didn't include, from the beginning, attributes about
4075  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4076  * benefit of drivers that rebuild IEs in the firmware.
4077  */
4078 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4079 {
4080         const struct cfg80211_beacon_data *bcn = &params->beacon;
4081         size_t ies_len = bcn->tail_len;
4082         const u8 *ies = bcn->tail;
4083         const u8 *rates;
4084         const u8 *cap;
4085
4086         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4087         nl80211_check_ap_rate_selectors(params, rates);
4088
4089         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4090         nl80211_check_ap_rate_selectors(params, rates);
4091
4092         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4093         if (cap && cap[1] >= sizeof(*params->ht_cap))
4094                 params->ht_cap = (void *)(cap + 2);
4095         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4096         if (cap && cap[1] >= sizeof(*params->vht_cap))
4097                 params->vht_cap = (void *)(cap + 2);
4098 }
4099
4100 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4101                                    struct cfg80211_ap_settings *params)
4102 {
4103         struct wireless_dev *wdev;
4104         bool ret = false;
4105
4106         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4107                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4108                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4109                         continue;
4110
4111                 if (!wdev->preset_chandef.chan)
4112                         continue;
4113
4114                 params->chandef = wdev->preset_chandef;
4115                 ret = true;
4116                 break;
4117         }
4118
4119         return ret;
4120 }
4121
4122 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4123                                     enum nl80211_auth_type auth_type,
4124                                     enum nl80211_commands cmd)
4125 {
4126         if (auth_type > NL80211_AUTHTYPE_MAX)
4127                 return false;
4128
4129         switch (cmd) {
4130         case NL80211_CMD_AUTHENTICATE:
4131                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4132                     auth_type == NL80211_AUTHTYPE_SAE)
4133                         return false;
4134                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4135                                              NL80211_EXT_FEATURE_FILS_STA) &&
4136                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4137                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4138                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4139                         return false;
4140                 return true;
4141         case NL80211_CMD_CONNECT:
4142                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4143                     auth_type == NL80211_AUTHTYPE_SAE)
4144                         return false;
4145
4146                 /* FILS with SK PFS or PK not supported yet */
4147                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4148                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4149                         return false;
4150                 if (!wiphy_ext_feature_isset(
4151                             &rdev->wiphy,
4152                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4153                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4154                         return false;
4155                 return true;
4156         case NL80211_CMD_START_AP:
4157                 /* SAE not supported yet */
4158                 if (auth_type == NL80211_AUTHTYPE_SAE)
4159                         return false;
4160                 /* FILS not supported yet */
4161                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4162                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4163                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4164                         return false;
4165                 return true;
4166         default:
4167                 return false;
4168         }
4169 }
4170
4171 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4172 {
4173         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4174         struct net_device *dev = info->user_ptr[1];
4175         struct wireless_dev *wdev = dev->ieee80211_ptr;
4176         struct cfg80211_ap_settings params;
4177         int err;
4178
4179         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4180             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4181                 return -EOPNOTSUPP;
4182
4183         if (!rdev->ops->start_ap)
4184                 return -EOPNOTSUPP;
4185
4186         if (wdev->beacon_interval)
4187                 return -EALREADY;
4188
4189         memset(&params, 0, sizeof(params));
4190
4191         /* these are required for START_AP */
4192         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4193             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4194             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4195                 return -EINVAL;
4196
4197         err = nl80211_parse_beacon(info->attrs, &params.beacon);
4198         if (err)
4199                 return err;
4200
4201         params.beacon_interval =
4202                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4203         params.dtim_period =
4204                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4205
4206         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4207                                            params.beacon_interval);
4208         if (err)
4209                 return err;
4210
4211         /*
4212          * In theory, some of these attributes should be required here
4213          * but since they were not used when the command was originally
4214          * added, keep them optional for old user space programs to let
4215          * them continue to work with drivers that do not need the
4216          * additional information -- drivers must check!
4217          */
4218         if (info->attrs[NL80211_ATTR_SSID]) {
4219                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4220                 params.ssid_len =
4221                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4222                 if (params.ssid_len == 0 ||
4223                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4224                         return -EINVAL;
4225         }
4226
4227         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
4228                 params.hidden_ssid = nla_get_u32(
4229                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4230                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
4231                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
4232                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
4233                         return -EINVAL;
4234         }
4235
4236         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4237
4238         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4239                 params.auth_type = nla_get_u32(
4240                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4241                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4242                                              NL80211_CMD_START_AP))
4243                         return -EINVAL;
4244         } else
4245                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4246
4247         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4248                                       NL80211_MAX_NR_CIPHER_SUITES);
4249         if (err)
4250                 return err;
4251
4252         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4253                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4254                         return -EOPNOTSUPP;
4255                 params.inactivity_timeout = nla_get_u16(
4256                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4257         }
4258
4259         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4260                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4261                         return -EINVAL;
4262                 params.p2p_ctwindow =
4263                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4264                 if (params.p2p_ctwindow > 127)
4265                         return -EINVAL;
4266                 if (params.p2p_ctwindow != 0 &&
4267                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4268                         return -EINVAL;
4269         }
4270
4271         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4272                 u8 tmp;
4273
4274                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4275                         return -EINVAL;
4276                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4277                 if (tmp > 1)
4278                         return -EINVAL;
4279                 params.p2p_opp_ps = tmp;
4280                 if (params.p2p_opp_ps != 0 &&
4281                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4282                         return -EINVAL;
4283         }
4284
4285         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4286                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4287                 if (err)
4288                         return err;
4289         } else if (wdev->preset_chandef.chan) {
4290                 params.chandef = wdev->preset_chandef;
4291         } else if (!nl80211_get_ap_channel(rdev, &params))
4292                 return -EINVAL;
4293
4294         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4295                                            wdev->iftype))
4296                 return -EINVAL;
4297
4298         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4299                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4300                 if (err)
4301                         return err;
4302
4303                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4304                                               &params.beacon_rate);
4305                 if (err)
4306                         return err;
4307         }
4308
4309         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4310                 params.smps_mode =
4311                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4312                 switch (params.smps_mode) {
4313                 case NL80211_SMPS_OFF:
4314                         break;
4315                 case NL80211_SMPS_STATIC:
4316                         if (!(rdev->wiphy.features &
4317                               NL80211_FEATURE_STATIC_SMPS))
4318                                 return -EINVAL;
4319                         break;
4320                 case NL80211_SMPS_DYNAMIC:
4321                         if (!(rdev->wiphy.features &
4322                               NL80211_FEATURE_DYNAMIC_SMPS))
4323                                 return -EINVAL;
4324                         break;
4325                 default:
4326                         return -EINVAL;
4327                 }
4328         } else {
4329                 params.smps_mode = NL80211_SMPS_OFF;
4330         }
4331
4332         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4333         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4334                 return -EOPNOTSUPP;
4335
4336         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4337                 params.acl = parse_acl_data(&rdev->wiphy, info);
4338                 if (IS_ERR(params.acl))
4339                         return PTR_ERR(params.acl);
4340         }
4341
4342         nl80211_calculate_ap_params(&params);
4343
4344         wdev_lock(wdev);
4345         err = rdev_start_ap(rdev, dev, &params);
4346         if (!err) {
4347                 wdev->preset_chandef = params.chandef;
4348                 wdev->beacon_interval = params.beacon_interval;
4349                 wdev->chandef = params.chandef;
4350                 wdev->ssid_len = params.ssid_len;
4351                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4352
4353                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4354                         wdev->conn_owner_nlportid = info->snd_portid;
4355         }
4356         wdev_unlock(wdev);
4357
4358         kfree(params.acl);
4359
4360         return err;
4361 }
4362
4363 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4364 {
4365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4366         struct net_device *dev = info->user_ptr[1];
4367         struct wireless_dev *wdev = dev->ieee80211_ptr;
4368         struct cfg80211_beacon_data params;
4369         int err;
4370
4371         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4372             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4373                 return -EOPNOTSUPP;
4374
4375         if (!rdev->ops->change_beacon)
4376                 return -EOPNOTSUPP;
4377
4378         if (!wdev->beacon_interval)
4379                 return -EINVAL;
4380
4381         err = nl80211_parse_beacon(info->attrs, &params);
4382         if (err)
4383                 return err;
4384
4385         wdev_lock(wdev);
4386         err = rdev_change_beacon(rdev, dev, &params);
4387         wdev_unlock(wdev);
4388
4389         return err;
4390 }
4391
4392 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4393 {
4394         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4395         struct net_device *dev = info->user_ptr[1];
4396
4397         return cfg80211_stop_ap(rdev, dev, false);
4398 }
4399
4400 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4401         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4402         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4403         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4404         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4405         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4406         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4407 };
4408
4409 static int parse_station_flags(struct genl_info *info,
4410                                enum nl80211_iftype iftype,
4411                                struct station_parameters *params)
4412 {
4413         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4414         struct nlattr *nla;
4415         int flag;
4416
4417         /*
4418          * Try parsing the new attribute first so userspace
4419          * can specify both for older kernels.
4420          */
4421         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4422         if (nla) {
4423                 struct nl80211_sta_flag_update *sta_flags;
4424
4425                 sta_flags = nla_data(nla);
4426                 params->sta_flags_mask = sta_flags->mask;
4427                 params->sta_flags_set = sta_flags->set;
4428                 params->sta_flags_set &= params->sta_flags_mask;
4429                 if ((params->sta_flags_mask |
4430                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4431                         return -EINVAL;
4432                 return 0;
4433         }
4434
4435         /* if present, parse the old attribute */
4436
4437         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4438         if (!nla)
4439                 return 0;
4440
4441         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4442                              sta_flags_policy, info->extack))
4443                 return -EINVAL;
4444
4445         /*
4446          * Only allow certain flags for interface types so that
4447          * other attributes are silently ignored. Remember that
4448          * this is backward compatibility code with old userspace
4449          * and shouldn't be hit in other cases anyway.
4450          */
4451         switch (iftype) {
4452         case NL80211_IFTYPE_AP:
4453         case NL80211_IFTYPE_AP_VLAN:
4454         case NL80211_IFTYPE_P2P_GO:
4455                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4456                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4457                                          BIT(NL80211_STA_FLAG_WME) |
4458                                          BIT(NL80211_STA_FLAG_MFP);
4459                 break;
4460         case NL80211_IFTYPE_P2P_CLIENT:
4461         case NL80211_IFTYPE_STATION:
4462                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4463                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4464                 break;
4465         case NL80211_IFTYPE_MESH_POINT:
4466                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4467                                          BIT(NL80211_STA_FLAG_MFP) |
4468                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4469                 break;
4470         default:
4471                 return -EINVAL;
4472         }
4473
4474         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4475                 if (flags[flag]) {
4476                         params->sta_flags_set |= (1<<flag);
4477
4478                         /* no longer support new API additions in old API */
4479                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4480                                 return -EINVAL;
4481                 }
4482         }
4483
4484         return 0;
4485 }
4486
4487 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4488                                  int attr)
4489 {
4490         struct nlattr *rate;
4491         u32 bitrate;
4492         u16 bitrate_compat;
4493         enum nl80211_rate_info rate_flg;
4494
4495         rate = nla_nest_start(msg, attr);
4496         if (!rate)
4497                 return false;
4498
4499         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4500         bitrate = cfg80211_calculate_bitrate(info);
4501         /* report 16-bit bitrate only if we can */
4502         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4503         if (bitrate > 0 &&
4504             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4505                 return false;
4506         if (bitrate_compat > 0 &&
4507             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4508                 return false;
4509
4510         switch (info->bw) {
4511         case RATE_INFO_BW_5:
4512                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4513                 break;
4514         case RATE_INFO_BW_10:
4515                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4516                 break;
4517         default:
4518                 WARN_ON(1);
4519                 /* fall through */
4520         case RATE_INFO_BW_20:
4521                 rate_flg = 0;
4522                 break;
4523         case RATE_INFO_BW_40:
4524                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4525                 break;
4526         case RATE_INFO_BW_80:
4527                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4528                 break;
4529         case RATE_INFO_BW_160:
4530                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4531                 break;
4532         case RATE_INFO_BW_HE_RU:
4533                 rate_flg = 0;
4534                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4535         }
4536
4537         if (rate_flg && nla_put_flag(msg, rate_flg))
4538                 return false;
4539
4540         if (info->flags & RATE_INFO_FLAGS_MCS) {
4541                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4542                         return false;
4543                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4544                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4545                         return false;
4546         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4547                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4548                         return false;
4549                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4550                         return false;
4551                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4552                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4553                         return false;
4554         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4555                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4556                         return false;
4557                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4558                         return false;
4559                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4560                         return false;
4561                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4562                         return false;
4563                 if (info->bw == RATE_INFO_BW_HE_RU &&
4564                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4565                                info->he_ru_alloc))
4566                         return false;
4567         }
4568
4569         nla_nest_end(msg, rate);
4570         return true;
4571 }
4572
4573 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4574                                int id)
4575 {
4576         void *attr;
4577         int i = 0;
4578
4579         if (!mask)
4580                 return true;
4581
4582         attr = nla_nest_start(msg, id);
4583         if (!attr)
4584                 return false;
4585
4586         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4587                 if (!(mask & BIT(i)))
4588                         continue;
4589
4590                 if (nla_put_u8(msg, i, signal[i]))
4591                         return false;
4592         }
4593
4594         nla_nest_end(msg, attr);
4595
4596         return true;
4597 }
4598
4599 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4600                                 u32 seq, int flags,
4601                                 struct cfg80211_registered_device *rdev,
4602                                 struct net_device *dev,
4603                                 const u8 *mac_addr, struct station_info *sinfo)
4604 {
4605         void *hdr;
4606         struct nlattr *sinfoattr, *bss_param;
4607
4608         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4609         if (!hdr)
4610                 return -1;
4611
4612         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4613             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4614             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4615                 goto nla_put_failure;
4616
4617         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4618         if (!sinfoattr)
4619                 goto nla_put_failure;
4620
4621 #define PUT_SINFO(attr, memb, type) do {                                \
4622         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4623         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4624             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4625                              sinfo->memb))                              \
4626                 goto nla_put_failure;                                   \
4627         } while (0)
4628 #define PUT_SINFO_U64(attr, memb) do {                                  \
4629         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4630             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4631                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4632                 goto nla_put_failure;                                   \
4633         } while (0)
4634
4635         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4636         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4637
4638         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4639                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4640             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4641                         (u32)sinfo->rx_bytes))
4642                 goto nla_put_failure;
4643
4644         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4645                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4646             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4647                         (u32)sinfo->tx_bytes))
4648                 goto nla_put_failure;
4649
4650         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4651         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4652         PUT_SINFO(LLID, llid, u16);
4653         PUT_SINFO(PLID, plid, u16);
4654         PUT_SINFO(PLINK_STATE, plink_state, u8);
4655         PUT_SINFO_U64(RX_DURATION, rx_duration);
4656
4657         switch (rdev->wiphy.signal_type) {
4658         case CFG80211_SIGNAL_TYPE_MBM:
4659                 PUT_SINFO(SIGNAL, signal, u8);
4660                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4661                 break;
4662         default:
4663                 break;
4664         }
4665         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4666                 if (!nl80211_put_signal(msg, sinfo->chains,
4667                                         sinfo->chain_signal,
4668                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4669                         goto nla_put_failure;
4670         }
4671         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4672                 if (!nl80211_put_signal(msg, sinfo->chains,
4673                                         sinfo->chain_signal_avg,
4674                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4675                         goto nla_put_failure;
4676         }
4677         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4678                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4679                                           NL80211_STA_INFO_TX_BITRATE))
4680                         goto nla_put_failure;
4681         }
4682         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4683                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4684                                           NL80211_STA_INFO_RX_BITRATE))
4685                         goto nla_put_failure;
4686         }
4687
4688         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4689         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4690         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4691         PUT_SINFO(TX_FAILED, tx_failed, u32);
4692         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4693         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4694         PUT_SINFO(LOCAL_PM, local_pm, u32);
4695         PUT_SINFO(PEER_PM, peer_pm, u32);
4696         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4697
4698         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4699                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4700                 if (!bss_param)
4701                         goto nla_put_failure;
4702
4703                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4704                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4705                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4706                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4707                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4708                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4709                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4710                                sinfo->bss_param.dtim_period) ||
4711                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4712                                 sinfo->bss_param.beacon_interval))
4713                         goto nla_put_failure;
4714
4715                 nla_nest_end(msg, bss_param);
4716         }
4717         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4718             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4719                     sizeof(struct nl80211_sta_flag_update),
4720                     &sinfo->sta_flags))
4721                 goto nla_put_failure;
4722
4723         PUT_SINFO_U64(T_OFFSET, t_offset);
4724         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4725         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4726         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4727         PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4728         if (wiphy_ext_feature_isset(&rdev->wiphy,
4729                                     NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT))
4730                 PUT_SINFO(DATA_ACK_SIGNAL_AVG, avg_ack_signal, s8);
4731
4732 #undef PUT_SINFO
4733 #undef PUT_SINFO_U64
4734
4735         if (sinfo->pertid) {
4736                 struct nlattr *tidsattr;
4737                 int tid;
4738
4739                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4740                 if (!tidsattr)
4741                         goto nla_put_failure;
4742
4743                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4744                         struct cfg80211_tid_stats *tidstats;
4745                         struct nlattr *tidattr;
4746
4747                         tidstats = &sinfo->pertid[tid];
4748
4749                         if (!tidstats->filled)
4750                                 continue;
4751
4752                         tidattr = nla_nest_start(msg, tid + 1);
4753                         if (!tidattr)
4754                                 goto nla_put_failure;
4755
4756 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4757         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4758             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4759                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4760                 goto nla_put_failure;                                   \
4761         } while (0)
4762
4763                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4764                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4765                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4766                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4767
4768 #undef PUT_TIDVAL_U64
4769                         if ((tidstats->filled &
4770                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4771                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4772                                                    NL80211_TID_STATS_TXQ_STATS))
4773                                 goto nla_put_failure;
4774
4775                         nla_nest_end(msg, tidattr);
4776                 }
4777
4778                 nla_nest_end(msg, tidsattr);
4779         }
4780
4781         nla_nest_end(msg, sinfoattr);
4782
4783         if (sinfo->assoc_req_ies_len &&
4784             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4785                     sinfo->assoc_req_ies))
4786                 goto nla_put_failure;
4787
4788         cfg80211_sinfo_release_content(sinfo);
4789         genlmsg_end(msg, hdr);
4790         return 0;
4791
4792  nla_put_failure:
4793         cfg80211_sinfo_release_content(sinfo);
4794         genlmsg_cancel(msg, hdr);
4795         return -EMSGSIZE;
4796 }
4797
4798 static int nl80211_dump_station(struct sk_buff *skb,
4799                                 struct netlink_callback *cb)
4800 {
4801         struct station_info sinfo;
4802         struct cfg80211_registered_device *rdev;
4803         struct wireless_dev *wdev;
4804         u8 mac_addr[ETH_ALEN];
4805         int sta_idx = cb->args[2];
4806         int err;
4807
4808         rtnl_lock();
4809         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4810         if (err)
4811                 goto out_err;
4812
4813         if (!wdev->netdev) {
4814                 err = -EINVAL;
4815                 goto out_err;
4816         }
4817
4818         if (!rdev->ops->dump_station) {
4819                 err = -EOPNOTSUPP;
4820                 goto out_err;
4821         }
4822
4823         while (1) {
4824                 memset(&sinfo, 0, sizeof(sinfo));
4825                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4826                                         mac_addr, &sinfo);
4827                 if (err == -ENOENT)
4828                         break;
4829                 if (err)
4830                         goto out_err;
4831
4832                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4833                                 NETLINK_CB(cb->skb).portid,
4834                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4835                                 rdev, wdev->netdev, mac_addr,
4836                                 &sinfo) < 0)
4837                         goto out;
4838
4839                 sta_idx++;
4840         }
4841
4842  out:
4843         cb->args[2] = sta_idx;
4844         err = skb->len;
4845  out_err:
4846         rtnl_unlock();
4847
4848         return err;
4849 }
4850
4851 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4852 {
4853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4854         struct net_device *dev = info->user_ptr[1];
4855         struct station_info sinfo;
4856         struct sk_buff *msg;
4857         u8 *mac_addr = NULL;
4858         int err;
4859
4860         memset(&sinfo, 0, sizeof(sinfo));
4861
4862         if (!info->attrs[NL80211_ATTR_MAC])
4863                 return -EINVAL;
4864
4865         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4866
4867         if (!rdev->ops->get_station)
4868                 return -EOPNOTSUPP;
4869
4870         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4871         if (err)
4872                 return err;
4873
4874         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4875         if (!msg) {
4876                 cfg80211_sinfo_release_content(&sinfo);
4877                 return -ENOMEM;
4878         }
4879
4880         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4881                                  info->snd_portid, info->snd_seq, 0,
4882                                  rdev, dev, mac_addr, &sinfo) < 0) {
4883                 nlmsg_free(msg);
4884                 return -ENOBUFS;
4885         }
4886
4887         return genlmsg_reply(msg, info);
4888 }
4889
4890 int cfg80211_check_station_change(struct wiphy *wiphy,
4891                                   struct station_parameters *params,
4892                                   enum cfg80211_station_type statype)
4893 {
4894         if (params->listen_interval != -1 &&
4895             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4896                 return -EINVAL;
4897
4898         if (params->support_p2p_ps != -1 &&
4899             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4900                 return -EINVAL;
4901
4902         if (params->aid &&
4903             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4904             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4905                 return -EINVAL;
4906
4907         /* When you run into this, adjust the code below for the new flag */
4908         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4909
4910         switch (statype) {
4911         case CFG80211_STA_MESH_PEER_KERNEL:
4912         case CFG80211_STA_MESH_PEER_USER:
4913                 /*
4914                  * No ignoring the TDLS flag here -- the userspace mesh
4915                  * code doesn't have the bug of including TDLS in the
4916                  * mask everywhere.
4917                  */
4918                 if (params->sta_flags_mask &
4919                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4920                                   BIT(NL80211_STA_FLAG_MFP) |
4921                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4922                         return -EINVAL;
4923                 break;
4924         case CFG80211_STA_TDLS_PEER_SETUP:
4925         case CFG80211_STA_TDLS_PEER_ACTIVE:
4926                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4927                         return -EINVAL;
4928                 /* ignore since it can't change */
4929                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4930                 break;
4931         default:
4932                 /* disallow mesh-specific things */
4933                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4934                         return -EINVAL;
4935                 if (params->local_pm)
4936                         return -EINVAL;
4937                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4938                         return -EINVAL;
4939         }
4940
4941         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4942             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4943                 /* TDLS can't be set, ... */
4944                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4945                         return -EINVAL;
4946                 /*
4947                  * ... but don't bother the driver with it. This works around
4948                  * a hostapd/wpa_supplicant issue -- it always includes the
4949                  * TLDS_PEER flag in the mask even for AP mode.
4950                  */
4951                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4952         }
4953
4954         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4955             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4956                 /* reject other things that can't change */
4957                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4958                         return -EINVAL;
4959                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4960                         return -EINVAL;
4961                 if (params->supported_rates)
4962                         return -EINVAL;
4963                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
4964                     params->he_capa)
4965                         return -EINVAL;
4966         }
4967
4968         if (statype != CFG80211_STA_AP_CLIENT &&
4969             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4970                 if (params->vlan)
4971                         return -EINVAL;
4972         }
4973
4974         switch (statype) {
4975         case CFG80211_STA_AP_MLME_CLIENT:
4976                 /* Use this only for authorizing/unauthorizing a station */
4977                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4978                         return -EOPNOTSUPP;
4979                 break;
4980         case CFG80211_STA_AP_CLIENT:
4981         case CFG80211_STA_AP_CLIENT_UNASSOC:
4982                 /* accept only the listed bits */
4983                 if (params->sta_flags_mask &
4984                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4985                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4986                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4987                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4988                                   BIT(NL80211_STA_FLAG_WME) |
4989                                   BIT(NL80211_STA_FLAG_MFP)))
4990                         return -EINVAL;
4991
4992                 /* but authenticated/associated only if driver handles it */
4993                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4994                     params->sta_flags_mask &
4995                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4996                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4997                         return -EINVAL;
4998                 break;
4999         case CFG80211_STA_IBSS:
5000         case CFG80211_STA_AP_STA:
5001                 /* reject any changes other than AUTHORIZED */
5002                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5003                         return -EINVAL;
5004                 break;
5005         case CFG80211_STA_TDLS_PEER_SETUP:
5006                 /* reject any changes other than AUTHORIZED or WME */
5007                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5008                                                BIT(NL80211_STA_FLAG_WME)))
5009                         return -EINVAL;
5010                 /* force (at least) rates when authorizing */
5011                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5012                     !params->supported_rates)
5013                         return -EINVAL;
5014                 break;
5015         case CFG80211_STA_TDLS_PEER_ACTIVE:
5016                 /* reject any changes */
5017                 return -EINVAL;
5018         case CFG80211_STA_MESH_PEER_KERNEL:
5019                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5020                         return -EINVAL;
5021                 break;
5022         case CFG80211_STA_MESH_PEER_USER:
5023                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5024                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5025                         return -EINVAL;
5026                 break;
5027         }
5028
5029         /*
5030          * Older kernel versions ignored this attribute entirely, so don't
5031          * reject attempts to update it but mark it as unused instead so the
5032          * driver won't look at the data.
5033          */
5034         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5035             statype != CFG80211_STA_TDLS_PEER_SETUP)
5036                 params->opmode_notif_used = false;
5037
5038         return 0;
5039 }
5040 EXPORT_SYMBOL(cfg80211_check_station_change);
5041
5042 /*
5043  * Get vlan interface making sure it is running and on the right wiphy.
5044  */
5045 static struct net_device *get_vlan(struct genl_info *info,
5046                                    struct cfg80211_registered_device *rdev)
5047 {
5048         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5049         struct net_device *v;
5050         int ret;
5051
5052         if (!vlanattr)
5053                 return NULL;
5054
5055         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5056         if (!v)
5057                 return ERR_PTR(-ENODEV);
5058
5059         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5060                 ret = -EINVAL;
5061                 goto error;
5062         }
5063
5064         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5065             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5066             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5067                 ret = -EINVAL;
5068                 goto error;
5069         }
5070
5071         if (!netif_running(v)) {
5072                 ret = -ENETDOWN;
5073                 goto error;
5074         }
5075
5076         return v;
5077  error:
5078         dev_put(v);
5079         return ERR_PTR(ret);
5080 }
5081
5082 static const struct nla_policy
5083 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5084         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5085         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5086 };
5087
5088 static int nl80211_parse_sta_wme(struct genl_info *info,
5089                                  struct station_parameters *params)
5090 {
5091         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5092         struct nlattr *nla;
5093         int err;
5094
5095         /* parse WME attributes if present */
5096         if (!info->attrs[NL80211_ATTR_STA_WME])
5097                 return 0;
5098
5099         nla = info->attrs[NL80211_ATTR_STA_WME];
5100         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5101                                nl80211_sta_wme_policy, info->extack);
5102         if (err)
5103                 return err;
5104
5105         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5106                 params->uapsd_queues = nla_get_u8(
5107                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5108         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5109                 return -EINVAL;
5110
5111         if (tb[NL80211_STA_WME_MAX_SP])
5112                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5113
5114         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5115                 return -EINVAL;
5116
5117         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5118
5119         return 0;
5120 }
5121
5122 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5123                                       struct station_parameters *params)
5124 {
5125         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5126                 params->supported_channels =
5127                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5128                 params->supported_channels_len =
5129                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5130                 /*
5131                  * Need to include at least one (first channel, number of
5132                  * channels) tuple for each subband, and must have proper
5133                  * tuples for the rest of the data as well.
5134                  */
5135                 if (params->supported_channels_len < 2)
5136                         return -EINVAL;
5137                 if (params->supported_channels_len % 2)
5138                         return -EINVAL;
5139         }
5140
5141         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5142                 params->supported_oper_classes =
5143                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5144                 params->supported_oper_classes_len =
5145                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5146                 /*
5147                  * The value of the Length field of the Supported Operating
5148                  * Classes element is between 2 and 253.
5149                  */
5150                 if (params->supported_oper_classes_len < 2 ||
5151                     params->supported_oper_classes_len > 253)
5152                         return -EINVAL;
5153         }
5154         return 0;
5155 }
5156
5157 static int nl80211_set_station_tdls(struct genl_info *info,
5158                                     struct station_parameters *params)
5159 {
5160         int err;
5161         /* Dummy STA entry gets updated once the peer capabilities are known */
5162         if (info->attrs[NL80211_ATTR_PEER_AID])
5163                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5164         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5165                 params->ht_capa =
5166                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5167         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5168                 params->vht_capa =
5169                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5170         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5171                 params->he_capa =
5172                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5173                 params->he_capa_len =
5174                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5175
5176                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5177                         return -EINVAL;
5178         }
5179
5180         err = nl80211_parse_sta_channel_info(info, params);
5181         if (err)
5182                 return err;
5183
5184         return nl80211_parse_sta_wme(info, params);
5185 }
5186
5187 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5188 {
5189         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5190         struct net_device *dev = info->user_ptr[1];
5191         struct station_parameters params;
5192         u8 *mac_addr;
5193         int err;
5194
5195         memset(&params, 0, sizeof(params));
5196
5197         if (!rdev->ops->change_station)
5198                 return -EOPNOTSUPP;
5199
5200         /*
5201          * AID and listen_interval properties can be set only for unassociated
5202          * station. Include these parameters here and will check them in
5203          * cfg80211_check_station_change().
5204          */
5205         if (info->attrs[NL80211_ATTR_STA_AID])
5206                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5207
5208         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5209                 params.listen_interval =
5210                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5211         else
5212                 params.listen_interval = -1;
5213
5214         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5215                 u8 tmp;
5216
5217                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5218                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5219                         return -EINVAL;
5220
5221                 params.support_p2p_ps = tmp;
5222         } else {
5223                 params.support_p2p_ps = -1;
5224         }
5225
5226         if (!info->attrs[NL80211_ATTR_MAC])
5227                 return -EINVAL;
5228
5229         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5230
5231         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5232                 params.supported_rates =
5233                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5234                 params.supported_rates_len =
5235                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5236         }
5237
5238         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5239                 params.capability =
5240                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5241                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5242         }
5243
5244         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5245                 params.ext_capab =
5246                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5247                 params.ext_capab_len =
5248                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5249         }
5250
5251         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5252                 return -EINVAL;
5253
5254         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5255                 params.plink_action =
5256                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5257                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5258                         return -EINVAL;
5259         }
5260
5261         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5262                 params.plink_state =
5263                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5264                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
5265                         return -EINVAL;
5266                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
5267                         params.peer_aid = nla_get_u16(
5268                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5269                         if (params.peer_aid > IEEE80211_MAX_AID)
5270                                 return -EINVAL;
5271                 }
5272                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5273         }
5274
5275         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
5276                 enum nl80211_mesh_power_mode pm = nla_get_u32(
5277                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5278
5279                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
5280                     pm > NL80211_MESH_POWER_MAX)
5281                         return -EINVAL;
5282
5283                 params.local_pm = pm;
5284         }
5285
5286         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5287                 params.opmode_notif_used = true;
5288                 params.opmode_notif =
5289                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5290         }
5291
5292         /* Include parameters for TDLS peer (will check later) */
5293         err = nl80211_set_station_tdls(info, &params);
5294         if (err)
5295                 return err;
5296
5297         params.vlan = get_vlan(info, rdev);
5298         if (IS_ERR(params.vlan))
5299                 return PTR_ERR(params.vlan);
5300
5301         switch (dev->ieee80211_ptr->iftype) {
5302         case NL80211_IFTYPE_AP:
5303         case NL80211_IFTYPE_AP_VLAN:
5304         case NL80211_IFTYPE_P2P_GO:
5305         case NL80211_IFTYPE_P2P_CLIENT:
5306         case NL80211_IFTYPE_STATION:
5307         case NL80211_IFTYPE_ADHOC:
5308         case NL80211_IFTYPE_MESH_POINT:
5309                 break;
5310         default:
5311                 err = -EOPNOTSUPP;
5312                 goto out_put_vlan;
5313         }
5314
5315         /* driver will call cfg80211_check_station_change() */
5316         err = rdev_change_station(rdev, dev, mac_addr, &params);
5317
5318  out_put_vlan:
5319         if (params.vlan)
5320                 dev_put(params.vlan);
5321
5322         return err;
5323 }
5324
5325 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5326 {
5327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5328         int err;
5329         struct net_device *dev = info->user_ptr[1];
5330         struct station_parameters params;
5331         u8 *mac_addr = NULL;
5332         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5333                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5334
5335         memset(&params, 0, sizeof(params));
5336
5337         if (!rdev->ops->add_station)
5338                 return -EOPNOTSUPP;
5339
5340         if (!info->attrs[NL80211_ATTR_MAC])
5341                 return -EINVAL;
5342
5343         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5344                 return -EINVAL;
5345
5346         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5347                 return -EINVAL;
5348
5349         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5350             !info->attrs[NL80211_ATTR_PEER_AID])
5351                 return -EINVAL;
5352
5353         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5354         params.supported_rates =
5355                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5356         params.supported_rates_len =
5357                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5358         params.listen_interval =
5359                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5360
5361         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5362                 u8 tmp;
5363
5364                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5365                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5366                         return -EINVAL;
5367
5368                 params.support_p2p_ps = tmp;
5369         } else {
5370                 /*
5371                  * if not specified, assume it's supported for P2P GO interface,
5372                  * and is NOT supported for AP interface
5373                  */
5374                 params.support_p2p_ps =
5375                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5376         }
5377
5378         if (info->attrs[NL80211_ATTR_PEER_AID])
5379                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5380         else
5381                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5382         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5383                 return -EINVAL;
5384
5385         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5386                 params.capability =
5387                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5388                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5389         }
5390
5391         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5392                 params.ext_capab =
5393                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5394                 params.ext_capab_len =
5395                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5396         }
5397
5398         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5399                 params.ht_capa =
5400                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5401
5402         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5403                 params.vht_capa =
5404                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5405
5406         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5407                 params.he_capa =
5408                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5409                 params.he_capa_len =
5410                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5411
5412                 /* max len is validated in nla policy */
5413                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5414                         return -EINVAL;
5415         }
5416
5417         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5418                 params.opmode_notif_used = true;
5419                 params.opmode_notif =
5420                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5421         }
5422
5423         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5424                 params.plink_action =
5425                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5426                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5427                         return -EINVAL;
5428         }
5429
5430         err = nl80211_parse_sta_channel_info(info, &params);
5431         if (err)
5432                 return err;
5433
5434         err = nl80211_parse_sta_wme(info, &params);
5435         if (err)
5436                 return err;
5437
5438         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5439                 return -EINVAL;
5440
5441         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5442          * as userspace might just pass through the capabilities from the IEs
5443          * directly, rather than enforcing this restriction and returning an
5444          * error in this case.
5445          */
5446         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5447                 params.ht_capa = NULL;
5448                 params.vht_capa = NULL;
5449
5450                 /* HE requires WME */
5451                 if (params.he_capa_len)
5452                         return -EINVAL;
5453         }
5454
5455         /* When you run into this, adjust the code below for the new flag */
5456         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5457
5458         switch (dev->ieee80211_ptr->iftype) {
5459         case NL80211_IFTYPE_AP:
5460         case NL80211_IFTYPE_AP_VLAN:
5461         case NL80211_IFTYPE_P2P_GO:
5462                 /* ignore WME attributes if iface/sta is not capable */
5463                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5464                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5465                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5466
5467                 /* TDLS peers cannot be added */
5468                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5469                     info->attrs[NL80211_ATTR_PEER_AID])
5470                         return -EINVAL;
5471                 /* but don't bother the driver with it */
5472                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5473
5474                 /* allow authenticated/associated only if driver handles it */
5475                 if (!(rdev->wiphy.features &
5476                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5477                     params.sta_flags_mask & auth_assoc)
5478                         return -EINVAL;
5479
5480                 /* Older userspace, or userspace wanting to be compatible with
5481                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5482                  * and assoc flags in the mask, but assumes the station will be
5483                  * added as associated anyway since this was the required driver
5484                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5485                  * introduced.
5486                  * In order to not bother drivers with this quirk in the API
5487                  * set the flags in both the mask and set for new stations in
5488                  * this case.
5489                  */
5490                 if (!(params.sta_flags_mask & auth_assoc)) {
5491                         params.sta_flags_mask |= auth_assoc;
5492                         params.sta_flags_set |= auth_assoc;
5493                 }
5494
5495                 /* must be last in here for error handling */
5496                 params.vlan = get_vlan(info, rdev);
5497                 if (IS_ERR(params.vlan))
5498                         return PTR_ERR(params.vlan);
5499                 break;
5500         case NL80211_IFTYPE_MESH_POINT:
5501                 /* ignore uAPSD data */
5502                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5503
5504                 /* associated is disallowed */
5505                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5506                         return -EINVAL;
5507                 /* TDLS peers cannot be added */
5508                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5509                     info->attrs[NL80211_ATTR_PEER_AID])
5510                         return -EINVAL;
5511                 break;
5512         case NL80211_IFTYPE_STATION:
5513         case NL80211_IFTYPE_P2P_CLIENT:
5514                 /* ignore uAPSD data */
5515                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5516
5517                 /* these are disallowed */
5518                 if (params.sta_flags_mask &
5519                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5520                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5521                         return -EINVAL;
5522                 /* Only TDLS peers can be added */
5523                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5524                         return -EINVAL;
5525                 /* Can only add if TDLS ... */
5526                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5527                         return -EOPNOTSUPP;
5528                 /* ... with external setup is supported */
5529                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5530                         return -EOPNOTSUPP;
5531                 /*
5532                  * Older wpa_supplicant versions always mark the TDLS peer
5533                  * as authorized, but it shouldn't yet be.
