net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_beacon_head(const struct nlattr *attr,
 204                                 struct netlink_ext_ack *extack)
 205 {
 206         const u8 *data = nla_data(attr);
 207         unsigned int len = nla_len(attr);
 208         const struct element *elem;
 209         const struct ieee80211_mgmt *mgmt = (void *)data;
 210         unsigned int fixedlen = offsetof(struct ieee80211_mgmt,
 211                                          u.beacon.variable);
 212
 213         if (len < fixedlen)
 214                 goto err;
 215
 216         if (ieee80211_hdrlen(mgmt->frame_control) !=
 217             offsetof(struct ieee80211_mgmt, u.beacon))
 218                 goto err;
 219
 220         data += fixedlen;
 221         len -= fixedlen;
 222
 223         for_each_element(elem, data, len) {
 224                 /* nothing */
 225         }
 226
 227         if (for_each_element_completed(elem, data, len))
 228                 return 0;
 229
 230 err:
 231         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 232         return -EINVAL;
 233 }
 234
 235 /* policy for the attributes */
 236 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 237         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 238         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 239                                       .len = 20-1 },
 240         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 241
 242         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 243         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 244         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 245         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 246         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 247
 248         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 249         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 250         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 251         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 252         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 253         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 254
 255         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 256         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 257         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 258
 259         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 260         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 261
 262         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 263         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 264                                     .len = WLAN_MAX_KEY_LEN },
 265         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 266         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 267         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 268         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 269         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 270
 271         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 272         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 273         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 274                                        .len = IEEE80211_MAX_DATA_LEN },
 275         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 276                                        .len = IEEE80211_MAX_DATA_LEN },
 277         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 278         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 279         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 280         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 281                                                .len = NL80211_MAX_SUPP_RATES },
 282         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 283         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 284         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 285         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 286                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 287         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_BINARY,
 288                                           .len = ETH_ALEN },
 289
 290         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 291         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 292
 293         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 294         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 295         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 296         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 297                                            .len = NL80211_MAX_SUPP_RATES },
 298         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 299
 300         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 301         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 302
 303         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 304
 305         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 306         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 307                               .len = IEEE80211_MAX_DATA_LEN },
 308         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 309         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 310
 311         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 312                                 .len = IEEE80211_MAX_SSID_LEN },
 313         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 314         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 315         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 316         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 317         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 318         [NL80211_ATTR_STA_FLAGS2] = {
 319                 .len = sizeof(struct nl80211_sta_flag_update),
 320         },
 321         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 322         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 323         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 325         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 327         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 328         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 329         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 330         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 331         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 332         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 333         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 334         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 335                                  .len = IEEE80211_MAX_DATA_LEN },
 336         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 337         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 338         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 339         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 340         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 341         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 342         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 343         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 344         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 345         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 346         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 347         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 348         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 349         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 350         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 351         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 352         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 353         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 354         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 355         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 356                                          .len = IEEE80211_MAX_DATA_LEN },
 357         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 358                                          .len = IEEE80211_MAX_DATA_LEN },
 359         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 360         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 361         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 362         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 363         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 364         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 365         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 367         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 368         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 369         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 370                                       .len = IEEE80211_MAX_DATA_LEN },
 371         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 372         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 373         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 374                 .len = NL80211_HT_CAPABILITY_LEN
 375         },
 376         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 377         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 378         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 379         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 380         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 381         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 382         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 383         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 384         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 385         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 386         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 387         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 388         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 389         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 390         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 391         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 392         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 394                 .len = NL80211_VHT_CAPABILITY_LEN,
 395         },
 396         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 397         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 398                                   .len = IEEE80211_MAX_DATA_LEN },
 399         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 400         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 401         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 402         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 403         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 404         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 405         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 406         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 407         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 408         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 409         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 410         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 411         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 412         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 413                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 414         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 415         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 416         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 417         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 418         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 419         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 420         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 421         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 422         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 423         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 424         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 425         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 426         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 427         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 428         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 430         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 431         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 432         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 433                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 434         },
 435         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 436         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 437         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 438         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 439         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 440                                     .len = FILS_MAX_KEK_LEN },
 441         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 442         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 443         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 444         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 445         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 446                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 447         },
 448         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 449         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 450                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 451         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 452                                           .len = FILS_ERP_MAX_REALM_LEN },
 453         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 454         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 455                                         .len = FILS_ERP_MAX_RRK_LEN },
 456         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 457         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 458         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 459         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 460
 461         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 462         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 463         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 464         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 465                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 466 };