5534                  */
5535                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5536                 break;
5537         default:
5538                 return -EOPNOTSUPP;
5539         }
5540
5541         /* be aware of params.vlan when changing code here */
5542
5543         err = rdev_add_station(rdev, dev, mac_addr, &params);
5544
5545         if (params.vlan)
5546                 dev_put(params.vlan);
5547         return err;
5548 }
5549
5550 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5551 {
5552         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5553         struct net_device *dev = info->user_ptr[1];
5554         struct station_del_parameters params;
5555
5556         memset(&params, 0, sizeof(params));
5557
5558         if (info->attrs[NL80211_ATTR_MAC])
5559                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5560
5561         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5562             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5563             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5564             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5565                 return -EINVAL;
5566
5567         if (!rdev->ops->del_station)
5568                 return -EOPNOTSUPP;
5569
5570         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5571                 params.subtype =
5572                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5573                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5574                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5575                         return -EINVAL;
5576         } else {
5577                 /* Default to Deauthentication frame */
5578                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5579         }
5580
5581         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5582                 params.reason_code =
5583                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5584                 if (params.reason_code == 0)
5585                         return -EINVAL; /* 0 is reserved */
5586         } else {
5587                 /* Default to reason code 2 */
5588                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5589         }
5590
5591         return rdev_del_station(rdev, dev, &params);
5592 }
5593
5594 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5595                                 int flags, struct net_device *dev,
5596                                 u8 *dst, u8 *next_hop,
5597                                 struct mpath_info *pinfo)
5598 {
5599         void *hdr;
5600         struct nlattr *pinfoattr;
5601
5602         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5603         if (!hdr)
5604                 return -1;
5605
5606         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5607             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5608             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5609             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5610                 goto nla_put_failure;
5611
5612         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5613         if (!pinfoattr)
5614                 goto nla_put_failure;
5615         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5616             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5617                         pinfo->frame_qlen))
5618                 goto nla_put_failure;
5619         if (((pinfo->filled & MPATH_INFO_SN) &&
5620              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5621             ((pinfo->filled & MPATH_INFO_METRIC) &&
5622              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5623                          pinfo->metric)) ||
5624             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5625              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5626                          pinfo->exptime)) ||
5627             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5628              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5629                         pinfo->flags)) ||
5630             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5631              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5632                          pinfo->discovery_timeout)) ||
5633             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5634              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5635                         pinfo->discovery_retries)))
5636                 goto nla_put_failure;
5637
5638         nla_nest_end(msg, pinfoattr);
5639
5640         genlmsg_end(msg, hdr);
5641         return 0;
5642
5643  nla_put_failure:
5644         genlmsg_cancel(msg, hdr);
5645         return -EMSGSIZE;
5646 }
5647
5648 static int nl80211_dump_mpath(struct sk_buff *skb,
5649                               struct netlink_callback *cb)
5650 {
5651         struct mpath_info pinfo;
5652         struct cfg80211_registered_device *rdev;
5653         struct wireless_dev *wdev;
5654         u8 dst[ETH_ALEN];
5655         u8 next_hop[ETH_ALEN];
5656         int path_idx = cb->args[2];
5657         int err;
5658
5659         rtnl_lock();
5660         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5661         if (err)
5662                 goto out_err;
5663
5664         if (!rdev->ops->dump_mpath) {
5665                 err = -EOPNOTSUPP;
5666                 goto out_err;
5667         }
5668
5669         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5670                 err = -EOPNOTSUPP;
5671                 goto out_err;
5672         }
5673
5674         while (1) {
5675                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5676                                       next_hop, &pinfo);
5677                 if (err == -ENOENT)
5678                         break;
5679                 if (err)
5680                         goto out_err;
5681
5682                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5683                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5684                                        wdev->netdev, dst, next_hop,
5685                                        &pinfo) < 0)
5686                         goto out;
5687
5688                 path_idx++;
5689         }
5690
5691  out:
5692         cb->args[2] = path_idx;
5693         err = skb->len;
5694  out_err:
5695         rtnl_unlock();
5696         return err;
5697 }
5698
5699 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5700 {
5701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5702         int err;
5703         struct net_device *dev = info->user_ptr[1];
5704         struct mpath_info pinfo;
5705         struct sk_buff *msg;
5706         u8 *dst = NULL;
5707         u8 next_hop[ETH_ALEN];
5708
5709         memset(&pinfo, 0, sizeof(pinfo));
5710
5711         if (!info->attrs[NL80211_ATTR_MAC])
5712                 return -EINVAL;
5713
5714         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5715
5716         if (!rdev->ops->get_mpath)
5717                 return -EOPNOTSUPP;
5718
5719         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5720                 return -EOPNOTSUPP;
5721
5722         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5723         if (err)
5724                 return err;
5725
5726         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5727         if (!msg)
5728                 return -ENOMEM;
5729
5730         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5731                                  dev, dst, next_hop, &pinfo) < 0) {
5732                 nlmsg_free(msg);
5733                 return -ENOBUFS;
5734         }
5735
5736         return genlmsg_reply(msg, info);
5737 }
5738
5739 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5740 {
5741         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5742         struct net_device *dev = info->user_ptr[1];
5743         u8 *dst = NULL;
5744         u8 *next_hop = NULL;
5745
5746         if (!info->attrs[NL80211_ATTR_MAC])
5747                 return -EINVAL;
5748
5749         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5750                 return -EINVAL;
5751
5752         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5753         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5754
5755         if (!rdev->ops->change_mpath)
5756                 return -EOPNOTSUPP;
5757
5758         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5759                 return -EOPNOTSUPP;
5760
5761         return rdev_change_mpath(rdev, dev, dst, next_hop);
5762 }
5763
5764 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5765 {
5766         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5767         struct net_device *dev = info->user_ptr[1];
5768         u8 *dst = NULL;
5769         u8 *next_hop = NULL;
5770
5771         if (!info->attrs[NL80211_ATTR_MAC])
5772                 return -EINVAL;
5773
5774         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5775                 return -EINVAL;
5776
5777         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5778         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5779
5780         if (!rdev->ops->add_mpath)
5781                 return -EOPNOTSUPP;
5782
5783         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5784                 return -EOPNOTSUPP;
5785
5786         return rdev_add_mpath(rdev, dev, dst, next_hop);
5787 }
5788
5789 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5790 {
5791         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5792         struct net_device *dev = info->user_ptr[1];
5793         u8 *dst = NULL;
5794
5795         if (info->attrs[NL80211_ATTR_MAC])
5796                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5797
5798         if (!rdev->ops->del_mpath)
5799                 return -EOPNOTSUPP;
5800
5801         return rdev_del_mpath(rdev, dev, dst);
5802 }
5803
5804 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5805 {
5806         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5807         int err;
5808         struct net_device *dev = info->user_ptr[1];
5809         struct mpath_info pinfo;
5810         struct sk_buff *msg;
5811         u8 *dst = NULL;
5812         u8 mpp[ETH_ALEN];
5813
5814         memset(&pinfo, 0, sizeof(pinfo));
5815
5816         if (!info->attrs[NL80211_ATTR_MAC])
5817                 return -EINVAL;
5818
5819         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5820
5821         if (!rdev->ops->get_mpp)
5822                 return -EOPNOTSUPP;
5823
5824         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5825                 return -EOPNOTSUPP;
5826
5827         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5828         if (err)
5829                 return err;
5830
5831         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5832         if (!msg)
5833                 return -ENOMEM;
5834
5835         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5836                                dev, dst, mpp, &pinfo) < 0) {
5837                 nlmsg_free(msg);
5838                 return -ENOBUFS;
5839         }
5840
5841         return genlmsg_reply(msg, info);
5842 }
5843
5844 static int nl80211_dump_mpp(struct sk_buff *skb,
5845                             struct netlink_callback *cb)
5846 {
5847         struct mpath_info pinfo;
5848         struct cfg80211_registered_device *rdev;
5849         struct wireless_dev *wdev;
5850         u8 dst[ETH_ALEN];
5851         u8 mpp[ETH_ALEN];
5852         int path_idx = cb->args[2];
5853         int err;
5854
5855         rtnl_lock();
5856         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5857         if (err)
5858                 goto out_err;
5859
5860         if (!rdev->ops->dump_mpp) {
5861                 err = -EOPNOTSUPP;
5862                 goto out_err;
5863         }
5864
5865         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5866                 err = -EOPNOTSUPP;
5867                 goto out_err;
5868         }
5869
5870         while (1) {
5871                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5872                                     mpp, &pinfo);
5873                 if (err == -ENOENT)
5874                         break;
5875                 if (err)
5876                         goto out_err;
5877
5878                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5879                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5880                                        wdev->netdev, dst, mpp,
5881                                        &pinfo) < 0)
5882                         goto out;
5883
5884                 path_idx++;
5885         }
5886
5887  out:
5888         cb->args[2] = path_idx;
5889         err = skb->len;
5890  out_err:
5891         rtnl_unlock();
5892         return err;
5893 }
5894
5895 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5896 {
5897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5898         struct net_device *dev = info->user_ptr[1];
5899         struct wireless_dev *wdev = dev->ieee80211_ptr;
5900         struct bss_parameters params;
5901         int err;
5902
5903         memset(&params, 0, sizeof(params));
5904         /* default to not changing parameters */
5905         params.use_cts_prot = -1;
5906         params.use_short_preamble = -1;
5907         params.use_short_slot_time = -1;
5908         params.ap_isolate = -1;
5909         params.ht_opmode = -1;
5910         params.p2p_ctwindow = -1;
5911         params.p2p_opp_ps = -1;
5912
5913         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5914                 params.use_cts_prot =
5915                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5916         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5917                 params.use_short_preamble =
5918                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5919         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5920                 params.use_short_slot_time =
5921                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5922         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5923                 params.basic_rates =
5924                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5925                 params.basic_rates_len =
5926                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5927         }
5928         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5929                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5930         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5931                 params.ht_opmode =
5932                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5933
5934         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5935                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5936                         return -EINVAL;
5937                 params.p2p_ctwindow =
5938                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5939                 if (params.p2p_ctwindow < 0)
5940                         return -EINVAL;
5941                 if (params.p2p_ctwindow != 0 &&
5942                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5943                         return -EINVAL;
5944         }
5945
5946         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5947                 u8 tmp;
5948
5949                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5950                         return -EINVAL;
5951                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5952                 if (tmp > 1)
5953                         return -EINVAL;
5954                 params.p2p_opp_ps = tmp;
5955                 if (params.p2p_opp_ps &&
5956                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5957                         return -EINVAL;
5958         }
5959
5960         if (!rdev->ops->change_bss)
5961                 return -EOPNOTSUPP;
5962
5963         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5964             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5965                 return -EOPNOTSUPP;
5966
5967         wdev_lock(wdev);
5968         err = rdev_change_bss(rdev, dev, &params);
5969         wdev_unlock(wdev);
5970
5971         return err;
5972 }
5973
5974 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5975 {
5976         char *data = NULL;
5977         bool is_indoor;
5978         enum nl80211_user_reg_hint_type user_reg_hint_type;
5979         u32 owner_nlportid;
5980
5981         /*
5982          * You should only get this when cfg80211 hasn't yet initialized
5983          * completely when built-in to the kernel right between the time
5984          * window between nl80211_init() and regulatory_init(), if that is
5985          * even possible.
5986          */
5987         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5988                 return -EINPROGRESS;
5989
5990         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5991                 user_reg_hint_type =
5992                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5993         else
5994                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5995
5996         switch (user_reg_hint_type) {
5997         case NL80211_USER_REG_HINT_USER:
5998         case NL80211_USER_REG_HINT_CELL_BASE:
5999                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6000                         return -EINVAL;
6001
6002                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6003                 return regulatory_hint_user(data, user_reg_hint_type);
6004         case NL80211_USER_REG_HINT_INDOOR:
6005                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6006                         owner_nlportid = info->snd_portid;
6007                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6008                 } else {
6009                         owner_nlportid = 0;
6010                         is_indoor = true;
6011                 }
6012
6013                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6014         default:
6015                 return -EINVAL;
6016         }
6017 }
6018
6019 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6020 {
6021         return reg_reload_regdb();
6022 }
6023
6024 static int nl80211_get_mesh_config(struct sk_buff *skb,
6025                                    struct genl_info *info)
6026 {
6027         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6028         struct net_device *dev = info->user_ptr[1];
6029         struct wireless_dev *wdev = dev->ieee80211_ptr;
6030         struct mesh_config cur_params;
6031         int err = 0;
6032         void *hdr;
6033         struct nlattr *pinfoattr;
6034         struct sk_buff *msg;
6035
6036         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6037                 return -EOPNOTSUPP;
6038
6039         if (!rdev->ops->get_mesh_config)
6040                 return -EOPNOTSUPP;
6041
6042         wdev_lock(wdev);
6043         /* If not connected, get default parameters */
6044         if (!wdev->mesh_id_len)
6045                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6046         else
6047                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6048         wdev_unlock(wdev);
6049
6050         if (err)
6051                 return err;
6052
6053         /* Draw up a netlink message to send back */
6054         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6055         if (!msg)
6056                 return -ENOMEM;
6057         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6058                              NL80211_CMD_GET_MESH_CONFIG);
6059         if (!hdr)
6060                 goto out;
6061         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6062         if (!pinfoattr)
6063                 goto nla_put_failure;
6064         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6065             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6066                         cur_params.dot11MeshRetryTimeout) ||
6067             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6068                         cur_params.dot11MeshConfirmTimeout) ||
6069             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6070                         cur_params.dot11MeshHoldingTimeout) ||
6071             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6072                         cur_params.dot11MeshMaxPeerLinks) ||
6073             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6074                        cur_params.dot11MeshMaxRetries) ||
6075             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6076                        cur_params.dot11MeshTTL) ||
6077             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6078                        cur_params.element_ttl) ||
6079             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6080                        cur_params.auto_open_plinks) ||
6081             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6082                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6083             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6084                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6085             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6086                         cur_params.path_refresh_time) ||
6087             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6088                         cur_params.min_discovery_timeout) ||
6089             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6090                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6091             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6092                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6093             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6094                         cur_params.dot11MeshHWMPperrMinInterval) ||
6095             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6096                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6097             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6098                        cur_params.dot11MeshHWMPRootMode) ||
6099             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6100                         cur_params.dot11MeshHWMPRannInterval) ||
6101             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6102                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6103             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6104                        cur_params.dot11MeshForwarding) ||
6105             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6106                         cur_params.rssi_threshold) ||
6107             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6108                         cur_params.ht_opmode) ||
6109             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6110                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6111             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6112                         cur_params.dot11MeshHWMProotInterval) ||
6113             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6114                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6115             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6116                         cur_params.power_mode) ||
6117             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6118                         cur_params.dot11MeshAwakeWindowDuration) ||
6119             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6120                         cur_params.plink_timeout))
6121                 goto nla_put_failure;
6122         nla_nest_end(msg, pinfoattr);
6123         genlmsg_end(msg, hdr);
6124         return genlmsg_reply(msg, info);
6125
6126  nla_put_failure:
6127  out:
6128         nlmsg_free(msg);
6129         return -ENOBUFS;
6130 }
6131
6132 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6133         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
6134         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
6135         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
6136         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
6137         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
6138         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
6139         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
6140         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
6141         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
6142         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6143         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6144         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
6145         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6146         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
6147         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
6148         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
6149         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
6150         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
6151         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
6152         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
6153         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
6154         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6155         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6156         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
6157         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
6158         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
6159         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6160         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6161 };
6162
6163 static const struct nla_policy
6164         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6165         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6166         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6167         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6168         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6169         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6170         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6171         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
6172                                     .len = IEEE80211_MAX_DATA_LEN },
6173         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6174 };
6175
6176 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
6177 {
6178         u8 val = nla_get_u8(nla);
6179         if (val < min || val > max)
6180                 return -EINVAL;
6181         *out = val;
6182         return 0;
6183 }
6184
6185 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
6186 {
6187         u8 val = nla_get_u8(nla);
6188         if (val < min || val > max)
6189                 return -EINVAL;
6190         *out = val;
6191         return 0;
6192 }
6193
6194 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
6195 {
6196         u16 val = nla_get_u16(nla);
6197         if (val < min || val > max)
6198                 return -EINVAL;
6199         *out = val;
6200         return 0;
6201 }
6202
6203 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
6204 {
6205         u32 val = nla_get_u32(nla);
6206         if (val < min || val > max)
6207                 return -EINVAL;
6208         *out = val;
6209         return 0;
6210 }
6211
6212 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
6213 {
6214         s32 val = nla_get_s32(nla);
6215         if (val < min || val > max)
6216                 return -EINVAL;
6217         *out = val;
6218         return 0;
6219 }
6220
6221 static int nl80211_check_power_mode(const struct nlattr *nla,
6222                                     enum nl80211_mesh_power_mode min,
6223                                     enum nl80211_mesh_power_mode max,
6224                                     enum nl80211_mesh_power_mode *out)
6225 {
6226         u32 val = nla_get_u32(nla);
6227         if (val < min || val > max)
6228                 return -EINVAL;
6229         *out = val;
6230         return 0;
6231 }
6232
6233 static int nl80211_parse_mesh_config(struct genl_info *info,
6234                                      struct mesh_config *cfg,
6235                                      u32 *mask_out)
6236 {
6237         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6238         u32 mask = 0;
6239         u16 ht_opmode;
6240
6241 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
6242 do {                                                                        \
6243         if (tb[attr]) {                                                     \
6244                 if (fn(tb[attr], min, max, &cfg->param))                    \
6245                         return -EINVAL;                                     \
6246                 mask |= (1 << (attr - 1));                                  \
6247         }                                                                   \
6248 } while (0)
6249
6250         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6251                 return -EINVAL;
6252         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6253                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6254                              nl80211_meshconf_params_policy, info->extack))
6255                 return -EINVAL;
6256
6257         /* This makes sure that there aren't more than 32 mesh config
6258          * parameters (otherwise our bitfield scheme would not work.) */
6259         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6260
6261         /* Fill in the params struct */
6262         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
6263                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
6264                                   nl80211_check_u16);
6265         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
6266                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6267                                   nl80211_check_u16);
6268         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
6269                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
6270                                   nl80211_check_u16);
6271         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
6272                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
6273                                   nl80211_check_u16);
6274         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
6275                                   mask, NL80211_MESHCONF_MAX_RETRIES,
6276                                   nl80211_check_u8);
6277         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
6278                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
6279         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
6280                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
6281                                   nl80211_check_u8);
6282         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
6283                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6284                                   nl80211_check_bool);
6285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6286                                   1, 255, mask,
6287                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6288                                   nl80211_check_u32);
6289         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
6290                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6291                                   nl80211_check_u8);
6292         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
6293                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
6294                                   nl80211_check_u32);
6295         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
6296                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6297                                   nl80211_check_u16);
6298         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6299                                   1, 65535, mask,
6300                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6301                                   nl80211_check_u32);
6302         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
6303                                   1, 65535, mask,
6304                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6305                                   nl80211_check_u16);
6306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6307                                   1, 65535, mask,
6308                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6309                                   nl80211_check_u16);
6310         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6311                                   dot11MeshHWMPnetDiameterTraversalTime,
6312                                   1, 65535, mask,
6313                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6314                                   nl80211_check_u16);
6315         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6316                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6317                                   nl80211_check_u8);
6318         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6319                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6320                                   nl80211_check_u16);
6321         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6322                                   dot11MeshGateAnnouncementProtocol, 0, 1,
6323                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6324                                   nl80211_check_bool);
6325         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6326                                   mask, NL80211_MESHCONF_FORWARDING,
6327                                   nl80211_check_bool);
6328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6329                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6330                                   nl80211_check_s32);
6331         /*
6332          * Check HT operation mode based on
6333          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6334          */
6335         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6336                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6337
6338                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6339                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6340                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6341                         return -EINVAL;
6342
6343                 /* NON_HT_STA bit is reserved, but some programs set it */
6344                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6345
6346                 cfg->ht_opmode = ht_opmode;
6347                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6348         }
6349         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6350                                   1, 65535, mask,
6351                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6352                                   nl80211_check_u32);
6353         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6354                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6355                                   nl80211_check_u16);
6356         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6357                                   dot11MeshHWMPconfirmationInterval,
6358                                   1, 65535, mask,
6359                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6360                                   nl80211_check_u16);
6361         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6362                                   NL80211_MESH_POWER_ACTIVE,
6363                                   NL80211_MESH_POWER_MAX,
6364                                   mask, NL80211_MESHCONF_POWER_MODE,
6365                                   nl80211_check_power_mode);
6366         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6367                                   0, 65535, mask,
6368                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6369         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6370                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6371                                   nl80211_check_u32);
6372         if (mask_out)
6373                 *mask_out = mask;
6374
6375         return 0;
6376
6377 #undef FILL_IN_MESH_PARAM_IF_SET
6378 }
6379
6380 static int nl80211_parse_mesh_setup(struct genl_info *info,
6381                                      struct mesh_setup *setup)
6382 {
6383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6384         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6385
6386         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6387                 return -EINVAL;
6388         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6389                              info->attrs[NL80211_ATTR_MESH_SETUP],
6390                              nl80211_mesh_setup_params_policy, info->extack))
6391                 return -EINVAL;
6392
6393         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6394                 setup->sync_method =
6395                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6396                  IEEE80211_SYNC_METHOD_VENDOR :
6397                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6398
6399         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6400                 setup->path_sel_proto =
6401                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6402                  IEEE80211_PATH_PROTOCOL_VENDOR :
6403                  IEEE80211_PATH_PROTOCOL_HWMP;
6404
6405         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6406                 setup->path_metric =
6407                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6408                  IEEE80211_PATH_METRIC_VENDOR :
6409                  IEEE80211_PATH_METRIC_AIRTIME;
6410
6411         if (tb[NL80211_MESH_SETUP_IE]) {
6412                 struct nlattr *ieattr =
6413                         tb[NL80211_MESH_SETUP_IE];
6414                 if (!is_valid_ie_attr(ieattr))
6415                         return -EINVAL;
6416                 setup->ie = nla_data(ieattr);
6417                 setup->ie_len = nla_len(ieattr);
6418         }
6419         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6420             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6421                 return -EINVAL;
6422         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6423         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6424         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6425         if (setup->is_secure)
6426                 setup->user_mpm = true;
6427
6428         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6429                 if (!setup->user_mpm)
6430                         return -EINVAL;
6431                 setup->auth_id =
6432                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6433         }
6434
6435         return 0;
6436 }
6437
6438 static int nl80211_update_mesh_config(struct sk_buff *skb,
6439                                       struct genl_info *info)
6440 {
6441         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6442         struct net_device *dev = info->user_ptr[1];
6443         struct wireless_dev *wdev = dev->ieee80211_ptr;
6444         struct mesh_config cfg;
6445         u32 mask;
6446         int err;
6447
6448         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6449                 return -EOPNOTSUPP;
6450
6451         if (!rdev->ops->update_mesh_config)
6452                 return -EOPNOTSUPP;
6453
6454         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6455         if (err)
6456                 return err;
6457
6458         wdev_lock(wdev);
6459         if (!wdev->mesh_id_len)
6460                 err = -ENOLINK;
6461
6462         if (!err)
6463                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6464
6465         wdev_unlock(wdev);
6466
6467         return err;
6468 }
6469
6470 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6471                               struct sk_buff *msg)
6472 {
6473         struct nlattr *nl_reg_rules;
6474         unsigned int i;
6475
6476         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6477             (regdom->dfs_region &&
6478              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6479                 goto nla_put_failure;
6480
6481         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6482         if (!nl_reg_rules)
6483                 goto nla_put_failure;
6484
6485         for (i = 0; i < regdom->n_reg_rules; i++) {
6486                 struct nlattr *nl_reg_rule;
6487                 const struct ieee80211_reg_rule *reg_rule;
6488                 const struct ieee80211_freq_range *freq_range;
6489                 const struct ieee80211_power_rule *power_rule;
6490                 unsigned int max_bandwidth_khz;
6491
6492                 reg_rule = &regdom->reg_rules[i];
6493                 freq_range = &reg_rule->freq_range;
6494                 power_rule = &reg_rule->power_rule;
6495
6496                 nl_reg_rule = nla_nest_start(msg, i);
6497                 if (!nl_reg_rule)
6498                         goto nla_put_failure;
6499
6500                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6501                 if (!max_bandwidth_khz)
6502                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6503                                                                   reg_rule);
6504
6505                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6506                                 reg_rule->flags) ||
6507                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6508                                 freq_range->start_freq_khz) ||
6509                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6510                                 freq_range->end_freq_khz) ||
6511                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6512                                 max_bandwidth_khz) ||
6513                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6514                                 power_rule->max_antenna_gain) ||
6515                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6516                                 power_rule->max_eirp) ||
6517                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6518                                 reg_rule->dfs_cac_ms))
6519                         goto nla_put_failure;
6520
6521                 nla_nest_end(msg, nl_reg_rule);
6522         }
6523
6524         nla_nest_end(msg, nl_reg_rules);
6525         return 0;
6526
6527 nla_put_failure:
6528         return -EMSGSIZE;
6529 }
6530
6531 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6532 {
6533         const struct ieee80211_regdomain *regdom = NULL;
6534         struct cfg80211_registered_device *rdev;
6535         struct wiphy *wiphy = NULL;
6536         struct sk_buff *msg;
6537         void *hdr;
6538
6539         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6540         if (!msg)
6541                 return -ENOBUFS;
6542
6543         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6544                              NL80211_CMD_GET_REG);
6545         if (!hdr)
6546                 goto put_failure;
6547
6548         if (info->attrs[NL80211_ATTR_WIPHY]) {
6549                 bool self_managed;
6550
6551                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6552                 if (IS_ERR(rdev)) {
6553                         nlmsg_free(msg);
6554                         return PTR_ERR(rdev);
6555                 }
6556
6557                 wiphy = &rdev->wiphy;
6558                 self_managed = wiphy->regulatory_flags &
6559                                REGULATORY_WIPHY_SELF_MANAGED;
6560                 regdom = get_wiphy_regdom(wiphy);
6561
6562                 /* a self-managed-reg device must have a private regdom */
6563                 if (WARN_ON(!regdom && self_managed)) {
6564                         nlmsg_free(msg);
6565                         return -EINVAL;
6566                 }
6567
6568                 if (regdom &&
6569                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6570                         goto nla_put_failure;
6571         }
6572
6573         if (!wiphy && reg_last_request_cell_base() &&
6574             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6575                         NL80211_USER_REG_HINT_CELL_BASE))
6576                 goto nla_put_failure;
6577
6578         rcu_read_lock();
6579
6580         if (!regdom)
6581                 regdom = rcu_dereference(cfg80211_regdomain);
6582
6583         if (nl80211_put_regdom(regdom, msg))
6584                 goto nla_put_failure_rcu;
6585
6586         rcu_read_unlock();
6587
6588         genlmsg_end(msg, hdr);
6589         return genlmsg_reply(msg, info);
6590
6591 nla_put_failure_rcu:
6592         rcu_read_unlock();
6593 nla_put_failure:
6594 put_failure:
6595         nlmsg_free(msg);
6596         return -EMSGSIZE;
6597 }
6598
6599 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6600                                u32 seq, int flags, struct wiphy *wiphy,
6601                                const struct ieee80211_regdomain *regdom)
6602 {
6603         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6604                                    NL80211_CMD_GET_REG);
6605
6606         if (!hdr)
6607                 return -1;
6608
6609         genl_dump_check_consistent(cb, hdr);
6610
6611         if (nl80211_put_regdom(regdom, msg))
6612                 goto nla_put_failure;
6613
6614         if (!wiphy && reg_last_request_cell_base() &&
6615             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6616                         NL80211_USER_REG_HINT_CELL_BASE))
6617                 goto nla_put_failure;
6618
6619         if (wiphy &&
6620             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6621                 goto nla_put_failure;
6622
6623         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6624             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6625                 goto nla_put_failure;
6626
6627         genlmsg_end(msg, hdr);
6628         return 0;
6629
6630 nla_put_failure:
6631         genlmsg_cancel(msg, hdr);
6632         return -EMSGSIZE;
6633 }
6634
6635 static int nl80211_get_reg_dump(struct sk_buff *skb,
6636                                 struct netlink_callback *cb)
6637 {
6638         const struct ieee80211_regdomain *regdom = NULL;
6639         struct cfg80211_registered_device *rdev;
6640         int err, reg_idx, start = cb->args[2];
6641
6642         rtnl_lock();
6643
6644         if (cfg80211_regdomain && start == 0) {
6645                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6646                                           NLM_F_MULTI, NULL,
6647                                           rtnl_dereference(cfg80211_regdomain));
6648                 if (err < 0)
6649                         goto out_err;
6650         }
6651
6652         /* the global regdom is idx 0 */
6653         reg_idx = 1;
6654         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6655                 regdom = get_wiphy_regdom(&rdev->wiphy);
6656                 if (!regdom)
6657                         continue;
6658
6659                 if (++reg_idx <= start)
6660                         continue;
6661
6662                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6663                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6664                 if (err < 0) {
6665                         reg_idx--;
6666                         break;
6667                 }
6668         }
6669
6670         cb->args[2] = reg_idx;
6671         err = skb->len;
6672 out_err:
6673         rtnl_unlock();
6674         return err;
6675 }
6676
6677 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6678 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6679         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6680         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6681         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6682         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6683         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6684         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6685         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6686 };
6687
6688 static int parse_reg_rule(struct nlattr *tb[],
6689         struct ieee80211_reg_rule *reg_rule)
6690 {
6691         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6692         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6693
6694         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6695                 return -EINVAL;
6696         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6697                 return -EINVAL;
6698         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6699                 return -EINVAL;
6700         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6701                 return -EINVAL;
6702         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6703                 return -EINVAL;
6704
6705         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6706
6707         freq_range->start_freq_khz =
6708                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6709         freq_range->end_freq_khz =
6710                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6711         freq_range->max_bandwidth_khz =
6712                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6713
6714         power_rule->max_eirp =
6715                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6716
6717         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6718                 power_rule->max_antenna_gain =
6719                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6720
6721         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6722                 reg_rule->dfs_cac_ms =
6723                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6724
6725         return 0;
6726 }
6727
6728 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6729 {
6730         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6731         struct nlattr *nl_reg_rule;
6732         char *alpha2;
6733         int rem_reg_rules, r;
6734         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6735         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6736         struct ieee80211_regdomain *rd;
6737
6738         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6739                 return -EINVAL;
6740
6741         if (!info->attrs[NL80211_ATTR_REG_RULES])
6742                 return -EINVAL;
6743
6744         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6745
6746         if (info->attrs[NL80211_ATTR_DFS_REGION])
6747                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6748
6749         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6750                             rem_reg_rules) {
6751                 num_rules++;
6752                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6753                         return -EINVAL;
6754         }
6755
6756         if (!reg_is_valid_request(alpha2))
6757                 return -EINVAL;
6758
6759         size_of_regd = sizeof(struct ieee80211_regdomain) +
6760                        num_rules * sizeof(struct ieee80211_reg_rule);
6761
6762         rd = kzalloc(size_of_regd, GFP_KERNEL);
6763         if (!rd)
6764                 return -ENOMEM;
6765
6766         rd->n_reg_rules = num_rules;
6767         rd->alpha2[0] = alpha2[0];
6768         rd->alpha2[1] = alpha2[1];
6769
6770         /*
6771          * Disable DFS master mode if the DFS region was
6772          * not supported or known on this kernel.
6773          */
6774         if (reg_supported_dfs_region(dfs_region))
6775                 rd->dfs_region = dfs_region;
6776
6777         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6778                             rem_reg_rules) {
6779                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6780                                      nl_reg_rule, reg_rule_policy,
6781                                      info->extack);
6782                 if (r)
6783                         goto bad_reg;
6784                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6785                 if (r)
6786                         goto bad_reg;
6787
6788                 rule_idx++;
6789
6790                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6791                         r = -EINVAL;
6792                         goto bad_reg;
6793                 }
6794         }
6795
6796         /* set_regdom takes ownership of rd */
6797         return set_regdom(rd, REGD_SOURCE_CRDA);
6798  bad_reg:
6799         kfree(rd);
6800         return r;
6801 }
6802 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6803
6804 static int validate_scan_freqs(struct nlattr *freqs)
6805 {
6806         struct nlattr *attr1, *attr2;
6807         int n_channels = 0, tmp1, tmp2;
6808
6809         nla_for_each_nested(attr1, freqs, tmp1)
6810                 if (nla_len(attr1) != sizeof(u32))
6811                         return 0;
6812
6813         nla_for_each_nested(attr1, freqs, tmp1) {
6814                 n_channels++;
6815                 /*
6816                  * Some hardware has a limited channel list for
6817                  * scanning, and it is pretty much nonsensical
6818                  * to scan for a channel twice, so disallow that
6819                  * and don't require drivers to check that the
6820                  * channel list they get isn't longer than what
6821                  * they can scan, as long as they can scan all
6822                  * the channels they registered at once.
6823                  */
6824                 nla_for_each_nested(attr2, freqs, tmp2)
6825                         if (attr1 != attr2 &&
6826                             nla_get_u32(attr1) == nla_get_u32(attr2))
6827                                 return 0;
6828         }
6829
6830         return n_channels;
6831 }
6832
6833 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6834 {
6835         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6836 }
6837
6838 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6839                             struct cfg80211_bss_selection *bss_select)
6840 {
6841         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6842         struct nlattr *nest;
6843         int err;
6844         bool found = false;
6845         int i;
6846
6847         /* only process one nested attribute */
6848         nest = nla_data(nla);
6849         if (!nla_ok(nest, nla_len(nest)))
6850                 return -EINVAL;
6851
6852         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6853                                nl80211_bss_select_policy, NULL);
6854         if (err)
6855                 return err;
6856
6857         /* only one attribute may be given */
6858         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6859                 if (attr[i]) {
6860                         if (found)
6861                                 return -EINVAL;
6862                         found = true;
6863                 }
6864         }
6865
6866         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6867
6868         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6869                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6870
6871         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6872                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6873                 bss_select->param.band_pref =
6874                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6875                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6876                         return -EINVAL;
6877         }
6878
6879         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6880                 struct nl80211_bss_select_rssi_adjust *adj_param;
6881
6882                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6883                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6884                 bss_select->param.adjust.band = adj_param->band;
6885                 bss_select->param.adjust.delta = adj_param->delta;
6886                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6887                         return -EINVAL;
6888         }
6889
6890         /* user-space did not provide behaviour attribute */
6891         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6892                 return -EINVAL;
6893
6894         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6895                 return -EINVAL;
6896
6897         return 0;
6898 }
6899
6900 static int nl80211_parse_random_mac(struct nlattr **attrs,
6901                                     u8 *mac_addr, u8 *mac_addr_mask)
6902 {
6903         int i;
6904
6905         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6906                 eth_zero_addr(mac_addr);
6907                 eth_zero_addr(mac_addr_mask);
6908                 mac_addr[0] = 0x2;
6909                 mac_addr_mask[0] = 0x3;
6910
6911                 return 0;
6912         }
6913
6914         /* need both or none */
6915         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6916                 return -EINVAL;
6917
6918         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6919         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6920
6921         /* don't allow or configure an mcast address */
6922         if (!is_multicast_ether_addr(mac_addr_mask) ||
6923             is_multicast_ether_addr(mac_addr))
6924                 return -EINVAL;
6925
6926         /*
6927          * allow users to pass a MAC address that has bits set outside
6928          * of the mask, but don't bother drivers with having to deal
6929          * with such bits
6930          */
6931         for (i = 0; i < ETH_ALEN; i++)
6932                 mac_addr[i] &= mac_addr_mask[i];
6933
6934         return 0;
6935 }
6936
6937 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6938 {
6939         ASSERT_WDEV_LOCK(wdev);
6940
6941         if (!cfg80211_beaconing_iface_active(wdev))
6942                 return true;
6943
6944         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6945                 return true;
6946
6947         return regulatory_pre_cac_allowed(wdev->wiphy);
6948 }
6949
6950 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
6951                                     enum nl80211_ext_feature_index feat)
6952 {
6953         if (!(flags & flag))
6954                 return true;
6955         if (wiphy_ext_feature_isset(wiphy, feat))
6956                 return true;
6957         return false;
6958 }
6959
6960 static int
6961 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6962                          void *request, struct nlattr **attrs,
6963                          bool is_sched_scan)
6964 {
6965         u8 *mac_addr, *mac_addr_mask;
6966         u32 *flags;
6967         enum nl80211_feature_flags randomness_flag;
6968
6969         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6970                 return 0;
6971
6972         if (is_sched_scan) {
6973                 struct cfg80211_sched_scan_request *req = request;
6974
6975                 randomness_flag = wdev ?
6976                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6977                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6978                 flags = &req->flags;
6979                 mac_addr = req->mac_addr;
6980                 mac_addr_mask = req->mac_addr_mask;
6981         } else {
6982                 struct cfg80211_scan_request *req = request;
6983
6984                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6985                 flags = &req->flags;
6986                 mac_addr = req->mac_addr;
6987                 mac_addr_mask = req->mac_addr_mask;
6988         }
6989
6990         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6991
6992         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6993              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6994             !nl80211_check_scan_feat(wiphy, *flags,
6995                                      NL80211_SCAN_FLAG_LOW_SPAN,
6996                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
6997             !nl80211_check_scan_feat(wiphy, *flags,
6998                                      NL80211_SCAN_FLAG_LOW_POWER,
6999                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7000             !nl80211_check_scan_feat(wiphy, *flags,
7001                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7002                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7003             !nl80211_check_scan_feat(wiphy, *flags,
7004                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7005                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7006             !nl80211_check_scan_feat(wiphy, *flags,
7007                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7008                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7009             !nl80211_check_scan_feat(wiphy, *flags,
7010                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7011                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7012             !nl80211_check_scan_feat(wiphy, *flags,
7013                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7014                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7015             !nl80211_check_scan_feat(wiphy, *flags,
7016                                      NL80211_SCAN_FLAG_RANDOM_SN,
7017                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7018             !nl80211_check_scan_feat(wiphy, *flags,
7019                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7020                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7021                 return -EOPNOTSUPP;
7022
7023         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7024                 int err;
7025
7026                 if (!(wiphy->features & randomness_flag) ||
7027                     (wdev && wdev->current_bss))
7028                         return -EOPNOTSUPP;
7029
7030                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7031                 if (err)
7032                         return err;
7033         }
7034
7035         return 0;
7036 }
7037
7038 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7039 {
7040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7041         struct wireless_dev *wdev = info->user_ptr[1];
7042         struct cfg80211_scan_request *request;
7043         struct nlattr *attr;
7044         struct wiphy *wiphy;
7045         int err, tmp, n_ssids = 0, n_channels, i;
7046         size_t ie_len;
7047
7048         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7049                 return -EINVAL;
7050
7051         wiphy = &rdev->wiphy;
7052
7053         if (wdev->iftype == NL80211_IFTYPE_NAN)
7054                 return -EOPNOTSUPP;
7055
7056         if (!rdev->ops->scan)
7057                 return -EOPNOTSUPP;
7058
7059         if (rdev->scan_req || rdev->scan_msg) {
7060                 err = -EBUSY;
7061                 goto unlock;
7062         }
7063
7064         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7065                 n_channels = validate_scan_freqs(
7066                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7067                 if (!n_channels) {
7068                         err = -EINVAL;
7069                         goto unlock;
7070                 }
7071         } else {
7072                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7073         }
7074
7075         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7076                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7077                         n_ssids++;
7078
7079         if (n_ssids > wiphy->max_scan_ssids) {
7080                 err = -EINVAL;
7081                 goto unlock;
7082         }
7083
7084         if (info->attrs[NL80211_ATTR_IE])
7085                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7086         else
7087                 ie_len = 0;
7088
7089         if (ie_len > wiphy->max_scan_ie_len) {
7090                 err = -EINVAL;
7091                 goto unlock;
7092         }
7093
7094         request = kzalloc(sizeof(*request)
7095                         + sizeof(*request->ssids) * n_ssids
7096                         + sizeof(*request->channels) * n_channels
7097                         + ie_len, GFP_KERNEL);
7098         if (!request) {
7099                 err = -ENOMEM;
7100                 goto unlock;
7101         }
7102
7103         if (n_ssids)
7104                 request->ssids = (void *)&request->channels[n_channels];
7105         request->n_ssids = n_ssids;
7106         if (ie_len) {
7107                 if (n_ssids)
7108                         request->ie = (void *)(request->ssids + n_ssids);
7109                 else
7110                         request->ie = (void *)(request->channels + n_channels);
7111         }
7112
7113         i = 0;
7114         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7115                 /* user specified, bail out if channel not found */
7116                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7117                         struct ieee80211_channel *chan;
7118
7119                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7120
7121                         if (!chan) {
7122                                 err = -EINVAL;
7123                                 goto out_free;
7124                         }
7125
7126                         /* ignore disabled channels */
7127                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7128                                 continue;
7129
7130                         request->channels[i] = chan;
7131                         i++;
7132                 }
7133         } else {
7134                 enum nl80211_band band;
7135
7136                 /* all channels */
7137                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7138                         int j;
7139
7140                         if (!wiphy->bands[band])
7141                                 continue;
7142                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7143                                 struct ieee80211_channel *chan;
7144
7145                                 chan = &wiphy->bands[band]->channels[j];
7146
7147                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7148                                         continue;
7149
7150                                 request->channels[i] = chan;
7151                                 i++;
7152                         }
7153                 }
7154         }
7155
7156         if (!i) {
7157                 err = -EINVAL;
7158                 goto out_free;
7159         }
7160
7161         request->n_channels = i;
7162
7163         wdev_lock(wdev);
7164         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7165                 struct ieee80211_channel *chan;
7166
7167                 if (request->n_channels != 1) {
7168                         wdev_unlock(wdev);
7169                         err = -EBUSY;
7170                         goto out_free;
7171                 }
7172
7173                 chan = request->channels[0];
7174                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7175                         wdev_unlock(wdev);
7176                         err = -EBUSY;
7177                         goto out_free;
7178                 }
7179         }
7180         wdev_unlock(wdev);
7181
7182         i = 0;
7183         if (n_ssids) {
7184                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7185                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7186                                 err = -EINVAL;
7187                                 goto out_free;
7188                         }
7189                         request->ssids[i].ssid_len = nla_len(attr);
7190                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7191                         i++;
7192                 }
7193         }
7194
7195         if (info->attrs[NL80211_ATTR_IE]) {
7196                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7197                 memcpy((void *)request->ie,
7198                        nla_data(info->attrs[NL80211_ATTR_IE]),
7199                        request->ie_len);
7200         }
7201
7202         for (i = 0; i < NUM_NL80211_BANDS; i++)
7203                 if (wiphy->bands[i])
7204                         request->rates[i] =
7205                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7206
7207         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7208                 nla_for_each_nested(attr,
7209                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7210                                     tmp) {
7211                         enum nl80211_band band = nla_type(attr);
7212
7213                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7214                                 err = -EINVAL;
7215                                 goto out_free;
7216                         }
7217
7218                         if (!wiphy->bands[band])
7219                                 continue;
7220
7221                         err = ieee80211_get_ratemask(wiphy->bands[band],
7222                                                      nla_data(attr),
7223                                                      nla_len(attr),
7224                                                      &request->rates[band]);
7225                         if (err)
7226                                 goto out_free;
7227                 }
7228         }
7229
7230         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7231                 if (!wiphy_ext_feature_isset(wiphy,
7232                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7233                         err = -EOPNOTSUPP;
7234                         goto out_free;
7235                 }
7236
7237                 request->duration =
7238                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7239                 request->duration_mandatory =
7240                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7241         }
7242
7243         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7244                                        false);
7245         if (err)
7246                 goto out_free;
7247
7248         request->no_cck =
7249                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7250
7251         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7252          * BSSID to scan for. This was problematic because that same attribute
7253          * was already used for another purpose (local random MAC address). The
7254          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7255          * compatibility with older userspace components, also use the
7256          * NL80211_ATTR_MAC value here if it can be determined to be used for
7257          * the specific BSSID use case instead of the random MAC address
7258          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7259          */
7260         if (info->attrs[NL80211_ATTR_BSSID])
7261                 memcpy(request->bssid,
7262                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7263         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7264                  info->attrs[NL80211_ATTR_MAC])
7265                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7266                        ETH_ALEN);
7267         else
7268                 eth_broadcast_addr(request->bssid);
7269
7270         request->wdev = wdev;
7271         request->wiphy = &rdev->wiphy;
7272         request->scan_start = jiffies;
7273
7274         rdev->scan_req = request;
7275         err = rdev_scan(rdev, request);
7276
7277         if (!err) {
7278                 nl80211_send_scan_start(rdev, wdev);
7279                 if (wdev->netdev)
7280                         dev_hold(wdev->netdev);
7281         } else {
7282  out_free:
7283                 rdev->scan_req = NULL;
7284                 kfree(request);
7285         }
7286
7287  unlock:
7288         return err;
7289 }
7290
7291 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7292 {
7293         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7294         struct wireless_dev *wdev = info->user_ptr[1];
7295
7296         if (!rdev->ops->abort_scan)
7297                 return -EOPNOTSUPP;
7298
7299         if (rdev->scan_msg)
7300                 return 0;
7301
7302         if (!rdev->scan_req)
7303                 return -ENOENT;
7304
7305         rdev_abort_scan(rdev, wdev);
7306         return 0;
7307 }
7308
7309 static int
7310 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7311                                struct cfg80211_sched_scan_request *request,
7312                                struct nlattr **attrs)
7313 {
7314         int tmp, err, i = 0;
7315         struct nlattr *attr;
7316
7317         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7318                 u32 interval;
7319
7320                 /*
7321                  * If scan plans are not specified,
7322                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7323                  * case one scan plan will be set with the specified scan
7324                  * interval and infinite number of iterations.
7325                  */
7326                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7327                 if (!interval)
7328                         return -EINVAL;
7329
7330                 request->scan_plans[0].interval =
7331                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7332                 if (!request->scan_plans[0].interval)
7333                         return -EINVAL;
7334
7335                 if (request->scan_plans[0].interval >
7336                     wiphy->max_sched_scan_plan_interval)
7337                         request->scan_plans[0].interval =
7338                                 wiphy->max_sched_scan_plan_interval;
7339
7340                 return 0;
7341         }
7342
7343         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7344                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7345
7346                 if (WARN_ON(i >= n_plans))
7347                         return -EINVAL;
7348
7349                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7350                                        attr, nl80211_plan_policy, NULL);
7351                 if (err)
7352                         return err;
7353
7354                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7355                         return -EINVAL;
7356
7357                 request->scan_plans[i].interval =
7358                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7359                 if (!request->scan_plans[i].interval ||
7360                     request->scan_plans[i].interval >
7361                     wiphy->max_sched_scan_plan_interval)
7362                         return -EINVAL;
7363
7364                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7365                         request->scan_plans[i].iterations =
7366                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7367                         if (!request->scan_plans[i].iterations ||
7368                             (request->scan_plans[i].iterations >
7369                              wiphy->max_sched_scan_plan_iterations))
7370                                 return -EINVAL;
7371                 } else if (i < n_plans - 1) {
7372                         /*
7373                          * All scan plans but the last one must specify
7374                          * a finite number of iterations
7375                          */
7376                         return -EINVAL;
7377                 }
7378
7379                 i++;
7380         }
7381
7382         /*
7383          * The last scan plan must not specify the number of
7384          * iterations, it is supposed to run infinitely
7385          */
7386         if (request->scan_plans[n_plans - 1].iterations)
7387                 return  -EINVAL;
7388
7389         return 0;
7390 }
7391
7392 static struct cfg80211_sched_scan_request *
7393 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7394                          struct nlattr **attrs, int max_match_sets)
7395 {
7396         struct cfg80211_sched_scan_request *request;
7397         struct nlattr *attr;
7398         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7399         enum nl80211_band band;
7400         size_t ie_len;
7401         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7402         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7403
7404         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7405                 return ERR_PTR(-EINVAL);
7406
7407         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7408                 n_channels = validate_scan_freqs(
7409                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7410                 if (!n_channels)
7411                         return ERR_PTR(-EINVAL);
7412         } else {
7413                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7414         }
7415
7416         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7417                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7418                                     tmp)
7419                         n_ssids++;
7420
7421         if (n_ssids > wiphy->max_sched_scan_ssids)
7422                 return ERR_PTR(-EINVAL);
7423
7424         /*
7425          * First, count the number of 'real' matchsets. Due to an issue with
7426          * the old implementation, matchsets containing only the RSSI attribute
7427          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7428          * RSSI for all matchsets, rather than their own matchset for reporting
7429          * all APs with a strong RSSI. This is needed to be compatible with
7430          * older userspace that treated a matchset with only the RSSI as the
7431          * global RSSI for all other matchsets - if there are other matchsets.
7432          */
7433         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7434                 nla_for_each_nested(attr,
7435                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7436                                     tmp) {
7437                         struct nlattr *rssi;
7438
7439                         err = nla_parse_nested(tb,
7440                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7441                                                attr, nl80211_match_policy,
7442                                                NULL);
7443                         if (err)
7444                                 return ERR_PTR(err);
7445
7446                         /* SSID and BSSID are mutually exclusive */
7447                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7448                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7449                                 return ERR_PTR(-EINVAL);
7450
7451                         /* add other standalone attributes here */
7452                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7453                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7454                                 n_match_sets++;
7455                                 continue;
7456                         }
7457                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7458                         if (rssi)
7459                                 default_match_rssi = nla_get_s32(rssi);
7460                 }
7461         }
7462
7463         /* However, if there's no other matchset, add the RSSI one */
7464         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7465                 n_match_sets = 1;
7466
7467         if (n_match_sets > max_match_sets)
7468                 return ERR_PTR(-EINVAL);
7469
7470         if (attrs[NL80211_ATTR_IE])
7471                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7472         else
7473                 ie_len = 0;
7474
7475         if (ie_len > wiphy->max_sched_scan_ie_len)
7476                 return ERR_PTR(-EINVAL);
7477
7478         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7479                 /*
7480                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7481                  * each scan plan already specifies its own interval
7482                  */
7483                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7484                         return ERR_PTR(-EINVAL);
7485
7486                 nla_for_each_nested(attr,
7487                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7488                         n_plans++;
7489         } else {
7490                 /*
7491                  * The scan interval attribute is kept for backward
7492                  * compatibility. If no scan plans are specified and sched scan
7493                  * interval is specified, one scan plan will be set with this
7494                  * scan interval and infinite number of iterations.
7495                  */
7496                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7497                         return ERR_PTR(-EINVAL);
7498
7499                 n_plans = 1;
7500         }
7501
7502         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7503                 return ERR_PTR(-EINVAL);
7504
7505         if (!wiphy_ext_feature_isset(
7506                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7507             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7508              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7509                 return ERR_PTR(-EINVAL);
7510
7511         request = kzalloc(sizeof(*request)
7512                         + sizeof(*request->ssids) * n_ssids
7513                         + sizeof(*request->match_sets) * n_match_sets
7514                         + sizeof(*request->scan_plans) * n_plans
7515                         + sizeof(*request->channels) * n_channels
7516                         + ie_len, GFP_KERNEL);
7517         if (!request)
7518                 return ERR_PTR(-ENOMEM);
7519
7520         if (n_ssids)
7521                 request->ssids = (void *)&request->channels[n_channels];
7522         request->n_ssids = n_ssids;
7523         if (ie_len) {
7524                 if (n_ssids)
7525                         request->ie = (void *)(request->ssids + n_ssids);
7526                 else
7527                         request->ie = (void *)(request->channels + n_channels);
7528         }
7529
7530         if (n_match_sets) {
7531                 if (request->ie)
7532                         request->match_sets = (void *)(request->ie + ie_len);
7533                 else if (n_ssids)
7534                         request->match_sets =
7535                                 (void *)(request->ssids + n_ssids);
7536                 else
7537                         request->match_sets =
7538                                 (void *)(request->channels + n_channels);
7539         }
7540         request->n_match_sets = n_match_sets;
7541
7542         if (n_match_sets)
7543                 request->scan_plans = (void *)(request->match_sets +
7544                                                n_match_sets);
7545         else if (request->ie)
7546                 request->scan_plans = (void *)(request->ie + ie_len);
7547         else if (n_ssids)
7548                 request->scan_plans = (void *)(request->ssids + n_ssids);
7549         else
7550                 request->scan_plans = (void *)(request->channels + n_channels);
7551
7552         request->n_scan_plans = n_plans;
7553
7554         i = 0;
7555         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7556                 /* user specified, bail out if channel not found */
7557                 nla_for_each_nested(attr,
7558                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7559                                     tmp) {
7560                         struct ieee80211_channel *chan;
7561
7562                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7563
7564                         if (!chan) {
7565                                 err = -EINVAL;
7566                                 goto out_free;
7567                         }
7568
7569                         /* ignore disabled channels */
7570                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7571                                 continue;
7572
7573                         request->channels[i] = chan;
7574                         i++;
7575                 }
7576         } else {
7577                 /* all channels */
7578                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7579                         int j;
7580
7581                         if (!wiphy->bands[band])
7582                                 continue;
7583                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7584                                 struct ieee80211_channel *chan;
7585
7586                                 chan = &wiphy->bands[band]->channels[j];
7587
7588                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7589                                         continue;
7590
7591                                 request->channels[i] = chan;
7592                                 i++;
7593                         }
7594                 }
7595         }
7596
7597         if (!i) {
7598                 err = -EINVAL;
7599                 goto out_free;
7600         }
7601
7602         request->n_channels = i;
7603
7604         i = 0;
7605         if (n_ssids) {
7606                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7607                                     tmp) {
7608                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7609                                 err = -EINVAL;
7610                                 goto out_free;
7611                         }
7612                         request->ssids[i].ssid_len = nla_len(attr);
7613                         memcpy(request->ssids[i].ssid, nla_data(attr),
7614                                nla_len(attr));
7615                         i++;
7616                 }
7617         }
7618
7619         i = 0;
7620         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7621                 nla_for_each_nested(attr,
7622                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7623                                     tmp) {
7624                         struct nlattr *ssid, *bssid, *rssi;
7625
7626                         err = nla_parse_nested(tb,
7627                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7628                                                attr, nl80211_match_policy,
7629                                                NULL);
7630                         if (err)
7631                                 goto out_free;
7632                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7633                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7634                         if (ssid || bssid) {
7635                                 if (WARN_ON(i >= n_match_sets)) {
7636                                         /* this indicates a programming error,
7637                                          * the loop above should have verified
7638                                          * things properly
7639                                          */
7640                                         err = -EINVAL;
7641                                         goto out_free;
7642                                 }
7643
7644                                 if (ssid) {
7645                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7646                                                 err = -EINVAL;
7647                                                 goto out_free;
7648                                         }
7649                                         memcpy(request->match_sets[i].ssid.ssid,
7650                                                nla_data(ssid), nla_len(ssid));
7651                                         request->match_sets[i].ssid.ssid_len =
7652                                                 nla_len(ssid);
7653                                 }
7654                                 if (bssid) {
7655                                         if (nla_len(bssid) != ETH_ALEN) {
7656                                                 err = -EINVAL;
7657                                                 goto out_free;
7658                                         }
7659                                         memcpy(request->match_sets[i].bssid,
7660                                                nla_data(bssid), ETH_ALEN);
7661                                 }
7662
7663                                 /* special attribute - old implementation w/a */
7664                                 request->match_sets[i].rssi_thold =
7665                                         default_match_rssi;
7666                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7667                                 if (rssi)
7668                                         request->match_sets[i].rssi_thold =
7669                                                 nla_get_s32(rssi);
7670                         }
7671                         i++;
7672                 }
7673
7674                 /* there was no other matchset, so the RSSI one is alone */
7675                 if (i == 0 && n_match_sets)
7676                         request->match_sets[0].rssi_thold = default_match_rssi;
7677
7678                 request->min_rssi_thold = INT_MAX;
7679                 for (i = 0; i < n_match_sets; i++)
7680                         request->min_rssi_thold =
7681                                 min(request->match_sets[i].rssi_thold,
7682                                     request->min_rssi_thold);
7683         } else {
7684                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7685         }
7686
7687         if (ie_len) {
7688                 request->ie_len = ie_len;
7689                 memcpy((void *)request->ie,
7690                        nla_data(attrs[NL80211_ATTR_IE]),
7691                        request->ie_len);
7692         }
7693
7694         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7695         if (err)
7696                 goto out_free;
7697
7698         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7699                 request->delay =
7700                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7701
7702         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7703                 request->relative_rssi = nla_get_s8(
7704                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7705                 request->relative_rssi_set = true;
7706         }
7707
7708         if (request->relative_rssi_set &&
7709             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7710                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7711
7712                 rssi_adjust = nla_data(
7713                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7714                 request->rssi_adjust.band = rssi_adjust->band;
7715                 request->rssi_adjust.delta = rssi_adjust->delta;
7716                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7717                         err = -EINVAL;
7718                         goto out_free;
7719                 }
7720         }
7721
7722         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7723         if (err)
7724                 goto out_free;
7725
7726         request->scan_start = jiffies;
7727
7728         return request;
7729
7730 out_free:
7731         kfree(request);
7732         return ERR_PTR(err);
7733 }
7734
7735 static int nl80211_start_sched_scan(struct sk_buff *skb,
7736                                     struct genl_info *info)
7737 {
7738         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7739         struct net_device *dev = info->user_ptr[1];
7740         struct wireless_dev *wdev = dev->ieee80211_ptr;
7741         struct cfg80211_sched_scan_request *sched_scan_req;
7742         bool want_multi;
7743         int err;
7744
7745         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7746                 return -EOPNOTSUPP;
7747
7748         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7749         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7750         if (err)
7751                 return err;
7752
7753         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7754                                                   info->attrs,
7755                                                   rdev->wiphy.max_match_sets);
7756
7757         err = PTR_ERR_OR_ZERO(sched_scan_req);
7758         if (err)
7759                 goto out_err;
7760
7761         /* leave request id zero for legacy request
7762          * or if driver does not support multi-scheduled scan
7763          */
7764         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7765                 while (!sched_scan_req->reqid)
7766                         sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7767         }
7768
7769         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7770         if (err)
7771                 goto out_free;
7772
7773         sched_scan_req->dev = dev;
7774         sched_scan_req->wiphy = &rdev->wiphy;
7775
7776         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7777                 sched_scan_req->owner_nlportid = info->snd_portid;
7778
7779         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7780
7781         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7782         return 0;
7783
7784 out_free:
7785         kfree(sched_scan_req);
7786 out_err:
7787         return err;
7788 }
7789
7790 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7791                                    struct genl_info *info)
7792 {
7793         struct cfg80211_sched_scan_request *req;
7794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7795         u64 cookie;
7796
7797         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7798                 return -EOPNOTSUPP;
7799
7800         if (info->attrs[NL80211_ATTR_COOKIE]) {
7801                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7802                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7803         }
7804
7805         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7806                                      struct cfg80211_sched_scan_request,
7807                                      list);
7808         if (!req || req->reqid ||
7809             (req->owner_nlportid &&
7810              req->owner_nlportid != info->snd_portid))
7811                 return -ENOENT;
7812
7813         return cfg80211_stop_sched_scan_req(rdev, req, false);
7814 }
7815
7816 static int nl80211_start_radar_detection(struct sk_buff *skb,
7817                                          struct genl_info *info)
7818 {
7819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7820         struct net_device *dev = info->user_ptr[1];
7821         struct wireless_dev *wdev = dev->ieee80211_ptr;
7822         struct wiphy *wiphy = wdev->wiphy;
7823         struct cfg80211_chan_def chandef;
7824         enum nl80211_dfs_regions dfs_region;
7825         unsigned int cac_time_ms;
7826         int err;
7827
7828         dfs_region = reg_get_dfs_region(wiphy);
7829         if (dfs_region == NL80211_DFS_UNSET)
7830                 return -EINVAL;
7831
7832         err = nl80211_parse_chandef(rdev, info, &chandef);
7833         if (err)
7834                 return err;
7835
7836         if (netif_carrier_ok(dev))
7837                 return -EBUSY;
7838
7839         if (wdev->cac_started)
7840                 return -EBUSY;
7841
7842         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7843         if (err < 0)
7844                 return err;
7845
7846         if (err == 0)
7847                 return -EINVAL;
7848
7849         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7850                 return -EINVAL;
7851
7852         /* CAC start is offloaded to HW and can't be started manually */
7853         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7854                 return -EOPNOTSUPP;
7855
7856         if (!rdev->ops->start_radar_detection)
7857                 return -EOPNOTSUPP;
7858
7859         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7860         if (WARN_ON(!cac_time_ms))
7861                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7862
7863         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7864         if (!err) {
7865                 wdev->chandef = chandef;
7866                 wdev->cac_started = true;
7867                 wdev->cac_start_time = jiffies;
7868                 wdev->cac_time_ms = cac_time_ms;
7869         }
7870         return err;
7871 }
7872
7873 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7874 {
7875         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7876         struct net_device *dev = info->user_ptr[1];
7877         struct wireless_dev *wdev = dev->ieee80211_ptr;
7878         struct cfg80211_csa_settings params;
7879         /* csa_attrs is defined static to avoid waste of stack size - this
7880          * function is called under RTNL lock, so this should not be a problem.
7881          */
7882         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7883         int err;
7884         bool need_new_beacon = false;
7885         bool need_handle_dfs_flag = true;
7886         int len, i;
7887         u32 cs_count;
7888
7889         if (!rdev->ops->channel_switch ||
7890             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7891                 return -EOPNOTSUPP;
7892
7893         switch (dev->ieee80211_ptr->iftype) {
7894         case NL80211_IFTYPE_AP:
7895         case NL80211_IFTYPE_P2P_GO:
7896                 need_new_beacon = true;
7897                 /* For all modes except AP the handle_dfs flag needs to be
7898                  * supplied to tell the kernel that userspace will handle radar
7899                  * events when they happen. Otherwise a switch to a channel
7900                  * requiring DFS will be rejected.
7901                  */
7902                 need_handle_dfs_flag = false;
7903
7904                 /* useless if AP is not running */
7905                 if (!wdev->beacon_interval)
7906                         return -ENOTCONN;
7907                 break;
7908         case NL80211_IFTYPE_ADHOC:
7909                 if (!wdev->ssid_len)
7910                         return -ENOTCONN;
7911                 break;
7912         case NL80211_IFTYPE_MESH_POINT:
7913                 if (!wdev->mesh_id_len)
7914                         return -ENOTCONN;
7915                 break;
7916         default:
7917                 return -EOPNOTSUPP;
7918         }
7919
7920         memset(&params, 0, sizeof(params));
7921
7922         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7923             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7924                 return -EINVAL;
7925
7926         /* only important for AP, IBSS and mesh create IEs internally */
7927         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7928                 return -EINVAL;
7929
7930         /* Even though the attribute is u32, the specification says
7931          * u8, so let's make sure we don't overflow.
7932          */
7933         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7934         if (cs_count > 255)
7935                 return -EINVAL;
7936
7937         params.count = cs_count;
7938
7939         if (!need_new_beacon)
7940                 goto skip_beacons;
7941
7942         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7943         if (err)
7944                 return err;
7945
7946         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7947                                info->attrs[NL80211_ATTR_CSA_IES],
7948                                nl80211_policy, info->extack);
7949         if (err)
7950                 return err;
7951
7952         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7953         if (err)
7954                 return err;
7955
7956         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7957                 return -EINVAL;
7958
7959         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7960         if (!len || (len % sizeof(u16)))
7961                 return -EINVAL;
7962
7963         params.n_counter_offsets_beacon = len / sizeof(u16);
7964         if (rdev->wiphy.max_num_csa_counters &&
7965             (params.n_counter_offsets_beacon >
7966              rdev->wiphy.max_num_csa_counters))
7967                 return -EINVAL;
7968
7969         params.counter_offsets_beacon =
7970                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7971
7972         /* sanity checks - counters should fit and be the same */
7973         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7974                 u16 offset = params.counter_offsets_beacon[i];
7975
7976                 if (offset >= params.beacon_csa.tail_len)
7977                         return -EINVAL;
7978
7979                 if (params.beacon_csa.tail[offset] != params.count)
7980                         return -EINVAL;
7981         }
7982
7983         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7984                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7985                 if (!len || (len % sizeof(u16)))
7986                         return -EINVAL;
7987
7988                 params.n_counter_offsets_presp = len / sizeof(u16);
7989                 if (rdev->wiphy.max_num_csa_counters &&
7990                     (params.n_counter_offsets_presp >
7991                      rdev->wiphy.max_num_csa_counters))
7992                         return -EINVAL;
7993
7994                 params.counter_offsets_presp =
7995                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7996
7997                 /* sanity checks - counters should fit and be the same */
7998                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7999                         u16 offset = params.counter_offsets_presp[i];
8000
8001                         if (offset >= params.beacon_csa.probe_resp_len)
8002                                 return -EINVAL;
8003
8004                         if (params.beacon_csa.probe_resp[offset] !=
8005                             params.count)
8006                                 return -EINVAL;
8007                 }
8008         }
8009
8010 skip_beacons:
8011         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8012         if (err)
8013                 return err;
8014
8015         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8016                                            wdev->iftype))
8017                 return -EINVAL;
8018
8019         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8020                                             &params.chandef,
8021                                             wdev->iftype);
8022         if (err < 0)
8023                 return err;
8024
8025         if (err > 0) {
8026                 params.radar_required = true;
8027                 if (need_handle_dfs_flag &&
8028                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8029                         return -EINVAL;
8030                 }
8031         }
8032
8033         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8034                 params.block_tx = true;
8035
8036         wdev_lock(wdev);
8037         err = rdev_channel_switch(rdev, dev, &params);
8038         wdev_unlock(wdev);
8039
8040         return err;
8041 }
8042
8043 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8044                             u32 seq, int flags,
8045                             struct cfg80211_registered_device *rdev,
8046                             struct wireless_dev *wdev,
8047                             struct cfg80211_internal_bss *intbss)
8048 {
8049         struct cfg80211_bss *res = &intbss->pub;
8050         const struct cfg80211_bss_ies *ies;
8051         void *hdr;
8052         struct nlattr *bss;
8053
8054         ASSERT_WDEV_LOCK(wdev);
8055
8056         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8057                              NL80211_CMD_NEW_SCAN_RESULTS);
8058         if (!hdr)
8059                 return -1;
8060
8061         genl_dump_check_consistent(cb, hdr);
8062
8063         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8064                 goto nla_put_failure;
8065         if (wdev->netdev &&
8066             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8067                 goto nla_put_failure;
8068         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8069                               NL80211_ATTR_PAD))
8070                 goto nla_put_failure;
8071
8072         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8073         if (!bss)
8074                 goto nla_put_failure;
8075         if ((!is_zero_ether_addr(res->bssid) &&
8076              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8077                 goto nla_put_failure;
8078
8079         rcu_read_lock();
8080         /* indicate whether we have probe response data or not */
8081         if (rcu_access_pointer(res->proberesp_ies) &&
8082             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8083                 goto fail_unlock_rcu;
8084
8085         /* this pointer prefers to be pointed to probe response data
8086          * but is always valid
8087          */
8088         ies = rcu_dereference(res->ies);
8089         if (ies) {
8090                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8091                                       NL80211_BSS_PAD))
8092                         goto fail_unlock_rcu;
8093                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8094                                         ies->len, ies->data))
8095                         goto fail_unlock_rcu;
8096         }
8097
8098         /* and this pointer is always (unless driver didn't know) beacon data */
8099         ies = rcu_dereference(res->beacon_ies);
8100         if (ies && ies->from_beacon) {
8101                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8102                                       NL80211_BSS_PAD))
8103                         goto fail_unlock_rcu;
8104                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8105                                         ies->len, ies->data))
8106                         goto fail_unlock_rcu;
8107         }
8108         rcu_read_unlock();
8109
8110         if (res->beacon_interval &&
8111             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8112                 goto nla_put_failure;
8113         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8114             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8115             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8116             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8117                         jiffies_to_msecs(jiffies - intbss->ts)))
8118                 goto nla_put_failure;
8119
8120         if (intbss->parent_tsf &&
8121             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8122                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8123              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8124                      intbss->parent_bssid)))
8125                 goto nla_put_failure;
8126
8127         if (intbss->ts_boottime &&
8128             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8129                               intbss->ts_boottime, NL80211_BSS_PAD))
8130                 goto nla_put_failure;
8131
8132         if (!nl80211_put_signal(msg, intbss->pub.chains,
8133                                 intbss->pub.chain_signal,
8134                                 NL80211_BSS_CHAIN_SIGNAL))
8135                 goto nla_put_failure;
8136
8137         switch (rdev->wiphy.signal_type) {
8138         case CFG80211_SIGNAL_TYPE_MBM:
8139                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8140                         goto nla_put_failure;
8141                 break;
8142         case CFG80211_SIGNAL_TYPE_UNSPEC:
8143                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8144                         goto nla_put_failure;
8145                 break;
8146         default:
8147                 break;
8148         }
8149
8150         switch (wdev->iftype) {
8151         case NL80211_IFTYPE_P2P_CLIENT:
8152         case NL80211_IFTYPE_STATION:
8153                 if (intbss == wdev->current_bss &&
8154                     nla_put_u32(msg, NL80211_BSS_STATUS,
8155                                 NL80211_BSS_STATUS_ASSOCIATED))
8156                         goto nla_put_failure;
8157                 break;
8158         case NL80211_IFTYPE_ADHOC:
8159                 if (intbss == wdev->current_bss &&
8160                     nla_put_u32(msg, NL80211_BSS_STATUS,
8161                                 NL80211_BSS_STATUS_IBSS_JOINED))
8162                         goto nla_put_failure;
8163                 break;
8164         default:
8165                 break;
8166         }
8167
8168         nla_nest_end(msg, bss);
8169
8170         genlmsg_end(msg, hdr);
8171         return 0;
8172
8173  fail_unlock_rcu:
8174         rcu_read_unlock();
8175  nla_put_failure:
8176         genlmsg_cancel(msg, hdr);
8177         return -EMSGSIZE;
8178 }
8179
8180 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8181 {
8182         struct cfg80211_registered_device *rdev;
8183         struct cfg80211_internal_bss *scan;
8184         struct wireless_dev *wdev;
8185         int start = cb->args[2], idx = 0;
8186         int err;
8187
8188         rtnl_lock();
8189         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8190         if (err) {
8191                 rtnl_unlock();
8192                 return err;
8193         }
8194
8195         wdev_lock(wdev);
8196         spin_lock_bh(&rdev->bss_lock);
8197
8198         /*
8199          * dump_scan will be called multiple times to break up the scan results
8200          * into multiple messages.  It is unlikely that any more bss-es will be
8201          * expired after the first call, so only call only call this on the
8202          * first dump_scan invocation.
8203          */
8204         if (start == 0)
8205                 cfg80211_bss_expire(rdev);
8206
8207         cb->seq = rdev->bss_generation;
8208
8209         list_for_each_entry(scan, &rdev->bss_list, list) {
8210                 if (++idx <= start)
8211                         continue;
8212                 if (nl80211_send_bss(skb, cb,
8213                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8214                                 rdev, wdev, scan) < 0) {
8215                         idx--;
8216                         break;
8217                 }
8218         }
8219
8220         spin_unlock_bh(&rdev->bss_lock);
8221         wdev_unlock(wdev);
8222
8223         cb->args[2] = idx;
8224         rtnl_unlock();
8225
8226         return skb->len;
8227 }
8228
8229 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8230                                int flags, struct net_device *dev,
8231                                bool allow_radio_stats,
8232                                struct survey_info *survey)
8233 {
8234         void *hdr;
8235         struct nlattr *infoattr;
8236
8237         /* skip radio stats if userspace didn't request them */
8238         if (!survey->channel && !allow_radio_stats)
8239                 return 0;
8240
8241         hdr = nl80211hdr_put(msg, portid, seq, flags,
8242                              NL80211_CMD_NEW_SURVEY_RESULTS);
8243         if (!hdr)
8244                 return -ENOMEM;
8245
8246         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8247                 goto nla_put_failure;
8248
8249         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8250         if (!infoattr)
8251                 goto nla_put_failure;
8252
8253         if (survey->channel &&
8254             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8255                         survey->channel->center_freq))
8256                 goto nla_put_failure;
8257
8258         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8259             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8260                 goto nla_put_failure;
8261         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8262             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8263                 goto nla_put_failure;
8264         if ((survey->filled & SURVEY_INFO_TIME) &&
8265             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8266                         survey->time, NL80211_SURVEY_INFO_PAD))
8267                 goto nla_put_failure;
8268         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8269             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8270                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8271                 goto nla_put_failure;
8272         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8273             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8274                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8275                 goto nla_put_failure;
8276         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8277             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8278                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8279                 goto nla_put_failure;
8280         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8281             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8282                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8283                 goto nla_put_failure;
8284         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8285             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8286                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8287                 goto nla_put_failure;
8288
8289         nla_nest_end(msg, infoattr);
8290
8291         genlmsg_end(msg, hdr);
8292         return 0;
8293
8294  nla_put_failure:
8295         genlmsg_cancel(msg, hdr);
8296         return -EMSGSIZE;
8297 }
8298
8299 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8300 {
8301         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8302         struct survey_info survey;
8303         struct cfg80211_registered_device *rdev;
8304         struct wireless_dev *wdev;
8305         int survey_idx = cb->args[2];
8306         int res;
8307         bool radio_stats;
8308
8309         rtnl_lock();
8310         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8311         if (res)
8312                 goto out_err;
8313
8314         /* prepare_wdev_dump parsed the attributes */
8315         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8316
8317         if (!wdev->netdev) {
8318                 res = -EINVAL;
8319                 goto out_err;
8320         }
8321
8322         if (!rdev->ops->dump_survey) {
8323                 res = -EOPNOTSUPP;
8324                 goto out_err;
8325         }
8326
8327         while (1) {
8328                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8329                 if (res == -ENOENT)
8330                         break;
8331                 if (res)
8332                         goto out_err;
8333
8334                 /* don't send disabled channels, but do send non-channel data */
8335                 if (survey.channel &&
8336                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8337                         survey_idx++;
8338                         continue;
8339                 }
8340
8341                 if (nl80211_send_survey(skb,
8342                                 NETLINK_CB(cb->skb).portid,
8343                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8344                                 wdev->netdev, radio_stats, &survey) < 0)
8345                         goto out;
8346                 survey_idx++;
8347         }
8348
8349  out:
8350         cb->args[2] = survey_idx;
8351         res = skb->len;
8352  out_err:
8353         rtnl_unlock();
8354         return res;
8355 }
8356
8357 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8358 {
8359         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8360                                   NL80211_WPA_VERSION_2));
8361 }
8362
8363 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8364 {
8365         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8366         struct net_device *dev = info->user_ptr[1];
8367         struct ieee80211_channel *chan;
8368         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8369         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8370         enum nl80211_auth_type auth_type;
8371         struct key_parse key;
8372         bool local_state_change;
8373
8374         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8375                 return -EINVAL;
8376
8377         if (!info->attrs[NL80211_ATTR_MAC])
8378                 return -EINVAL;
8379
8380         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8381                 return -EINVAL;
8382
8383         if (!info->attrs[NL80211_ATTR_SSID])
8384                 return -EINVAL;
8385
8386         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8387                 return -EINVAL;
8388
8389         err = nl80211_parse_key(info, &key);
8390         if (err)
8391                 return err;
8392
8393         if (key.idx >= 0) {
8394                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8395                         return -EINVAL;
8396                 if (!key.p.key || !key.p.key_len)
8397                         return -EINVAL;
8398                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8399                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8400                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8401                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8402                         return -EINVAL;
8403                 if (key.idx > 3)
8404                         return -EINVAL;
8405         } else {
8406                 key.p.key_len = 0;
8407                 key.p.key = NULL;
8408         }
8409
8410         if (key.idx >= 0) {
8411                 int i;
8412                 bool ok = false;
8413
8414                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8415                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8416                                 ok = true;
8417                                 break;
8418                         }
8419                 }
8420                 if (!ok)
8421                         return -EINVAL;
8422         }
8423
8424         if (!rdev->ops->auth)
8425                 return -EOPNOTSUPP;
8426
8427         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8428             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8429                 return -EOPNOTSUPP;
8430
8431         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8432         chan = nl80211_get_valid_chan(&rdev->wiphy,
8433                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8434         if (!chan)
8435                 return -EINVAL;
8436
8437         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8438         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8439
8440         if (info->attrs[NL80211_ATTR_IE]) {
8441                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8442                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8443         }
8444
8445         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8446         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8447                 return -EINVAL;
8448
8449         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8450              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8451              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8452              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8453             !info->attrs[NL80211_ATTR_AUTH_DATA])
8454                 return -EINVAL;
8455
8456         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8457                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8458                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8459                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8460                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8461                         return -EINVAL;
8462                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8463                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8464                 /* need to include at least Auth Transaction and Status Code */
8465                 if (auth_data_len < 4)
8466                         return -EINVAL;
8467         }
8468
8469         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8470
8471         /*
8472          * Since we no longer track auth state, ignore
8473          * requests to only change local state.