 467
 468 /* policy for the key attributes */
 469 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 470         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 471         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 472         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 473         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 474         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 475         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 476         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 477         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 478 };
 479
 480 /* policy for the key default flags */
 481 static const struct nla_policy
 482 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 483         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 484         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 485 };
 486
 487 #ifdef CONFIG_PM
 488 /* policy for WoWLAN attributes */
 489 static const struct nla_policy
 490 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 491         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 492         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 493         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 494         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 495         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 496         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 497         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 498         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 499         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 500         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 501 };
 502
 503 static const struct nla_policy
 504 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 505         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 506         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 507         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 508         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 509         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 510         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 511         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 512                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 513         },
 514         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 515                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 516         },
 517         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 518         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 519         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 520 };
 521 #endif /* CONFIG_PM */
 522
 523 /* policy for coalesce rule attributes */
 524 static const struct nla_policy
 525 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 526         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 527         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 528         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 529 };
 530
 531 /* policy for GTK rekey offload attributes */
 532 static const struct nla_policy
 533 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 534         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 535         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 536         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 537 };
 538
 539 static const struct nla_policy
 540 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 541         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 542                                                  .len = IEEE80211_MAX_SSID_LEN },
 543         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 544         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 545 };
 546
 547 static const struct nla_policy
 548 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 549         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 550         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 551 };
 552
 553 static const struct nla_policy
 554 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 555         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 556         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 557         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 558                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 559         },
 560 };
 561
 562 /* policy for NAN function attributes */
 563 static const struct nla_policy
 564 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 565         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 566         [NL80211_NAN_FUNC_SERVICE_ID] = {
 567                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 568         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 569         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 570         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 571         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 572         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 573         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 574         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 575         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 576         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 577                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 578         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 579         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 580         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 581         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 582         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 583 };
 584
 585 /* policy for Service Response Filter attributes */
 586 static const struct nla_policy
 587 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 588         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 589         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 590                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 591         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 592         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 593 };
 594
 595 /* policy for packet pattern attributes */
 596 static const struct nla_policy
 597 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 598         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 599         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 600         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 601 };
 602
 603 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 604                                      struct netlink_callback *cb,
 605                                      struct cfg80211_registered_device **rdev,
 606                                      struct wireless_dev **wdev)
 607 {
 608         int err;
 609
 610         if (!cb->args[0]) {
 611                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 612                                   genl_family_attrbuf(&nl80211_fam),
 613                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 614                 if (err)
 615                         return err;
 616
 617                 *wdev = __cfg80211_wdev_from_attrs(
 618                                         sock_net(skb->sk),
 619                                         genl_family_attrbuf(&nl80211_fam));
 620                 if (IS_ERR(*wdev))
 621                         return PTR_ERR(*wdev);
 622                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 623                 /* 0 is the first index - add 1 to parse only once */
 624                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 625                 cb->args[1] = (*wdev)->identifier;
 626         } else {
 627                 /* subtract the 1 again here */
 628                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 629                 struct wireless_dev *tmp;
 630
 631                 if (!wiphy)
 632                         return -ENODEV;
 633                 *rdev = wiphy_to_rdev(wiphy);
 634                 *wdev = NULL;
 635
 636                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 637                         if (tmp->identifier == cb->args[1]) {
 638                                 *wdev = tmp;
 639                                 break;
 640                         }
 641                 }
 642
 643                 if (!*wdev)
 644                         return -ENODEV;
 645         }
 646
 647         return 0;
 648 }
 649
 650 /* IE validation */
 651 static bool is_valid_ie_attr(const struct nlattr *attr)
 652 {
 653         const u8 *pos;
 654         int len;
 655
 656         if (!attr)
 657                 return true;
 658
 659         pos = nla_data(attr);
 660         len = nla_len(attr);
 661
 662         while (len) {
 663                 u8 elemlen;
 664
 665                 if (len < 2)
 666                         return false;
 667                 len -= 2;
 668
 669                 elemlen = pos[1];
 670                 if (elemlen > len)
 671                         return false;
 672
 673                 len -= elemlen;
 674                 pos += 2 + elemlen;
 675         }
 676
 677         return true;
 678 }
 679
 680 /* message building helper */
 681 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 682                                    int flags, u8 cmd)
 683 {
 684         /* since there is no private header just add the generic one */
 685         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 686 }
 687
 688 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 689                                      const struct ieee80211_reg_rule *rule)
 690 {
 691         int j;
 692         struct nlattr *nl_wmm_rules =
 693                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 694
 695         if (!nl_wmm_rules)
 696                 goto nla_put_failure;
 697
 698         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 699                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 700
 701                 if (!nl_wmm_rule)
 702                         goto nla_put_failure;
 703
 704                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 705                                 rule->wmm_rule.client[j].cw_min) ||
 706                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 707                                 rule->wmm_rule.client[j].cw_max) ||
 708                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 709                                rule->wmm_rule.client[j].aifsn) ||
 710                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 711                                 rule->wmm_rule.client[j].cot))
 712                         goto nla_put_failure;
 713
 714                 nla_nest_end(msg, nl_wmm_rule);
 715         }
 716         nla_nest_end(msg, nl_wmm_rules);
 717
 718         return 0;
 719
 720 nla_put_failure:
 721         return -ENOBUFS;
 722 }
 723
 724 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 725                                    struct ieee80211_channel *chan,
 726                                    bool large)
 727 {
 728         /* Some channels must be completely excluded from the
 729          * list to protect old user-space tools from breaking
 730          */
 731         if (!large && chan->flags &
 732             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 733                 return 0;
 734
 735         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 736                         chan->center_freq))
 737                 goto nla_put_failure;
 738
 739         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 740             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 741                 goto nla_put_failure;
 742         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 743                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 744                         goto nla_put_failure;
 745                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 746                         goto nla_put_failure;
 747         }
 748         if (chan->flags & IEEE80211_CHAN_RADAR) {
 749                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 750                         goto nla_put_failure;
 751                 if (large) {
 752                         u32 time;
 753
 754                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 755
 756                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 757                                         chan->dfs_state))
 758                                 goto nla_put_failure;
 759                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 760                                         time))
 761                                 goto nla_put_failure;
 762                         if (nla_put_u32(msg,
 763                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 764                                         chan->dfs_cac_ms))
 765                                 goto nla_put_failure;
 766                 }
 767         }
 768
 769         if (large) {
 770                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 771                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 772                         goto nla_put_failure;
 773                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 774                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 775                         goto nla_put_failure;
 776                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 777                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 778                         goto nla_put_failure;
 779                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 780                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 781                         goto nla_put_failure;
 782                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 783                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 784                         goto nla_put_failure;
 785                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 786                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 787                         goto nla_put_failure;
 788                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 789                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 790                         goto nla_put_failure;
 791                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 792                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 793                         goto nla_put_failure;
 794         }
 795
 796         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 797                         DBM_TO_MBM(chan->max_power)))