8474          */
8475         if (local_state_change)
8476                 return 0;
8477
8478         wdev_lock(dev->ieee80211_ptr);
8479         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8480                                  ssid, ssid_len, ie, ie_len,
8481                                  key.p.key, key.p.key_len, key.idx,
8482                                  auth_data, auth_data_len);
8483         wdev_unlock(dev->ieee80211_ptr);
8484         return err;
8485 }
8486
8487 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8488                                      struct genl_info *info)
8489 {
8490         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8491                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8492                 return -EINVAL;
8493         }
8494
8495         if (!rdev->ops->tx_control_port ||
8496             !wiphy_ext_feature_isset(&rdev->wiphy,
8497                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8498                 return -EOPNOTSUPP;
8499
8500         return 0;
8501 }
8502
8503 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8504                                    struct genl_info *info,
8505                                    struct cfg80211_crypto_settings *settings,
8506                                    int cipher_limit)
8507 {
8508         memset(settings, 0, sizeof(*settings));
8509
8510         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8511
8512         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8513                 u16 proto;
8514
8515                 proto = nla_get_u16(
8516                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8517                 settings->control_port_ethertype = cpu_to_be16(proto);
8518                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8519                     proto != ETH_P_PAE)
8520                         return -EINVAL;
8521                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8522                         settings->control_port_no_encrypt = true;
8523         } else
8524                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8525
8526         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8527                 int r = validate_pae_over_nl80211(rdev, info);
8528
8529                 if (r < 0)
8530                         return r;
8531
8532                 settings->control_port_over_nl80211 = true;
8533         }
8534
8535         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8536                 void *data;
8537                 int len, i;
8538
8539                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8540                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8541                 settings->n_ciphers_pairwise = len / sizeof(u32);
8542
8543                 if (len % sizeof(u32))
8544                         return -EINVAL;
8545
8546                 if (settings->n_ciphers_pairwise > cipher_limit)
8547                         return -EINVAL;
8548
8549                 memcpy(settings->ciphers_pairwise, data, len);
8550
8551                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8552                         if (!cfg80211_supported_cipher_suite(
8553                                         &rdev->wiphy,
8554                                         settings->ciphers_pairwise[i]))
8555                                 return -EINVAL;
8556         }
8557
8558         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8559                 settings->cipher_group =
8560                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8561                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8562                                                      settings->cipher_group))
8563                         return -EINVAL;
8564         }
8565
8566         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8567                 settings->wpa_versions =
8568                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8569                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8570                         return -EINVAL;
8571         }
8572
8573         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8574                 void *data;
8575                 int len;
8576
8577                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8578                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8579                 settings->n_akm_suites = len / sizeof(u32);
8580
8581                 if (len % sizeof(u32))
8582                         return -EINVAL;
8583
8584                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8585                         return -EINVAL;
8586
8587                 memcpy(settings->akm_suites, data, len);
8588         }
8589
8590         if (info->attrs[NL80211_ATTR_PMK]) {
8591                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8592                         return -EINVAL;
8593                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8594                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8595                         return -EINVAL;
8596                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8597         }
8598
8599         return 0;
8600 }
8601
8602 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8603 {
8604         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8605         struct net_device *dev = info->user_ptr[1];
8606         struct ieee80211_channel *chan;
8607         struct cfg80211_assoc_request req = {};
8608         const u8 *bssid, *ssid;
8609         int err, ssid_len = 0;
8610
8611         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8612             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8613                 return -EPERM;
8614
8615         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8616                 return -EINVAL;
8617
8618         if (!info->attrs[NL80211_ATTR_MAC] ||
8619             !info->attrs[NL80211_ATTR_SSID] ||
8620             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8621                 return -EINVAL;
8622
8623         if (!rdev->ops->assoc)
8624                 return -EOPNOTSUPP;
8625
8626         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8627             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8628                 return -EOPNOTSUPP;
8629
8630         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8631
8632         chan = nl80211_get_valid_chan(&rdev->wiphy,
8633                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8634         if (!chan)
8635                 return -EINVAL;
8636
8637         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8638         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8639
8640         if (info->attrs[NL80211_ATTR_IE]) {
8641                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8642                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8643         }
8644
8645         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8646                 enum nl80211_mfp mfp =
8647                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8648                 if (mfp == NL80211_MFP_REQUIRED)
8649                         req.use_mfp = true;
8650                 else if (mfp != NL80211_MFP_NO)
8651                         return -EINVAL;
8652         }
8653
8654         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8655                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8656
8657         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8658                 req.flags |= ASSOC_REQ_DISABLE_HT;
8659
8660         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8661                 memcpy(&req.ht_capa_mask,
8662                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8663                        sizeof(req.ht_capa_mask));
8664
8665         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8666                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8667                         return -EINVAL;
8668                 memcpy(&req.ht_capa,
8669                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8670                        sizeof(req.ht_capa));
8671         }
8672
8673         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8674                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8675
8676         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8677                 memcpy(&req.vht_capa_mask,
8678                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8679                        sizeof(req.vht_capa_mask));
8680
8681         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8682                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8683                         return -EINVAL;
8684                 memcpy(&req.vht_capa,
8685                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8686                        sizeof(req.vht_capa));
8687         }
8688
8689         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8690                 if (!((rdev->wiphy.features &
8691                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8692                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8693                     !wiphy_ext_feature_isset(&rdev->wiphy,
8694                                              NL80211_EXT_FEATURE_RRM))
8695                         return -EINVAL;
8696                 req.flags |= ASSOC_REQ_USE_RRM;
8697         }
8698
8699         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8700                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8701                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8702                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8703                         return -EINVAL;
8704                 req.fils_nonces =
8705                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8706         }
8707
8708         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8709         if (!err) {
8710                 wdev_lock(dev->ieee80211_ptr);
8711
8712                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8713                                           ssid, ssid_len, &req);
8714
8715                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8716                         dev->ieee80211_ptr->conn_owner_nlportid =
8717                                 info->snd_portid;
8718                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8719                                bssid, ETH_ALEN);
8720                 }
8721
8722                 wdev_unlock(dev->ieee80211_ptr);
8723         }
8724
8725         return err;
8726 }
8727
8728 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8729 {
8730         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8731         struct net_device *dev = info->user_ptr[1];
8732         const u8 *ie = NULL, *bssid;
8733         int ie_len = 0, err;
8734         u16 reason_code;
8735         bool local_state_change;
8736
8737         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8738             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8739                 return -EPERM;
8740
8741         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8742                 return -EINVAL;
8743
8744         if (!info->attrs[NL80211_ATTR_MAC])
8745                 return -EINVAL;
8746
8747         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8748                 return -EINVAL;
8749
8750         if (!rdev->ops->deauth)
8751                 return -EOPNOTSUPP;
8752
8753         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8754             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8755                 return -EOPNOTSUPP;
8756
8757         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8758
8759         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8760         if (reason_code == 0) {
8761                 /* Reason Code 0 is reserved */
8762                 return -EINVAL;
8763         }
8764
8765         if (info->attrs[NL80211_ATTR_IE]) {
8766                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8767                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8768         }
8769
8770         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8771
8772         wdev_lock(dev->ieee80211_ptr);
8773         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8774                                    local_state_change);
8775         wdev_unlock(dev->ieee80211_ptr);
8776         return err;
8777 }
8778
8779 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8780 {
8781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8782         struct net_device *dev = info->user_ptr[1];
8783         const u8 *ie = NULL, *bssid;
8784         int ie_len = 0, err;
8785         u16 reason_code;
8786         bool local_state_change;
8787
8788         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8789             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8790                 return -EPERM;
8791
8792         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8793                 return -EINVAL;
8794
8795         if (!info->attrs[NL80211_ATTR_MAC])
8796                 return -EINVAL;
8797
8798         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8799                 return -EINVAL;
8800
8801         if (!rdev->ops->disassoc)
8802                 return -EOPNOTSUPP;
8803
8804         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8805             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8806                 return -EOPNOTSUPP;
8807
8808         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8809
8810         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8811         if (reason_code == 0) {
8812                 /* Reason Code 0 is reserved */
8813                 return -EINVAL;
8814         }
8815
8816         if (info->attrs[NL80211_ATTR_IE]) {
8817                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8818                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8819         }
8820
8821         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8822
8823         wdev_lock(dev->ieee80211_ptr);
8824         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8825                                      local_state_change);
8826         wdev_unlock(dev->ieee80211_ptr);
8827         return err;
8828 }
8829
8830 static bool
8831 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8832                          int mcast_rate[NUM_NL80211_BANDS],
8833                          int rateval)
8834 {
8835         struct wiphy *wiphy = &rdev->wiphy;
8836         bool found = false;
8837         int band, i;
8838
8839         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8840                 struct ieee80211_supported_band *sband;
8841
8842                 sband = wiphy->bands[band];
8843                 if (!sband)
8844                         continue;
8845
8846                 for (i = 0; i < sband->n_bitrates; i++) {
8847                         if (sband->bitrates[i].bitrate == rateval) {
8848                                 mcast_rate[band] = i + 1;
8849                                 found = true;
8850                                 break;
8851                         }
8852                 }
8853         }
8854
8855         return found;
8856 }
8857
8858 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8859 {
8860         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8861         struct net_device *dev = info->user_ptr[1];
8862         struct cfg80211_ibss_params ibss;
8863         struct wiphy *wiphy;
8864         struct cfg80211_cached_keys *connkeys = NULL;
8865         int err;
8866
8867         memset(&ibss, 0, sizeof(ibss));
8868
8869         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8870                 return -EINVAL;
8871
8872         if (!info->attrs[NL80211_ATTR_SSID] ||
8873             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8874                 return -EINVAL;
8875
8876         ibss.beacon_interval = 100;
8877
8878         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8879                 ibss.beacon_interval =
8880                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8881
8882         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8883                                            ibss.beacon_interval);
8884         if (err)
8885                 return err;
8886
8887         if (!rdev->ops->join_ibss)
8888                 return -EOPNOTSUPP;
8889
8890         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8891                 return -EOPNOTSUPP;
8892
8893         wiphy = &rdev->wiphy;
8894
8895         if (info->attrs[NL80211_ATTR_MAC]) {
8896                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8897
8898                 if (!is_valid_ether_addr(ibss.bssid))
8899                         return -EINVAL;
8900         }
8901         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8902         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8903
8904         if (info->attrs[NL80211_ATTR_IE]) {
8905                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8906                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8907         }
8908
8909         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8910         if (err)
8911                 return err;
8912
8913         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8914                                      NL80211_IFTYPE_ADHOC))
8915                 return -EINVAL;
8916
8917         switch (ibss.chandef.width) {
8918         case NL80211_CHAN_WIDTH_5:
8919         case NL80211_CHAN_WIDTH_10:
8920         case NL80211_CHAN_WIDTH_20_NOHT:
8921                 break;
8922         case NL80211_CHAN_WIDTH_20:
8923         case NL80211_CHAN_WIDTH_40:
8924                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8925                         return -EINVAL;
8926                 break;
8927         case NL80211_CHAN_WIDTH_80:
8928         case NL80211_CHAN_WIDTH_80P80:
8929         case NL80211_CHAN_WIDTH_160:
8930                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8931                         return -EINVAL;
8932                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8933                                              NL80211_EXT_FEATURE_VHT_IBSS))
8934                         return -EINVAL;
8935                 break;
8936         default:
8937                 return -EINVAL;
8938         }
8939
8940         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8941         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8942
8943         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8944                 u8 *rates =
8945                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8946                 int n_rates =
8947                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8948                 struct ieee80211_supported_band *sband =
8949                         wiphy->bands[ibss.chandef.chan->band];
8950
8951                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8952                                              &ibss.basic_rates);
8953                 if (err)
8954                         return err;
8955         }
8956
8957         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8958                 memcpy(&ibss.ht_capa_mask,
8959                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8960                        sizeof(ibss.ht_capa_mask));
8961
8962         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8963                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8964                         return -EINVAL;
8965                 memcpy(&ibss.ht_capa,
8966                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8967                        sizeof(ibss.ht_capa));
8968         }
8969
8970         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8971             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8972                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8973                 return -EINVAL;
8974
8975         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8976                 bool no_ht = false;
8977
8978                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8979                 if (IS_ERR(connkeys))
8980                         return PTR_ERR(connkeys);
8981
8982                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8983                     no_ht) {
8984                         kzfree(connkeys);
8985                         return -EINVAL;
8986                 }
8987         }
8988
8989         ibss.control_port =
8990                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8991
8992         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8993                 int r = validate_pae_over_nl80211(rdev, info);
8994
8995                 if (r < 0)
8996                         return r;
8997
8998                 ibss.control_port_over_nl80211 = true;
8999         }
9000
9001         ibss.userspace_handles_dfs =
9002                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9003
9004         wdev_lock(dev->ieee80211_ptr);
9005         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9006         if (err)
9007                 kzfree(connkeys);
9008         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9009                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9010         wdev_unlock(dev->ieee80211_ptr);
9011
9012         return err;
9013 }
9014
9015 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9016 {
9017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9018         struct net_device *dev = info->user_ptr[1];
9019
9020         if (!rdev->ops->leave_ibss)
9021                 return -EOPNOTSUPP;
9022
9023         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9024                 return -EOPNOTSUPP;
9025
9026         return cfg80211_leave_ibss(rdev, dev, false);
9027 }
9028
9029 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9030 {
9031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9032         struct net_device *dev = info->user_ptr[1];
9033         int mcast_rate[NUM_NL80211_BANDS];
9034         u32 nla_rate;
9035         int err;
9036
9037         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9038             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9040                 return -EOPNOTSUPP;
9041
9042         if (!rdev->ops->set_mcast_rate)
9043                 return -EOPNOTSUPP;
9044
9045         memset(mcast_rate, 0, sizeof(mcast_rate));
9046
9047         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9048                 return -EINVAL;
9049
9050         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9051         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9052                 return -EINVAL;
9053
9054         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9055
9056         return err;
9057 }
9058
9059 static struct sk_buff *
9060 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9061                             struct wireless_dev *wdev, int approxlen,
9062                             u32 portid, u32 seq, enum nl80211_commands cmd,
9063                             enum nl80211_attrs attr,
9064                             const struct nl80211_vendor_cmd_info *info,
9065                             gfp_t gfp)
9066 {
9067         struct sk_buff *skb;
9068         void *hdr;
9069         struct nlattr *data;
9070
9071         skb = nlmsg_new(approxlen + 100, gfp);
9072         if (!skb)
9073                 return NULL;
9074
9075         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9076         if (!hdr) {
9077                 kfree_skb(skb);
9078                 return NULL;
9079         }
9080
9081         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9082                 goto nla_put_failure;
9083
9084         if (info) {
9085                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9086                                 info->vendor_id))
9087                         goto nla_put_failure;
9088                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9089                                 info->subcmd))
9090                         goto nla_put_failure;
9091         }
9092
9093         if (wdev) {
9094                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9095                                       wdev_id(wdev), NL80211_ATTR_PAD))
9096                         goto nla_put_failure;
9097                 if (wdev->netdev &&
9098                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9099                                 wdev->netdev->ifindex))
9100                         goto nla_put_failure;
9101         }
9102
9103         data = nla_nest_start(skb, attr);
9104         if (!data)
9105                 goto nla_put_failure;
9106
9107         ((void **)skb->cb)[0] = rdev;
9108         ((void **)skb->cb)[1] = hdr;
9109         ((void **)skb->cb)[2] = data;
9110
9111         return skb;
9112
9113  nla_put_failure:
9114         kfree_skb(skb);
9115         return NULL;
9116 }
9117
9118 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9119                                            struct wireless_dev *wdev,
9120                                            enum nl80211_commands cmd,
9121                                            enum nl80211_attrs attr,
9122                                            int vendor_event_idx,
9123                                            int approxlen, gfp_t gfp)
9124 {
9125         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9126         const struct nl80211_vendor_cmd_info *info;
9127
9128         switch (cmd) {
9129         case NL80211_CMD_TESTMODE:
9130                 if (WARN_ON(vendor_event_idx != -1))
9131                         return NULL;
9132                 info = NULL;
9133                 break;
9134         case NL80211_CMD_VENDOR:
9135                 if (WARN_ON(vendor_event_idx < 0 ||
9136                             vendor_event_idx >= wiphy->n_vendor_events))
9137                         return NULL;
9138                 info = &wiphy->vendor_events[vendor_event_idx];
9139                 break;
9140         default:
9141                 WARN_ON(1);
9142                 return NULL;
9143         }
9144
9145         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9146                                            cmd, attr, info, gfp);
9147 }
9148 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9149
9150 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9151 {
9152         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9153         void *hdr = ((void **)skb->cb)[1];
9154         struct nlattr *data = ((void **)skb->cb)[2];
9155         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9156
9157         /* clear CB data for netlink core to own from now on */
9158         memset(skb->cb, 0, sizeof(skb->cb));
9159
9160         nla_nest_end(skb, data);
9161         genlmsg_end(skb, hdr);
9162
9163         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9164                 mcgrp = NL80211_MCGRP_VENDOR;
9165
9166         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9167                                 mcgrp, gfp);
9168 }
9169 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9170
9171 #ifdef CONFIG_NL80211_TESTMODE
9172 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9173 {
9174         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9175         struct wireless_dev *wdev =
9176                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9177         int err;
9178
9179         if (!rdev->ops->testmode_cmd)
9180                 return -EOPNOTSUPP;
9181
9182         if (IS_ERR(wdev)) {
9183                 err = PTR_ERR(wdev);
9184                 if (err != -EINVAL)
9185                         return err;
9186                 wdev = NULL;
9187         } else if (wdev->wiphy != &rdev->wiphy) {
9188                 return -EINVAL;
9189         }
9190
9191         if (!info->attrs[NL80211_ATTR_TESTDATA])
9192                 return -EINVAL;
9193
9194         rdev->cur_cmd_info = info;
9195         err = rdev_testmode_cmd(rdev, wdev,
9196                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9197                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9198         rdev->cur_cmd_info = NULL;
9199
9200         return err;
9201 }
9202
9203 static int nl80211_testmode_dump(struct sk_buff *skb,
9204                                  struct netlink_callback *cb)
9205 {
9206         struct cfg80211_registered_device *rdev;
9207         int err;
9208         long phy_idx;
9209         void *data = NULL;
9210         int data_len = 0;
9211
9212         rtnl_lock();
9213
9214         if (cb->args[0]) {
9215                 /*
9216                  * 0 is a valid index, but not valid for args[0],
9217                  * so we need to offset by 1.
9218                  */
9219                 phy_idx = cb->args[0] - 1;
9220
9221                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9222                 if (!rdev) {
9223                         err = -ENOENT;
9224                         goto out_err;
9225                 }
9226         } else {
9227                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9228
9229                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9230                                   attrbuf, nl80211_fam.maxattr,
9231                                   nl80211_policy, NULL);
9232                 if (err)
9233                         goto out_err;
9234
9235                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9236                 if (IS_ERR(rdev)) {
9237                         err = PTR_ERR(rdev);
9238                         goto out_err;
9239                 }
9240                 phy_idx = rdev->wiphy_idx;
9241
9242                 if (attrbuf[NL80211_ATTR_TESTDATA])
9243                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9244         }
9245
9246         if (cb->args[1]) {
9247                 data = nla_data((void *)cb->args[1]);
9248                 data_len = nla_len((void *)cb->args[1]);
9249         }
9250
9251         if (!rdev->ops->testmode_dump) {
9252                 err = -EOPNOTSUPP;
9253                 goto out_err;
9254         }
9255
9256         while (1) {
9257                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9258                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9259                                            NL80211_CMD_TESTMODE);
9260                 struct nlattr *tmdata;
9261
9262                 if (!hdr)
9263                         break;
9264
9265                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9266                         genlmsg_cancel(skb, hdr);
9267                         break;
9268                 }
9269
9270                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9271                 if (!tmdata) {
9272                         genlmsg_cancel(skb, hdr);
9273                         break;
9274                 }
9275                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9276                 nla_nest_end(skb, tmdata);
9277
9278                 if (err == -ENOBUFS || err == -ENOENT) {
9279                         genlmsg_cancel(skb, hdr);
9280                         break;
9281                 } else if (err) {
9282                         genlmsg_cancel(skb, hdr);
9283                         goto out_err;
9284                 }
9285
9286                 genlmsg_end(skb, hdr);
9287         }
9288
9289         err = skb->len;
9290         /* see above */
9291         cb->args[0] = phy_idx + 1;
9292  out_err:
9293         rtnl_unlock();
9294         return err;
9295 }
9296 #endif
9297
9298 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9299 {
9300         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9301         struct net_device *dev = info->user_ptr[1];
9302         struct cfg80211_connect_params connect;
9303         struct wiphy *wiphy;
9304         struct cfg80211_cached_keys *connkeys = NULL;
9305         int err;
9306
9307         memset(&connect, 0, sizeof(connect));
9308
9309         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9310                 return -EINVAL;
9311
9312         if (!info->attrs[NL80211_ATTR_SSID] ||
9313             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9314                 return -EINVAL;
9315
9316         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9317                 connect.auth_type =
9318                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9319                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9320                                              NL80211_CMD_CONNECT))
9321                         return -EINVAL;
9322         } else
9323                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9324
9325         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9326
9327         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9328             !wiphy_ext_feature_isset(&rdev->wiphy,
9329                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9330                 return -EINVAL;
9331         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9332
9333         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9334                                       NL80211_MAX_NR_CIPHER_SUITES);
9335         if (err)
9336                 return err;
9337
9338         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9339             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9340                 return -EOPNOTSUPP;
9341
9342         wiphy = &rdev->wiphy;
9343
9344         connect.bg_scan_period = -1;
9345         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9346                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9347                 connect.bg_scan_period =
9348                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9349         }
9350
9351         if (info->attrs[NL80211_ATTR_MAC])
9352                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9353         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9354                 connect.bssid_hint =
9355                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9356         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9357         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9358
9359         if (info->attrs[NL80211_ATTR_IE]) {
9360                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9361                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9362         }
9363
9364         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9365                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9366                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9367                     !wiphy_ext_feature_isset(&rdev->wiphy,
9368                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9369                         return -EOPNOTSUPP;
9370
9371                 if (connect.mfp != NL80211_MFP_REQUIRED &&
9372                     connect.mfp != NL80211_MFP_NO &&
9373                     connect.mfp != NL80211_MFP_OPTIONAL)
9374                         return -EINVAL;
9375         } else {
9376                 connect.mfp = NL80211_MFP_NO;
9377         }
9378
9379         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9380                 connect.prev_bssid =
9381                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9382
9383         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9384                 connect.channel = nl80211_get_valid_chan(
9385                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9386                 if (!connect.channel)
9387                         return -EINVAL;
9388         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9389                 connect.channel_hint = nl80211_get_valid_chan(
9390                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9391                 if (!connect.channel_hint)
9392                         return -EINVAL;
9393         }
9394
9395         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9396                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9397                 if (IS_ERR(connkeys))
9398                         return PTR_ERR(connkeys);
9399         }
9400
9401         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9402                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9403
9404         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9405                 memcpy(&connect.ht_capa_mask,
9406                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9407                        sizeof(connect.ht_capa_mask));
9408
9409         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9410                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9411                         kzfree(connkeys);
9412                         return -EINVAL;
9413                 }
9414                 memcpy(&connect.ht_capa,
9415                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9416                        sizeof(connect.ht_capa));
9417         }
9418
9419         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9420                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9421
9422         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9423                 memcpy(&connect.vht_capa_mask,
9424                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9425                        sizeof(connect.vht_capa_mask));
9426
9427         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9428                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9429                         kzfree(connkeys);
9430                         return -EINVAL;
9431                 }
9432                 memcpy(&connect.vht_capa,
9433                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9434                        sizeof(connect.vht_capa));
9435         }
9436
9437         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9438                 if (!((rdev->wiphy.features &
9439                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9440                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9441                     !wiphy_ext_feature_isset(&rdev->wiphy,
9442                                              NL80211_EXT_FEATURE_RRM)) {
9443                         kzfree(connkeys);
9444                         return -EINVAL;
9445                 }
9446                 connect.flags |= ASSOC_REQ_USE_RRM;
9447         }
9448
9449         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9450         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9451                 kzfree(connkeys);
9452                 return -EOPNOTSUPP;
9453         }
9454
9455         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9456                 /* bss selection makes no sense if bssid is set */
9457                 if (connect.bssid) {
9458                         kzfree(connkeys);
9459                         return -EINVAL;
9460                 }
9461
9462                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9463                                        wiphy, &connect.bss_select);
9464                 if (err) {
9465                         kzfree(connkeys);
9466                         return err;
9467                 }
9468         }
9469
9470         if (wiphy_ext_feature_isset(&rdev->wiphy,
9471                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9472             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9473             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9474             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9475             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9476                 connect.fils_erp_username =
9477                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9478                 connect.fils_erp_username_len =
9479                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9480                 connect.fils_erp_realm =
9481                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9482                 connect.fils_erp_realm_len =
9483                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9484                 connect.fils_erp_next_seq_num =
9485                         nla_get_u16(
9486                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9487                 connect.fils_erp_rrk =
9488                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9489                 connect.fils_erp_rrk_len =
9490                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9491         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9492                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9493                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9494                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9495                 kzfree(connkeys);
9496                 return -EINVAL;
9497         }
9498
9499         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9500                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9501                         kzfree(connkeys);
9502                         GENL_SET_ERR_MSG(info,
9503                                          "external auth requires connection ownership");
9504                         return -EINVAL;
9505                 }
9506                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9507         }
9508
9509         wdev_lock(dev->ieee80211_ptr);
9510
9511         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9512                                connect.prev_bssid);
9513         if (err)
9514                 kzfree(connkeys);
9515
9516         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9517                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9518                 if (connect.bssid)
9519                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9520                                connect.bssid, ETH_ALEN);
9521                 else
9522                         memset(dev->ieee80211_ptr->disconnect_bssid,
9523                                0, ETH_ALEN);
9524         }
9525
9526         wdev_unlock(dev->ieee80211_ptr);
9527
9528         return err;
9529 }
9530
9531 static int nl80211_update_connect_params(struct sk_buff *skb,
9532                                          struct genl_info *info)
9533 {
9534         struct cfg80211_connect_params connect = {};
9535         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9536         struct net_device *dev = info->user_ptr[1];
9537         struct wireless_dev *wdev = dev->ieee80211_ptr;
9538         bool fils_sk_offload;
9539         u32 auth_type;
9540         u32 changed = 0;
9541         int ret;
9542
9543         if (!rdev->ops->update_connect_params)
9544                 return -EOPNOTSUPP;
9545
9546         if (info->attrs[NL80211_ATTR_IE]) {
9547                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9548                         return -EINVAL;
9549                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9550                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9551                 changed |= UPDATE_ASSOC_IES;
9552         }
9553
9554         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9555                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9556
9557         /*
9558          * when driver supports fils-sk offload all attributes must be
9559          * provided. So the else covers "fils-sk-not-all" and
9560          * "no-fils-sk-any".
9561          */
9562         if (fils_sk_offload &&
9563             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9564             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9565             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9566             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9567                 connect.fils_erp_username =
9568                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9569                 connect.fils_erp_username_len =
9570                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9571                 connect.fils_erp_realm =
9572                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9573                 connect.fils_erp_realm_len =
9574                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9575                 connect.fils_erp_next_seq_num =
9576                         nla_get_u16(
9577                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9578                 connect.fils_erp_rrk =
9579                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9580                 connect.fils_erp_rrk_len =
9581                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9582                 changed |= UPDATE_FILS_ERP_INFO;
9583         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9584                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9585                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9586                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9587                 return -EINVAL;
9588         }
9589
9590         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9591                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9592                 if (!nl80211_valid_auth_type(rdev, auth_type,
9593                                              NL80211_CMD_CONNECT))
9594                         return -EINVAL;
9595
9596                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9597                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9598                         return -EINVAL;
9599
9600                 connect.auth_type = auth_type;
9601                 changed |= UPDATE_AUTH_TYPE;
9602         }
9603
9604         wdev_lock(dev->ieee80211_ptr);
9605         if (!wdev->current_bss)
9606                 ret = -ENOLINK;
9607         else
9608                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9609         wdev_unlock(dev->ieee80211_ptr);
9610
9611         return ret;
9612 }
9613
9614 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9615 {
9616         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9617         struct net_device *dev = info->user_ptr[1];
9618         u16 reason;
9619         int ret;
9620
9621         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9622             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9623                 return -EPERM;
9624
9625         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9626                 reason = WLAN_REASON_DEAUTH_LEAVING;
9627         else
9628                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9629
9630         if (reason == 0)
9631                 return -EINVAL;
9632
9633         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9634             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9635                 return -EOPNOTSUPP;
9636
9637         wdev_lock(dev->ieee80211_ptr);
9638         ret = cfg80211_disconnect(rdev, dev, reason, true);
9639         wdev_unlock(dev->ieee80211_ptr);
9640         return ret;
9641 }
9642
9643 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9644 {
9645         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9646         struct net *net;
9647         int err;
9648
9649         if (info->attrs[NL80211_ATTR_PID]) {
9650                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9651
9652                 net = get_net_ns_by_pid(pid);
9653         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9654                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9655
9656                 net = get_net_ns_by_fd(fd);
9657         } else {
9658                 return -EINVAL;
9659         }
9660
9661         if (IS_ERR(net))
9662                 return PTR_ERR(net);
9663
9664         err = 0;
9665
9666         /* check if anything to do */
9667         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9668                 err = cfg80211_switch_netns(rdev, net);
9669
9670         put_net(net);
9671         return err;
9672 }
9673
9674 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9675 {
9676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9677         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9678                         struct cfg80211_pmksa *pmksa) = NULL;
9679         struct net_device *dev = info->user_ptr[1];
9680         struct cfg80211_pmksa pmksa;
9681
9682         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9683
9684         if (!info->attrs[NL80211_ATTR_PMKID])
9685                 return -EINVAL;
9686
9687         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9688
9689         if (info->attrs[NL80211_ATTR_MAC]) {
9690                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9691         } else if (info->attrs[NL80211_ATTR_SSID] &&
9692                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9693                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9694                     info->attrs[NL80211_ATTR_PMK])) {
9695                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9696                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9697                 pmksa.cache_id =
9698                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9699         } else {
9700                 return -EINVAL;
9701         }
9702         if (info->attrs[NL80211_ATTR_PMK]) {
9703                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9704                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9705         }
9706
9707         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9708             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9709                 return -EOPNOTSUPP;
9710
9711         switch (info->genlhdr->cmd) {
9712         case NL80211_CMD_SET_PMKSA:
9713                 rdev_ops = rdev->ops->set_pmksa;
9714                 break;
9715         case NL80211_CMD_DEL_PMKSA:
9716                 rdev_ops = rdev->ops->del_pmksa;
9717                 break;
9718         default:
9719                 WARN_ON(1);
9720                 break;
9721         }
9722
9723         if (!rdev_ops)
9724                 return -EOPNOTSUPP;
9725
9726         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9727 }
9728
9729 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9730 {
9731         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9732         struct net_device *dev = info->user_ptr[1];
9733
9734         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9735             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9736                 return -EOPNOTSUPP;
9737
9738         if (!rdev->ops->flush_pmksa)
9739                 return -EOPNOTSUPP;
9740
9741         return rdev_flush_pmksa(rdev, dev);
9742 }
9743
9744 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9745 {
9746         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9747         struct net_device *dev = info->user_ptr[1];
9748         u8 action_code, dialog_token;
9749         u32 peer_capability = 0;
9750         u16 status_code;
9751         u8 *peer;
9752         bool initiator;
9753
9754         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9755             !rdev->ops->tdls_mgmt)
9756                 return -EOPNOTSUPP;
9757
9758         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9759             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9760             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9761             !info->attrs[NL80211_ATTR_IE] ||
9762             !info->attrs[NL80211_ATTR_MAC])
9763                 return -EINVAL;
9764
9765         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9766         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9767         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9768         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9769         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9770         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9771                 peer_capability =
9772                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9773
9774         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9775                               dialog_token, status_code, peer_capability,
9776                               initiator,
9777                               nla_data(info->attrs[NL80211_ATTR_IE]),
9778                               nla_len(info->attrs[NL80211_ATTR_IE]));
9779 }
9780
9781 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9782 {
9783         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9784         struct net_device *dev = info->user_ptr[1];
9785         enum nl80211_tdls_operation operation;
9786         u8 *peer;
9787
9788         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9789             !rdev->ops->tdls_oper)
9790                 return -EOPNOTSUPP;
9791
9792         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9793             !info->attrs[NL80211_ATTR_MAC])
9794                 return -EINVAL;
9795
9796         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9797         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9798
9799         return rdev_tdls_oper(rdev, dev, peer, operation);
9800 }
9801
9802 static int nl80211_remain_on_channel(struct sk_buff *skb,
9803                                      struct genl_info *info)
9804 {
9805         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9806         struct wireless_dev *wdev = info->user_ptr[1];
9807         struct cfg80211_chan_def chandef;
9808         const struct cfg80211_chan_def *compat_chandef;
9809         struct sk_buff *msg;
9810         void *hdr;
9811         u64 cookie;
9812         u32 duration;
9813         int err;
9814
9815         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9816             !info->attrs[NL80211_ATTR_DURATION])
9817                 return -EINVAL;
9818
9819         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9820
9821         if (!rdev->ops->remain_on_channel ||
9822             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9823                 return -EOPNOTSUPP;
9824
9825         /*
9826          * We should be on that channel for at least a minimum amount of
9827          * time (10ms) but no longer than the driver supports.
9828          */
9829         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9830             duration > rdev->wiphy.max_remain_on_channel_duration)
9831                 return -EINVAL;
9832
9833         err = nl80211_parse_chandef(rdev, info, &chandef);
9834         if (err)
9835                 return err;
9836
9837         wdev_lock(wdev);
9838         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9839             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9840                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9841                                                              &chandef);
9842                 if (compat_chandef != &chandef) {
9843                         wdev_unlock(wdev);
9844                         return -EBUSY;
9845                 }
9846         }
9847         wdev_unlock(wdev);
9848
9849         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9850         if (!msg)
9851                 return -ENOMEM;
9852
9853         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9854                              NL80211_CMD_REMAIN_ON_CHANNEL);
9855         if (!hdr) {
9856                 err = -ENOBUFS;
9857                 goto free_msg;
9858         }
9859
9860         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9861                                      duration, &cookie);
9862
9863         if (err)
9864                 goto free_msg;
9865
9866         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9867                               NL80211_ATTR_PAD))
9868                 goto nla_put_failure;
9869
9870         genlmsg_end(msg, hdr);
9871
9872         return genlmsg_reply(msg, info);
9873
9874  nla_put_failure:
9875         err = -ENOBUFS;
9876  free_msg:
9877         nlmsg_free(msg);
9878         return err;
9879 }
9880
9881 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9882                                             struct genl_info *info)
9883 {
9884         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9885         struct wireless_dev *wdev = info->user_ptr[1];
9886         u64 cookie;
9887
9888         if (!info->attrs[NL80211_ATTR_COOKIE])
9889                 return -EINVAL;
9890
9891         if (!rdev->ops->cancel_remain_on_channel)
9892                 return -EOPNOTSUPP;
9893
9894         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9895
9896         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9897 }
9898
9899 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9900                                        struct genl_info *info)
9901 {
9902         struct cfg80211_bitrate_mask mask;
9903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9904         struct net_device *dev = info->user_ptr[1];
9905         int err;
9906
9907         if (!rdev->ops->set_bitrate_mask)
9908                 return -EOPNOTSUPP;
9909
9910         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9911         if (err)
9912                 return err;
9913
9914         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9915 }
9916
9917 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9918 {
9919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9920         struct wireless_dev *wdev = info->user_ptr[1];
9921         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9922
9923         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9924                 return -EINVAL;
9925
9926         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9927                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9928
9929         switch (wdev->iftype) {
9930         case NL80211_IFTYPE_STATION:
9931         case NL80211_IFTYPE_ADHOC:
9932         case NL80211_IFTYPE_P2P_CLIENT:
9933         case NL80211_IFTYPE_AP:
9934         case NL80211_IFTYPE_AP_VLAN:
9935         case NL80211_IFTYPE_MESH_POINT:
9936         case NL80211_IFTYPE_P2P_GO:
9937         case NL80211_IFTYPE_P2P_DEVICE:
9938                 break;
9939         case NL80211_IFTYPE_NAN:
9940         default:
9941                 return -EOPNOTSUPP;
9942         }
9943
9944         /* not much point in registering if we can't reply */
9945         if (!rdev->ops->mgmt_tx)
9946                 return -EOPNOTSUPP;
9947
9948         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9949                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9950                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9951 }
9952
9953 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9954 {
9955         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9956         struct wireless_dev *wdev = info->user_ptr[1];
9957         struct cfg80211_chan_def chandef;
9958         int err;
9959         void *hdr = NULL;
9960         u64 cookie;
9961         struct sk_buff *msg = NULL;
9962         struct cfg80211_mgmt_tx_params params = {
9963                 .dont_wait_for_ack =
9964                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9965         };
9966
9967         if (!info->attrs[NL80211_ATTR_FRAME])
9968                 return -EINVAL;
9969
9970         if (!rdev->ops->mgmt_tx)
9971                 return -EOPNOTSUPP;
9972
9973         switch (wdev->iftype) {
9974         case NL80211_IFTYPE_P2P_DEVICE:
9975                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9976                         return -EINVAL;
9977         case NL80211_IFTYPE_STATION:
9978         case NL80211_IFTYPE_ADHOC:
9979         case NL80211_IFTYPE_P2P_CLIENT:
9980         case NL80211_IFTYPE_AP:
9981         case NL80211_IFTYPE_AP_VLAN:
9982         case NL80211_IFTYPE_MESH_POINT:
9983         case NL80211_IFTYPE_P2P_GO:
9984                 break;
9985         case NL80211_IFTYPE_NAN:
9986         default:
9987                 return -EOPNOTSUPP;
9988         }
9989
9990         if (info->attrs[NL80211_ATTR_DURATION]) {
9991                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9992                         return -EINVAL;
9993                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9994
9995                 /*
9996                  * We should wait on the channel for at least a minimum amount
9997                  * of time (10ms) but no longer than the driver supports.