 798                 goto nla_put_failure;
 799
 800         if (large) {
 801                 const struct ieee80211_reg_rule *rule =
 802                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 803
 804                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 805                         if (nl80211_msg_put_wmm_rules(msg, rule))
 806                                 goto nla_put_failure;
 807                 }
 808         }
 809
 810         return 0;
 811
 812  nla_put_failure:
 813         return -ENOBUFS;
 814 }
 815
 816 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 817                                   struct cfg80211_txq_stats *txqstats,
 818                                   int attrtype)
 819 {
 820         struct nlattr *txqattr;
 821
 822 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 823         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 824             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 825                 return false;                                             \
 826         } while (0)
 827
 828         txqattr = nla_nest_start(msg, attrtype);
 829         if (!txqattr)
 830                 return false;
 831
 832         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 833         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 834         PUT_TXQVAL_U32(FLOWS, flows);
 835         PUT_TXQVAL_U32(DROPS, drops);
 836         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 837         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 838         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 839         PUT_TXQVAL_U32(COLLISIONS, collisions);
 840         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 841         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 842         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 843         nla_nest_end(msg, txqattr);
 844
 845 #undef PUT_TXQVAL_U32
 846         return true;
 847 }
 848
 849 /* netlink command implementations */
 850
 851 struct key_parse {
 852         struct key_params p;
 853         int idx;
 854         int type;
 855         bool def, defmgmt;
 856         bool def_uni, def_multi;
 857 };
 858
 859 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 860                                  struct key_parse *k)
 861 {
 862         struct nlattr *tb[NL80211_KEY_MAX + 1];
 863         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 864                                    nl80211_key_policy, info->extack);
 865         if (err)
 866                 return err;
 867
 868         k->def = !!tb[NL80211_KEY_DEFAULT];
 869         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 870
 871         if (k->def) {
 872                 k->def_uni = true;
 873                 k->def_multi = true;
 874         }
 875         if (k->defmgmt)
 876                 k->def_multi = true;
 877
 878         if (tb[NL80211_KEY_IDX])
 879                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 880
 881         if (tb[NL80211_KEY_DATA]) {
 882                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 883                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 884         }
 885
 886         if (tb[NL80211_KEY_SEQ]) {
 887                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 888                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 889         }
 890
 891         if (tb[NL80211_KEY_CIPHER])
 892                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 893
 894         if (tb[NL80211_KEY_TYPE]) {
 895                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 896                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 897                         return genl_err_attr(info, -EINVAL,
 898                                              tb[NL80211_KEY_TYPE]);
 899         }
 900
 901         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 902                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 903
 904                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 905                                        tb[NL80211_KEY_DEFAULT_TYPES],
 906                                        nl80211_key_default_policy,
 907                                        info->extack);
 908                 if (err)
 909                         return err;
 910
 911                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 912                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 913         }
 914
 915         return 0;
 916 }
 917
 918 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 919 {
 920         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 921                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 922                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 923         }
 924
 925         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 926                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 927                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 928         }
 929
 930         if (info->attrs[NL80211_ATTR_KEY_IDX])
 931                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 932
 933         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 934                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 935
 936         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 937         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 938
 939         if (k->def) {
 940                 k->def_uni = true;
 941                 k->def_multi = true;
 942         }
 943         if (k->defmgmt)
 944                 k->def_multi = true;
 945
 946         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 947                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 948                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES) {
 949                         GENL_SET_ERR_MSG(info, "key type out of range");
 950                         return -EINVAL;
 951                 }
 952         }
 953
 954         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 955                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 956                 int err = nla_parse_nested(kdt,
 957                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 958                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 959                                            nl80211_key_default_policy,
 960                                            info->extack);
 961                 if (err)
 962                         return err;
 963
 964                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 965                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 966         }
 967
 968         return 0;
 969 }
 970
 971 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 972 {
 973         int err;
 974
 975         memset(k, 0, sizeof(*k));
 976         k->idx = -1;
 977         k->type = -1;
 978
 979         if (info->attrs[NL80211_ATTR_KEY])
 980                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 981         else
 982                 err = nl80211_parse_key_old(info, k);
 983
 984         if (err)
 985                 return err;
 986
 987         if (k->def && k->defmgmt) {
 988                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 989                 return -EINVAL;
 990         }
 991
 992         if (k->defmgmt) {
 993                 if (k->def_uni || !k->def_multi) {
 994                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 995                         return -EINVAL;
 996                 }
 997         }
 998
 999         if (k->idx != -1) {
1000                 if (k->defmgmt) {
1001                         if (k->idx < 4 || k->idx > 5) {
1002                                 GENL_SET_ERR_MSG(info,
1003                                                  "defmgmt key idx not 4 or 5");
1004                                 return -EINVAL;
1005                         }
1006                 } else if (k->def) {
1007                         if (k->idx < 0 || k->idx > 3) {
1008                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1009                                 return -EINVAL;
1010                         }
1011                 } else {
1012                         if (k->idx < 0 || k->idx > 5) {
1013                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1014                                 return -EINVAL;
1015                         }
1016                 }
1017         }
1018
1019         return 0;
1020 }
1021
1022 static struct cfg80211_cached_keys *
1023 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1024                        struct genl_info *info, bool *no_ht)
1025 {
1026         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1027         struct key_parse parse;
1028         struct nlattr *key;
1029         struct cfg80211_cached_keys *result;
1030         int rem, err, def = 0;
1031         bool have_key = false;
1032
1033         nla_for_each_nested(key, keys, rem) {
1034                 have_key = true;
1035                 break;
1036         }
1037
1038         if (!have_key)
1039                 return NULL;
1040
1041         result = kzalloc(sizeof(*result), GFP_KERNEL);
1042         if (!result)
1043                 return ERR_PTR(-ENOMEM);
1044
1045         result->def = -1;
1046
1047         nla_for_each_nested(key, keys, rem) {
1048                 memset(&parse, 0, sizeof(parse));
1049                 parse.idx = -1;
1050
1051                 err = nl80211_parse_key_new(info, key, &parse);
1052                 if (err)
1053                         goto error;
1054                 err = -EINVAL;
1055                 if (!parse.p.key)
1056                         goto error;
1057                 if (parse.idx < 0 || parse.idx > 3) {
1058                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1059                         goto error;
1060                 }
1061                 if (parse.def) {
1062                         if (def) {
1063                                 GENL_SET_ERR_MSG(info,
1064                                                  "only one key can be default");
1065                                 goto error;
1066                         }
1067                         def = 1;
1068                         result->def = parse.idx;
1069                         if (!parse.def_uni || !parse.def_multi)
1070                                 goto error;
1071                 } else if (parse.defmgmt)
1072                         goto error;
1073                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1074                                                      parse.idx, false, NULL);
1075                 if (err)
1076                         goto error;
1077                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1078                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1079                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1080                         err = -EINVAL;
1081                         goto error;
1082                 }
1083                 result->params[parse.idx].cipher = parse.p.cipher;
1084                 result->params[parse.idx].key_len = parse.p.key_len;
1085                 result->params[parse.idx].key = result->data[parse.idx];
1086                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1087
1088                 /* must be WEP key if we got here */
1089                 if (no_ht)
1090                         *no_ht = true;
1091         }
1092
1093         if (result->def < 0) {
1094                 err = -EINVAL;
1095                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1096                 goto error;
1097         }
1098
1099         return result;
1100  error:
1101         kfree(result);
1102         return ERR_PTR(err);
1103 }
1104
1105 static int nl80211_key_allowed(struct wireless_dev *wdev)
1106 {
1107         ASSERT_WDEV_LOCK(wdev);
1108
1109         switch (wdev->iftype) {
1110         case NL80211_IFTYPE_AP:
1111         case NL80211_IFTYPE_AP_VLAN:
1112         case NL80211_IFTYPE_P2P_GO:
1113         case NL80211_IFTYPE_MESH_POINT:
1114                 break;
1115         case NL80211_IFTYPE_ADHOC:
1116         case NL80211_IFTYPE_STATION:
1117         case NL80211_IFTYPE_P2P_CLIENT:
1118                 if (!wdev->current_bss)
1119                         return -ENOLINK;
1120                 break;
1121         case NL80211_IFTYPE_UNSPECIFIED:
1122         case NL80211_IFTYPE_OCB:
1123         case NL80211_IFTYPE_MONITOR:
1124         case NL80211_IFTYPE_NAN:
1125         case NL80211_IFTYPE_P2P_DEVICE:
1126         case NL80211_IFTYPE_WDS:
1127         case NUM_NL80211_IFTYPES:
1128                 return -EINVAL;
1129         }
1130
1131         return 0;
1132 }
1133
1134 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1135                                                         struct nlattr *tb)
1136 {
1137         struct ieee80211_channel *chan;
1138
1139         if (tb == NULL)
1140                 return NULL;
1141         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1142         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1143                 return NULL;
1144         return chan;
1145 }
1146
1147 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1148 {
1149         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1150         int i;
1151
1152         if (!nl_modes)
1153                 goto nla_put_failure;
1154
1155         i = 0;
1156         while (ifmodes) {
1157                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1158                         goto nla_put_failure;
1159                 ifmodes >>= 1;
1160                 i++;
1161         }
1162
1163         nla_nest_end(msg, nl_modes);
1164         return 0;
1165
1166 nla_put_failure:
1167         return -ENOBUFS;
1168 }
1169
1170 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1171                                           struct sk_buff *msg,
1172                                           bool large)
1173 {
1174         struct nlattr *nl_combis;
1175         int i, j;
1176
1177         nl_combis = nla_nest_start(msg,
1178                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1179         if (!nl_combis)
1180                 goto nla_put_failure;
1181
1182         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1183                 const struct ieee80211_iface_combination *c;
1184                 struct nlattr *nl_combi, *nl_limits;
1185
1186                 c = &wiphy->iface_combinations[i];
1187
1188                 nl_combi = nla_nest_start(msg, i + 1);
1189                 if (!nl_combi)
1190                         goto nla_put_failure;
1191
1192                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1193                 if (!nl_limits)