9998                  */
9999                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10000                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10001                         return -EINVAL;
10002         }
10003
10004         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10005
10006         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10007                 return -EINVAL;
10008
10009         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10010
10011         /* get the channel if any has been specified, otherwise pass NULL to
10012          * the driver. The latter will use the current one
10013          */
10014         chandef.chan = NULL;
10015         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10016                 err = nl80211_parse_chandef(rdev, info, &chandef);
10017                 if (err)
10018                         return err;
10019         }
10020
10021         if (!chandef.chan && params.offchan)
10022                 return -EINVAL;
10023
10024         wdev_lock(wdev);
10025         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10026                 wdev_unlock(wdev);
10027                 return -EBUSY;
10028         }
10029         wdev_unlock(wdev);
10030
10031         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10032         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10033
10034         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10035                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10036                 int i;
10037
10038                 if (len % sizeof(u16))
10039                         return -EINVAL;
10040
10041                 params.n_csa_offsets = len / sizeof(u16);
10042                 params.csa_offsets =
10043                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10044
10045                 /* check that all the offsets fit the frame */
10046                 for (i = 0; i < params.n_csa_offsets; i++) {
10047                         if (params.csa_offsets[i] >= params.len)
10048                                 return -EINVAL;
10049                 }
10050         }
10051
10052         if (!params.dont_wait_for_ack) {
10053                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10054                 if (!msg)
10055                         return -ENOMEM;
10056
10057                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10058                                      NL80211_CMD_FRAME);
10059                 if (!hdr) {
10060                         err = -ENOBUFS;
10061                         goto free_msg;
10062                 }
10063         }
10064
10065         params.chan = chandef.chan;
10066         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10067         if (err)
10068                 goto free_msg;
10069
10070         if (msg) {
10071                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10072                                       NL80211_ATTR_PAD))
10073                         goto nla_put_failure;
10074
10075                 genlmsg_end(msg, hdr);
10076                 return genlmsg_reply(msg, info);
10077         }
10078
10079         return 0;
10080
10081  nla_put_failure:
10082         err = -ENOBUFS;
10083  free_msg:
10084         nlmsg_free(msg);
10085         return err;
10086 }
10087
10088 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10089 {
10090         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10091         struct wireless_dev *wdev = info->user_ptr[1];
10092         u64 cookie;
10093
10094         if (!info->attrs[NL80211_ATTR_COOKIE])
10095                 return -EINVAL;
10096
10097         if (!rdev->ops->mgmt_tx_cancel_wait)
10098                 return -EOPNOTSUPP;
10099
10100         switch (wdev->iftype) {
10101         case NL80211_IFTYPE_STATION:
10102         case NL80211_IFTYPE_ADHOC:
10103         case NL80211_IFTYPE_P2P_CLIENT:
10104         case NL80211_IFTYPE_AP:
10105         case NL80211_IFTYPE_AP_VLAN:
10106         case NL80211_IFTYPE_P2P_GO:
10107         case NL80211_IFTYPE_P2P_DEVICE:
10108                 break;
10109         case NL80211_IFTYPE_NAN:
10110         default:
10111                 return -EOPNOTSUPP;
10112         }
10113
10114         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10115
10116         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10117 }
10118
10119 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10120 {
10121         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10122         struct wireless_dev *wdev;
10123         struct net_device *dev = info->user_ptr[1];
10124         u8 ps_state;
10125         bool state;
10126         int err;
10127
10128         if (!info->attrs[NL80211_ATTR_PS_STATE])
10129                 return -EINVAL;
10130
10131         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10132
10133         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
10134                 return -EINVAL;
10135
10136         wdev = dev->ieee80211_ptr;
10137
10138         if (!rdev->ops->set_power_mgmt)
10139                 return -EOPNOTSUPP;
10140
10141         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10142
10143         if (state == wdev->ps)
10144                 return 0;
10145
10146         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10147         if (!err)
10148                 wdev->ps = state;
10149         return err;
10150 }
10151
10152 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10153 {
10154         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10155         enum nl80211_ps_state ps_state;
10156         struct wireless_dev *wdev;
10157         struct net_device *dev = info->user_ptr[1];
10158         struct sk_buff *msg;
10159         void *hdr;
10160         int err;
10161
10162         wdev = dev->ieee80211_ptr;
10163
10164         if (!rdev->ops->set_power_mgmt)
10165                 return -EOPNOTSUPP;
10166
10167         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10168         if (!msg)
10169                 return -ENOMEM;
10170
10171         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10172                              NL80211_CMD_GET_POWER_SAVE);
10173         if (!hdr) {
10174                 err = -ENOBUFS;
10175                 goto free_msg;
10176         }
10177
10178         if (wdev->ps)
10179                 ps_state = NL80211_PS_ENABLED;
10180         else
10181                 ps_state = NL80211_PS_DISABLED;
10182
10183         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10184                 goto nla_put_failure;
10185
10186         genlmsg_end(msg, hdr);
10187         return genlmsg_reply(msg, info);
10188
10189  nla_put_failure:
10190         err = -ENOBUFS;
10191  free_msg:
10192         nlmsg_free(msg);
10193         return err;
10194 }
10195
10196 static const struct nla_policy
10197 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10198         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10199         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10200         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10201         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10202         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10203         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10204         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10205 };
10206
10207 static int nl80211_set_cqm_txe(struct genl_info *info,
10208                                u32 rate, u32 pkts, u32 intvl)
10209 {
10210         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10211         struct net_device *dev = info->user_ptr[1];
10212         struct wireless_dev *wdev = dev->ieee80211_ptr;
10213
10214         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10215                 return -EINVAL;
10216
10217         if (!rdev->ops->set_cqm_txe_config)
10218                 return -EOPNOTSUPP;
10219
10220         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10221             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10222                 return -EOPNOTSUPP;
10223
10224         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10225 }
10226
10227 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10228                                     struct net_device *dev)
10229 {
10230         struct wireless_dev *wdev = dev->ieee80211_ptr;
10231         s32 last, low, high;
10232         u32 hyst;
10233         int i, n;
10234         int err;
10235
10236         /* RSSI reporting disabled? */
10237         if (!wdev->cqm_config)
10238                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10239
10240         /*
10241          * Obtain current RSSI value if possible, if not and no RSSI threshold
10242          * event has been received yet, we should receive an event after a
10243          * connection is established and enough beacons received to calculate
10244          * the average.
10245          */
10246         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10247             rdev->ops->get_station) {
10248                 struct station_info sinfo = {};
10249                 u8 *mac_addr;
10250
10251                 mac_addr = wdev->current_bss->pub.bssid;
10252
10253                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10254                 if (err)
10255                         return err;
10256
10257                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10258                         wdev->cqm_config->last_rssi_event_value =
10259                                 (s8) sinfo.rx_beacon_signal_avg;
10260         }
10261
10262         last = wdev->cqm_config->last_rssi_event_value;
10263         hyst = wdev->cqm_config->rssi_hyst;
10264         n = wdev->cqm_config->n_rssi_thresholds;
10265
10266         for (i = 0; i < n; i++)
10267                 if (last < wdev->cqm_config->rssi_thresholds[i])
10268                         break;
10269
10270         low = i > 0 ?
10271                 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
10272         high = i < n ?
10273                 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
10274
10275         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10276 }
10277
10278 static int nl80211_set_cqm_rssi(struct genl_info *info,
10279                                 const s32 *thresholds, int n_thresholds,
10280                                 u32 hysteresis)
10281 {
10282         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10283         struct net_device *dev = info->user_ptr[1];
10284         struct wireless_dev *wdev = dev->ieee80211_ptr;
10285         int i, err;
10286         s32 prev = S32_MIN;
10287
10288         /* Check all values negative and sorted */
10289         for (i = 0; i < n_thresholds; i++) {
10290                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10291                         return -EINVAL;
10292
10293                 prev = thresholds[i];
10294         }
10295
10296         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10297             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10298                 return -EOPNOTSUPP;
10299
10300         wdev_lock(wdev);
10301         cfg80211_cqm_config_free(wdev);
10302         wdev_unlock(wdev);
10303
10304         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10305                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10306                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10307
10308                 return rdev_set_cqm_rssi_config(rdev, dev,
10309                                                 thresholds[0], hysteresis);
10310         }
10311
10312         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10313                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10314                 return -EOPNOTSUPP;
10315
10316         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10317                 n_thresholds = 0;
10318
10319         wdev_lock(wdev);
10320         if (n_thresholds) {
10321                 struct cfg80211_cqm_config *cqm_config;
10322
10323                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10324                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10325                 if (!cqm_config) {
10326                         err = -ENOMEM;
10327                         goto unlock;
10328                 }
10329
10330                 cqm_config->rssi_hyst = hysteresis;
10331                 cqm_config->n_rssi_thresholds = n_thresholds;
10332                 memcpy(cqm_config->rssi_thresholds, thresholds,
10333                        n_thresholds * sizeof(s32));
10334
10335                 wdev->cqm_config = cqm_config;
10336         }
10337
10338         err = cfg80211_cqm_rssi_update(rdev, dev);
10339
10340 unlock:
10341         wdev_unlock(wdev);
10342
10343         return err;
10344 }
10345
10346 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10347 {
10348         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10349         struct nlattr *cqm;
10350         int err;
10351
10352         cqm = info->attrs[NL80211_ATTR_CQM];
10353         if (!cqm)
10354                 return -EINVAL;
10355
10356         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10357                                nl80211_attr_cqm_policy, info->extack);
10358         if (err)
10359                 return err;
10360
10361         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10362             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10363                 const s32 *thresholds =
10364                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10365                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10366                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10367
10368                 if (len % 4)
10369                         return -EINVAL;
10370
10371                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10372                                             hysteresis);
10373         }
10374
10375         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10376             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10377             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10378                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10379                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10380                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10381
10382                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10383         }
10384
10385         return -EINVAL;
10386 }
10387
10388 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10389 {
10390         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10391         struct net_device *dev = info->user_ptr[1];
10392         struct ocb_setup setup = {};
10393         int err;
10394
10395         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10396         if (err)
10397                 return err;
10398
10399         return cfg80211_join_ocb(rdev, dev, &setup);
10400 }
10401
10402 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10403 {
10404         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10405         struct net_device *dev = info->user_ptr[1];
10406
10407         return cfg80211_leave_ocb(rdev, dev);
10408 }
10409
10410 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10411 {
10412         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10413         struct net_device *dev = info->user_ptr[1];
10414         struct mesh_config cfg;
10415         struct mesh_setup setup;
10416         int err;
10417
10418         /* start with default */
10419         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10420         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10421
10422         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10423                 /* and parse parameters if given */
10424                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10425                 if (err)
10426                         return err;
10427         }
10428
10429         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10430             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10431                 return -EINVAL;
10432
10433         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10434         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10435
10436         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10437             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10438                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10439                         return -EINVAL;
10440
10441         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10442                 setup.beacon_interval =
10443                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10444
10445                 err = cfg80211_validate_beacon_int(rdev,
10446                                                    NL80211_IFTYPE_MESH_POINT,
10447                                                    setup.beacon_interval);
10448                 if (err)
10449                         return err;
10450         }
10451
10452         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10453                 setup.dtim_period =
10454                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10455                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10456                         return -EINVAL;
10457         }
10458
10459         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10460                 /* parse additional setup parameters if given */
10461                 err = nl80211_parse_mesh_setup(info, &setup);
10462                 if (err)
10463                         return err;
10464         }
10465
10466         if (setup.user_mpm)
10467                 cfg.auto_open_plinks = false;
10468
10469         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10470                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10471                 if (err)
10472                         return err;
10473         } else {
10474                 /* __cfg80211_join_mesh() will sort it out */
10475                 setup.chandef.chan = NULL;
10476         }
10477
10478         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10479                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10480                 int n_rates =
10481                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10482                 struct ieee80211_supported_band *sband;
10483
10484                 if (!setup.chandef.chan)
10485                         return -EINVAL;
10486
10487                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10488
10489                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10490                                              &setup.basic_rates);
10491                 if (err)
10492                         return err;
10493         }
10494
10495         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10496                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10497                 if (err)
10498                         return err;
10499
10500                 if (!setup.chandef.chan)
10501                         return -EINVAL;
10502
10503                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10504                                               &setup.beacon_rate);
10505                 if (err)
10506                         return err;
10507         }
10508
10509         setup.userspace_handles_dfs =
10510                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10511
10512         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10513                 int r = validate_pae_over_nl80211(rdev, info);
10514
10515                 if (r < 0)
10516                         return r;
10517
10518                 setup.control_port_over_nl80211 = true;
10519         }
10520
10521         wdev_lock(dev->ieee80211_ptr);
10522         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10523         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10524                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10525         wdev_unlock(dev->ieee80211_ptr);
10526
10527         return err;
10528 }
10529
10530 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10531 {
10532         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10533         struct net_device *dev = info->user_ptr[1];
10534
10535         return cfg80211_leave_mesh(rdev, dev);
10536 }
10537
10538 #ifdef CONFIG_PM
10539 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10540                                         struct cfg80211_registered_device *rdev)
10541 {
10542         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10543         struct nlattr *nl_pats, *nl_pat;
10544         int i, pat_len;
10545
10546         if (!wowlan->n_patterns)
10547                 return 0;
10548
10549         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10550         if (!nl_pats)
10551                 return -ENOBUFS;
10552
10553         for (i = 0; i < wowlan->n_patterns; i++) {
10554                 nl_pat = nla_nest_start(msg, i + 1);
10555                 if (!nl_pat)
10556                         return -ENOBUFS;
10557                 pat_len = wowlan->patterns[i].pattern_len;
10558                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10559                             wowlan->patterns[i].mask) ||
10560                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10561                             wowlan->patterns[i].pattern) ||
10562                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10563                                 wowlan->patterns[i].pkt_offset))
10564                         return -ENOBUFS;
10565                 nla_nest_end(msg, nl_pat);
10566         }
10567         nla_nest_end(msg, nl_pats);
10568
10569         return 0;
10570 }
10571
10572 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10573                                    struct cfg80211_wowlan_tcp *tcp)
10574 {
10575         struct nlattr *nl_tcp;
10576
10577         if (!tcp)
10578                 return 0;
10579
10580         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10581         if (!nl_tcp)
10582                 return -ENOBUFS;
10583
10584         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10585             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10586             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10587             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10588             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10589             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10590                     tcp->payload_len, tcp->payload) ||
10591             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10592                         tcp->data_interval) ||
10593             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10594                     tcp->wake_len, tcp->wake_data) ||
10595             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10596                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10597                 return -ENOBUFS;
10598
10599         if (tcp->payload_seq.len &&
10600             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10601                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10602                 return -ENOBUFS;
10603
10604         if (tcp->payload_tok.len &&
10605             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10606                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10607                     &tcp->payload_tok))
10608                 return -ENOBUFS;
10609
10610         nla_nest_end(msg, nl_tcp);
10611
10612         return 0;
10613 }
10614
10615 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10616                                   struct cfg80211_sched_scan_request *req)
10617 {
10618         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10619         int i;
10620
10621         if (!req)
10622                 return 0;
10623
10624         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10625         if (!nd)
10626                 return -ENOBUFS;
10627
10628         if (req->n_scan_plans == 1 &&
10629             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10630                         req->scan_plans[0].interval * 1000))
10631                 return -ENOBUFS;
10632
10633         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10634                 return -ENOBUFS;
10635
10636         if (req->relative_rssi_set) {
10637                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10638
10639                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10640                                req->relative_rssi))
10641                         return -ENOBUFS;
10642
10643                 rssi_adjust.band = req->rssi_adjust.band;
10644                 rssi_adjust.delta = req->rssi_adjust.delta;
10645                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10646                             sizeof(rssi_adjust), &rssi_adjust))
10647                         return -ENOBUFS;
10648         }
10649
10650         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10651         if (!freqs)
10652                 return -ENOBUFS;
10653
10654         for (i = 0; i < req->n_channels; i++) {
10655                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10656                         return -ENOBUFS;
10657         }
10658
10659         nla_nest_end(msg, freqs);
10660
10661         if (req->n_match_sets) {
10662                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10663                 if (!matches)
10664                         return -ENOBUFS;
10665
10666                 for (i = 0; i < req->n_match_sets; i++) {
10667                         match = nla_nest_start(msg, i);
10668                         if (!match)
10669                                 return -ENOBUFS;
10670
10671                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10672                                     req->match_sets[i].ssid.ssid_len,
10673                                     req->match_sets[i].ssid.ssid))
10674                                 return -ENOBUFS;
10675                         nla_nest_end(msg, match);
10676                 }
10677                 nla_nest_end(msg, matches);
10678         }
10679
10680         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10681         if (!scan_plans)
10682                 return -ENOBUFS;
10683
10684         for (i = 0; i < req->n_scan_plans; i++) {
10685                 scan_plan = nla_nest_start(msg, i + 1);
10686                 if (!scan_plan)
10687                         return -ENOBUFS;
10688
10689                 if (!scan_plan ||
10690                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10691                                 req->scan_plans[i].interval) ||
10692                     (req->scan_plans[i].iterations &&
10693                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10694                                  req->scan_plans[i].iterations)))
10695                         return -ENOBUFS;
10696                 nla_nest_end(msg, scan_plan);
10697         }
10698         nla_nest_end(msg, scan_plans);
10699
10700         nla_nest_end(msg, nd);
10701
10702         return 0;
10703 }
10704
10705 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10706 {
10707         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10708         struct sk_buff *msg;
10709         void *hdr;
10710         u32 size = NLMSG_DEFAULT_SIZE;
10711
10712         if (!rdev->wiphy.wowlan)
10713                 return -EOPNOTSUPP;
10714
10715         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10716                 /* adjust size to have room for all the data */
10717                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10718                         rdev->wiphy.wowlan_config->tcp->payload_len +
10719                         rdev->wiphy.wowlan_config->tcp->wake_len +
10720                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10721         }
10722
10723         msg = nlmsg_new(size, GFP_KERNEL);
10724         if (!msg)
10725                 return -ENOMEM;
10726
10727         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10728                              NL80211_CMD_GET_WOWLAN);
10729         if (!hdr)
10730                 goto nla_put_failure;
10731
10732         if (rdev->wiphy.wowlan_config) {
10733                 struct nlattr *nl_wowlan;
10734
10735                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10736                 if (!nl_wowlan)
10737                         goto nla_put_failure;
10738
10739                 if ((rdev->wiphy.wowlan_config->any &&
10740                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10741                     (rdev->wiphy.wowlan_config->disconnect &&
10742                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10743                     (rdev->wiphy.wowlan_config->magic_pkt &&
10744                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10745                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10746                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10747                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10748                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10749                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10750                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10751                     (rdev->wiphy.wowlan_config->rfkill_release &&
10752                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10753                         goto nla_put_failure;
10754
10755                 if (nl80211_send_wowlan_patterns(msg, rdev))
10756                         goto nla_put_failure;
10757
10758                 if (nl80211_send_wowlan_tcp(msg,
10759                                             rdev->wiphy.wowlan_config->tcp))
10760                         goto nla_put_failure;
10761
10762                 if (nl80211_send_wowlan_nd(
10763                             msg,
10764                             rdev->wiphy.wowlan_config->nd_config))
10765                         goto nla_put_failure;
10766
10767                 nla_nest_end(msg, nl_wowlan);
10768         }
10769
10770         genlmsg_end(msg, hdr);
10771         return genlmsg_reply(msg, info);
10772
10773 nla_put_failure:
10774         nlmsg_free(msg);
10775         return -ENOBUFS;
10776 }
10777
10778 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10779                                     struct nlattr *attr,
10780                                     struct cfg80211_wowlan *trig)
10781 {
10782         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10783         struct cfg80211_wowlan_tcp *cfg;
10784         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10785         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10786         u32 size;
10787         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10788         int err, port;
10789
10790         if (!rdev->wiphy.wowlan->tcp)
10791                 return -EINVAL;
10792
10793         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10794                                nl80211_wowlan_tcp_policy, NULL);
10795         if (err)
10796                 return err;
10797
10798         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10799             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10800             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10801             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10802             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10803             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10804             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10805             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10806                 return -EINVAL;
10807
10808         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10809         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10810                 return -EINVAL;
10811
10812         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10813                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10814             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10815                 return -EINVAL;
10816
10817         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10818         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10819                 return -EINVAL;
10820
10821         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10822         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10823                 return -EINVAL;
10824
10825         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10826                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10827
10828                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10829                 tokens_size = tokln - sizeof(*tok);
10830
10831                 if (!tok->len || tokens_size % tok->len)
10832                         return -EINVAL;
10833                 if (!rdev->wiphy.wowlan->tcp->tok)
10834                         return -EINVAL;
10835                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10836                         return -EINVAL;
10837                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10838                         return -EINVAL;
10839                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10840                         return -EINVAL;
10841                 if (tok->offset + tok->len > data_size)
10842                         return -EINVAL;
10843         }
10844
10845         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10846                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10847                 if (!rdev->wiphy.wowlan->tcp->seq)
10848                         return -EINVAL;
10849                 if (seq->len == 0 || seq->len > 4)
10850                         return -EINVAL;
10851                 if (seq->len + seq->offset > data_size)
10852                         return -EINVAL;
10853         }
10854
10855         size = sizeof(*cfg);
10856         size += data_size;
10857         size += wake_size + wake_mask_size;
10858         size += tokens_size;
10859
10860         cfg = kzalloc(size, GFP_KERNEL);
10861         if (!cfg)
10862                 return -ENOMEM;
10863         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10864         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10865         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10866                ETH_ALEN);
10867         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10868                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10869         else
10870                 port = 0;
10871 #ifdef CONFIG_INET
10872         /* allocate a socket and port for it and use it */
10873         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10874                             IPPROTO_TCP, &cfg->sock, 1);
10875         if (err) {
10876                 kfree(cfg);
10877                 return err;
10878         }
10879         if (inet_csk_get_port(cfg->sock->sk, port)) {
10880                 sock_release(cfg->sock);
10881                 kfree(cfg);
10882                 return -EADDRINUSE;
10883         }
10884         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10885 #else
10886         if (!port) {
10887                 kfree(cfg);
10888                 return -EINVAL;
10889         }
10890         cfg->src_port = port;
10891 #endif
10892
10893         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10894         cfg->payload_len = data_size;
10895         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10896         memcpy((void *)cfg->payload,
10897                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10898                data_size);
10899         if (seq)
10900                 cfg->payload_seq = *seq;
10901         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10902         cfg->wake_len = wake_size;
10903         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10904         memcpy((void *)cfg->wake_data,
10905                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10906                wake_size);
10907         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10908                          data_size + wake_size;
10909         memcpy((void *)cfg->wake_mask,
10910                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10911                wake_mask_size);
10912         if (tok) {
10913                 cfg->tokens_size = tokens_size;
10914                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10915         }
10916
10917         trig->tcp = cfg;
10918
10919         return 0;
10920 }
10921
10922 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10923                                    const struct wiphy_wowlan_support *wowlan,
10924                                    struct nlattr *attr,
10925                                    struct cfg80211_wowlan *trig)
10926 {
10927         struct nlattr **tb;
10928         int err;
10929
10930         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10931         if (!tb)
10932                 return -ENOMEM;
10933
10934         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10935                 err = -EOPNOTSUPP;
10936                 goto out;
10937         }
10938
10939         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10940                                NULL);
10941         if (err)
10942                 goto out;
10943
10944         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10945                                                    wowlan->max_nd_match_sets);
10946         err = PTR_ERR_OR_ZERO(trig->nd_config);
10947         if (err)
10948                 trig->nd_config = NULL;
10949
10950 out:
10951         kfree(tb);
10952         return err;
10953 }
10954
10955 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10956 {
10957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10958         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10959         struct cfg80211_wowlan new_triggers = {};
10960         struct cfg80211_wowlan *ntrig;
10961         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10962         int err, i;
10963         bool prev_enabled = rdev->wiphy.wowlan_config;
10964         bool regular = false;
10965
10966         if (!wowlan)
10967                 return -EOPNOTSUPP;
10968
10969         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10970                 cfg80211_rdev_free_wowlan(rdev);
10971                 rdev->wiphy.wowlan_config = NULL;
10972                 goto set_wakeup;
10973         }
10974
10975         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10976                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10977                                nl80211_wowlan_policy, info->extack);
10978         if (err)
10979                 return err;
10980
10981         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10982                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10983                         return -EINVAL;
10984                 new_triggers.any = true;
10985         }
10986
10987         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10988                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10989                         return -EINVAL;
10990                 new_triggers.disconnect = true;
10991                 regular = true;
10992         }
10993
10994         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10995                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10996                         return -EINVAL;
10997                 new_triggers.magic_pkt = true;
10998                 regular = true;
10999         }
11000
11001         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11002                 return -EINVAL;
11003
11004         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11005                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11006                         return -EINVAL;
11007                 new_triggers.gtk_rekey_failure = true;
11008                 regular = true;
11009         }
11010
11011         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11012                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11013                         return -EINVAL;
11014                 new_triggers.eap_identity_req = true;
11015                 regular = true;
11016         }
11017
11018         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11019                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11020                         return -EINVAL;
11021                 new_triggers.four_way_handshake = true;
11022                 regular = true;
11023         }
11024
11025         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11026                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11027                         return -EINVAL;
11028                 new_triggers.rfkill_release = true;
11029                 regular = true;
11030         }
11031
11032         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11033                 struct nlattr *pat;
11034                 int n_patterns = 0;
11035                 int rem, pat_len, mask_len, pkt_offset;
11036                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11037
11038                 regular = true;
11039
11040                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11041                                     rem)
11042                         n_patterns++;
11043                 if (n_patterns > wowlan->n_patterns)
11044                         return -EINVAL;
11045
11046                 new_triggers.patterns = kcalloc(n_patterns,
11047                                                 sizeof(new_triggers.patterns[0]),
11048                                                 GFP_KERNEL);
11049                 if (!new_triggers.patterns)
11050                         return -ENOMEM;
11051
11052                 new_triggers.n_patterns = n_patterns;
11053                 i = 0;
11054
11055                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11056                                     rem) {
11057                         u8 *mask_pat;
11058
11059                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11060                                                nl80211_packet_pattern_policy,
11061                                                info->extack);
11062                         if (err)
11063                                 goto error;
11064
11065                         err = -EINVAL;
11066                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11067                             !pat_tb[NL80211_PKTPAT_PATTERN])
11068                                 goto error;
11069                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11070                         mask_len = DIV_ROUND_UP(pat_len, 8);
11071                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11072                                 goto error;
11073                         if (pat_len > wowlan->pattern_max_len ||
11074                             pat_len < wowlan->pattern_min_len)
11075                                 goto error;
11076
11077                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11078                                 pkt_offset = 0;
11079                         else
11080                                 pkt_offset = nla_get_u32(
11081                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11082                         if (pkt_offset > wowlan->max_pkt_offset)
11083                                 goto error;
11084                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11085
11086                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11087                         if (!mask_pat) {
11088                                 err = -ENOMEM;
11089                                 goto error;
11090                         }
11091                         new_triggers.patterns[i].mask = mask_pat;
11092                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11093                                mask_len);
11094                         mask_pat += mask_len;
11095                         new_triggers.patterns[i].pattern = mask_pat;
11096                         new_triggers.patterns[i].pattern_len = pat_len;
11097                         memcpy(mask_pat,
11098                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11099                                pat_len);
11100                         i++;
11101                 }
11102         }
11103
11104         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11105                 regular = true;
11106                 err = nl80211_parse_wowlan_tcp(
11107                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11108                         &new_triggers);
11109                 if (err)
11110                         goto error;
11111         }
11112
11113         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11114                 regular = true;
11115                 err = nl80211_parse_wowlan_nd(
11116                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11117                         &new_triggers);
11118                 if (err)
11119                         goto error;
11120         }
11121
11122         /* The 'any' trigger means the device continues operating more or less
11123          * as in its normal operation mode and wakes up the host on most of the
11124          * normal interrupts (like packet RX, ...)
11125          * It therefore makes little sense to combine with the more constrained
11126          * wakeup trigger modes.
11127          */
11128         if (new_triggers.any && regular) {
11129                 err = -EINVAL;
11130                 goto error;
11131         }
11132
11133         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11134         if (!ntrig) {
11135                 err = -ENOMEM;
11136                 goto error;
11137         }
11138         cfg80211_rdev_free_wowlan(rdev);
11139         rdev->wiphy.wowlan_config = ntrig;
11140
11141  set_wakeup:
11142         if (rdev->ops->set_wakeup &&
11143             prev_enabled != !!rdev->wiphy.wowlan_config)
11144                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11145
11146         return 0;
11147  error:
11148         for (i = 0; i < new_triggers.n_patterns; i++)
11149                 kfree(new_triggers.patterns[i].mask);
11150         kfree(new_triggers.patterns);
11151         if (new_triggers.tcp && new_triggers.tcp->sock)
11152                 sock_release(new_triggers.tcp->sock);
11153         kfree(new_triggers.tcp);
11154         kfree(new_triggers.nd_config);
11155         return err;
11156 }
11157 #endif
11158
11159 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11160                                        struct cfg80211_registered_device *rdev)
11161 {
11162         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11163         int i, j, pat_len;
11164         struct cfg80211_coalesce_rules *rule;
11165
11166         if (!rdev->coalesce->n_rules)
11167                 return 0;
11168
11169         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11170         if (!nl_rules)
11171                 return -ENOBUFS;
11172
11173         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11174                 nl_rule = nla_nest_start(msg, i + 1);
11175                 if (!nl_rule)
11176                         return -ENOBUFS;
11177
11178                 rule = &rdev->coalesce->rules[i];
11179                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11180                                 rule->delay))
11181                         return -ENOBUFS;
11182
11183                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11184                                 rule->condition))
11185                         return -ENOBUFS;
11186
11187                 nl_pats = nla_nest_start(msg,
11188                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11189                 if (!nl_pats)
11190                         return -ENOBUFS;
11191
11192                 for (j = 0; j < rule->n_patterns; j++) {
11193                         nl_pat = nla_nest_start(msg, j + 1);
11194                         if (!nl_pat)
11195                                 return -ENOBUFS;
11196                         pat_len = rule->patterns[j].pattern_len;
11197                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11198                                     DIV_ROUND_UP(pat_len, 8),
11199                                     rule->patterns[j].mask) ||
11200                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11201                                     rule->patterns[j].pattern) ||
11202                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11203                                         rule->patterns[j].pkt_offset))
11204                                 return -ENOBUFS;
11205                         nla_nest_end(msg, nl_pat);
11206                 }
11207                 nla_nest_end(msg, nl_pats);
11208                 nla_nest_end(msg, nl_rule);
11209         }
11210         nla_nest_end(msg, nl_rules);
11211
11212         return 0;
11213 }
11214
11215 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11216 {
11217         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11218         struct sk_buff *msg;
11219         void *hdr;
11220
11221         if (!rdev->wiphy.coalesce)
11222                 return -EOPNOTSUPP;
11223
11224         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11225         if (!msg)
11226                 return -ENOMEM;
11227
11228         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11229                              NL80211_CMD_GET_COALESCE);
11230         if (!hdr)
11231                 goto nla_put_failure;
11232
11233         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11234                 goto nla_put_failure;
11235
11236         genlmsg_end(msg, hdr);
11237         return genlmsg_reply(msg, info);
11238
11239 nla_put_failure:
11240         nlmsg_free(msg);
11241         return -ENOBUFS;
11242 }
11243
11244 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11245 {
11246         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11247         int i, j;
11248         struct cfg80211_coalesce_rules *rule;
11249
11250         if (!coalesce)
11251                 return;
11252
11253         for (i = 0; i < coalesce->n_rules; i++) {
11254                 rule = &coalesce->rules[i];
11255                 for (j = 0; j < rule->n_patterns; j++)
11256                         kfree(rule->patterns[j].mask);
11257                 kfree(rule->patterns);
11258         }
11259         kfree(coalesce->rules);
11260         kfree(coalesce);
11261         rdev->coalesce = NULL;
11262 }
11263
11264 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11265                                        struct nlattr *rule,
11266                                        struct cfg80211_coalesce_rules *new_rule)
11267 {
11268         int err, i;
11269         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11270         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11271         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11272         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11273
11274         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11275                                nl80211_coalesce_policy, NULL);
11276         if (err)
11277                 return err;
11278
11279         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11280                 new_rule->delay =
11281                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11282         if (new_rule->delay > coalesce->max_delay)
11283                 return -EINVAL;
11284
11285         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11286                 new_rule->condition =
11287                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11288         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
11289             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
11290                 return -EINVAL;
11291
11292         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11293                 return -EINVAL;
11294
11295         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11296                             rem)
11297                 n_patterns++;
11298         if (n_patterns > coalesce->n_patterns)
11299                 return -EINVAL;
11300
11301         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11302                                      GFP_KERNEL);
11303         if (!new_rule->patterns)
11304                 return -ENOMEM;
11305
11306         new_rule->n_patterns = n_patterns;
11307         i = 0;
11308
11309         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11310                             rem) {
11311                 u8 *mask_pat;
11312
11313                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11314                                        nl80211_packet_pattern_policy, NULL);
11315                 if (err)
11316                         return err;
11317
11318                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11319                     !pat_tb[NL80211_PKTPAT_PATTERN])
11320                         return -EINVAL;
11321                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11322                 mask_len = DIV_ROUND_UP(pat_len, 8);
11323                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11324                         return -EINVAL;
11325                 if (pat_len > coalesce->pattern_max_len ||
11326                     pat_len < coalesce->pattern_min_len)
11327                         return -EINVAL;
11328
11329                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11330                         pkt_offset = 0;
11331                 else
11332                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11333                 if (pkt_offset > coalesce->max_pkt_offset)
11334                         return -EINVAL;
11335                 new_rule->patterns[i].pkt_offset = pkt_offset;
11336
11337                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11338                 if (!mask_pat)
11339                         return -ENOMEM;
11340
11341                 new_rule->patterns[i].mask = mask_pat;
11342                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11343                        mask_len);
11344
11345                 mask_pat += mask_len;
11346                 new_rule->patterns[i].pattern = mask_pat;
11347                 new_rule->patterns[i].pattern_len = pat_len;
11348                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11349                        pat_len);
11350                 i++;
11351         }
11352
11353         return 0;
11354 }
11355
11356 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11357 {
11358         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11359         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11360         struct cfg80211_coalesce new_coalesce = {};
11361         struct cfg80211_coalesce *n_coalesce;
11362         int err, rem_rule, n_rules = 0, i, j;
11363         struct nlattr *rule;
11364         struct cfg80211_coalesce_rules *tmp_rule;
11365
11366         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11367                 return -EOPNOTSUPP;
11368
11369         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11370                 cfg80211_rdev_free_coalesce(rdev);
11371                 rdev_set_coalesce(rdev, NULL);
11372                 return 0;
11373         }
11374
11375         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11376                             rem_rule)
11377                 n_rules++;
11378         if (n_rules > coalesce->n_rules)
11379                 return -EINVAL;
11380
11381         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11382                                      GFP_KERNEL);
11383         if (!new_coalesce.rules)
11384                 return -ENOMEM;
11385
11386         new_coalesce.n_rules = n_rules;
11387         i = 0;
11388
11389         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11390                             rem_rule) {
11391                 err = nl80211_parse_coalesce_rule(rdev, rule,
11392                                                   &new_coalesce.rules[i]);
11393                 if (err)
11394                         goto error;
11395
11396                 i++;
11397         }
11398
11399         err = rdev_set_coalesce(rdev, &new_coalesce);
11400         if (err)
11401                 goto error;
11402
11403         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11404         if (!n_coalesce) {
11405                 err = -ENOMEM;
11406                 goto error;
11407         }
11408         cfg80211_rdev_free_coalesce(rdev);
11409         rdev->coalesce = n_coalesce;
11410
11411         return 0;
11412 error:
11413         for (i = 0; i < new_coalesce.n_rules; i++) {
11414                 tmp_rule = &new_coalesce.rules[i];
11415                 for (j = 0; j < tmp_rule->n_patterns; j++)
11416                         kfree(tmp_rule->patterns[j].mask);
11417                 kfree(tmp_rule->patterns);
11418         }
11419         kfree(new_coalesce.rules);
11420
11421         return err;
11422 }
11423
11424 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11425 {
11426         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11427         struct net_device *dev = info->user_ptr[1];
11428         struct wireless_dev *wdev = dev->ieee80211_ptr;
11429         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11430         struct cfg80211_gtk_rekey_data rekey_data;
11431         int err;
11432
11433         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11434                 return -EINVAL;
11435
11436         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11437                                info->attrs[NL80211_ATTR_REKEY_DATA],
11438                                nl80211_rekey_policy, info->extack);
11439         if (err)
11440                 return err;
11441
11442         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11443             !tb[NL80211_REKEY_DATA_KCK])
11444                 return -EINVAL;
11445         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11446                 return -ERANGE;
11447         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11448                 return -ERANGE;
11449         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11450                 return -ERANGE;
11451
11452         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11453         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11454         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11455
11456         wdev_lock(wdev);
11457         if (!wdev->current_bss) {
11458                 err = -ENOTCONN;
11459                 goto out;
11460         }
11461
11462         if (!rdev->ops->set_rekey_data) {
11463                 err = -EOPNOTSUPP;
11464                 goto out;
11465         }
11466
11467         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11468  out:
11469         wdev_unlock(wdev);
11470         return err;
11471 }
11472
11473 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11474                                              struct genl_info *info)
11475 {
11476         struct net_device *dev = info->user_ptr[1];
11477         struct wireless_dev *wdev = dev->ieee80211_ptr;
11478
11479         if (wdev->iftype != NL80211_IFTYPE_AP &&
11480             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11481                 return -EINVAL;
11482
11483         if (wdev->ap_unexpected_nlportid)
11484                 return -EBUSY;
11485
11486         wdev->ap_unexpected_nlportid = info->snd_portid;
11487         return 0;
11488 }
11489
11490 static int nl80211_probe_client(struct sk_buff *skb,
11491                                 struct genl_info *info)
11492 {
11493         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11494         struct net_device *dev = info->user_ptr[1];
11495         struct wireless_dev *wdev = dev->ieee80211_ptr;
11496         struct sk_buff *msg;
11497         void *hdr;
11498         const u8 *addr;
11499         u64 cookie;
11500         int err;
11501
11502         if (wdev->iftype != NL80211_IFTYPE_AP &&
11503             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11504                 return -EOPNOTSUPP;
11505
11506         if (!info->attrs[NL80211_ATTR_MAC])
11507                 return -EINVAL;
11508
11509         if (!rdev->ops->probe_client)
11510                 return -EOPNOTSUPP;
11511
11512         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11513         if (!msg)
11514                 return -ENOMEM;
11515
11516         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11517                              NL80211_CMD_PROBE_CLIENT);
11518         if (!hdr) {
11519                 err = -ENOBUFS;
11520                 goto free_msg;
11521         }
11522
11523         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11524
11525         err = rdev_probe_client(rdev, dev, addr, &cookie);
11526         if (err)
11527                 goto free_msg;
11528
11529         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11530                               NL80211_ATTR_PAD))
11531                 goto nla_put_failure;
11532
11533         genlmsg_end(msg, hdr);
11534
11535         return genlmsg_reply(msg, info);
11536
11537  nla_put_failure:
11538         err = -ENOBUFS;
11539  free_msg:
11540         nlmsg_free(msg);
11541         return err;
11542 }
11543
11544 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11545 {
11546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11547         struct cfg80211_beacon_registration *reg, *nreg;
11548         int rv;
11549
11550         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11551                 return -EOPNOTSUPP;
11552
11553         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11554         if (!nreg)
11555                 return -ENOMEM;
11556
11557         /* First, check if already registered. */
11558         spin_lock_bh(&rdev->beacon_registrations_lock);
11559         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11560                 if (reg->nlportid == info->snd_portid) {
11561                         rv = -EALREADY;
11562                         goto out_err;
11563                 }
11564         }
11565         /* Add it to the list */
11566         nreg->nlportid = info->snd_portid;
11567         list_add(&nreg->list, &rdev->beacon_registrations);
11568
11569         spin_unlock_bh(&rdev->beacon_registrations_lock);
11570
11571         return 0;
11572 out_err:
11573         spin_unlock_bh(&rdev->beacon_registrations_lock);
11574         kfree(nreg);
11575         return rv;
11576 }
11577
11578 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11579 {
11580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11581         struct wireless_dev *wdev = info->user_ptr[1];
11582         int err;
11583
11584         if (!rdev->ops->start_p2p_device)
11585                 return -EOPNOTSUPP;
11586
11587         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11588                 return -EOPNOTSUPP;
11589
11590         if (wdev_running(wdev))
11591                 return 0;
11592
11593         if (rfkill_blocked(rdev->rfkill))
11594                 return -ERFKILL;
11595
11596         err = rdev_start_p2p_device(rdev, wdev);
11597         if (err)
11598                 return err;
11599
11600         wdev->is_running = true;
11601         rdev->opencount++;
11602
11603         return 0;
11604 }
11605
11606 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11607 {
11608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11609         struct wireless_dev *wdev = info->user_ptr[1];
11610
11611         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11612                 return -EOPNOTSUPP;
11613
11614         if (!rdev->ops->stop_p2p_device)
11615                 return -EOPNOTSUPP;
11616
11617         cfg80211_stop_p2p_device(rdev, wdev);
11618
11619         return 0;
11620 }
11621
11622 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11623 {
11624         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11625         struct wireless_dev *wdev = info->user_ptr[1];
11626         struct cfg80211_nan_conf conf = {};
11627         int err;
11628
11629         if (wdev->iftype != NL80211_IFTYPE_NAN)
11630                 return -EOPNOTSUPP;
11631
11632         if (wdev_running(wdev))
11633                 return -EEXIST;
11634
11635         if (rfkill_blocked(rdev->rfkill))
11636                 return -ERFKILL;
11637
11638         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11639                 return -EINVAL;
11640
11641         conf.master_pref =
11642                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11643         if (!conf.master_pref)
11644                 return -EINVAL;
11645
11646         if (info->attrs[NL80211_ATTR_BANDS]) {
11647                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11648
11649                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11650                         return -EOPNOTSUPP;
11651
11652                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11653                         return -EINVAL;
11654
11655                 conf.bands = bands;
11656         }
11657
11658         err = rdev_start_nan(rdev, wdev, &conf);
11659         if (err)
11660                 return err;
11661
11662         wdev->is_running = true;
11663         rdev->opencount++;
11664
11665         return 0;
11666 }
11667
11668 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11669 {
11670         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11671         struct wireless_dev *wdev = info->user_ptr[1];
11672
11673         if (wdev->iftype != NL80211_IFTYPE_NAN)
11674                 return -EOPNOTSUPP;
11675
11676         cfg80211_stop_nan(rdev, wdev);
11677
11678         return 0;
11679 }
11680
11681 static int validate_nan_filter(struct nlattr *filter_attr)
11682 {
11683         struct nlattr *attr;
11684         int len = 0, n_entries = 0, rem;
11685
11686         nla_for_each_nested(attr, filter_attr, rem) {
11687                 len += nla_len(attr);
11688                 n_entries++;
11689         }
11690
11691         if (len >= U8_MAX)
11692                 return -EINVAL;
11693
11694         return n_entries;
11695 }
11696
11697 static int handle_nan_filter(struct nlattr *attr_filter,
11698                              struct cfg80211_nan_func *func,
11699                              bool tx)
11700 {
11701         struct nlattr *attr;
11702         int n_entries, rem, i;
11703         struct cfg80211_nan_func_filter *filter;
11704
11705         n_entries = validate_nan_filter(attr_filter);
11706         if (n_entries < 0)
11707                 return n_entries;
11708
11709         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11710
11711         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11712         if (!filter)
11713                 return -ENOMEM;
11714
11715         i = 0;
11716         nla_for_each_nested(attr, attr_filter, rem) {
11717                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11718                 filter[i].len = nla_len(attr);
11719                 i++;
11720         }
11721         if (tx) {
11722                 func->num_tx_filters = n_entries;
11723                 func->tx_filters = filter;
11724         } else {
11725                 func->num_rx_filters = n_entries;
11726                 func->rx_filters = filter;
11727         }
11728
11729         return 0;
11730 }
11731
11732 static int nl80211_nan_add_func(struct sk_buff *skb,
11733                                 struct genl_info *info)
11734 {
11735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11736         struct wireless_dev *wdev = info->user_ptr[1];
11737         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11738         struct cfg80211_nan_func *func;
11739         struct sk_buff *msg = NULL;
11740         void *hdr = NULL;
11741         int err = 0;
11742
11743         if (wdev->iftype != NL80211_IFTYPE_NAN)
11744                 return -EOPNOTSUPP;
11745
11746         if (!wdev_running(wdev))
11747                 return -ENOTCONN;
11748
11749         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11750                 return -EINVAL;
11751
11752         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11753                                info->attrs[NL80211_ATTR_NAN_FUNC],
11754                                nl80211_nan_func_policy, info->extack);
11755         if (err)
11756                 return err;
11757
11758         func = kzalloc(sizeof(*func), GFP_KERNEL);
11759         if (!func)
11760                 return -ENOMEM;
11761
11762         func->cookie = wdev->wiphy->cookie_counter++;
11763
11764         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11765             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11766                 err = -EINVAL;
11767                 goto out;
11768         }
11769
11770
11771         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11772
11773         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11774                 err = -EINVAL;
11775                 goto out;
11776         }
11777
11778         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11779                sizeof(func->service_id));
11780
11781         func->close_range =
11782                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11783
11784         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11785                 func->serv_spec_info_len =
11786                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11787                 func->serv_spec_info =
11788                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11789                                 func->serv_spec_info_len,
11790                                 GFP_KERNEL);
11791                 if (!func->serv_spec_info) {
11792                         err = -ENOMEM;
11793                         goto out;
11794                 }
11795         }
11796
11797         if (tb[NL80211_NAN_FUNC_TTL])
11798                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11799
11800         switch (func->type) {
11801         case NL80211_NAN_FUNC_PUBLISH:
11802                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11803                         err = -EINVAL;
11804                         goto out;
11805                 }
11806
11807                 func->publish_type =
11808                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11809                 func->publish_bcast =
11810                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11811
11812                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11813                         func->publish_bcast) {
11814                         err = -EINVAL;
11815                         goto out;
11816                 }
11817                 break;
11818         case NL80211_NAN_FUNC_SUBSCRIBE:
11819                 func->subscribe_active =
11820                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11821                 break;
11822         case NL80211_NAN_FUNC_FOLLOW_UP:
11823                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11824                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11825                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11826                         err = -EINVAL;
11827                         goto out;
11828                 }
11829
11830                 func->followup_id =
11831                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11832                 func->followup_reqid =
11833                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11834                 memcpy(func->followup_dest.addr,
11835                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11836                        sizeof(func->followup_dest.addr));
11837                 if (func->ttl) {
11838                         err = -EINVAL;
11839                         goto out;
11840                 }
11841                 break;
11842         default:
11843                 err = -EINVAL;
11844                 goto out;
11845         }
11846
11847         if (tb[NL80211_NAN_FUNC_SRF]) {
11848                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11849
11850                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11851                                        tb[NL80211_NAN_FUNC_SRF],
11852                                        nl80211_nan_srf_policy, info->extack);
11853                 if (err)
11854                         goto out;
11855
11856                 func->srf_include =
11857                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11858
11859                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11860                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11861                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11862                                 err = -EINVAL;
11863                                 goto out;
11864                         }
11865
11866                         func->srf_bf_len =
11867                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11868                         func->srf_bf =
11869                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11870                                         func->srf_bf_len, GFP_KERNEL);
11871                         if (!func->srf_bf) {
11872                                 err = -ENOMEM;
11873                                 goto out;
11874                         }
11875
11876                         func->srf_bf_idx =
11877                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11878                 } else {
11879                         struct nlattr *attr, *mac_attr =
11880                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11881                         int n_entries, rem, i = 0;
11882
11883                         if (!mac_attr) {
11884                                 err = -EINVAL;
11885                                 goto out;
11886                         }
11887
11888                         n_entries = validate_acl_mac_addrs(mac_attr);
11889                         if (n_entries <= 0) {
11890                                 err = -EINVAL;
11891                                 goto out;
11892                         }
11893
11894                         func->srf_num_macs = n_entries;
11895                         func->srf_macs =
11896                                 kcalloc(n_entries, sizeof(*func->srf_macs),
11897                                         GFP_KERNEL);
11898                         if (!func->srf_macs) {
11899                                 err = -ENOMEM;
11900                                 goto out;
11901                         }
11902
11903                         nla_for_each_nested(attr, mac_attr, rem)
11904                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11905                                        sizeof(*func->srf_macs));
11906                 }
11907         }
11908
11909         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11910                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11911                                         func, true);
11912                 if (err)
11913                         goto out;
11914         }
11915
11916         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11917                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11918                                         func, false);
11919                 if (err)
11920                         goto out;
11921         }
11922
11923         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11924         if (!msg) {
11925                 err = -ENOMEM;
11926                 goto out;
11927         }
11928
11929         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11930                              NL80211_CMD_ADD_NAN_FUNCTION);
11931         /* This can't really happen - we just allocated 4KB */
11932         if (WARN_ON(!hdr)) {
11933                 err = -ENOMEM;
11934                 goto out;
11935         }
11936
11937         err = rdev_add_nan_func(rdev, wdev, func);
11938 out:
11939         if (err < 0) {
11940                 cfg80211_free_nan_func(func);
11941                 nlmsg_free(msg);
11942                 return err;
11943         }
11944
11945         /* propagate the instance id and cookie to userspace  */
11946         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11947                               NL80211_ATTR_PAD))
11948                 goto nla_put_failure;
11949
11950         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11951         if (!func_attr)
11952                 goto nla_put_failure;
11953
11954         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11955                        func->instance_id))
11956                 goto nla_put_failure;
11957
11958         nla_nest_end(msg, func_attr);
11959
11960         genlmsg_end(msg, hdr);
11961         return genlmsg_reply(msg, info);
11962
11963 nla_put_failure:
11964         nlmsg_free(msg);
11965         return -ENOBUFS;
11966 }
11967
11968 static int nl80211_nan_del_func(struct sk_buff *skb,
11969                                struct genl_info *info)
11970 {
11971         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11972         struct wireless_dev *wdev = info->user_ptr[1];
11973         u64 cookie;
11974
11975         if (wdev->iftype != NL80211_IFTYPE_NAN)
11976                 return -EOPNOTSUPP;
11977
11978         if (!wdev_running(wdev))
11979                 return -ENOTCONN;
11980
11981         if (!info->attrs[NL80211_ATTR_COOKIE])
11982                 return -EINVAL;
11983
11984         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11985
11986         rdev_del_nan_func(rdev, wdev, cookie);
11987
11988         return 0;
11989 }
11990
11991 static int nl80211_nan_change_config(struct sk_buff *skb,
11992                                      struct genl_info *info)
11993 {
11994         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11995         struct wireless_dev *wdev = info->user_ptr[1];
11996         struct cfg80211_nan_conf conf = {};
11997         u32 changed = 0;
11998
11999         if (wdev->iftype != NL80211_IFTYPE_NAN)
12000                 return -EOPNOTSUPP;
12001
12002         if (!wdev_running(wdev))
12003                 return -ENOTCONN;
12004
12005         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12006                 conf.master_pref =
12007                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12008                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12009                         return -EINVAL;
12010
12011                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12012         }
12013
12014         if (info->attrs[NL80211_ATTR_BANDS]) {
12015                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12016
12017                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12018                         return -EOPNOTSUPP;
12019
12020                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12021                         return -EINVAL;
12022
12023                 conf.bands = bands;
12024                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12025         }
12026
12027         if (!changed)
12028                 return -EINVAL;
12029
12030         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12031 }
12032
12033 void cfg80211_nan_match(struct wireless_dev *wdev,
12034                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12035 {
12036         struct wiphy *wiphy = wdev->wiphy;
12037         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12038         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12039         struct sk_buff *msg;
12040         void *hdr;
12041
12042         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12043                 return;
12044
12045         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12046         if (!msg)
12047                 return;
12048
12049         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12050         if (!hdr) {
12051                 nlmsg_free(msg);
12052                 return;
12053         }
12054
12055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12056             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12057                                          wdev->netdev->ifindex)) ||
12058             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12059                               NL80211_ATTR_PAD))
12060                 goto nla_put_failure;
12061
12062         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12063                               NL80211_ATTR_PAD) ||
12064             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12065                 goto nla_put_failure;
12066
12067         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12068         if (!match_attr)
12069                 goto nla_put_failure;
12070
12071         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12072         if (!local_func_attr)
12073                 goto nla_put_failure;
12074
12075         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12076                 goto nla_put_failure;
12077
12078         nla_nest_end(msg, local_func_attr);
12079
12080         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12081         if (!peer_func_attr)
12082                 goto nla_put_failure;
12083
12084         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12085             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12086                 goto nla_put_failure;
12087
12088         if (match->info && match->info_len &&
12089             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12090                     match->info))
12091                 goto nla_put_failure;
12092
12093         nla_nest_end(msg, peer_func_attr);
12094         nla_nest_end(msg, match_attr);
12095         genlmsg_end(msg, hdr);
12096
12097         if (!wdev->owner_nlportid)
12098                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12099                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12100         else
12101                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12102                                 wdev->owner_nlportid);
12103
12104         return;
12105
12106 nla_put_failure:
12107         nlmsg_free(msg);
12108 }
12109 EXPORT_SYMBOL(cfg80211_nan_match);
12110
12111 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12112                                   u8 inst_id,
12113                                   enum nl80211_nan_func_term_reason reason,
12114                                   u64 cookie, gfp_t gfp)
12115 {
12116         struct wiphy *wiphy = wdev->wiphy;
12117         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12118         struct sk_buff *msg;
12119         struct nlattr *func_attr;
12120         void *hdr;
12121
12122         if (WARN_ON(!inst_id))
12123                 return;
12124
12125         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12126         if (!msg)
12127                 return;
12128
12129         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12130         if (!hdr) {
12131                 nlmsg_free(msg);
12132                 return;
12133         }
12134
12135         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12136             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12137                                          wdev->netdev->ifindex)) ||
12138             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12139                               NL80211_ATTR_PAD))
12140                 goto nla_put_failure;
12141
12142         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12143                               NL80211_ATTR_PAD))
12144                 goto nla_put_failure;
12145
12146         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12147         if (!func_attr)
12148                 goto nla_put_failure;
12149
12150         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12151             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12152                 goto nla_put_failure;
12153
12154         nla_nest_end(msg, func_attr);
12155         genlmsg_end(msg, hdr);
12156
12157         if (!wdev->owner_nlportid)
12158                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12159                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12160         else
12161                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12162                                 wdev->owner_nlportid);
12163
12164         return;
12165
12166 nla_put_failure:
12167         nlmsg_free(msg);
12168 }
12169 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12170
12171 static int nl80211_get_protocol_features(struct sk_buff *skb,
12172                                          struct genl_info *info)
12173 {
12174         void *hdr;
12175         struct sk_buff *msg;
12176
12177         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12178         if (!msg)
12179                 return -ENOMEM;
12180
12181         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12182                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12183         if (!hdr)
12184                 goto nla_put_failure;
12185
12186         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12187                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12188                 goto nla_put_failure;
12189
12190         genlmsg_end(msg, hdr);
12191         return genlmsg_reply(msg, info);
12192
12193  nla_put_failure:
12194         kfree_skb(msg);
12195         return -ENOBUFS;
12196 }
12197
12198 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12199 {
12200         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12201         struct cfg80211_update_ft_ies_params ft_params;
12202         struct net_device *dev = info->user_ptr[1];
12203
12204         if (!rdev->ops->update_ft_ies)
12205                 return -EOPNOTSUPP;
12206
12207         if (!info->attrs[NL80211_ATTR_MDID] ||
12208             !info->attrs[NL80211_ATTR_IE] ||
12209             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
12210                 return -EINVAL;
12211
12212         memset(&ft_params, 0, sizeof(ft_params));
12213         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12214         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12215         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12216
12217         return rdev_update_ft_ies(rdev, dev, &ft_params);
12218 }
12219
12220 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12221                                        struct genl_info *info)
12222 {
12223         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12224         struct wireless_dev *wdev = info->user_ptr[1];
12225         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12226         u16 duration;
12227         int ret;
12228
12229         if (!rdev->ops->crit_proto_start)
12230                 return -EOPNOTSUPP;
12231
12232         if (WARN_ON(!rdev->ops->crit_proto_stop))
12233                 return -EINVAL;
12234
12235         if (rdev->crit_proto_nlportid)
12236                 return -EBUSY;
12237
12238         /* determine protocol if provided */
12239         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12240                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12241
12242         if (proto >= NUM_NL80211_CRIT_PROTO)
12243                 return -EINVAL;
12244
12245         /* timeout must be provided */
12246         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12247                 return -EINVAL;
12248
12249         duration =
12250                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12251
12252         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12253                 return -ERANGE;
12254
12255         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12256         if (!ret)
12257                 rdev->crit_proto_nlportid = info->snd_portid;
12258
12259         return ret;
12260 }
12261
12262 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12263                                       struct genl_info *info)
12264 {
12265         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12266         struct wireless_dev *wdev = info->user_ptr[1];
12267
12268         if (!rdev->ops->crit_proto_stop)
12269                 return -EOPNOTSUPP;
12270
12271         if (rdev->crit_proto_nlportid) {
12272                 rdev->crit_proto_nlportid = 0;
12273                 rdev_crit_proto_stop(rdev, wdev);
12274         }
12275         return 0;
12276 }
12277
12278 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12279 {
12280         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12281         struct wireless_dev *wdev =
12282                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12283         int i, err;
12284         u32 vid, subcmd;
12285
12286         if (!rdev->wiphy.vendor_commands)
12287                 return -EOPNOTSUPP;
12288
12289         if (IS_ERR(wdev)) {
12290                 err = PTR_ERR(wdev);
12291                 if (err != -EINVAL)
12292                         return err;
12293                 wdev = NULL;
12294         } else if (wdev->wiphy != &rdev->wiphy) {
12295                 return -EINVAL;
12296         }
12297
12298         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12299             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12300                 return -EINVAL;
12301
12302         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12303         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12304         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12305                 const struct wiphy_vendor_command *vcmd;
12306                 void *data = NULL;
12307                 int len = 0;
12308
12309                 vcmd = &rdev->wiphy.vendor_commands[i];
12310
12311                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12312                         continue;
12313
12314                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12315                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12316                         if (!wdev)
12317                                 return -EINVAL;
12318                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12319                             !wdev->netdev)
12320                                 return -EINVAL;
12321
12322                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12323                                 if (!wdev_running(wdev))
12324                                         return -ENETDOWN;
12325                         }
12326
12327                         if (!vcmd->doit)
12328                                 return -EOPNOTSUPP;
12329                 } else {
12330                         wdev = NULL;
12331                 }
12332
12333                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12334                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12335                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12336                 }
12337
12338                 rdev->cur_cmd_info = info;
12339                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12340                                                           data, len);
12341                 rdev->cur_cmd_info = NULL;
12342                 return err;
12343         }
12344
12345         return -EOPNOTSUPP;
12346 }
12347
12348 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12349                                        struct netlink_callback *cb,
12350                                        struct cfg80211_registered_device **rdev,
12351                                        struct wireless_dev **wdev)
12352 {
12353         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12354         u32 vid, subcmd;
12355         unsigned int i;
12356         int vcmd_idx = -1;
12357         int err;
12358         void *data = NULL;
12359         unsigned int data_len = 0;
12360
12361         if (cb->args[0]) {
12362                 /* subtract the 1 again here */
12363                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12364                 struct wireless_dev *tmp;
12365
12366                 if (!wiphy)
12367                         return -ENODEV;
12368                 *rdev = wiphy_to_rdev(wiphy);
12369                 *wdev = NULL;
12370
12371                 if (cb->args[1]) {
12372                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12373                                 if (tmp->identifier == cb->args[1] - 1) {
12374                                         *wdev = tmp;
12375                                         break;
12376                                 }
12377                         }
12378                 }
12379
12380                 /* keep rtnl locked in successful case */
12381                 return 0;
12382         }
12383
12384         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12385                           nl80211_fam.maxattr, nl80211_policy, NULL);
12386         if (err)
12387                 return err;
12388
12389         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12390             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12391                 return -EINVAL;
12392
12393         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12394         if (IS_ERR(*wdev))
12395                 *wdev = NULL;
12396
12397         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12398         if (IS_ERR(*rdev))
12399                 return PTR_ERR(*rdev);
12400
12401         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12402         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12403
12404         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12405                 const struct wiphy_vendor_command *vcmd;
12406
12407                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12408
12409                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12410                         continue;
12411
12412                 if (!vcmd->dumpit)
12413                         return -EOPNOTSUPP;
12414
12415                 vcmd_idx = i;
12416                 break;
12417         }
12418
12419         if (vcmd_idx < 0)
12420                 return -EOPNOTSUPP;
12421
12422         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12423                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12424                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12425         }
12426
12427         /* 0 is the first index - add 1 to parse only once */
12428         cb->args[0] = (*rdev)->wiphy_idx + 1;
12429         /* add 1 to know if it was NULL */
12430         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12431         cb->args[2] = vcmd_idx;
12432         cb->args[3] = (unsigned long)data;
12433         cb->args[4] = data_len;
12434
12435         /* keep rtnl locked in successful case */
12436         return 0;
12437 }
12438
12439 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12440                                    struct netlink_callback *cb)
12441 {
12442         struct cfg80211_registered_device *rdev;
12443         struct wireless_dev *wdev;
12444         unsigned int vcmd_idx;
12445         const struct wiphy_vendor_command *vcmd;
12446         void *data;
12447         int data_len;
12448         int err;
12449         struct nlattr *vendor_data;
12450
12451         rtnl_lock();
12452         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12453         if (err)
12454                 goto out;
12455
12456         vcmd_idx = cb->args[2];
12457         data = (void *)cb->args[3];
12458         data_len = cb->args[4];
12459         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12460
12461         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12462                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12463                 if (!wdev) {
12464                         err = -EINVAL;
12465                         goto out;
12466                 }
12467                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12468                     !wdev->netdev) {
12469                         err = -EINVAL;
12470                         goto out;
12471                 }
12472
12473                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12474                         if (!wdev_running(wdev)) {
12475                                 err = -ENETDOWN;
12476                                 goto out;
12477                         }
12478                 }
12479         }
12480
12481         while (1) {
12482                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12483                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12484                                            NL80211_CMD_VENDOR);
12485                 if (!hdr)
12486                         break;
12487
12488                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12489                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12490                                                wdev_id(wdev),
12491                                                NL80211_ATTR_PAD))) {
12492                         genlmsg_cancel(skb, hdr);
12493                         break;
12494                 }
12495
12496                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12497                 if (!vendor_data) {
12498                         genlmsg_cancel(skb, hdr);
12499                         break;
12500                 }
12501
12502                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12503                                    (unsigned long *)&cb->args[5]);
12504                 nla_nest_end(skb, vendor_data);
12505
12506                 if (err == -ENOBUFS || err == -ENOENT) {
12507                         genlmsg_cancel(skb, hdr);
12508                         break;
12509                 } else if (err) {
12510                         genlmsg_cancel(skb, hdr);
12511                         goto out;
12512                 }
12513
12514                 genlmsg_end(skb, hdr);
12515         }
12516
12517         err = skb->len;
12518  out:
12519         rtnl_unlock();
12520         return err;
12521 }
12522
12523 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12524                                            enum nl80211_commands cmd,
12525                                            enum nl80211_attrs attr,
12526                                            int approxlen)
12527 {
12528         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12529
12530         if (WARN_ON(!rdev->cur_cmd_info))
12531                 return NULL;
12532
12533         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12534                                            rdev->cur_cmd_info->snd_portid,
12535                                            rdev->cur_cmd_info->snd_seq,
12536                                            cmd, attr, NULL, GFP_KERNEL);
12537 }
12538 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12539
12540 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12541 {
12542         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12543         void *hdr = ((void **)skb->cb)[1];
12544         struct nlattr *data = ((void **)skb->cb)[2];
12545
12546         /* clear CB data for netlink core to own from now on */
12547         memset(skb->cb, 0, sizeof(skb->cb));
12548
12549         if (WARN_ON(!rdev->cur_cmd_info)) {
12550                 kfree_skb(skb);
12551                 return -EINVAL;
12552         }
12553
12554         nla_nest_end(skb, data);
12555         genlmsg_end(skb, hdr);
12556         return genlmsg_reply(skb, rdev->cur_cmd_info);
12557 }
12558 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12559
12560 static int nl80211_set_qos_map(struct sk_buff *skb,
12561                                struct genl_info *info)
12562 {
12563         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12564         struct cfg80211_qos_map *qos_map = NULL;
12565         struct net_device *dev = info->user_ptr[1];
12566         u8 *pos, len, num_des, des_len, des;
12567         int ret;
12568
12569         if (!rdev->ops->set_qos_map)
12570                 return -EOPNOTSUPP;
12571
12572         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12573                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12574                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12575
12576                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12577                     len > IEEE80211_QOS_MAP_LEN_MAX)
12578                         return -EINVAL;
12579
12580                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12581                 if (!qos_map)
12582                         return -ENOMEM;
12583
12584                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12585                 if (num_des) {
12586                         des_len = num_des *
12587                                 sizeof(struct cfg80211_dscp_exception);
12588                         memcpy(qos_map->dscp_exception, pos, des_len);
12589                         qos_map->num_des = num_des;
12590                         for (des = 0; des < num_des; des++) {
12591                                 if (qos_map->dscp_exception[des].up > 7) {
12592                                         kfree(qos_map);
12593                                         return -EINVAL;
12594                                 }
12595                         }
12596                         pos += des_len;
12597                 }
12598                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12599         }
12600
12601         wdev_lock(dev->ieee80211_ptr);
12602         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12603         if (!ret)
12604                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12605         wdev_unlock(dev->ieee80211_ptr);
12606
12607         kfree(qos_map);
12608         return ret;
12609 }
12610
12611 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12612 {
12613         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12614         struct net_device *dev = info->user_ptr[1];
12615         struct wireless_dev *wdev = dev->ieee80211_ptr;
12616         const u8 *peer;
12617         u8 tsid, up;
12618         u16 admitted_time = 0;
12619         int err;
12620
12621         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12622                 return -EOPNOTSUPP;
12623
12624         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12625             !info->attrs[NL80211_ATTR_USER_PRIO])
12626                 return -EINVAL;
12627
12628         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12629         if (tsid >= IEEE80211_NUM_TIDS)
12630                 return -EINVAL;
12631
12632         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12633         if (up >= IEEE80211_NUM_UPS)
12634                 return -EINVAL;
12635
12636         /* WMM uses TIDs 0-7 even for TSPEC */
12637         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12638                 /* TODO: handle 802.11 TSPEC/admission control
12639                  * need more attributes for that (e.g. BA session requirement);
12640                  * change the WMM adminssion test above to allow both then
12641                  */
12642                 return -EINVAL;
12643         }
12644
12645         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12646
12647         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12648                 admitted_time =
12649                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12650                 if (!admitted_time)
12651                         return -EINVAL;
12652         }
12653
12654         wdev_lock(wdev);
12655         switch (wdev->iftype) {
12656         case NL80211_IFTYPE_STATION:
12657         case NL80211_IFTYPE_P2P_CLIENT:
12658                 if (wdev->current_bss)
12659                         break;
12660                 err = -ENOTCONN;
12661                 goto out;
12662         default:
12663                 err = -EOPNOTSUPP;
12664                 goto out;
12665         }
12666
12667         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12668
12669  out:
12670         wdev_unlock(wdev);
12671         return err;
12672 }
12673
12674 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12675 {
12676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12677         struct net_device *dev = info->user_ptr[1];
12678         struct wireless_dev *wdev = dev->ieee80211_ptr;
12679         const u8 *peer;
12680         u8 tsid;
12681         int err;
12682
12683         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12684                 return -EINVAL;
12685
12686         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12687         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12688
12689         wdev_lock(wdev);
12690         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12691         wdev_unlock(wdev);
12692
12693         return err;
12694 }
12695
12696 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12697                                        struct genl_info *info)
12698 {
12699         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12700         struct net_device *dev = info->user_ptr[1];
12701         struct wireless_dev *wdev = dev->ieee80211_ptr;
12702         struct cfg80211_chan_def chandef = {};
12703         const u8 *addr;
12704         u8 oper_class;
12705         int err;
12706
12707         if (!rdev->ops->tdls_channel_switch ||
12708             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12709                 return -EOPNOTSUPP;
12710
12711         switch (dev->ieee80211_ptr->iftype) {
12712         case NL80211_IFTYPE_STATION:
12713         case NL80211_IFTYPE_P2P_CLIENT:
12714                 break;
12715         default:
12716                 return -EOPNOTSUPP;
12717         }
12718
12719         if (!info->attrs[NL80211_ATTR_MAC] ||
12720             !info->attrs[NL80211_ATTR_OPER_CLASS])
12721                 return -EINVAL;
12722
12723         err = nl80211_parse_chandef(rdev, info, &chandef);
12724         if (err)
12725                 return err;
12726
12727         /*
12728          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12729          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12730          * specification is not defined for them.
12731          */
12732         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12733             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12734             chandef.width != NL80211_CHAN_WIDTH_20)
12735                 return -EINVAL;
12736
12737         /* we will be active on the TDLS link */
12738         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12739                                            wdev->iftype))
12740                 return -EINVAL;
12741
12742         /* don't allow switching to DFS channels */
12743         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12744                 return -EINVAL;
12745
12746         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12747         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12748
12749         wdev_lock(wdev);
12750         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12751         wdev_unlock(wdev);
12752
12753         return err;
12754 }
12755
12756 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12757                                               struct genl_info *info)
12758 {
12759         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12760         struct net_device *dev = info->user_ptr[1];
12761         struct wireless_dev *wdev = dev->ieee80211_ptr;
12762         const u8 *addr;
12763
12764         if (!rdev->ops->tdls_channel_switch ||
12765             !rdev->ops->tdls_cancel_channel_switch ||
12766             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12767                 return -EOPNOTSUPP;
12768
12769         switch (dev->ieee80211_ptr->iftype) {
12770         case NL80211_IFTYPE_STATION:
12771         case NL80211_IFTYPE_P2P_CLIENT:
12772                 break;
12773         default:
12774                 return -EOPNOTSUPP;
12775         }
12776
12777         if (!info->attrs[NL80211_ATTR_MAC])
12778                 return -EINVAL;
12779
12780         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12781
12782         wdev_lock(wdev);
12783         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12784         wdev_unlock(wdev);
12785
12786         return 0;
12787 }
12788
12789 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12790                                             struct genl_info *info)
12791 {
12792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12793         struct net_device *dev = info->user_ptr[1];
12794         struct wireless_dev *wdev = dev->ieee80211_ptr;
12795         const struct nlattr *nla;
12796         bool enabled;
12797
12798         if (!rdev->ops->set_multicast_to_unicast)
12799                 return -EOPNOTSUPP;
12800
12801         if (wdev->iftype != NL80211_IFTYPE_AP &&
12802             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12803                 return -EOPNOTSUPP;
12804
12805         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12806         enabled = nla_get_flag(nla);
12807
12808         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12809 }
12810
12811 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12812 {
12813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12814         struct net_device *dev = info->user_ptr[1];
12815         struct wireless_dev *wdev = dev->ieee80211_ptr;
12816         struct cfg80211_pmk_conf pmk_conf = {};
12817         int ret;
12818
12819         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12820             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12821                 return -EOPNOTSUPP;
12822
12823         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12824                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12825                 return -EOPNOTSUPP;
12826
12827         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12828                 return -EINVAL;
12829
12830         wdev_lock(wdev);
12831         if (!wdev->current_bss) {
12832                 ret = -ENOTCONN;
12833                 goto out;
12834         }
12835
12836         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12837         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12838                 ret = -EINVAL;
12839                 goto out;
12840         }
12841
12842         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12843         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12844         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12845             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12846                 ret = -EINVAL;
12847                 goto out;
12848         }
12849
12850         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12851                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12852
12853                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12854                         ret = -EINVAL;
12855                         goto out;
12856                 }
12857
12858                 pmk_conf.pmk_r0_name =
12859                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12860         }
12861
12862         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12863 out:
12864         wdev_unlock(wdev);
12865         return ret;
12866 }
12867
12868 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12869 {
12870         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12871         struct net_device *dev = info->user_ptr[1];
12872         struct wireless_dev *wdev = dev->ieee80211_ptr;
12873         const u8 *aa;
12874         int ret;
12875
12876         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12877             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12878                 return -EOPNOTSUPP;
12879
12880         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12881                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12882                 return -EOPNOTSUPP;
12883
12884         if (!info->attrs[NL80211_ATTR_MAC])
12885                 return -EINVAL;
12886
12887         wdev_lock(wdev);
12888         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12889         ret = rdev_del_pmk(rdev, dev, aa);
12890         wdev_unlock(wdev);
12891
12892         return ret;
12893 }
12894
12895 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12896 {
12897         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12898         struct net_device *dev = info->user_ptr[1];
12899         struct cfg80211_external_auth_params params;
12900
12901         if (!rdev->ops->external_auth)
12902                 return -EOPNOTSUPP;
12903
12904         if (!info->attrs[NL80211_ATTR_SSID])
12905                 return -EINVAL;
12906
12907         if (!info->attrs[NL80211_ATTR_BSSID])
12908                 return -EINVAL;
12909
12910         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12911                 return -EINVAL;
12912
12913         memset(&params, 0, sizeof(params));
12914
12915         params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12916         if (params.ssid.ssid_len == 0 ||
12917             params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12918                 return -EINVAL;
12919         memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12920                params.ssid.ssid_len);
12921
12922         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12923                ETH_ALEN);
12924
12925         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12926
12927         return rdev_external_auth(rdev, dev, &params);
12928 }
12929
12930 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12931 {
12932         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12933         struct net_device *dev = info->user_ptr[1];
12934         struct wireless_dev *wdev = dev->ieee80211_ptr;
12935         const u8 *buf;
12936         size_t len;
12937         u8 *dest;
12938         u16 proto;
12939         bool noencrypt;
12940         int err;
12941
12942         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12943                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12944                 return -EOPNOTSUPP;
12945
12946         if (!rdev->ops->tx_control_port)
12947                 return -EOPNOTSUPP;
12948
12949         if (!info->attrs[NL80211_ATTR_FRAME] ||
12950             !info->attrs[NL80211_ATTR_MAC] ||
12951             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12952                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12953                 return -EINVAL;
12954         }
12955
12956         wdev_lock(wdev);
12957
12958         switch (wdev->iftype) {
12959         case NL80211_IFTYPE_AP:
12960         case NL80211_IFTYPE_P2P_GO:
12961         case NL80211_IFTYPE_MESH_POINT:
12962                 break;
12963         case NL80211_IFTYPE_ADHOC:
12964         case NL80211_IFTYPE_STATION:
12965         case NL80211_IFTYPE_P2P_CLIENT:
12966                 if (wdev->current_bss)
12967                         break;
12968                 err = -ENOTCONN;
12969                 goto out;
12970         default:
12971                 err = -EOPNOTSUPP;
12972                 goto out;
12973         }
12974
12975         wdev_unlock(wdev);
12976
12977         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12978         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12979         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12980         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12981         noencrypt =
12982                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12983
12984         return rdev_tx_control_port(rdev, dev, buf, len,
12985                                     dest, cpu_to_be16(proto), noencrypt);
12986
12987  out:
12988         wdev_unlock(wdev);
12989         return err;
12990 }
12991
12992 #define NL80211_FLAG_NEED_WIPHY         0x01
12993 #define NL80211_FLAG_NEED_NETDEV        0x02
12994 #define NL80211_FLAG_NEED_RTNL          0x04
12995 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
12996 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
12997                                          NL80211_FLAG_CHECK_NETDEV_UP)
12998 #define NL80211_FLAG_NEED_WDEV          0x10
12999 /* If a netdev is associated, it must be UP, P2P must be started */
13000 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13001                                          NL80211_FLAG_CHECK_NETDEV_UP)
13002 #define NL80211_FLAG_CLEAR_SKB          0x20
13003
13004 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13005                             struct genl_info *info)
13006 {
13007         struct cfg80211_registered_device *rdev;
13008         struct wireless_dev *wdev;
13009         struct net_device *dev;
13010         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13011
13012         if (rtnl)
13013                 rtnl_lock();
13014
13015         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13016                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13017                 if (IS_ERR(rdev)) {
13018                         if (rtnl)
13019                                 rtnl_unlock();
13020                         return PTR_ERR(rdev);
13021                 }
13022                 info->user_ptr[0] = rdev;
13023         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13024                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13025                 ASSERT_RTNL();
13026
13027                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13028                                                   info->attrs);
13029                 if (IS_ERR(wdev)) {
13030                         if (rtnl)
13031                                 rtnl_unlock();
13032                         return PTR_ERR(wdev);
13033                 }
13034
13035                 dev = wdev->netdev;
13036                 rdev = wiphy_to_rdev(wdev->wiphy);
13037
13038                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13039                         if (!dev) {
13040                                 if (rtnl)
13041                                         rtnl_unlock();
13042                                 return -EINVAL;
13043                         }
13044
13045                         info->user_ptr[1] = dev;
13046                 } else {
13047                         info->user_ptr[1] = wdev;
13048                 }
13049
13050                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13051                     !wdev_running(wdev)) {
13052                         if (rtnl)
13053                                 rtnl_unlock();
13054                         return -ENETDOWN;
13055                 }
13056
13057                 if (dev)
13058                         dev_hold(dev);
13059
13060                 info->user_ptr[0] = rdev;
13061         }
13062
13063         return 0;
13064 }
13065
13066 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13067                               struct genl_info *info)
13068 {
13069         if (info->user_ptr[1]) {
13070                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13071                         struct wireless_dev *wdev = info->user_ptr[1];
13072
13073                         if (wdev->netdev)
13074                                 dev_put(wdev->netdev);
13075                 } else {
13076                         dev_put(info->user_ptr[1]);
13077                 }
13078         }
13079
13080         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13081                 rtnl_unlock();
13082
13083         /* If needed, clear the netlink message payload from the SKB
13084          * as it might contain key data that shouldn't stick around on
13085          * the heap after the SKB is freed. The netlink message header
13086          * is still needed for further processing, so leave it intact.