1194                         goto nla_put_failure;
1195
1196                 for (j = 0; j < c->n_limits; j++) {
1197                         struct nlattr *nl_limit;
1198
1199                         nl_limit = nla_nest_start(msg, j + 1);
1200                         if (!nl_limit)
1201                                 goto nla_put_failure;
1202                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1203                                         c->limits[j].max))
1204                                 goto nla_put_failure;
1205                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1206                                                 c->limits[j].types))
1207                                 goto nla_put_failure;
1208                         nla_nest_end(msg, nl_limit);
1209                 }
1210
1211                 nla_nest_end(msg, nl_limits);
1212
1213                 if (c->beacon_int_infra_match &&
1214                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1215                         goto nla_put_failure;
1216                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1217                                 c->num_different_channels) ||
1218                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1219                                 c->max_interfaces))
1220                         goto nla_put_failure;
1221                 if (large &&
1222                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1223                                 c->radar_detect_widths) ||
1224                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1225                                 c->radar_detect_regions)))
1226                         goto nla_put_failure;
1227                 if (c->beacon_int_min_gcd &&
1228                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1229                                 c->beacon_int_min_gcd))
1230                         goto nla_put_failure;
1231
1232                 nla_nest_end(msg, nl_combi);
1233         }
1234
1235         nla_nest_end(msg, nl_combis);
1236
1237         return 0;
1238 nla_put_failure:
1239         return -ENOBUFS;
1240 }
1241
1242 #ifdef CONFIG_PM
1243 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1244                                         struct sk_buff *msg)
1245 {
1246         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1247         struct nlattr *nl_tcp;
1248
1249         if (!tcp)
1250                 return 0;
1251
1252         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1253         if (!nl_tcp)
1254                 return -ENOBUFS;
1255
1256         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1257                         tcp->data_payload_max))
1258                 return -ENOBUFS;
1259
1260         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1261                         tcp->data_payload_max))
1262                 return -ENOBUFS;
1263
1264         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1265                 return -ENOBUFS;
1266
1267         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1268                                 sizeof(*tcp->tok), tcp->tok))
1269                 return -ENOBUFS;
1270
1271         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1272                         tcp->data_interval_max))
1273                 return -ENOBUFS;
1274
1275         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1276                         tcp->wake_payload_max))
1277                 return -ENOBUFS;
1278
1279         nla_nest_end(msg, nl_tcp);
1280         return 0;
1281 }
1282
1283 static int nl80211_send_wowlan(struct sk_buff *msg,
1284                                struct cfg80211_registered_device *rdev,
1285                                bool large)
1286 {
1287         struct nlattr *nl_wowlan;
1288
1289         if (!rdev->wiphy.wowlan)
1290                 return 0;
1291
1292         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1293         if (!nl_wowlan)
1294                 return -ENOBUFS;
1295
1296         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1297              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1298             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1299              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1300             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1301              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1302             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1303              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1304             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1305              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1306             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1307              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1308             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1309              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1310             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1311              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1312                 return -ENOBUFS;
1313
1314         if (rdev->wiphy.wowlan->n_patterns) {
1315                 struct nl80211_pattern_support pat = {
1316                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1317                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1318                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1319                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1320                 };
1321
1322                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1323                             sizeof(pat), &pat))
1324                         return -ENOBUFS;
1325         }
1326
1327         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1328             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1329                         rdev->wiphy.wowlan->max_nd_match_sets))
1330                 return -ENOBUFS;
1331
1332         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1333                 return -ENOBUFS;
1334
1335         nla_nest_end(msg, nl_wowlan);
1336
1337         return 0;
1338 }
1339 #endif
1340
1341 static int nl80211_send_coalesce(struct sk_buff *msg,
1342                                  struct cfg80211_registered_device *rdev)
1343 {
1344         struct nl80211_coalesce_rule_support rule;
1345
1346         if (!rdev->wiphy.coalesce)
1347                 return 0;
1348
1349         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1350         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1351         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1352         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1353         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1354         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1355
1356         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1357                 return -ENOBUFS;
1358
1359         return 0;
1360 }
1361
1362 static int
1363 nl80211_send_iftype_data(struct sk_buff *msg,
1364                          const struct ieee80211_sband_iftype_data *iftdata)
1365 {
1366         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1367
1368         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1369                                 iftdata->types_mask))
1370                 return -ENOBUFS;
1371
1372         if (he_cap->has_he) {
1373                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1374                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1375                             he_cap->he_cap_elem.mac_cap_info) ||
1376                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1377                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1378                             he_cap->he_cap_elem.phy_cap_info) ||
1379                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1380                             sizeof(he_cap->he_mcs_nss_supp),
1381                             &he_cap->he_mcs_nss_supp) ||
1382                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1383                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1384                         return -ENOBUFS;
1385         }
1386
1387         return 0;
1388 }
1389
1390 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1391                                       struct ieee80211_supported_band *sband)
1392 {
1393         struct nlattr *nl_rates, *nl_rate;
1394         struct ieee80211_rate *rate;
1395         int i;
1396
1397         /* add HT info */
1398         if (sband->ht_cap.ht_supported &&
1399             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1400                      sizeof(sband->ht_cap.mcs),
1401                      &sband->ht_cap.mcs) ||
1402              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1403                          sband->ht_cap.cap) ||
1404              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1405                         sband->ht_cap.ampdu_factor) ||
1406              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1407                         sband->ht_cap.ampdu_density)))
1408                 return -ENOBUFS;
1409
1410         /* add VHT info */
1411         if (sband->vht_cap.vht_supported &&
1412             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1413                      sizeof(sband->vht_cap.vht_mcs),
1414                      &sband->vht_cap.vht_mcs) ||
1415              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1416                          sband->vht_cap.cap)))
1417                 return -ENOBUFS;
1418
1419         if (sband->n_iftype_data) {
1420                 struct nlattr *nl_iftype_data =
1421                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1422                 int err;
1423
1424                 if (!nl_iftype_data)
1425                         return -ENOBUFS;
1426
1427                 for (i = 0; i < sband->n_iftype_data; i++) {
1428                         struct nlattr *iftdata;
1429
1430                         iftdata = nla_nest_start(msg, i + 1);
1431                         if (!iftdata)
1432                                 return -ENOBUFS;
1433
1434                         err = nl80211_send_iftype_data(msg,
1435                                                        &sband->iftype_data[i]);
1436                         if (err)
1437                                 return err;
1438
1439                         nla_nest_end(msg, iftdata);
1440                 }
1441
1442                 nla_nest_end(msg, nl_iftype_data);
1443         }
1444
1445         /* add bitrates */
1446         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1447         if (!nl_rates)
1448                 return -ENOBUFS;
1449
1450         for (i = 0; i < sband->n_bitrates; i++) {
1451                 nl_rate = nla_nest_start(msg, i);
1452                 if (!nl_rate)
1453                         return -ENOBUFS;
1454
1455                 rate = &sband->bitrates[i];
1456                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1457                                 rate->bitrate))
1458                         return -ENOBUFS;
1459                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1460                     nla_put_flag(msg,
1461                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1462                         return -ENOBUFS;
1463
1464                 nla_nest_end(msg, nl_rate);
1465         }
1466
1467         nla_nest_end(msg, nl_rates);
1468
1469         return 0;
1470 }
1471
1472 static int
1473 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1474                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1475 {
1476         u16 stypes;
1477         struct nlattr *nl_ftypes, *nl_ifs;
1478         enum nl80211_iftype ift;
1479         int i;
1480
1481         if (!mgmt_stypes)
1482                 return 0;
1483
1484         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1485         if (!nl_ifs)
1486                 return -ENOBUFS;
1487
1488         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1489                 nl_ftypes = nla_nest_start(msg, ift);
1490                 if (!nl_ftypes)
1491                         return -ENOBUFS;
1492                 i = 0;
1493                 stypes = mgmt_stypes[ift].tx;
1494                 while (stypes) {
1495                         if ((stypes & 1) &&
1496                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1497                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1498                                 return -ENOBUFS;
1499                         stypes >>= 1;
1500                         i++;
1501                 }
1502                 nla_nest_end(msg, nl_ftypes);
1503         }
1504
1505         nla_nest_end(msg, nl_ifs);
1506
1507         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1508         if (!nl_ifs)
1509                 return -ENOBUFS;
1510
1511         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1512                 nl_ftypes = nla_nest_start(msg, ift);
1513                 if (!nl_ftypes)
1514                         return -ENOBUFS;
1515                 i = 0;
1516                 stypes = mgmt_stypes[ift].rx;
1517                 while (stypes) {
1518                         if ((stypes & 1) &&
1519                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1520                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1521                                 return -ENOBUFS;
1522                         stypes >>= 1;
1523                         i++;
1524                 }
1525                 nla_nest_end(msg, nl_ftypes);
1526         }
1527         nla_nest_end(msg, nl_ifs);
1528
1529         return 0;
1530 }
1531
1532 #define CMD(op, n)                                                      \
1533          do {                                                           \
1534                 if (rdev->ops->op) {                                    \
1535                         i++;                                            \
1536                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1537                                 goto nla_put_failure;                   \
1538                 }                                                       \
1539         } while (0)
1540
1541 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1542                                         struct sk_buff *msg)
1543 {
1544         int i = 0;
1545
1546         /*
1547          * do *NOT* add anything into this function, new things need to be
1548          * advertised only to new versions of userspace that can deal with
1549          * the split (and they can't possibly care about new features...