13087          */
13088         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13089                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13090
13091                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13092         }
13093 }
13094
13095 static const struct genl_ops nl80211_ops[] = {
13096         {
13097                 .cmd = NL80211_CMD_GET_WIPHY,
13098                 .doit = nl80211_get_wiphy,
13099                 .dumpit = nl80211_dump_wiphy,
13100                 .done = nl80211_dump_wiphy_done,
13101                 .policy = nl80211_policy,
13102                 /* can be retrieved by unprivileged users */
13103                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13104                                   NL80211_FLAG_NEED_RTNL,
13105         },
13106         {
13107                 .cmd = NL80211_CMD_SET_WIPHY,
13108                 .doit = nl80211_set_wiphy,
13109                 .policy = nl80211_policy,
13110                 .flags = GENL_UNS_ADMIN_PERM,
13111                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13112         },
13113         {
13114                 .cmd = NL80211_CMD_GET_INTERFACE,
13115                 .doit = nl80211_get_interface,
13116                 .dumpit = nl80211_dump_interface,
13117                 .policy = nl80211_policy,
13118                 /* can be retrieved by unprivileged users */
13119                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13120                                   NL80211_FLAG_NEED_RTNL,
13121         },
13122         {
13123                 .cmd = NL80211_CMD_SET_INTERFACE,
13124                 .doit = nl80211_set_interface,
13125                 .policy = nl80211_policy,
13126                 .flags = GENL_UNS_ADMIN_PERM,
13127                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13128                                   NL80211_FLAG_NEED_RTNL,
13129         },
13130         {
13131                 .cmd = NL80211_CMD_NEW_INTERFACE,
13132                 .doit = nl80211_new_interface,
13133                 .policy = nl80211_policy,
13134                 .flags = GENL_UNS_ADMIN_PERM,
13135                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13136                                   NL80211_FLAG_NEED_RTNL,
13137         },
13138         {
13139                 .cmd = NL80211_CMD_DEL_INTERFACE,
13140                 .doit = nl80211_del_interface,
13141                 .policy = nl80211_policy,
13142                 .flags = GENL_UNS_ADMIN_PERM,
13143                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13144                                   NL80211_FLAG_NEED_RTNL,
13145         },
13146         {
13147                 .cmd = NL80211_CMD_GET_KEY,
13148                 .doit = nl80211_get_key,
13149                 .policy = nl80211_policy,
13150                 .flags = GENL_UNS_ADMIN_PERM,
13151                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13152                                   NL80211_FLAG_NEED_RTNL,
13153         },
13154         {
13155                 .cmd = NL80211_CMD_SET_KEY,
13156                 .doit = nl80211_set_key,
13157                 .policy = nl80211_policy,
13158                 .flags = GENL_UNS_ADMIN_PERM,
13159                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13160                                   NL80211_FLAG_NEED_RTNL |
13161                                   NL80211_FLAG_CLEAR_SKB,
13162         },
13163         {
13164                 .cmd = NL80211_CMD_NEW_KEY,
13165                 .doit = nl80211_new_key,
13166                 .policy = nl80211_policy,
13167                 .flags = GENL_UNS_ADMIN_PERM,
13168                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13169                                   NL80211_FLAG_NEED_RTNL |
13170                                   NL80211_FLAG_CLEAR_SKB,
13171         },
13172         {
13173                 .cmd = NL80211_CMD_DEL_KEY,
13174                 .doit = nl80211_del_key,
13175                 .policy = nl80211_policy,
13176                 .flags = GENL_UNS_ADMIN_PERM,
13177                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13178                                   NL80211_FLAG_NEED_RTNL,
13179         },
13180         {
13181                 .cmd = NL80211_CMD_SET_BEACON,
13182                 .policy = nl80211_policy,
13183                 .flags = GENL_UNS_ADMIN_PERM,
13184                 .doit = nl80211_set_beacon,
13185                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13186                                   NL80211_FLAG_NEED_RTNL,
13187         },
13188         {
13189                 .cmd = NL80211_CMD_START_AP,
13190                 .policy = nl80211_policy,
13191                 .flags = GENL_UNS_ADMIN_PERM,
13192                 .doit = nl80211_start_ap,
13193                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13194                                   NL80211_FLAG_NEED_RTNL,
13195         },
13196         {
13197                 .cmd = NL80211_CMD_STOP_AP,
13198                 .policy = nl80211_policy,
13199                 .flags = GENL_UNS_ADMIN_PERM,
13200                 .doit = nl80211_stop_ap,
13201                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13202                                   NL80211_FLAG_NEED_RTNL,
13203         },
13204         {
13205                 .cmd = NL80211_CMD_GET_STATION,
13206                 .doit = nl80211_get_station,
13207                 .dumpit = nl80211_dump_station,
13208                 .policy = nl80211_policy,
13209                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13210                                   NL80211_FLAG_NEED_RTNL,
13211         },
13212         {
13213                 .cmd = NL80211_CMD_SET_STATION,
13214                 .doit = nl80211_set_station,
13215                 .policy = nl80211_policy,
13216                 .flags = GENL_UNS_ADMIN_PERM,
13217                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13218                                   NL80211_FLAG_NEED_RTNL,
13219         },
13220         {
13221                 .cmd = NL80211_CMD_NEW_STATION,
13222                 .doit = nl80211_new_station,
13223                 .policy = nl80211_policy,
13224                 .flags = GENL_UNS_ADMIN_PERM,
13225                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13226                                   NL80211_FLAG_NEED_RTNL,
13227         },
13228         {
13229                 .cmd = NL80211_CMD_DEL_STATION,
13230                 .doit = nl80211_del_station,
13231                 .policy = nl80211_policy,
13232                 .flags = GENL_UNS_ADMIN_PERM,
13233                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13234                                   NL80211_FLAG_NEED_RTNL,
13235         },
13236         {
13237                 .cmd = NL80211_CMD_GET_MPATH,
13238                 .doit = nl80211_get_mpath,
13239                 .dumpit = nl80211_dump_mpath,
13240                 .policy = nl80211_policy,
13241                 .flags = GENL_UNS_ADMIN_PERM,
13242                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13243                                   NL80211_FLAG_NEED_RTNL,
13244         },
13245         {
13246                 .cmd = NL80211_CMD_GET_MPP,
13247                 .doit = nl80211_get_mpp,
13248                 .dumpit = nl80211_dump_mpp,
13249                 .policy = nl80211_policy,
13250                 .flags = GENL_UNS_ADMIN_PERM,
13251                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13252                                   NL80211_FLAG_NEED_RTNL,
13253         },
13254         {
13255                 .cmd = NL80211_CMD_SET_MPATH,
13256                 .doit = nl80211_set_mpath,
13257                 .policy = nl80211_policy,
13258                 .flags = GENL_UNS_ADMIN_PERM,
13259                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13260                                   NL80211_FLAG_NEED_RTNL,
13261         },
13262         {
13263                 .cmd = NL80211_CMD_NEW_MPATH,
13264                 .doit = nl80211_new_mpath,
13265                 .policy = nl80211_policy,
13266                 .flags = GENL_UNS_ADMIN_PERM,
13267                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13268                                   NL80211_FLAG_NEED_RTNL,
13269         },
13270         {
13271                 .cmd = NL80211_CMD_DEL_MPATH,
13272                 .doit = nl80211_del_mpath,
13273                 .policy = nl80211_policy,
13274                 .flags = GENL_UNS_ADMIN_PERM,
13275                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13276                                   NL80211_FLAG_NEED_RTNL,
13277         },
13278         {
13279                 .cmd = NL80211_CMD_SET_BSS,
13280                 .doit = nl80211_set_bss,
13281                 .policy = nl80211_policy,
13282                 .flags = GENL_UNS_ADMIN_PERM,
13283                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13284                                   NL80211_FLAG_NEED_RTNL,
13285         },
13286         {
13287                 .cmd = NL80211_CMD_GET_REG,
13288                 .doit = nl80211_get_reg_do,
13289                 .dumpit = nl80211_get_reg_dump,
13290                 .policy = nl80211_policy,
13291                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13292                 /* can be retrieved by unprivileged users */
13293         },
13294 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13295         {
13296                 .cmd = NL80211_CMD_SET_REG,
13297                 .doit = nl80211_set_reg,
13298                 .policy = nl80211_policy,
13299                 .flags = GENL_ADMIN_PERM,
13300                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13301         },
13302 #endif
13303         {
13304                 .cmd = NL80211_CMD_REQ_SET_REG,
13305                 .doit = nl80211_req_set_reg,
13306                 .policy = nl80211_policy,
13307                 .flags = GENL_ADMIN_PERM,
13308         },
13309         {
13310                 .cmd = NL80211_CMD_RELOAD_REGDB,
13311                 .doit = nl80211_reload_regdb,
13312                 .policy = nl80211_policy,
13313                 .flags = GENL_ADMIN_PERM,
13314         },
13315         {
13316                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13317                 .doit = nl80211_get_mesh_config,
13318                 .policy = nl80211_policy,
13319                 /* can be retrieved by unprivileged users */
13320                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13321                                   NL80211_FLAG_NEED_RTNL,
13322         },
13323         {
13324                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13325                 .doit = nl80211_update_mesh_config,
13326                 .policy = nl80211_policy,
13327                 .flags = GENL_UNS_ADMIN_PERM,
13328                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13329                                   NL80211_FLAG_NEED_RTNL,
13330         },
13331         {
13332                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13333                 .doit = nl80211_trigger_scan,
13334                 .policy = nl80211_policy,
13335                 .flags = GENL_UNS_ADMIN_PERM,
13336                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13337                                   NL80211_FLAG_NEED_RTNL,
13338         },
13339         {
13340                 .cmd = NL80211_CMD_ABORT_SCAN,
13341                 .doit = nl80211_abort_scan,
13342                 .policy = nl80211_policy,
13343                 .flags = GENL_UNS_ADMIN_PERM,
13344                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13345                                   NL80211_FLAG_NEED_RTNL,
13346         },
13347         {
13348                 .cmd = NL80211_CMD_GET_SCAN,
13349                 .policy = nl80211_policy,
13350                 .dumpit = nl80211_dump_scan,
13351         },
13352         {
13353                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13354                 .doit = nl80211_start_sched_scan,
13355                 .policy = nl80211_policy,
13356                 .flags = GENL_UNS_ADMIN_PERM,
13357                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13358                                   NL80211_FLAG_NEED_RTNL,
13359         },
13360         {
13361                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13362                 .doit = nl80211_stop_sched_scan,
13363                 .policy = nl80211_policy,
13364                 .flags = GENL_UNS_ADMIN_PERM,
13365                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13366                                   NL80211_FLAG_NEED_RTNL,
13367         },
13368         {
13369                 .cmd = NL80211_CMD_AUTHENTICATE,
13370                 .doit = nl80211_authenticate,
13371                 .policy = nl80211_policy,
13372                 .flags = GENL_UNS_ADMIN_PERM,
13373                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13374                                   NL80211_FLAG_NEED_RTNL |
13375                                   NL80211_FLAG_CLEAR_SKB,
13376         },
13377         {
13378                 .cmd = NL80211_CMD_ASSOCIATE,
13379                 .doit = nl80211_associate,
13380                 .policy = nl80211_policy,
13381                 .flags = GENL_UNS_ADMIN_PERM,
13382                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13383                                   NL80211_FLAG_NEED_RTNL,
13384         },
13385         {
13386                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13387                 .doit = nl80211_deauthenticate,
13388                 .policy = nl80211_policy,
13389                 .flags = GENL_UNS_ADMIN_PERM,
13390                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13391                                   NL80211_FLAG_NEED_RTNL,
13392         },
13393         {
13394                 .cmd = NL80211_CMD_DISASSOCIATE,
13395                 .doit = nl80211_disassociate,
13396                 .policy = nl80211_policy,
13397                 .flags = GENL_UNS_ADMIN_PERM,
13398                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13399                                   NL80211_FLAG_NEED_RTNL,
13400         },
13401         {
13402                 .cmd = NL80211_CMD_JOIN_IBSS,
13403                 .doit = nl80211_join_ibss,
13404                 .policy = nl80211_policy,
13405                 .flags = GENL_UNS_ADMIN_PERM,
13406                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13407                                   NL80211_FLAG_NEED_RTNL,
13408         },
13409         {
13410                 .cmd = NL80211_CMD_LEAVE_IBSS,
13411                 .doit = nl80211_leave_ibss,
13412                 .policy = nl80211_policy,
13413                 .flags = GENL_UNS_ADMIN_PERM,
13414                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13415                                   NL80211_FLAG_NEED_RTNL,
13416         },
13417 #ifdef CONFIG_NL80211_TESTMODE
13418         {
13419                 .cmd = NL80211_CMD_TESTMODE,
13420                 .doit = nl80211_testmode_do,
13421                 .dumpit = nl80211_testmode_dump,
13422                 .policy = nl80211_policy,
13423                 .flags = GENL_UNS_ADMIN_PERM,
13424                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13425                                   NL80211_FLAG_NEED_RTNL,
13426         },
13427 #endif
13428         {
13429                 .cmd = NL80211_CMD_CONNECT,
13430                 .doit = nl80211_connect,
13431                 .policy = nl80211_policy,
13432                 .flags = GENL_UNS_ADMIN_PERM,
13433                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13434                                   NL80211_FLAG_NEED_RTNL,
13435         },
13436         {
13437                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13438                 .doit = nl80211_update_connect_params,
13439                 .policy = nl80211_policy,
13440                 .flags = GENL_ADMIN_PERM,
13441                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13442                                   NL80211_FLAG_NEED_RTNL,
13443         },
13444         {
13445                 .cmd = NL80211_CMD_DISCONNECT,
13446                 .doit = nl80211_disconnect,
13447                 .policy = nl80211_policy,
13448                 .flags = GENL_UNS_ADMIN_PERM,
13449                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13450                                   NL80211_FLAG_NEED_RTNL,
13451         },
13452         {
13453                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13454                 .doit = nl80211_wiphy_netns,
13455                 .policy = nl80211_policy,
13456                 .flags = GENL_UNS_ADMIN_PERM,
13457                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13458                                   NL80211_FLAG_NEED_RTNL,
13459         },
13460         {
13461                 .cmd = NL80211_CMD_GET_SURVEY,
13462                 .policy = nl80211_policy,
13463                 .dumpit = nl80211_dump_survey,
13464         },
13465         {
13466                 .cmd = NL80211_CMD_SET_PMKSA,
13467                 .doit = nl80211_setdel_pmksa,
13468                 .policy = nl80211_policy,
13469                 .flags = GENL_UNS_ADMIN_PERM,
13470                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13471                                   NL80211_FLAG_NEED_RTNL,
13472         },
13473         {
13474                 .cmd = NL80211_CMD_DEL_PMKSA,
13475                 .doit = nl80211_setdel_pmksa,
13476                 .policy = nl80211_policy,
13477                 .flags = GENL_UNS_ADMIN_PERM,
13478                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13479                                   NL80211_FLAG_NEED_RTNL,
13480         },
13481         {
13482                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13483                 .doit = nl80211_flush_pmksa,
13484                 .policy = nl80211_policy,
13485                 .flags = GENL_UNS_ADMIN_PERM,
13486                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13487                                   NL80211_FLAG_NEED_RTNL,
13488         },
13489         {
13490                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13491                 .doit = nl80211_remain_on_channel,
13492                 .policy = nl80211_policy,
13493                 .flags = GENL_UNS_ADMIN_PERM,
13494                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13495                                   NL80211_FLAG_NEED_RTNL,
13496         },
13497         {
13498                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13499                 .doit = nl80211_cancel_remain_on_channel,
13500                 .policy = nl80211_policy,
13501                 .flags = GENL_UNS_ADMIN_PERM,
13502                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13503                                   NL80211_FLAG_NEED_RTNL,
13504         },
13505         {
13506                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13507                 .doit = nl80211_set_tx_bitrate_mask,
13508                 .policy = nl80211_policy,
13509                 .flags = GENL_UNS_ADMIN_PERM,
13510                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13511                                   NL80211_FLAG_NEED_RTNL,
13512         },
13513         {
13514                 .cmd = NL80211_CMD_REGISTER_FRAME,
13515                 .doit = nl80211_register_mgmt,
13516                 .policy = nl80211_policy,
13517                 .flags = GENL_UNS_ADMIN_PERM,
13518                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13519                                   NL80211_FLAG_NEED_RTNL,
13520         },
13521         {
13522                 .cmd = NL80211_CMD_FRAME,
13523                 .doit = nl80211_tx_mgmt,
13524                 .policy = nl80211_policy,
13525                 .flags = GENL_UNS_ADMIN_PERM,
13526                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13527                                   NL80211_FLAG_NEED_RTNL,
13528         },
13529         {
13530                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13531                 .doit = nl80211_tx_mgmt_cancel_wait,
13532                 .policy = nl80211_policy,
13533                 .flags = GENL_UNS_ADMIN_PERM,
13534                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13535                                   NL80211_FLAG_NEED_RTNL,
13536         },
13537         {
13538                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13539                 .doit = nl80211_set_power_save,
13540                 .policy = nl80211_policy,
13541                 .flags = GENL_UNS_ADMIN_PERM,
13542                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13543                                   NL80211_FLAG_NEED_RTNL,
13544         },
13545         {
13546                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13547                 .doit = nl80211_get_power_save,
13548                 .policy = nl80211_policy,
13549                 /* can be retrieved by unprivileged users */
13550                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13551                                   NL80211_FLAG_NEED_RTNL,
13552         },
13553         {
13554                 .cmd = NL80211_CMD_SET_CQM,
13555                 .doit = nl80211_set_cqm,
13556                 .policy = nl80211_policy,
13557                 .flags = GENL_UNS_ADMIN_PERM,
13558                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13559                                   NL80211_FLAG_NEED_RTNL,
13560         },
13561         {
13562                 .cmd = NL80211_CMD_SET_CHANNEL,
13563                 .doit = nl80211_set_channel,
13564                 .policy = nl80211_policy,
13565                 .flags = GENL_UNS_ADMIN_PERM,
13566                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13567                                   NL80211_FLAG_NEED_RTNL,
13568         },
13569         {
13570                 .cmd = NL80211_CMD_SET_WDS_PEER,
13571                 .doit = nl80211_set_wds_peer,
13572                 .policy = nl80211_policy,
13573                 .flags = GENL_UNS_ADMIN_PERM,
13574                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13575                                   NL80211_FLAG_NEED_RTNL,
13576         },
13577         {
13578                 .cmd = NL80211_CMD_JOIN_MESH,
13579                 .doit = nl80211_join_mesh,
13580                 .policy = nl80211_policy,
13581                 .flags = GENL_UNS_ADMIN_PERM,
13582                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13583                                   NL80211_FLAG_NEED_RTNL,
13584         },
13585         {
13586                 .cmd = NL80211_CMD_LEAVE_MESH,
13587                 .doit = nl80211_leave_mesh,
13588                 .policy = nl80211_policy,
13589                 .flags = GENL_UNS_ADMIN_PERM,
13590                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13591                                   NL80211_FLAG_NEED_RTNL,
13592         },
13593         {
13594                 .cmd = NL80211_CMD_JOIN_OCB,
13595                 .doit = nl80211_join_ocb,
13596                 .policy = nl80211_policy,
13597                 .flags = GENL_UNS_ADMIN_PERM,
13598                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13599                                   NL80211_FLAG_NEED_RTNL,
13600         },
13601         {
13602                 .cmd = NL80211_CMD_LEAVE_OCB,
13603                 .doit = nl80211_leave_ocb,
13604                 .policy = nl80211_policy,
13605                 .flags = GENL_UNS_ADMIN_PERM,
13606                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13607                                   NL80211_FLAG_NEED_RTNL,
13608         },
13609 #ifdef CONFIG_PM
13610         {
13611                 .cmd = NL80211_CMD_GET_WOWLAN,
13612                 .doit = nl80211_get_wowlan,
13613                 .policy = nl80211_policy,
13614                 /* can be retrieved by unprivileged users */
13615                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13616                                   NL80211_FLAG_NEED_RTNL,
13617         },
13618         {
13619                 .cmd = NL80211_CMD_SET_WOWLAN,
13620                 .doit = nl80211_set_wowlan,
13621                 .policy = nl80211_policy,
13622                 .flags = GENL_UNS_ADMIN_PERM,
13623                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13624                                   NL80211_FLAG_NEED_RTNL,
13625         },
13626 #endif
13627         {
13628                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13629                 .doit = nl80211_set_rekey_data,
13630                 .policy = nl80211_policy,
13631                 .flags = GENL_UNS_ADMIN_PERM,
13632                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13633                                   NL80211_FLAG_NEED_RTNL |
13634                                   NL80211_FLAG_CLEAR_SKB,
13635         },
13636         {
13637                 .cmd = NL80211_CMD_TDLS_MGMT,
13638                 .doit = nl80211_tdls_mgmt,
13639                 .policy = nl80211_policy,
13640                 .flags = GENL_UNS_ADMIN_PERM,
13641                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13642                                   NL80211_FLAG_NEED_RTNL,
13643         },
13644         {
13645                 .cmd = NL80211_CMD_TDLS_OPER,
13646                 .doit = nl80211_tdls_oper,
13647                 .policy = nl80211_policy,
13648                 .flags = GENL_UNS_ADMIN_PERM,
13649                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13650                                   NL80211_FLAG_NEED_RTNL,
13651         },
13652         {
13653                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13654                 .doit = nl80211_register_unexpected_frame,
13655                 .policy = nl80211_policy,
13656                 .flags = GENL_UNS_ADMIN_PERM,
13657                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13658                                   NL80211_FLAG_NEED_RTNL,
13659         },
13660         {
13661                 .cmd = NL80211_CMD_PROBE_CLIENT,
13662                 .doit = nl80211_probe_client,
13663                 .policy = nl80211_policy,
13664                 .flags = GENL_UNS_ADMIN_PERM,
13665                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13666                                   NL80211_FLAG_NEED_RTNL,
13667         },
13668         {
13669                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13670                 .doit = nl80211_register_beacons,
13671                 .policy = nl80211_policy,
13672                 .flags = GENL_UNS_ADMIN_PERM,
13673                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13674                                   NL80211_FLAG_NEED_RTNL,
13675         },
13676         {
13677                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13678                 .doit = nl80211_set_noack_map,
13679                 .policy = nl80211_policy,
13680                 .flags = GENL_UNS_ADMIN_PERM,
13681                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13682                                   NL80211_FLAG_NEED_RTNL,
13683         },
13684         {
13685                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13686                 .doit = nl80211_start_p2p_device,
13687                 .policy = nl80211_policy,
13688                 .flags = GENL_UNS_ADMIN_PERM,
13689                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13690                                   NL80211_FLAG_NEED_RTNL,
13691         },
13692         {
13693                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13694                 .doit = nl80211_stop_p2p_device,
13695                 .policy = nl80211_policy,
13696                 .flags = GENL_UNS_ADMIN_PERM,
13697                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13698                                   NL80211_FLAG_NEED_RTNL,
13699         },
13700         {
13701                 .cmd = NL80211_CMD_START_NAN,
13702                 .doit = nl80211_start_nan,
13703                 .policy = nl80211_policy,
13704                 .flags = GENL_ADMIN_PERM,
13705                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13706                                   NL80211_FLAG_NEED_RTNL,
13707         },
13708         {
13709                 .cmd = NL80211_CMD_STOP_NAN,
13710                 .doit = nl80211_stop_nan,
13711                 .policy = nl80211_policy,
13712                 .flags = GENL_ADMIN_PERM,
13713                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13714                                   NL80211_FLAG_NEED_RTNL,
13715         },
13716         {
13717                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13718                 .doit = nl80211_nan_add_func,
13719                 .policy = nl80211_policy,
13720                 .flags = GENL_ADMIN_PERM,
13721                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13722                                   NL80211_FLAG_NEED_RTNL,
13723         },
13724         {
13725                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13726                 .doit = nl80211_nan_del_func,
13727                 .policy = nl80211_policy,
13728                 .flags = GENL_ADMIN_PERM,
13729                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13730                                   NL80211_FLAG_NEED_RTNL,
13731         },
13732         {
13733                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13734                 .doit = nl80211_nan_change_config,
13735                 .policy = nl80211_policy,
13736                 .flags = GENL_ADMIN_PERM,
13737                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13738                                   NL80211_FLAG_NEED_RTNL,
13739         },
13740         {
13741                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13742                 .doit = nl80211_set_mcast_rate,
13743                 .policy = nl80211_policy,
13744                 .flags = GENL_UNS_ADMIN_PERM,
13745                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13746                                   NL80211_FLAG_NEED_RTNL,
13747         },
13748         {
13749                 .cmd = NL80211_CMD_SET_MAC_ACL,
13750                 .doit = nl80211_set_mac_acl,
13751                 .policy = nl80211_policy,
13752                 .flags = GENL_UNS_ADMIN_PERM,
13753                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13754                                   NL80211_FLAG_NEED_RTNL,
13755         },
13756         {
13757                 .cmd = NL80211_CMD_RADAR_DETECT,
13758                 .doit = nl80211_start_radar_detection,
13759                 .policy = nl80211_policy,
13760                 .flags = GENL_UNS_ADMIN_PERM,
13761                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13762                                   NL80211_FLAG_NEED_RTNL,
13763         },
13764         {
13765                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13766                 .doit = nl80211_get_protocol_features,
13767                 .policy = nl80211_policy,
13768         },
13769         {
13770                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13771                 .doit = nl80211_update_ft_ies,
13772                 .policy = nl80211_policy,
13773                 .flags = GENL_UNS_ADMIN_PERM,
13774                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13775                                   NL80211_FLAG_NEED_RTNL,
13776         },
13777         {
13778                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13779                 .doit = nl80211_crit_protocol_start,
13780                 .policy = nl80211_policy,
13781                 .flags = GENL_UNS_ADMIN_PERM,
13782                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13783                                   NL80211_FLAG_NEED_RTNL,
13784         },
13785         {
13786                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13787                 .doit = nl80211_crit_protocol_stop,
13788                 .policy = nl80211_policy,
13789                 .flags = GENL_UNS_ADMIN_PERM,
13790                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13791                                   NL80211_FLAG_NEED_RTNL,
13792         },
13793         {
13794                 .cmd = NL80211_CMD_GET_COALESCE,
13795                 .doit = nl80211_get_coalesce,
13796                 .policy = nl80211_policy,
13797                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13798                                   NL80211_FLAG_NEED_RTNL,
13799         },
13800         {
13801                 .cmd = NL80211_CMD_SET_COALESCE,
13802                 .doit = nl80211_set_coalesce,
13803                 .policy = nl80211_policy,
13804                 .flags = GENL_UNS_ADMIN_PERM,
13805                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13806                                   NL80211_FLAG_NEED_RTNL,
13807         },
13808         {
13809                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13810                 .doit = nl80211_channel_switch,
13811                 .policy = nl80211_policy,
13812                 .flags = GENL_UNS_ADMIN_PERM,
13813                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13814                                   NL80211_FLAG_NEED_RTNL,
13815         },
13816         {
13817                 .cmd = NL80211_CMD_VENDOR,
13818                 .doit = nl80211_vendor_cmd,
13819                 .dumpit = nl80211_vendor_cmd_dump,
13820                 .policy = nl80211_policy,
13821                 .flags = GENL_UNS_ADMIN_PERM,
13822                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13823                                   NL80211_FLAG_NEED_RTNL,
13824         },
13825         {
13826                 .cmd = NL80211_CMD_SET_QOS_MAP,
13827                 .doit = nl80211_set_qos_map,
13828                 .policy = nl80211_policy,
13829                 .flags = GENL_UNS_ADMIN_PERM,
13830                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13831                                   NL80211_FLAG_NEED_RTNL,
13832         },
13833         {
13834                 .cmd = NL80211_CMD_ADD_TX_TS,
13835                 .doit = nl80211_add_tx_ts,
13836                 .policy = nl80211_policy,
13837                 .flags = GENL_UNS_ADMIN_PERM,
13838                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13839                                   NL80211_FLAG_NEED_RTNL,
13840         },
13841         {
13842                 .cmd = NL80211_CMD_DEL_TX_TS,
13843                 .doit = nl80211_del_tx_ts,
13844                 .policy = nl80211_policy,
13845                 .flags = GENL_UNS_ADMIN_PERM,
13846                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13847                                   NL80211_FLAG_NEED_RTNL,
13848         },
13849         {
13850                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13851                 .doit = nl80211_tdls_channel_switch,
13852                 .policy = nl80211_policy,
13853                 .flags = GENL_UNS_ADMIN_PERM,
13854                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13855                                   NL80211_FLAG_NEED_RTNL,
13856         },
13857         {
13858                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13859                 .doit = nl80211_tdls_cancel_channel_switch,
13860                 .policy = nl80211_policy,
13861                 .flags = GENL_UNS_ADMIN_PERM,
13862                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13863                                   NL80211_FLAG_NEED_RTNL,
13864         },
13865         {
13866                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13867                 .doit = nl80211_set_multicast_to_unicast,
13868                 .policy = nl80211_policy,
13869                 .flags = GENL_UNS_ADMIN_PERM,
13870                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13871                                   NL80211_FLAG_NEED_RTNL,
13872         },
13873         {
13874                 .cmd = NL80211_CMD_SET_PMK,
13875                 .doit = nl80211_set_pmk,
13876                 .policy = nl80211_policy,
13877                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13878                                   NL80211_FLAG_NEED_RTNL,
13879         },
13880         {
13881                 .cmd = NL80211_CMD_DEL_PMK,
13882                 .doit = nl80211_del_pmk,
13883                 .policy = nl80211_policy,
13884                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13885                                   NL80211_FLAG_NEED_RTNL,
13886         },
13887         {
13888                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13889                 .doit = nl80211_external_auth,
13890                 .policy = nl80211_policy,
13891                 .flags = GENL_ADMIN_PERM,
13892                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13893                                   NL80211_FLAG_NEED_RTNL,
13894         },
13895         {
13896                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13897                 .doit = nl80211_tx_control_port,
13898                 .policy = nl80211_policy,
13899                 .flags = GENL_UNS_ADMIN_PERM,
13900                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13901                                   NL80211_FLAG_NEED_RTNL,
13902         },
13903 };
13904
13905 static struct genl_family nl80211_fam __ro_after_init = {
13906         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13907         .hdrsize = 0,                   /* no private header */
13908         .version = 1,                   /* no particular meaning now */
13909         .maxattr = NL80211_ATTR_MAX,
13910         .netnsok = true,
13911         .pre_doit = nl80211_pre_doit,
13912         .post_doit = nl80211_post_doit,
13913         .module = THIS_MODULE,
13914         .ops = nl80211_ops,
13915         .n_ops = ARRAY_SIZE(nl80211_ops),
13916         .mcgrps = nl80211_mcgrps,
13917         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13918 };
13919
13920 /* notification functions */
13921
13922 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13923                           enum nl80211_commands cmd)
13924 {
13925         struct sk_buff *msg;
13926         struct nl80211_dump_wiphy_state state = {};
13927
13928         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13929                 cmd != NL80211_CMD_DEL_WIPHY);
13930
13931         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13932         if (!msg)
13933                 return;
13934
13935         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13936                 nlmsg_free(msg);
13937                 return;
13938         }
13939
13940         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13941                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13942 }
13943
13944 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13945                                 struct wireless_dev *wdev,
13946                                 enum nl80211_commands cmd)
13947 {
13948         struct sk_buff *msg;
13949
13950         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13951                 cmd != NL80211_CMD_DEL_INTERFACE);
13952
13953         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13954         if (!msg)
13955                 return;
13956
13957         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13958                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13959                 nlmsg_free(msg);
13960                 return;
13961         }
13962
13963         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13964                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13965 }
13966
13967 static int nl80211_add_scan_req(struct sk_buff *msg,
13968                                 struct cfg80211_registered_device *rdev)
13969 {
13970         struct cfg80211_scan_request *req = rdev->scan_req;
13971         struct nlattr *nest;
13972         int i;
13973
13974         if (WARN_ON(!req))
13975                 return 0;
13976
13977         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13978         if (!nest)
13979                 goto nla_put_failure;
13980         for (i = 0; i < req->n_ssids; i++) {
13981                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13982                         goto nla_put_failure;
13983         }
13984         nla_nest_end(msg, nest);
13985
13986         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13987         if (!nest)
13988                 goto nla_put_failure;
13989         for (i = 0; i < req->n_channels; i++) {
13990                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13991                         goto nla_put_failure;
13992         }
13993         nla_nest_end(msg, nest);
13994
13995         if (req->ie &&
13996             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13997                 goto nla_put_failure;
13998
13999         if (req->flags &&
14000             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14001                 goto nla_put_failure;
14002
14003         if (req->info.scan_start_tsf &&
14004             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14005                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14006              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14007                      req->info.tsf_bssid)))
14008                 goto nla_put_failure;
14009
14010         return 0;
14011  nla_put_failure:
14012         return -ENOBUFS;
14013 }
14014
14015 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14016                                  struct cfg80211_registered_device *rdev,
14017                                  struct wireless_dev *wdev,
14018                                  u32 portid, u32 seq, int flags,
14019                                  u32 cmd)
14020 {
14021         void *hdr;
14022
14023         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14024         if (!hdr)
14025                 return -1;
14026
14027         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14028             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14029                                          wdev->netdev->ifindex)) ||
14030             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14031                               NL80211_ATTR_PAD))
14032                 goto nla_put_failure;
14033
14034         /* ignore errors and send incomplete event anyway */
14035         nl80211_add_scan_req(msg, rdev);
14036
14037         genlmsg_end(msg, hdr);
14038         return 0;
14039
14040  nla_put_failure:
14041         genlmsg_cancel(msg, hdr);
14042         return -EMSGSIZE;
14043 }
14044
14045 static int
14046 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14047                             struct cfg80211_sched_scan_request *req, u32 cmd)
14048 {
14049         void *hdr;
14050
14051         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14052         if (!hdr)
14053                 return -1;
14054
14055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14056                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14057             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14058             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14059                               NL80211_ATTR_PAD))
14060                 goto nla_put_failure;
14061
14062         genlmsg_end(msg, hdr);
14063         return 0;
14064
14065  nla_put_failure:
14066         genlmsg_cancel(msg, hdr);
14067         return -EMSGSIZE;
14068 }
14069
14070 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14071                              struct wireless_dev *wdev)
14072 {
14073         struct sk_buff *msg;
14074
14075         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14076         if (!msg)
14077                 return;
14078
14079         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14080                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14081                 nlmsg_free(msg);
14082                 return;
14083         }
14084
14085         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14086                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14087 }
14088
14089 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14090                                        struct wireless_dev *wdev, bool aborted)
14091 {
14092         struct sk_buff *msg;
14093
14094         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14095         if (!msg)
14096                 return NULL;
14097
14098         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14099                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14100                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14101                 nlmsg_free(msg);
14102                 return NULL;
14103         }
14104
14105         return msg;
14106 }
14107
14108 /* send message created by nl80211_build_scan_msg() */
14109 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14110                            struct sk_buff *msg)
14111 {
14112         if (!msg)
14113                 return;
14114
14115         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14116                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14117 }
14118
14119 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14120 {
14121         struct sk_buff *msg;
14122
14123         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14124         if (!msg)
14125                 return;
14126
14127         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14128                 nlmsg_free(msg);
14129                 return;
14130         }
14131
14132         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14133                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14134 }
14135
14136 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14137                                           struct regulatory_request *request)
14138 {
14139         /* Userspace can always count this one always being set */
14140         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14141                 goto nla_put_failure;
14142
14143         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14144                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14145                                NL80211_REGDOM_TYPE_WORLD))
14146                         goto nla_put_failure;
14147         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14148                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14149                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14150                         goto nla_put_failure;
14151         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14152                    request->intersect) {
14153                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14154                                NL80211_REGDOM_TYPE_INTERSECTION))
14155                         goto nla_put_failure;
14156         } else {
14157                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14158                                NL80211_REGDOM_TYPE_COUNTRY) ||
14159                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14160                                    request->alpha2))
14161                         goto nla_put_failure;
14162         }
14163
14164         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14165                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14166
14167                 if (wiphy &&
14168                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14169                         goto nla_put_failure;
14170
14171                 if (wiphy &&
14172                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14173                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14174                         goto nla_put_failure;
14175         }
14176
14177         return true;
14178
14179 nla_put_failure:
14180         return false;
14181 }
14182
14183 /*
14184  * This can happen on global regulatory changes or device specific settings
14185  * based on custom regulatory domains.