1550          */
1551         CMD(add_virtual_intf, NEW_INTERFACE);
1552         CMD(change_virtual_intf, SET_INTERFACE);
1553         CMD(add_key, NEW_KEY);
1554         CMD(start_ap, START_AP);
1555         CMD(add_station, NEW_STATION);
1556         CMD(add_mpath, NEW_MPATH);
1557         CMD(update_mesh_config, SET_MESH_CONFIG);
1558         CMD(change_bss, SET_BSS);
1559         CMD(auth, AUTHENTICATE);
1560         CMD(assoc, ASSOCIATE);
1561         CMD(deauth, DEAUTHENTICATE);
1562         CMD(disassoc, DISASSOCIATE);
1563         CMD(join_ibss, JOIN_IBSS);
1564         CMD(join_mesh, JOIN_MESH);
1565         CMD(set_pmksa, SET_PMKSA);
1566         CMD(del_pmksa, DEL_PMKSA);
1567         CMD(flush_pmksa, FLUSH_PMKSA);
1568         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1569                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1570         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1571         CMD(mgmt_tx, FRAME);
1572         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1573         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1574                 i++;
1575                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1576                         goto nla_put_failure;
1577         }
1578         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1579             rdev->ops->join_mesh) {
1580                 i++;
1581                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1582                         goto nla_put_failure;
1583         }
1584         CMD(set_wds_peer, SET_WDS_PEER);
1585         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1586                 CMD(tdls_mgmt, TDLS_MGMT);
1587                 CMD(tdls_oper, TDLS_OPER);
1588         }
1589         if (rdev->wiphy.max_sched_scan_reqs)
1590                 CMD(sched_scan_start, START_SCHED_SCAN);
1591         CMD(probe_client, PROBE_CLIENT);
1592         CMD(set_noack_map, SET_NOACK_MAP);
1593         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1594                 i++;
1595                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1596                         goto nla_put_failure;
1597         }
1598         CMD(start_p2p_device, START_P2P_DEVICE);
1599         CMD(set_mcast_rate, SET_MCAST_RATE);
1600 #ifdef CONFIG_NL80211_TESTMODE
1601         CMD(testmode_cmd, TESTMODE);
1602 #endif
1603
1604         if (rdev->ops->connect || rdev->ops->auth) {
1605                 i++;
1606                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1607                         goto nla_put_failure;
1608         }
1609
1610         if (rdev->ops->disconnect || rdev->ops->deauth) {
1611                 i++;
1612                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1613                         goto nla_put_failure;
1614         }
1615
1616         return i;
1617  nla_put_failure:
1618         return -ENOBUFS;
1619 }
1620
1621 struct nl80211_dump_wiphy_state {
1622         s64 filter_wiphy;
1623         long start;
1624         long split_start, band_start, chan_start, capa_start;
1625         bool split;
1626 };
1627
1628 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1629                               enum nl80211_commands cmd,
1630                               struct sk_buff *msg, u32 portid, u32 seq,
1631                               int flags, struct nl80211_dump_wiphy_state *state)
1632 {
1633         void *hdr;
1634         struct nlattr *nl_bands, *nl_band;
1635         struct nlattr *nl_freqs, *nl_freq;
1636         struct nlattr *nl_cmds;
1637         enum nl80211_band band;
1638         struct ieee80211_channel *chan;
1639         int i;
1640         const struct ieee80211_txrx_stypes *mgmt_stypes =
1641                                 rdev->wiphy.mgmt_stypes;
1642         u32 features;
1643
1644         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1645         if (!hdr)
1646                 return -ENOBUFS;
1647
1648         if (WARN_ON(!state))
1649                 return -EINVAL;
1650
1651         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1652             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1653                            wiphy_name(&rdev->wiphy)) ||
1654             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1655                         cfg80211_rdev_list_generation))
1656                 goto nla_put_failure;
1657
1658         if (cmd != NL80211_CMD_NEW_WIPHY)
1659                 goto finish;
1660
1661         switch (state->split_start) {
1662         case 0:
1663                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1664                                rdev->wiphy.retry_short) ||
1665                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1666                                rdev->wiphy.retry_long) ||
1667                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1668                                 rdev->wiphy.frag_threshold) ||
1669                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1670                                 rdev->wiphy.rts_threshold) ||
1671                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1672                                rdev->wiphy.coverage_class) ||
1673                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1674                                rdev->wiphy.max_scan_ssids) ||
1675                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1676                                rdev->wiphy.max_sched_scan_ssids) ||
1677                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1678                                 rdev->wiphy.max_scan_ie_len) ||
1679                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1680                                 rdev->wiphy.max_sched_scan_ie_len) ||
1681                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1682                                rdev->wiphy.max_match_sets) ||
1683                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1684                                 rdev->wiphy.max_sched_scan_plans) ||
1685                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1686                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1687                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1688                                 rdev->wiphy.max_sched_scan_plan_iterations))
1689                         goto nla_put_failure;
1690
1691                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1692                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1693                         goto nla_put_failure;
1694                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1695                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1696                         goto nla_put_failure;
1697                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1698                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1699                         goto nla_put_failure;
1700                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1701                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1702                         goto nla_put_failure;
1703                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1704                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1705                         goto nla_put_failure;
1706                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1707                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1708                         goto nla_put_failure;
1709                 state->split_start++;
1710                 if (state->split)
1711                         break;
1712         case 1:
1713                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1714                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1715                             rdev->wiphy.cipher_suites))
1716                         goto nla_put_failure;
1717
1718                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1719                                rdev->wiphy.max_num_pmkids))
1720                         goto nla_put_failure;
1721
1722                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1723                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1724                         goto nla_put_failure;
1725
1726                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1727                                 rdev->wiphy.available_antennas_tx) ||
1728                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1729                                 rdev->wiphy.available_antennas_rx))
1730                         goto nla_put_failure;
1731
1732                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1733                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1734                                 rdev->wiphy.probe_resp_offload))
1735                         goto nla_put_failure;
1736
1737                 if ((rdev->wiphy.available_antennas_tx ||
1738                      rdev->wiphy.available_antennas_rx) &&
1739                     rdev->ops->get_antenna) {
1740                         u32 tx_ant = 0, rx_ant = 0;
1741                         int res;
1742
1743                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1744                         if (!res) {
1745                                 if (nla_put_u32(msg,
1746                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1747                                                 tx_ant) ||
1748                                     nla_put_u32(msg,
1749                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1750                                                 rx_ant))
1751                                         goto nla_put_failure;
1752                         }
1753                 }
1754
1755                 state->split_start++;
1756                 if (state->split)
1757                         break;
1758         case 2:
1759                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1760                                         rdev->wiphy.interface_modes))
1761                                 goto nla_put_failure;
1762                 state->split_start++;
1763                 if (state->split)
1764                         break;
1765         case 3:
1766                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1767                 if (!nl_bands)
1768                         goto nla_put_failure;
1769
1770                 for (band = state->band_start;
1771                      band < NUM_NL80211_BANDS; band++) {
1772                         struct ieee80211_supported_band *sband;
1773
1774                         sband = rdev->wiphy.bands[band];
1775
1776                         if (!sband)
1777                                 continue;
1778
1779                         nl_band = nla_nest_start(msg, band);
1780                         if (!nl_band)
1781                                 goto nla_put_failure;
1782
1783                         switch (state->chan_start) {
1784                         case 0:
1785                                 if (nl80211_send_band_rateinfo(msg, sband))
1786                                         goto nla_put_failure;
1787                                 state->chan_start++;
1788                                 if (state->split)
1789                                         break;
1790                         default:
1791                                 /* add frequencies */
1792                                 nl_freqs = nla_nest_start(
1793                                         msg, NL80211_BAND_ATTR_FREQS);
1794                                 if (!nl_freqs)
1795                                         goto nla_put_failure;
1796
1797                                 for (i = state->chan_start - 1;
1798                                      i < sband->n_channels;
1799                                      i++) {
1800                                         nl_freq = nla_nest_start(msg, i);
1801                                         if (!nl_freq)
1802                                                 goto nla_put_failure;
1803
1804                                         chan = &sband->channels[i];
1805
1806                                         if (nl80211_msg_put_channel(
1807                                                         msg, &rdev->wiphy, chan,
1808                                                         state->split))
1809                                                 goto nla_put_failure;
1810
1811                                         nla_nest_end(msg, nl_freq);
1812                                         if (state->split)
1813                                                 break;
1814                                 }
1815                                 if (i < sband->n_channels)
1816                                         state->chan_start = i + 2;
1817                                 else
1818                                         state->chan_start = 0;
1819                                 nla_nest_end(msg, nl_freqs);
1820                         }
1821
1822                         nla_nest_end(msg, nl_band);
1823
1824                         if (state->split) {
1825                                 /* start again here */
1826                                 if (state->chan_start)
1827                                         band--;
1828                                 break;
1829                         }
1830                 }
1831                 nla_nest_end(msg, nl_bands);
1832
1833                 if (band < NUM_NL80211_BANDS)
1834                         state->band_start = band + 1;
1835                 else
1836                         state->band_start = 0;
1837
1838                 /* if bands & channels are done, continue outside */
1839                 if (state->band_start == 0 && state->chan_start == 0)
1840                         state->split_start++;
1841                 if (state->split)
1842                         break;
1843         case 4:
1844                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1845                 if (!nl_cmds)
1846                         goto nla_put_failure;
1847
1848                 i = nl80211_add_commands_unsplit(rdev, msg);
1849                 if (i < 0)
1850                         goto nla_put_failure;
1851                 if (state->split) {
1852                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1853                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1854                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1855                                 CMD(channel_switch, CHANNEL_SWITCH);
1856                         CMD(set_qos_map, SET_QOS_MAP);
1857                         if (rdev->wiphy.features &
1858                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1859                                 CMD(add_tx_ts, ADD_TX_TS);
1860                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1861                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1862                 }
1863 #undef CMD
1864
1865                 nla_nest_end(msg, nl_cmds);
1866                 state->split_start++;
1867                 if (state->split)
1868                         break;
1869         case 5:
1870                 if (rdev->ops->remain_on_channel &&
1871                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1872                     nla_put_u32(msg,
1873                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1874                                 rdev->wiphy.max_remain_on_channel_duration))
1875                         goto nla_put_failure;
1876
1877                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1878                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1879                         goto nla_put_failure;
1880
1881                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1882                         goto nla_put_failure;
1883                 state->split_start++;
1884                 if (state->split)
1885                         break;
1886         case 6:
1887 #ifdef CONFIG_PM
1888                 if (nl80211_send_wowlan(msg, rdev, state->split))
1889                         goto nla_put_failure;
1890                 state->split_start++;
1891                 if (state->split)
1892                         break;
1893 #else
1894                 state->split_start++;
1895 #endif
1896         case 7:
1897                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1898                                         rdev->wiphy.software_iftypes))
1899                         goto nla_put_failure;
1900
1901                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1902                                                    state->split))
1903                         goto nla_put_failure;
1904
1905                 state->split_start++;
1906                 if (state->split)
1907                         break;
1908         case 8:
1909                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1910                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1911                                 rdev->wiphy.ap_sme_capa))
1912                         goto nla_put_failure;
1913
1914                 features = rdev->wiphy.features;
1915                 /*
1916                  * We can only add the per-channel limit information if the
1917                  * dump is split, otherwise it makes it too big. Therefore
1918                  * only advertise it in that case.