14186  */
14187 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14188                                      struct regulatory_request *request)
14189 {
14190         struct sk_buff *msg;
14191         void *hdr;
14192
14193         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14194         if (!msg)
14195                 return;
14196
14197         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14198         if (!hdr) {
14199                 nlmsg_free(msg);
14200                 return;
14201         }
14202
14203         if (nl80211_reg_change_event_fill(msg, request) == false)
14204                 goto nla_put_failure;
14205
14206         genlmsg_end(msg, hdr);
14207
14208         rcu_read_lock();
14209         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14210                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14211         rcu_read_unlock();
14212
14213         return;
14214
14215 nla_put_failure:
14216         nlmsg_free(msg);
14217 }
14218
14219 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14220                                     struct net_device *netdev,
14221                                     const u8 *buf, size_t len,
14222                                     enum nl80211_commands cmd, gfp_t gfp,
14223                                     int uapsd_queues)
14224 {
14225         struct sk_buff *msg;
14226         void *hdr;
14227
14228         msg = nlmsg_new(100 + len, gfp);
14229         if (!msg)
14230                 return;
14231
14232         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14233         if (!hdr) {
14234                 nlmsg_free(msg);
14235                 return;
14236         }
14237
14238         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14239             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14240             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14241                 goto nla_put_failure;
14242
14243         if (uapsd_queues >= 0) {
14244                 struct nlattr *nla_wmm =
14245                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14246                 if (!nla_wmm)
14247                         goto nla_put_failure;
14248
14249                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14250                                uapsd_queues))
14251                         goto nla_put_failure;
14252
14253                 nla_nest_end(msg, nla_wmm);
14254         }
14255
14256         genlmsg_end(msg, hdr);
14257
14258         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14259                                 NL80211_MCGRP_MLME, gfp);
14260         return;
14261
14262  nla_put_failure:
14263         nlmsg_free(msg);
14264 }
14265
14266 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14267                           struct net_device *netdev, const u8 *buf,
14268                           size_t len, gfp_t gfp)
14269 {
14270         nl80211_send_mlme_event(rdev, netdev, buf, len,
14271                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
14272 }
14273
14274 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14275                            struct net_device *netdev, const u8 *buf,
14276                            size_t len, gfp_t gfp, int uapsd_queues)
14277 {
14278         nl80211_send_mlme_event(rdev, netdev, buf, len,
14279                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14280 }
14281
14282 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14283                          struct net_device *netdev, const u8 *buf,
14284                          size_t len, gfp_t gfp)
14285 {
14286         nl80211_send_mlme_event(rdev, netdev, buf, len,
14287                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14288 }
14289
14290 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14291                            struct net_device *netdev, const u8 *buf,
14292                            size_t len, gfp_t gfp)
14293 {
14294         nl80211_send_mlme_event(rdev, netdev, buf, len,
14295                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
14296 }
14297
14298 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14299                                   size_t len)
14300 {
14301         struct wireless_dev *wdev = dev->ieee80211_ptr;
14302         struct wiphy *wiphy = wdev->wiphy;
14303         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14304         const struct ieee80211_mgmt *mgmt = (void *)buf;
14305         u32 cmd;
14306
14307         if (WARN_ON(len < 2))
14308                 return;
14309
14310         if (ieee80211_is_deauth(mgmt->frame_control))
14311                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14312         else
14313                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14314
14315         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14316         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14317 }
14318 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14319
14320 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14321                                       struct net_device *netdev, int cmd,
14322                                       const u8 *addr, gfp_t gfp)
14323 {
14324         struct sk_buff *msg;
14325         void *hdr;
14326
14327         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14328         if (!msg)
14329                 return;
14330
14331         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14332         if (!hdr) {
14333                 nlmsg_free(msg);
14334                 return;
14335         }
14336
14337         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14338             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14339             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14340             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14341                 goto nla_put_failure;
14342
14343         genlmsg_end(msg, hdr);
14344
14345         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14346                                 NL80211_MCGRP_MLME, gfp);
14347         return;
14348
14349  nla_put_failure:
14350         nlmsg_free(msg);
14351 }
14352
14353 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14354                                struct net_device *netdev, const u8 *addr,
14355                                gfp_t gfp)
14356 {
14357         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14358                                   addr, gfp);
14359 }
14360
14361 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14362                                 struct net_device *netdev, const u8 *addr,
14363                                 gfp_t gfp)
14364 {
14365         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14366                                   addr, gfp);
14367 }
14368
14369 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14370                                  struct net_device *netdev,
14371                                  struct cfg80211_connect_resp_params *cr,
14372                                  gfp_t gfp)
14373 {
14374         struct sk_buff *msg;
14375         void *hdr;
14376
14377         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14378                         cr->fils.kek_len + cr->fils.pmk_len +
14379                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14380         if (!msg)
14381                 return;
14382
14383         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14384         if (!hdr) {
14385                 nlmsg_free(msg);
14386                 return;
14387         }
14388
14389         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14390             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14391             (cr->bssid &&
14392              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14393             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14394                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14395                         cr->status) ||
14396             (cr->status < 0 &&
14397              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14398               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14399                           cr->timeout_reason))) ||
14400             (cr->req_ie &&
14401              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14402             (cr->resp_ie &&
14403              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14404                      cr->resp_ie)) ||
14405             (cr->fils.update_erp_next_seq_num &&
14406              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14407                          cr->fils.erp_next_seq_num)) ||
14408             (cr->status == WLAN_STATUS_SUCCESS &&
14409              ((cr->fils.kek &&
14410                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14411                        cr->fils.kek)) ||
14412               (cr->fils.pmk &&
14413                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14414               (cr->fils.pmkid &&
14415                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14416                 goto nla_put_failure;
14417
14418         genlmsg_end(msg, hdr);
14419
14420         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14421                                 NL80211_MCGRP_MLME, gfp);
14422         return;
14423
14424  nla_put_failure:
14425         nlmsg_free(msg);
14426 }
14427
14428 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14429                          struct net_device *netdev,
14430                          struct cfg80211_roam_info *info, gfp_t gfp)
14431 {
14432         struct sk_buff *msg;
14433         void *hdr;
14434         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14435
14436         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14437                         info->fils.kek_len + info->fils.pmk_len +
14438                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14439         if (!msg)
14440                 return;
14441
14442         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14443         if (!hdr) {
14444                 nlmsg_free(msg);
14445                 return;
14446         }
14447
14448         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14449             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14450             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14451             (info->req_ie &&
14452              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14453                      info->req_ie)) ||
14454             (info->resp_ie &&
14455              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14456                      info->resp_ie)) ||
14457             (info->fils.update_erp_next_seq_num &&
14458              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14459                          info->fils.erp_next_seq_num)) ||
14460             (info->fils.kek &&
14461              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14462                      info->fils.kek)) ||
14463             (info->fils.pmk &&
14464              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14465             (info->fils.pmkid &&
14466              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14467                 goto nla_put_failure;
14468
14469         genlmsg_end(msg, hdr);
14470
14471         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14472                                 NL80211_MCGRP_MLME, gfp);
14473         return;
14474
14475  nla_put_failure:
14476         nlmsg_free(msg);
14477 }
14478
14479 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14480                                   struct net_device *netdev, const u8 *bssid)
14481 {
14482         struct sk_buff *msg;
14483         void *hdr;
14484
14485         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14486         if (!msg)
14487                 return;
14488
14489         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14490         if (!hdr) {
14491                 nlmsg_free(msg);
14492                 return;
14493         }
14494
14495         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14496                 goto nla_put_failure;
14497
14498         genlmsg_end(msg, hdr);
14499
14500         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14501                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14502         return;
14503
14504  nla_put_failure:
14505         nlmsg_free(msg);
14506 }
14507
14508 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14509                                struct net_device *netdev, u16 reason,
14510                                const u8 *ie, size_t ie_len, bool from_ap)
14511 {
14512         struct sk_buff *msg;
14513         void *hdr;
14514
14515         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14516         if (!msg)
14517                 return;
14518
14519         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14520         if (!hdr) {
14521                 nlmsg_free(msg);
14522                 return;
14523         }
14524
14525         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14526             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14527             (reason &&
14528              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14529             (from_ap &&
14530              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14531             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14532                 goto nla_put_failure;
14533
14534         genlmsg_end(msg, hdr);
14535
14536         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14537                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14538         return;
14539
14540  nla_put_failure:
14541         nlmsg_free(msg);
14542 }
14543
14544 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14545                              struct net_device *netdev, const u8 *bssid,
14546                              gfp_t gfp)
14547 {
14548         struct sk_buff *msg;
14549         void *hdr;
14550
14551         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14552         if (!msg)
14553                 return;
14554
14555         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14556         if (!hdr) {
14557                 nlmsg_free(msg);
14558                 return;
14559         }
14560
14561         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14562             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14563             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14564                 goto nla_put_failure;
14565
14566         genlmsg_end(msg, hdr);
14567
14568         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14569                                 NL80211_MCGRP_MLME, gfp);
14570         return;
14571
14572  nla_put_failure:
14573         nlmsg_free(msg);
14574 }
14575
14576 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14577                                         const u8* ie, u8 ie_len, gfp_t gfp)
14578 {
14579         struct wireless_dev *wdev = dev->ieee80211_ptr;
14580         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14581         struct sk_buff *msg;
14582         void *hdr;
14583
14584         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14585                 return;
14586
14587         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14588
14589         msg = nlmsg_new(100 + ie_len, gfp);
14590         if (!msg)
14591                 return;
14592
14593         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14594         if (!hdr) {
14595                 nlmsg_free(msg);
14596                 return;
14597         }
14598
14599         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14600             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14601             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14602             (ie_len && ie &&
14603              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14604                 goto nla_put_failure;
14605
14606         genlmsg_end(msg, hdr);
14607
14608         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14609                                 NL80211_MCGRP_MLME, gfp);
14610         return;
14611
14612  nla_put_failure:
14613         nlmsg_free(msg);
14614 }
14615 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14616
14617 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14618                                  struct net_device *netdev, const u8 *addr,
14619                                  enum nl80211_key_type key_type, int key_id,
14620                                  const u8 *tsc, gfp_t gfp)
14621 {
14622         struct sk_buff *msg;
14623         void *hdr;
14624
14625         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14626         if (!msg)
14627                 return;
14628
14629         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14630         if (!hdr) {
14631                 nlmsg_free(msg);
14632                 return;
14633         }
14634
14635         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14636             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14637             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14638             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14639             (key_id != -1 &&
14640              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14641             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14642                 goto nla_put_failure;
14643
14644         genlmsg_end(msg, hdr);
14645
14646         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14647                                 NL80211_MCGRP_MLME, gfp);
14648         return;
14649
14650  nla_put_failure:
14651         nlmsg_free(msg);
14652 }
14653
14654 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14655                                     struct ieee80211_channel *channel_before,
14656                                     struct ieee80211_channel *channel_after)
14657 {
14658         struct sk_buff *msg;
14659         void *hdr;
14660         struct nlattr *nl_freq;
14661
14662         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14663         if (!msg)
14664                 return;
14665
14666         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14667         if (!hdr) {
14668                 nlmsg_free(msg);
14669                 return;
14670         }
14671
14672         /*
14673          * Since we are applying the beacon hint to a wiphy we know its
14674          * wiphy_idx is valid
14675          */
14676         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14677                 goto nla_put_failure;
14678
14679         /* Before */
14680         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14681         if (!nl_freq)
14682                 goto nla_put_failure;
14683
14684         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14685                 goto nla_put_failure;
14686         nla_nest_end(msg, nl_freq);
14687
14688         /* After */
14689         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14690         if (!nl_freq)
14691                 goto nla_put_failure;
14692
14693         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14694                 goto nla_put_failure;
14695         nla_nest_end(msg, nl_freq);
14696
14697         genlmsg_end(msg, hdr);
14698
14699         rcu_read_lock();
14700         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14701                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14702         rcu_read_unlock();
14703
14704         return;
14705
14706 nla_put_failure:
14707         nlmsg_free(msg);
14708 }
14709
14710 static void nl80211_send_remain_on_chan_event(
14711         int cmd, struct cfg80211_registered_device *rdev,
14712         struct wireless_dev *wdev, u64 cookie,
14713         struct ieee80211_channel *chan,
14714         unsigned int duration, gfp_t gfp)
14715 {
14716         struct sk_buff *msg;
14717         void *hdr;
14718
14719         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14720         if (!msg)
14721                 return;
14722
14723         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14724         if (!hdr) {
14725                 nlmsg_free(msg);
14726                 return;
14727         }
14728
14729         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14730             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14731                                          wdev->netdev->ifindex)) ||
14732             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14733                               NL80211_ATTR_PAD) ||
14734             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14735             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14736                         NL80211_CHAN_NO_HT) ||
14737             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14738                               NL80211_ATTR_PAD))
14739                 goto nla_put_failure;
14740
14741         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14742             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14743                 goto nla_put_failure;
14744
14745         genlmsg_end(msg, hdr);
14746
14747         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14748                                 NL80211_MCGRP_MLME, gfp);
14749         return;
14750
14751  nla_put_failure:
14752         nlmsg_free(msg);
14753 }
14754
14755 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14756                                struct ieee80211_channel *chan,
14757                                unsigned int duration, gfp_t gfp)
14758 {
14759         struct wiphy *wiphy = wdev->wiphy;
14760         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14761
14762         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14763         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14764                                           rdev, wdev, cookie, chan,
14765                                           duration, gfp);
14766 }
14767 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14768
14769 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14770                                         struct ieee80211_channel *chan,
14771                                         gfp_t gfp)
14772 {
14773         struct wiphy *wiphy = wdev->wiphy;
14774         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14775
14776         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14777         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14778                                           rdev, wdev, cookie, chan, 0, gfp);
14779 }
14780 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14781
14782 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14783                       struct station_info *sinfo, gfp_t gfp)
14784 {
14785         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14786         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14787         struct sk_buff *msg;
14788
14789         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14790
14791         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14792         if (!msg)
14793                 return;
14794
14795         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14796                                  rdev, dev, mac_addr, sinfo) < 0) {
14797                 nlmsg_free(msg);
14798                 return;
14799         }
14800
14801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14802                                 NL80211_MCGRP_MLME, gfp);
14803 }
14804 EXPORT_SYMBOL(cfg80211_new_sta);
14805
14806 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14807                             struct station_info *sinfo, gfp_t gfp)
14808 {
14809         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14810         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14811         struct sk_buff *msg;
14812         struct station_info empty_sinfo = {};
14813
14814         if (!sinfo)
14815                 sinfo = &empty_sinfo;
14816
14817         trace_cfg80211_del_sta(dev, mac_addr);
14818
14819         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14820         if (!msg) {
14821                 cfg80211_sinfo_release_content(sinfo);
14822                 return;
14823         }
14824
14825         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14826                                  rdev, dev, mac_addr, sinfo) < 0) {
14827                 nlmsg_free(msg);
14828                 return;
14829         }
14830
14831         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14832                                 NL80211_MCGRP_MLME, gfp);
14833 }
14834 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14835
14836 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14837                           enum nl80211_connect_failed_reason reason,
14838                           gfp_t gfp)
14839 {
14840         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14841         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14842         struct sk_buff *msg;
14843         void *hdr;
14844
14845         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14846         if (!msg)
14847                 return;
14848
14849         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14850         if (!hdr) {
14851                 nlmsg_free(msg);
14852                 return;
14853         }
14854
14855         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14856             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14857             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14858                 goto nla_put_failure;
14859
14860         genlmsg_end(msg, hdr);
14861
14862         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14863                                 NL80211_MCGRP_MLME, gfp);
14864         return;
14865
14866  nla_put_failure:
14867         nlmsg_free(msg);
14868 }
14869 EXPORT_SYMBOL(cfg80211_conn_failed);
14870
14871 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14872                                        const u8 *addr, gfp_t gfp)
14873 {
14874         struct wireless_dev *wdev = dev->ieee80211_ptr;
14875         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14876         struct sk_buff *msg;
14877         void *hdr;
14878         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14879
14880         if (!nlportid)
14881                 return false;
14882
14883         msg = nlmsg_new(100, gfp);
14884         if (!msg)
14885                 return true;
14886
14887         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14888         if (!hdr) {
14889                 nlmsg_free(msg);
14890                 return true;
14891         }
14892
14893         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14894             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14895             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14896                 goto nla_put_failure;
14897
14898         genlmsg_end(msg, hdr);
14899         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14900         return true;
14901
14902  nla_put_failure:
14903         nlmsg_free(msg);
14904         return true;
14905 }
14906
14907 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14908                                 const u8 *addr, gfp_t gfp)
14909 {
14910         struct wireless_dev *wdev = dev->ieee80211_ptr;
14911         bool ret;
14912
14913         trace_cfg80211_rx_spurious_frame(dev, addr);
14914
14915         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14916                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14917                 trace_cfg80211_return_bool(false);
14918                 return false;
14919         }
14920         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14921                                          addr, gfp);
14922         trace_cfg80211_return_bool(ret);
14923         return ret;
14924 }
14925 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14926
14927 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14928                                         const u8 *addr, gfp_t gfp)
14929 {
14930         struct wireless_dev *wdev = dev->ieee80211_ptr;
14931         bool ret;
14932
14933         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14934
14935         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14936                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14937                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14938                 trace_cfg80211_return_bool(false);
14939                 return false;
14940         }
14941         ret = __nl80211_unexpected_frame(dev,
14942                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14943                                          addr, gfp);
14944         trace_cfg80211_return_bool(ret);
14945         return ret;
14946 }
14947 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14948
14949 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14950                       struct wireless_dev *wdev, u32 nlportid,
14951                       int freq, int sig_dbm,
14952                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14953 {
14954         struct net_device *netdev = wdev->netdev;
14955         struct sk_buff *msg;
14956         void *hdr;
14957
14958         msg = nlmsg_new(100 + len, gfp);
14959         if (!msg)
14960                 return -ENOMEM;
14961
14962         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14963         if (!hdr) {
14964                 nlmsg_free(msg);
14965                 return -ENOMEM;
14966         }
14967
14968         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14969             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14970                                         netdev->ifindex)) ||
14971             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14972                               NL80211_ATTR_PAD) ||
14973             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14974             (sig_dbm &&
14975              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14976             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14977             (flags &&
14978              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14979                 goto nla_put_failure;
14980
14981         genlmsg_end(msg, hdr);
14982
14983         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14984
14985  nla_put_failure:
14986         nlmsg_free(msg);
14987         return -ENOBUFS;
14988 }
14989
14990 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14991                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
14992 {
14993         struct wiphy *wiphy = wdev->wiphy;
14994         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14995         struct net_device *netdev = wdev->netdev;
14996         struct sk_buff *msg;
14997         void *hdr;
14998
14999         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15000
15001         msg = nlmsg_new(100 + len, gfp);
15002         if (!msg)
15003                 return;
15004
15005         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15006         if (!hdr) {
15007                 nlmsg_free(msg);
15008                 return;
15009         }
15010
15011         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15012             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15013                                    netdev->ifindex)) ||
15014             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15015                               NL80211_ATTR_PAD) ||
15016             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15017             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15018                               NL80211_ATTR_PAD) ||
15019             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15020                 goto nla_put_failure;
15021
15022         genlmsg_end(msg, hdr);
15023
15024         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15025                                 NL80211_MCGRP_MLME, gfp);
15026         return;
15027
15028  nla_put_failure:
15029         nlmsg_free(msg);
15030 }
15031 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15032
15033 static int __nl80211_rx_control_port(struct net_device *dev,
15034                                      struct sk_buff *skb,
15035                                      bool unencrypted, gfp_t gfp)
15036 {
15037         struct wireless_dev *wdev = dev->ieee80211_ptr;
15038         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15039         struct ethhdr *ehdr = eth_hdr(skb);
15040         const u8 *addr = ehdr->h_source;
15041         u16 proto = be16_to_cpu(skb->protocol);
15042         struct sk_buff *msg;
15043         void *hdr;
15044         struct nlattr *frame;
15045
15046         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15047
15048         if (!nlportid)
15049                 return -ENOENT;
15050
15051         msg = nlmsg_new(100 + skb->len, gfp);
15052         if (!msg)
15053                 return -ENOMEM;
15054
15055         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15056         if (!hdr) {
15057                 nlmsg_free(msg);
15058                 return -ENOBUFS;
15059         }
15060
15061         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15062             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15063             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15064                               NL80211_ATTR_PAD) ||
15065             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15066             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15067             (unencrypted && nla_put_flag(msg,
15068                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15069                 goto nla_put_failure;
15070
15071         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15072         if (!frame)
15073                 goto nla_put_failure;
15074
15075         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15076         genlmsg_end(msg, hdr);
15077
15078         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15079
15080  nla_put_failure:
15081         nlmsg_free(msg);
15082         return -ENOBUFS;
15083 }
15084
15085 bool cfg80211_rx_control_port(struct net_device *dev,
15086                               struct sk_buff *skb, bool unencrypted)
15087 {
15088         int ret;
15089
15090         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15091         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15092         trace_cfg80211_return_bool(ret == 0);
15093         return ret == 0;
15094 }
15095 EXPORT_SYMBOL(cfg80211_rx_control_port);
15096
15097 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15098                                             const char *mac, gfp_t gfp)
15099 {
15100         struct wireless_dev *wdev = dev->ieee80211_ptr;
15101         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15102         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15103         void **cb;
15104
15105         if (!msg)
15106                 return NULL;
15107
15108         cb = (void **)msg->cb;
15109
15110         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15111         if (!cb[0]) {
15112                 nlmsg_free(msg);
15113                 return NULL;
15114         }
15115
15116         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15117             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15118                 goto nla_put_failure;
15119
15120         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15121                 goto nla_put_failure;
15122
15123         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15124         if (!cb[1])
15125                 goto nla_put_failure;
15126
15127         cb[2] = rdev;
15128
15129         return msg;
15130  nla_put_failure:
15131         nlmsg_free(msg);
15132         return NULL;
15133 }
15134
15135 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15136 {
15137         void **cb = (void **)msg->cb;
15138         struct cfg80211_registered_device *rdev = cb[2];
15139
15140         nla_nest_end(msg, cb[1]);
15141         genlmsg_end(msg, cb[0]);
15142
15143         memset(msg->cb, 0, sizeof(msg->cb));
15144
15145         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15146                                 NL80211_MCGRP_MLME, gfp);
15147 }
15148
15149 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15150                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15151                               s32 rssi_level, gfp_t gfp)
15152 {
15153         struct sk_buff *msg;
15154         struct wireless_dev *wdev = dev->ieee80211_ptr;
15155         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15156
15157         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15158
15159         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15160                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15161                 return;
15162
15163         if (wdev->cqm_config) {
15164                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15165
15166                 cfg80211_cqm_rssi_update(rdev, dev);
15167
15168                 if (rssi_level == 0)
15169                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15170         }
15171
15172         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15173         if (!msg)
15174                 return;
15175
15176         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15177                         rssi_event))
15178                 goto nla_put_failure;
15179
15180         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15181                                       rssi_level))
15182                 goto nla_put_failure;
15183
15184         cfg80211_send_cqm(msg, gfp);
15185
15186         return;
15187
15188  nla_put_failure:
15189         nlmsg_free(msg);
15190 }
15191 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15192
15193 void cfg80211_cqm_txe_notify(struct net_device *dev,
15194                              const u8 *peer, u32 num_packets,
15195                              u32 rate, u32 intvl, gfp_t gfp)
15196 {
15197         struct sk_buff *msg;
15198
15199         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15200         if (!msg)
15201                 return;
15202
15203         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15204                 goto nla_put_failure;
15205
15206         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15207                 goto nla_put_failure;
15208
15209         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15210                 goto nla_put_failure;
15211
15212         cfg80211_send_cqm(msg, gfp);
15213         return;
15214
15215  nla_put_failure:
15216         nlmsg_free(msg);
15217 }
15218 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15219
15220 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15221                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15222 {
15223         struct sk_buff *msg;
15224
15225         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15226
15227         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15228         if (!msg)
15229                 return;
15230
15231         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15232                 goto nla_put_failure;
15233
15234         cfg80211_send_cqm(msg, gfp);
15235         return;
15236
15237  nla_put_failure:
15238         nlmsg_free(msg);
15239 }
15240 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15241
15242 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15243 {
15244         struct sk_buff *msg;
15245
15246         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15247         if (!msg)
15248                 return;
15249
15250         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15251                 goto nla_put_failure;
15252
15253         cfg80211_send_cqm(msg, gfp);
15254         return;
15255
15256  nla_put_failure:
15257         nlmsg_free(msg);
15258 }
15259 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15260
15261 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15262                                      struct net_device *netdev, const u8 *bssid,
15263                                      const u8 *replay_ctr, gfp_t gfp)
15264 {
15265         struct sk_buff *msg;
15266         struct nlattr *rekey_attr;
15267         void *hdr;
15268
15269         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15270         if (!msg)
15271                 return;
15272
15273         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15274         if (!hdr) {
15275                 nlmsg_free(msg);
15276                 return;
15277         }
15278
15279         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15280             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15281             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15282                 goto nla_put_failure;
15283
15284         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15285         if (!rekey_attr)
15286                 goto nla_put_failure;
15287
15288         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15289                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15290                 goto nla_put_failure;
15291
15292         nla_nest_end(msg, rekey_attr);
15293
15294         genlmsg_end(msg, hdr);
15295
15296         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15297                                 NL80211_MCGRP_MLME, gfp);
15298         return;
15299
15300  nla_put_failure:
15301         nlmsg_free(msg);
15302 }
15303
15304 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15305                                const u8 *replay_ctr, gfp_t gfp)
15306 {
15307         struct wireless_dev *wdev = dev->ieee80211_ptr;
15308         struct wiphy *wiphy = wdev->wiphy;
15309         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15310
15311         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15312         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15313 }
15314 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15315
15316 static void
15317 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15318                                struct net_device *netdev, int index,
15319                                const u8 *bssid, bool preauth, gfp_t gfp)
15320 {
15321         struct sk_buff *msg;
15322         struct nlattr *attr;
15323         void *hdr;
15324
15325         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15326         if (!msg)
15327                 return;
15328
15329         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15330         if (!hdr) {
15331                 nlmsg_free(msg);
15332                 return;
15333         }
15334
15335         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15336             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15337                 goto nla_put_failure;
15338
15339         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15340         if (!attr)
15341                 goto nla_put_failure;
15342
15343         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15344             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15345             (preauth &&
15346              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15347                 goto nla_put_failure;
15348
15349         nla_nest_end(msg, attr);
15350
15351         genlmsg_end(msg, hdr);
15352
15353         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15354                                 NL80211_MCGRP_MLME, gfp);
15355         return;
15356
15357  nla_put_failure:
15358         nlmsg_free(msg);
15359 }
15360
15361 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15362                                      const u8 *bssid, bool preauth, gfp_t gfp)
15363 {
15364         struct wireless_dev *wdev = dev->ieee80211_ptr;
15365         struct wiphy *wiphy = wdev->wiphy;
15366         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15367
15368         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15369         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15370 }
15371 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15372
15373 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15374                                      struct net_device *netdev,
15375                                      struct cfg80211_chan_def *chandef,
15376                                      gfp_t gfp,
15377                                      enum nl80211_commands notif,
15378                                      u8 count)
15379 {
15380         struct sk_buff *msg;
15381         void *hdr;
15382
15383         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15384         if (!msg)
15385                 return;
15386
15387         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15388         if (!hdr) {
15389                 nlmsg_free(msg);
15390                 return;
15391         }
15392
15393         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15394                 goto nla_put_failure;
15395
15396         if (nl80211_send_chandef(msg, chandef))
15397                 goto nla_put_failure;
15398
15399         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15400             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15401                         goto nla_put_failure;
15402
15403         genlmsg_end(msg, hdr);
15404
15405         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15406                                 NL80211_MCGRP_MLME, gfp);
15407         return;
15408
15409  nla_put_failure:
15410         nlmsg_free(msg);
15411 }
15412
15413 void cfg80211_ch_switch_notify(struct net_device *dev,
15414                                struct cfg80211_chan_def *chandef)
15415 {
15416         struct wireless_dev *wdev = dev->ieee80211_ptr;
15417         struct wiphy *wiphy = wdev->wiphy;
15418         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15419
15420         ASSERT_WDEV_LOCK(wdev);
15421
15422         trace_cfg80211_ch_switch_notify(dev, chandef);
15423
15424         wdev->chandef = *chandef;
15425         wdev->preset_chandef = *chandef;
15426         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15427                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15428 }
15429 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15430
15431 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15432                                        struct cfg80211_chan_def *chandef,
15433                                        u8 count)
15434 {
15435         struct wireless_dev *wdev = dev->ieee80211_ptr;
15436         struct wiphy *wiphy = wdev->wiphy;
15437         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15438
15439         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15440
15441         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15442                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15443 }
15444 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15445
15446 void
15447 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15448                      const struct cfg80211_chan_def *chandef,
15449                      enum nl80211_radar_event event,
15450                      struct net_device *netdev, gfp_t gfp)
15451 {
15452         struct sk_buff *msg;
15453         void *hdr;
15454
15455         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15456         if (!msg)
15457                 return;
15458
15459         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15460         if (!hdr) {
15461                 nlmsg_free(msg);
15462                 return;
15463         }
15464
15465         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15466                 goto nla_put_failure;
15467
15468         /* NOP and radar events don't need a netdev parameter */
15469         if (netdev) {
15470                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15471
15472                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15473                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15474                                       NL80211_ATTR_PAD))
15475                         goto nla_put_failure;
15476         }
15477
15478         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15479                 goto nla_put_failure;
15480
15481         if (nl80211_send_chandef(msg, chandef))
15482                 goto nla_put_failure;
15483
15484         genlmsg_end(msg, hdr);
15485
15486         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15487                                 NL80211_MCGRP_MLME, gfp);
15488         return;
15489
15490  nla_put_failure:
15491         nlmsg_free(msg);
15492 }
15493
15494 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15495                                        struct sta_opmode_info *sta_opmode,
15496                                        gfp_t gfp)
15497 {
15498         struct sk_buff *msg;
15499         struct wireless_dev *wdev = dev->ieee80211_ptr;
15500         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15501         void *hdr;
15502
15503         if (WARN_ON(!mac))
15504                 return;
15505
15506         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15507         if (!msg)
15508                 return;
15509
15510         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15511         if (!hdr) {
15512                 nlmsg_free(msg);
15513                 return;
15514         }
15515
15516         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15517                 goto nla_put_failure;
15518
15519         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15520                 goto nla_put_failure;
15521
15522         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15523                 goto nla_put_failure;
15524
15525         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15526             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15527                 goto nla_put_failure;
15528
15529         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15530             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15531                 goto nla_put_failure;
15532
15533         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15534             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15535                 goto nla_put_failure;
15536
15537         genlmsg_end(msg, hdr);
15538
15539         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15540                                 NL80211_MCGRP_MLME, gfp);
15541
15542         return;
15543
15544 nla_put_failure:
15545         nlmsg_free(msg);
15546 }
15547 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15548
15549 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15550                            u64 cookie, bool acked, s32 ack_signal,
15551                            bool is_valid_ack_signal, gfp_t gfp)
15552 {
15553         struct wireless_dev *wdev = dev->ieee80211_ptr;
15554         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15555         struct sk_buff *msg;
15556         void *hdr;
15557
15558         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15559
15560         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15561
15562         if (!msg)
15563                 return;
15564
15565         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15566         if (!hdr) {
15567                 nlmsg_free(msg);
15568                 return;
15569         }
15570
15571         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15572             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15573             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15574             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15575                               NL80211_ATTR_PAD) ||
15576             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15577             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15578                                                 ack_signal)))
15579                 goto nla_put_failure;
15580
15581         genlmsg_end(msg, hdr);
15582
15583         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15584                                 NL80211_MCGRP_MLME, gfp);
15585         return;
15586
15587  nla_put_failure:
15588         nlmsg_free(msg);
15589 }
15590 EXPORT_SYMBOL(cfg80211_probe_status);
15591
15592 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15593                                  const u8 *frame, size_t len,
15594                                  int freq, int sig_dbm)
15595 {
15596         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15597         struct sk_buff *msg;
15598         void *hdr;
15599         struct cfg80211_beacon_registration *reg;
15600
15601         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15602
15603         spin_lock_bh(&rdev->beacon_registrations_lock);
15604         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15605                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15606                 if (!msg) {
15607                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15608                         return;
15609                 }
15610
15611                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15612                 if (!hdr)
15613                         goto nla_put_failure;
15614
15615                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15616                     (freq &&
15617                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15618                     (sig_dbm &&
15619                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15620                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15621                         goto nla_put_failure;
15622
15623                 genlmsg_end(msg, hdr);
15624
15625                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15626         }
15627         spin_unlock_bh(&rdev->beacon_registrations_lock);
15628         return;
15629
15630  nla_put_failure:
15631         spin_unlock_bh(&rdev->beacon_registrations_lock);
15632         nlmsg_free(msg);
15633 }
15634 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15635
15636 #ifdef CONFIG_PM
15637 static int cfg80211_net_detect_results(struct sk_buff *msg,
15638                                        struct cfg80211_wowlan_wakeup *wakeup)
15639 {
15640         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15641         struct nlattr *nl_results, *nl_match, *nl_freqs;
15642         int i, j;
15643
15644         nl_results = nla_nest_start(
15645                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15646         if (!nl_results)
15647                 return -EMSGSIZE;
15648
15649         for (i = 0; i < nd->n_matches; i++) {
15650                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15651
15652                 nl_match = nla_nest_start(msg, i);
15653                 if (!nl_match)
15654                         break;
15655
15656                 /* The SSID attribute is optional in nl80211, but for
15657                  * simplicity reasons it's always present in the
15658                  * cfg80211 structure.  If a driver can't pass the
15659                  * SSID, that needs to be changed.  A zero length SSID
15660                  * is still a valid SSID (wildcard), so it cannot be
15661                  * used for this purpose.
15662                  */
15663                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15664                             match->ssid.ssid)) {
15665                         nla_nest_cancel(msg, nl_match);
15666                         goto out;
15667                 }
15668
15669                 if (match->n_channels) {
15670                         nl_freqs = nla_nest_start(
15671                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15672                         if (!nl_freqs) {
15673                                 nla_nest_cancel(msg, nl_match);
15674                                 goto out;
15675                         }
15676
15677                         for (j = 0; j < match->n_channels; j++) {
15678                                 if (nla_put_u32(msg, j, match->channels[j])) {
15679                                         nla_nest_cancel(msg, nl_freqs);
15680                                         nla_nest_cancel(msg, nl_match);
15681                                         goto out;
15682                                 }
15683                         }
15684
15685                         nla_nest_end(msg, nl_freqs);
15686                 }
15687
15688                 nla_nest_end(msg, nl_match);
15689         }
15690
15691 out:
15692         nla_nest_end(msg, nl_results);
15693         return 0;
15694 }
15695
15696 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15697                                    struct cfg80211_wowlan_wakeup *wakeup,
15698                                    gfp_t gfp)
15699 {
15700         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15701         struct sk_buff *msg;
15702         void *hdr;
15703         int size = 200;
15704
15705         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15706
15707         if (wakeup)
15708                 size += wakeup->packet_present_len;
15709
15710         msg = nlmsg_new(size, gfp);
15711         if (!msg)
15712                 return;
15713
15714         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15715         if (!hdr)
15716                 goto free_msg;
15717
15718         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15719             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15720                               NL80211_ATTR_PAD))
15721                 goto free_msg;
15722
15723         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15724                                         wdev->netdev->ifindex))
15725                 goto free_msg;
15726
15727         if (wakeup) {
15728                 struct nlattr *reasons;
15729
15730                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15731                 if (!reasons)
15732                         goto free_msg;
15733
15734                 if (wakeup->disconnect &&
15735                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15736                         goto free_msg;
15737                 if (wakeup->magic_pkt &&
15738                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15739                         goto free_msg;
15740                 if (wakeup->gtk_rekey_failure &&
15741                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15742                         goto free_msg;
15743                 if (wakeup->eap_identity_req &&
15744                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15745                         goto free_msg;
15746                 if (wakeup->four_way_handshake &&
15747                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15748                         goto free_msg;
15749                 if (wakeup->rfkill_release &&
15750                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15751                         goto free_msg;
15752
15753                 if (wakeup->pattern_idx >= 0 &&
15754                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15755                                 wakeup->pattern_idx))
15756                         goto free_msg;
15757
15758                 if (wakeup->tcp_match &&
15759                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15760                         goto free_msg;
15761
15762                 if (wakeup->tcp_connlost &&
15763                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15764                         goto free_msg;
15765
15766                 if (wakeup->tcp_nomoretokens &&
15767                     nla_put_flag(msg,
15768                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15769                         goto free_msg;
15770
15771                 if (wakeup->packet) {
15772                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15773                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15774
15775                         if (!wakeup->packet_80211) {
15776                                 pkt_attr =
15777                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15778                                 len_attr =
15779                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15780                         }
15781
15782                         if (wakeup->packet_len &&
15783                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15784                                 goto free_msg;
15785
15786                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15787                                     wakeup->packet))
15788                                 goto free_msg;
15789                 }
15790
15791                 if (wakeup->net_detect &&
15792                     cfg80211_net_detect_results(msg, wakeup))
15793                                 goto free_msg;
15794
15795                 nla_nest_end(msg, reasons);
15796         }
15797
15798         genlmsg_end(msg, hdr);
15799
15800         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15801                                 NL80211_MCGRP_MLME, gfp);
15802         return;
15803
15804  free_msg:
15805         nlmsg_free(msg);
15806 }
15807 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15808 #endif
15809
15810 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15811                                 enum nl80211_tdls_operation oper,
15812                                 u16 reason_code, gfp_t gfp)
15813 {
15814         struct wireless_dev *wdev = dev->ieee80211_ptr;
15815         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15816         struct sk_buff *msg;
15817         void *hdr;
15818
15819         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15820                                          reason_code);
15821
15822         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15823         if (!msg)
15824                 return;
15825
15826         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15827         if (!hdr) {
15828                 nlmsg_free(msg);
15829                 return;
15830         }
15831
15832         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15833             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15834             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15835             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15836             (reason_code > 0 &&
15837              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15838                 goto nla_put_failure;
15839
15840         genlmsg_end(msg, hdr);
15841
15842         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15843                                 NL80211_MCGRP_MLME, gfp);
15844         return;
15845
15846  nla_put_failure:
15847         nlmsg_free(msg);
15848 }
15849 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15850
15851 static int nl80211_netlink_notify(struct notifier_block * nb,
15852                                   unsigned long state,
15853                                   void *_notify)
15854 {
15855         struct netlink_notify *notify = _notify;
15856         struct cfg80211_registered_device *rdev;
15857         struct wireless_dev *wdev;
15858         struct cfg80211_beacon_registration *reg, *tmp;
15859
15860         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15861                 return NOTIFY_DONE;
15862
15863         rcu_read_lock();
15864
15865         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15866                 struct cfg80211_sched_scan_request *sched_scan_req;
15867
15868                 list_for_each_entry_rcu(sched_scan_req,
15869                                         &rdev->sched_scan_req_list,
15870                                         list) {
15871                         if (sched_scan_req->owner_nlportid == notify->portid) {
15872                                 sched_scan_req->nl_owner_dead = true;
15873                                 schedule_work(&rdev->sched_scan_stop_wk);
15874                         }
15875                 }
15876
15877                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15878                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15879
15880                         if (wdev->owner_nlportid == notify->portid) {
15881                                 wdev->nl_owner_dead = true;
15882                                 schedule_work(&rdev->destroy_work);
15883                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15884                                 schedule_work(&wdev->disconnect_wk);
15885                         }
15886                 }
15887
15888                 spin_lock_bh(&rdev->beacon_registrations_lock);
15889                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15890                                          list) {
15891                         if (reg->nlportid == notify->portid) {
15892                                 list_del(&reg->list);
15893                                 kfree(reg);
15894                                 break;
15895                         }
15896                 }
15897                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15898         }
15899
15900         rcu_read_unlock();
15901
15902         /*
15903          * It is possible that the user space process that is controlling the
15904          * indoor setting disappeared, so notify the regulatory core.
15905          */
15906         regulatory_netlink_notify(notify->portid);
15907         return NOTIFY_OK;
15908 }
15909
15910 static struct notifier_block nl80211_netlink_notifier = {
15911         .notifier_call = nl80211_netlink_notify,
15912 };
15913
15914 void cfg80211_ft_event(struct net_device *netdev,
15915                        struct cfg80211_ft_event_params *ft_event)
15916 {
15917         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15918         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15919         struct sk_buff *msg;
15920         void *hdr;
15921
15922         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15923
15924         if (!ft_event->target_ap)
15925                 return;
15926
15927         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
15928                         GFP_KERNEL);
15929         if (!msg)
15930                 return;
15931
15932         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15933         if (!hdr)
15934                 goto out;
15935
15936         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15937             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15938             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15939                 goto out;
15940
15941         if (ft_event->ies &&
15942             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15943                 goto out;
15944         if (ft_event->ric_ies &&
15945             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15946                     ft_event->ric_ies))
15947                 goto out;
15948
15949         genlmsg_end(msg, hdr);
15950
15951         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15952                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15953         return;
15954  out:
15955         nlmsg_free(msg);
15956 }
15957 EXPORT_SYMBOL(cfg80211_ft_event);
15958
15959 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15960 {
15961         struct cfg80211_registered_device *rdev;
15962         struct sk_buff *msg;
15963         void *hdr;
15964         u32 nlportid;
15965
15966         rdev = wiphy_to_rdev(wdev->wiphy);
15967         if (!rdev->crit_proto_nlportid)
15968                 return;
15969
15970         nlportid = rdev->crit_proto_nlportid;
15971         rdev->crit_proto_nlportid = 0;
15972
15973         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15974         if (!msg)
15975                 return;
15976
15977         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15978         if (!hdr)
15979                 goto nla_put_failure;
15980
15981         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15982             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15983                               NL80211_ATTR_PAD))
15984                 goto nla_put_failure;
15985
15986         genlmsg_end(msg, hdr);
15987
15988         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15989         return;
15990
15991  nla_put_failure:
15992         nlmsg_free(msg);
15993 }
15994 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15995
15996 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15997 {
15998         struct wiphy *wiphy = wdev->wiphy;
15999         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16000         struct sk_buff *msg;
16001         void *hdr;
16002
16003         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16004         if (!msg)
16005                 return;
16006
16007         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16008         if (!hdr)
16009                 goto out;
16010
16011         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16012             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16013             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16014                               NL80211_ATTR_PAD))
16015                 goto out;
16016
16017         genlmsg_end(msg, hdr);
16018
16019         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16020                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16021         return;
16022  out:
16023         nlmsg_free(msg);
16024 }
16025
16026 int cfg80211_external_auth_request(struct net_device *dev,
16027                                    struct cfg80211_external_auth_params *params,
16028                                    gfp_t gfp)
16029 {
16030         struct wireless_dev *wdev = dev->ieee80211_ptr;
16031         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16032         struct sk_buff *msg;
16033         void *hdr;
16034
16035         if (!wdev->conn_owner_nlportid)
16036                 return -EINVAL;
16037
16038         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16039         if (!msg)
16040                 return -ENOMEM;
16041
16042         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16043         if (!hdr)
16044                 goto nla_put_failure;
16045
16046         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16047             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16048             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16049             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16050                         params->action) ||
16051             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16052             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16053                     params->ssid.ssid))
16054                 goto nla_put_failure;
16055
16056         genlmsg_end(msg, hdr);
16057         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16058                         wdev->conn_owner_nlportid);
16059         return 0;
16060
16061  nla_put_failure:
16062         nlmsg_free(msg);
16063         return -ENOBUFS;
16064 }
16065 EXPORT_SYMBOL(cfg80211_external_auth_request);
16066
16067 /* initialisation/exit functions */
16068
16069 int __init nl80211_init(void)
16070 {
16071         int err;
16072
16073         err = genl_register_family(&nl80211_fam);
16074         if (err)
16075                 return err;
16076
16077         err = netlink_register_notifier(&nl80211_netlink_notifier);
16078         if (err)
16079                 goto err_out;
16080
16081         return 0;
16082  err_out:
16083         genl_unregister_family(&nl80211_fam);
16084         return err;
16085 }
16086
16087 void nl80211_exit(void)
16088 {
16089         netlink_unregister_notifier(&nl80211_netlink_notifier);
16090         genl_unregister_family(&nl80211_fam);
16091 }