1919                  */
1920                 if (state->split)
1921                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1922                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1923                         goto nla_put_failure;
1924
1925                 if (rdev->wiphy.ht_capa_mod_mask &&
1926                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1927                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1928                             rdev->wiphy.ht_capa_mod_mask))
1929                         goto nla_put_failure;
1930
1931                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1932                     rdev->wiphy.max_acl_mac_addrs &&
1933                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1934                                 rdev->wiphy.max_acl_mac_addrs))
1935                         goto nla_put_failure;
1936
1937                 /*
1938                  * Any information below this point is only available to
1939                  * applications that can deal with it being split. This
1940                  * helps ensure that newly added capabilities don't break
1941                  * older tools by overrunning their buffers.
1942                  *
1943                  * We still increment split_start so that in the split
1944                  * case we'll continue with more data in the next round,
1945                  * but break unconditionally so unsplit data stops here.
1946                  */
1947                 state->split_start++;
1948                 break;
1949         case 9:
1950                 if (rdev->wiphy.extended_capabilities &&
1951                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1952                              rdev->wiphy.extended_capabilities_len,
1953                              rdev->wiphy.extended_capabilities) ||
1954                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1955                              rdev->wiphy.extended_capabilities_len,
1956                              rdev->wiphy.extended_capabilities_mask)))
1957                         goto nla_put_failure;
1958
1959                 if (rdev->wiphy.vht_capa_mod_mask &&
1960                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1961                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1962                             rdev->wiphy.vht_capa_mod_mask))
1963                         goto nla_put_failure;
1964
1965                 state->split_start++;
1966                 break;
1967         case 10:
1968                 if (nl80211_send_coalesce(msg, rdev))
1969                         goto nla_put_failure;
1970
1971                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1972                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1973                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1974                         goto nla_put_failure;
1975
1976                 if (rdev->wiphy.max_ap_assoc_sta &&
1977                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1978                                 rdev->wiphy.max_ap_assoc_sta))
1979                         goto nla_put_failure;
1980
1981                 state->split_start++;
1982                 break;
1983         case 11:
1984                 if (rdev->wiphy.n_vendor_commands) {
1985                         const struct nl80211_vendor_cmd_info *info;
1986                         struct nlattr *nested;
1987
1988                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1989                         if (!nested)
1990                                 goto nla_put_failure;
1991
1992                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1993                                 info = &rdev->wiphy.vendor_commands[i].info;
1994                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1995                                         goto nla_put_failure;
1996                         }
1997                         nla_nest_end(msg, nested);
1998                 }
1999
2000                 if (rdev->wiphy.n_vendor_events) {
2001                         const struct nl80211_vendor_cmd_info *info;
2002                         struct nlattr *nested;
2003
2004                         nested = nla_nest_start(msg,
2005                                                 NL80211_ATTR_VENDOR_EVENTS);
2006                         if (!nested)
2007                                 goto nla_put_failure;
2008
2009                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2010                                 info = &rdev->wiphy.vendor_events[i];
2011                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2012                                         goto nla_put_failure;
2013                         }
2014                         nla_nest_end(msg, nested);
2015                 }
2016                 state->split_start++;
2017                 break;
2018         case 12:
2019                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2020                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2021                                rdev->wiphy.max_num_csa_counters))
2022                         goto nla_put_failure;
2023
2024                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2025                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2026                         goto nla_put_failure;
2027
2028                 if (rdev->wiphy.max_sched_scan_reqs &&
2029                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2030                                 rdev->wiphy.max_sched_scan_reqs))
2031                         goto nla_put_failure;
2032
2033                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2034                             sizeof(rdev->wiphy.ext_features),
2035                             rdev->wiphy.ext_features))
2036                         goto nla_put_failure;
2037
2038                 if (rdev->wiphy.bss_select_support) {
2039                         struct nlattr *nested;
2040                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2041
2042                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2043                         if (!nested)
2044                                 goto nla_put_failure;
2045
2046                         i = 0;
2047                         while (bss_select_support) {
2048                                 if ((bss_select_support & 1) &&
2049                                     nla_put_flag(msg, i))
2050                                         goto nla_put_failure;
2051                                 i++;
2052                                 bss_select_support >>= 1;
2053                         }
2054                         nla_nest_end(msg, nested);
2055                 }
2056
2057                 state->split_start++;
2058                 break;
2059         case 13:
2060                 if (rdev->wiphy.num_iftype_ext_capab &&
2061                     rdev->wiphy.iftype_ext_capab) {
2062                         struct nlattr *nested_ext_capab, *nested;
2063
2064                         nested = nla_nest_start(msg,
2065                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2066                         if (!nested)
2067                                 goto nla_put_failure;
2068
2069                         for (i = state->capa_start;
2070                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2071                                 const struct wiphy_iftype_ext_capab *capab;
2072
2073                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2074
2075                                 nested_ext_capab = nla_nest_start(msg, i);
2076                                 if (!nested_ext_capab ||
2077                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2078                                                 capab->iftype) ||
2079                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2080                                             capab->extended_capabilities_len,
2081                                             capab->extended_capabilities) ||
2082                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2083                                             capab->extended_capabilities_len,
2084                                             capab->extended_capabilities_mask))
2085                                         goto nla_put_failure;
2086
2087                                 nla_nest_end(msg, nested_ext_capab);
2088                                 if (state->split)
2089                                         break;
2090                         }
2091                         nla_nest_end(msg, nested);
2092                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2093                                 state->capa_start = i + 1;
2094                                 break;
2095                         }
2096                 }
2097
2098                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2099                                 rdev->wiphy.nan_supported_bands))
2100                         goto nla_put_failure;
2101
2102                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2103                                             NL80211_EXT_FEATURE_TXQS)) {
2104                         struct cfg80211_txq_stats txqstats = {};
2105                         int res;
2106
2107                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2108                         if (!res &&
2109                             !nl80211_put_txq_stats(msg, &txqstats,
2110                                                    NL80211_ATTR_TXQ_STATS))
2111                                 goto nla_put_failure;
2112
2113                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2114                                         rdev->wiphy.txq_limit))
2115                                 goto nla_put_failure;
2116                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2117                                         rdev->wiphy.txq_memory_limit))
2118                                 goto nla_put_failure;
2119                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2120                                         rdev->wiphy.txq_quantum))
2121                                 goto nla_put_failure;
2122                 }
2123
2124                 /* done */
2125                 state->split_start = 0;
2126                 break;
2127         }
2128  finish:
2129         genlmsg_end(msg, hdr);
2130         return 0;
2131
2132  nla_put_failure:
2133         genlmsg_cancel(msg, hdr);
2134         return -EMSGSIZE;
2135 }
2136
2137 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2138                                     struct netlink_callback *cb,
2139                                     struct nl80211_dump_wiphy_state *state)
2140 {
2141         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2142         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2143                               nl80211_fam.maxattr, nl80211_policy, NULL);
2144         /* ignore parse errors for backward compatibility */
2145         if (ret)
2146                 return 0;
2147
2148         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2149         if (tb[NL80211_ATTR_WIPHY])
2150                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2151         if (tb[NL80211_ATTR_WDEV])
2152                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2153         if (tb[NL80211_ATTR_IFINDEX]) {
2154                 struct net_device *netdev;
2155                 struct cfg80211_registered_device *rdev;
2156                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2157
2158                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2159                 if (!netdev)
2160                         return -ENODEV;
2161                 if (netdev->ieee80211_ptr) {
2162                         rdev = wiphy_to_rdev(
2163                                 netdev->ieee80211_ptr->wiphy);
2164                         state->filter_wiphy = rdev->wiphy_idx;
2165                 }
2166         }
2167
2168         return 0;
2169 }
2170
2171 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2172 {
2173         int idx = 0, ret;
2174         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2175         struct cfg80211_registered_device *rdev;
2176
2177         rtnl_lock();
2178         if (!state) {
2179                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2180                 if (!state) {
2181                         rtnl_unlock();
2182                         return -ENOMEM;
2183                 }
2184                 state->filter_wiphy = -1;
2185                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2186                 if (ret) {
2187                         kfree(state);
2188                         rtnl_unlock();
2189                         return ret;
2190                 }
2191                 cb->args[0] = (long)state;
2192         }
2193
2194         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2195                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2196                         continue;
2197                 if (++idx <= state->start)
2198                         continue;
2199                 if (state->filter_wiphy != -1 &&
2200                     state->filter_wiphy != rdev->wiphy_idx)
2201                         continue;
2202                 /* attempt to fit multiple wiphy data chunks into the skb */
2203                 do {
2204                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2205                                                  skb,
2206                                                  NETLINK_CB(cb->skb).portid,
2207                                                  cb->nlh->nlmsg_seq,
2208                                                  NLM_F_MULTI, state);
2209                         if (ret < 0) {
2210                                 /*
2211                                  * If sending the wiphy data didn't fit (ENOBUFS
2212                                  * or EMSGSIZE returned), this SKB is still
2213                                  * empty (so it's not too big because another
2214                                  * wiphy dataset is already in the skb) and
2215                                  * we've not tried to adjust the dump allocation
2216                                  * yet ... then adjust the alloc size to be
2217                                  * bigger, and return 1 but with the empty skb.
2218                                  * This results in an empty message being RX'ed
2219                                  * in userspace, but that is ignored.
2220                                  *
2221                                  * We can then retry with the larger buffer.
2222                                  */
2223                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2224                                     !skb->len && !state->split &&
2225                                     cb->min_dump_alloc < 4096) {
2226                                         cb->min_dump_alloc = 4096;
2227                                         state->split_start = 0;
2228                                         rtnl_unlock();
2229                                         return 1;
2230                                 }
2231                                 idx--;
2232                                 break;
2233                         }
2234                 } while (state->split_start > 0);
2235                 break;
2236         }
2237         rtnl_unlock();
2238
2239         state->start = idx;
2240
2241         return skb->len;
2242 }
2243
2244 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2245 {
2246         kfree((void *)cb->args[0]);
2247         return 0;
2248 }
2249
2250 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2251 {
2252         struct sk_buff *msg;
2253         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2254         struct nl80211_dump_wiphy_state state = {};
2255
2256         msg = nlmsg_new(4096, GFP_KERNEL);
2257         if (!msg)
2258                 return -ENOMEM;
2259
2260         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2261                                info->snd_portid, info->snd_seq, 0,
2262                                &state) < 0) {
2263                 nlmsg_free(msg);
2264                 return -ENOBUFS;
2265         }
2266
2267         return genlmsg_reply(msg, info);
2268 }
2269
2270 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2271         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2272         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2273         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2274         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2275         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2276 };
2277
2278 static int parse_txq_params(struct nlattr *tb[],
2279                             struct ieee80211_txq_params *txq_params)
2280 {
2281         u8 ac;
2282
2283         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2284             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2285             !tb[NL80211_TXQ_ATTR_AIFS])
2286                 return -EINVAL;
2287
2288         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2289         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2290         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2291         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2292         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2293
2294         if (ac >= NL80211_NUM_ACS)
2295                 return -EINVAL;
2296         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2297         return 0;
2298 }
2299
2300 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2301 {
2302         /*
2303          * You can only set the channel explicitly for WDS interfaces,
2304          * all others have their channel managed via their respective
2305          * "establish a connection" command (connect, join, ...)
2306          *
2307          * For AP/GO and mesh mode, the channel can be set with the
2308          * channel userspace API, but is only stored and passed to the
2309          * low-level driver when the AP starts or the mesh is joined.
2310          * This is for backward compatibility, userspace can also give
2311          * the channel in the start-ap or join-mesh commands instead.
2312          *
2313          * Monitors are special as they are normally slaved to
2314          * whatever else is going on, so they have their own special
2315          * operation to set the monitor channel if possible.
2316          */
2317         return !wdev ||
2318                 wdev->iftype == NL80211_IFTYPE_AP ||
2319                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2320                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2321                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2322 }
2323
2324 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2325                                  struct genl_info *info,
2326                                  struct cfg80211_chan_def *chandef)
2327 {
2328         u32 control_freq;
2329
2330         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2331                 return -EINVAL;
2332
2333         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2334
2335         memset(chandef, 0, sizeof(*chandef));
2336
2337         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2338         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2339         chandef->center_freq1 = control_freq;
2340         chandef->center_freq2 = 0;
2341
2342         /* Primary channel not allowed */
2343         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2344                 return -EINVAL;
2345
2346         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2347                 enum nl80211_channel_type chantype;
2348
2349                 chantype = nla_get_u32(
2350                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2351
2352                 switch (chantype) {
2353                 case NL80211_CHAN_NO_HT:
2354                 case NL80211_CHAN_HT20:
2355                 case NL80211_CHAN_HT40PLUS:
2356                 case NL80211_CHAN_HT40MINUS:
2357                         cfg80211_chandef_create(chandef, chandef->chan,
2358                                                 chantype);
2359                         /* user input for center_freq is incorrect */
2360                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2361                             chandef->center_freq1 != nla_get_u32(
2362                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2363                                 return -EINVAL;
2364                         /* center_freq2 must be zero */
2365                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2366                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2367                                 return -EINVAL;
2368                         break;
2369                 default:
2370                         return -EINVAL;
2371                 }
2372         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2373                 chandef->width =
2374                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2375                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2376                         chandef->center_freq1 =
2377                                 nla_get_u32(
2378                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2379                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2380                         chandef->center_freq2 =
2381                                 nla_get_u32(
2382                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2383         }
2384
2385         if (!cfg80211_chandef_valid(chandef))
2386                 return -EINVAL;
2387
2388         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2389                                      IEEE80211_CHAN_DISABLED))
2390                 return -EINVAL;
2391
2392         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2393              chandef->width == NL80211_CHAN_WIDTH_10) &&
2394             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2395                 return -EINVAL;
2396
2397         return 0;
2398 }
2399
2400 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2401                                  struct net_device *dev,
2402                                  struct genl_info *info)
2403 {
2404         struct cfg80211_chan_def chandef;
2405         int result;
2406         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2407         struct wireless_dev *wdev = NULL;
2408
2409         if (dev)
2410                 wdev = dev->ieee80211_ptr;
2411         if (!nl80211_can_set_dev_channel(wdev))
2412                 return -EOPNOTSUPP;
2413         if (wdev)
2414                 iftype = wdev->iftype;
2415
2416         result = nl80211_parse_chandef(rdev, info, &chandef);
2417         if (result)
2418                 return result;
2419
2420         switch (iftype) {
2421         case NL80211_IFTYPE_AP:
2422         case NL80211_IFTYPE_P2P_GO:
2423                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2424                                                    iftype)) {
2425                         result = -EINVAL;
2426                         break;
2427                 }
2428                 if (wdev->beacon_interval) {
2429                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2430                             !(rdev->wiphy.features &
2431                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2432                                 result = -EBUSY;
2433                                 break;
2434                         }
2435
2436                         /* Only allow dynamic channel width changes */
2437                         if (chandef.chan != wdev->preset_chandef.chan) {
2438                                 result = -EBUSY;
2439                                 break;
2440                         }
2441                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2442                         if (result)
2443                                 break;
2444                 }
2445                 wdev->preset_chandef = chandef;
2446                 result = 0;
2447                 break;
2448         case NL80211_IFTYPE_MESH_POINT:
2449                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2450                 break;
2451         case NL80211_IFTYPE_MONITOR:
2452                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2453                 break;
2454         default:
2455                 result = -EINVAL;
2456         }
2457
2458         return result;
2459 }
2460
2461 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2462 {
2463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2464         struct net_device *netdev = info->user_ptr[1];
2465
2466         return __nl80211_set_channel(rdev, netdev, info);
2467 }
2468
2469 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2470 {
2471         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2472         struct net_device *dev = info->user_ptr[1];
2473         struct wireless_dev *wdev = dev->ieee80211_ptr;
2474         const u8 *bssid;
2475
2476         if (!info->attrs[NL80211_ATTR_MAC])
2477                 return -EINVAL;
2478
2479         if (netif_running(dev))
2480                 return -EBUSY;
2481
2482         if (!rdev->ops->set_wds_peer)
2483                 return -EOPNOTSUPP;
2484
2485         if (wdev->iftype != NL80211_IFTYPE_WDS)
2486                 return -EOPNOTSUPP;
2487
2488         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2489         return rdev_set_wds_peer(rdev, dev, bssid);
2490 }
2491
2492 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2493 {
2494         struct cfg80211_registered_device *rdev;
2495         struct net_device *netdev = NULL;
2496         struct wireless_dev *wdev;
2497         int result = 0, rem_txq_params = 0;
2498         struct nlattr *nl_txq_params;
2499         u32 changed;
2500         u8 retry_short = 0, retry_long = 0;
2501         u32 frag_threshold = 0, rts_threshold = 0;
2502         u8 coverage_class = 0;
2503         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2504
2505         ASSERT_RTNL();
2506
2507         /*
2508          * Try to find the wiphy and netdev. Normally this
2509          * function shouldn't need the netdev, but this is
2510          * done for backward compatibility -- previously
2511          * setting the channel was done per wiphy, but now
2512          * it is per netdev. Previous userland like hostapd
2513          * also passed a netdev to set_wiphy, so that it is
2514          * possible to let that go to the right netdev!
2515          */
2516
2517         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2518                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2519
2520                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2521                 if (netdev && netdev->ieee80211_ptr)
2522                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2523                 else
2524                         netdev = NULL;
2525         }
2526
2527         if (!netdev) {
2528                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2529                                                   info->attrs);
2530                 if (IS_ERR(rdev))
2531                         return PTR_ERR(rdev);
2532                 wdev = NULL;
2533                 netdev = NULL;
2534                 result = 0;
2535         } else
2536                 wdev = netdev->ieee80211_ptr;
2537
2538         /*
2539          * end workaround code, by now the rdev is available
2540          * and locked, and wdev may or may not be NULL.
2541          */
2542
2543         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2544                 result = cfg80211_dev_rename(
2545                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2546
2547         if (result)
2548                 return result;
2549
2550         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2551                 struct ieee80211_txq_params txq_params;
2552                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2553
2554                 if (!rdev->ops->set_txq_params)
2555                         return -EOPNOTSUPP;
2556
2557                 if (!netdev)
2558                         return -EINVAL;
2559
2560                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2561                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2562                         return -EINVAL;
2563
2564                 if (!netif_running(netdev))
2565                         return -ENETDOWN;
2566
2567                 nla_for_each_nested(nl_txq_params,
2568                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2569                                     rem_txq_params) {
2570                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2571                                                   nl_txq_params,
2572                                                   txq_params_policy,
2573                                                   info->extack);
2574                         if (result)
2575                                 return result;
2576                         result = parse_txq_params(tb, &txq_params);
2577                         if (result)
2578                                 return result;
2579
2580                         result = rdev_set_txq_params(rdev, netdev,
2581                                                      &txq_params);
2582                         if (result)
2583                                 return result;
2584                 }
2585         }
2586
2587         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2588                 result = __nl80211_set_channel(
2589                         rdev,
2590                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2591                         info);
2592                 if (result)
2593                         return result;
2594         }
2595
2596         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2597                 struct wireless_dev *txp_wdev = wdev;
2598                 enum nl80211_tx_power_setting type;
2599                 int idx, mbm = 0;
2600
2601                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2602                         txp_wdev = NULL;
2603
2604                 if (!rdev->ops->set_tx_power)
2605                         return -EOPNOTSUPP;
2606
2607                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2608                 type = nla_get_u32(info->attrs[idx]);
2609
2610                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2611                     (type != NL80211_TX_POWER_AUTOMATIC))
2612                         return -EINVAL;
2613
2614                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2615                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2616                         mbm = nla_get_u32(info->attrs[idx]);
2617                 }
2618
2619                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2620                 if (result)
2621                         return result;
2622         }
2623
2624         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2625             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2626                 u32 tx_ant, rx_ant;
2627
2628                 if ((!rdev->wiphy.available_antennas_tx &&
2629                      !rdev->wiphy.available_antennas_rx) ||
2630                     !rdev->ops->set_antenna)
2631                         return -EOPNOTSUPP;
2632
2633                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2634                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2635
2636                 /* reject antenna configurations which don't match the
2637                  * available antenna masks, except for the "all" mask */
2638                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2639                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2640                         return -EINVAL;
2641
2642                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2643                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2644
2645                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2646                 if (result)
2647                         return result;
2648         }
2649
2650         changed = 0;
2651
2652         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2653                 retry_short = nla_get_u8(
2654                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2655                 if (retry_short == 0)
2656                         return -EINVAL;
2657
2658                 changed |= WIPHY_PARAM_RETRY_SHORT;
2659         }
2660
2661         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2662                 retry_long = nla_get_u8(
2663                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2664                 if (retry_long == 0)
2665                         return -EINVAL;
2666
2667                 changed |= WIPHY_PARAM_RETRY_LONG;
2668         }
2669
2670         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2671                 frag_threshold = nla_get_u32(
2672                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2673                 if (frag_threshold < 256)
2674                         return -EINVAL;
2675
2676                 if (frag_threshold != (u32) -1) {
2677                         /*
2678                          * Fragments (apart from the last one) are required to
2679                          * have even length. Make the fragmentation code
2680                          * simpler by stripping LSB should someone try to use
2681                          * odd threshold value.
2682                          */
2683                         frag_threshold &= ~0x1;
2684                 }
2685                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2686         }
2687
2688         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2689                 rts_threshold = nla_get_u32(
2690                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2691                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2692         }
2693
2694         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2695                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2696                         return -EINVAL;
2697
2698                 coverage_class = nla_get_u8(
2699                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2700                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2701         }
2702
2703         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2704                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2705                         return -EOPNOTSUPP;
2706
2707                 changed |= WIPHY_PARAM_DYN_ACK;
2708         }
2709
2710         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2711                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2712                                              NL80211_EXT_FEATURE_TXQS))
2713                         return -EOPNOTSUPP;
2714                 txq_limit = nla_get_u32(
2715                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2716                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2717         }
2718
2719         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2720                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2721                                              NL80211_EXT_FEATURE_TXQS))
2722                         return -EOPNOTSUPP;
2723                 txq_memory_limit = nla_get_u32(
2724                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2725                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2726         }
2727
2728         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2729                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2730                                              NL80211_EXT_FEATURE_TXQS))
2731                         return -EOPNOTSUPP;
2732                 txq_quantum = nla_get_u32(
2733                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2734                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2735         }
2736
2737         if (changed) {
2738                 u8 old_retry_short, old_retry_long;
2739                 u32 old_frag_threshold, old_rts_threshold;
2740                 u8 old_coverage_class;
2741                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2742
2743                 if (!rdev->ops->set_wiphy_params)
2744                         return -EOPNOTSUPP;
2745
2746                 old_retry_short = rdev->wiphy.retry_short;
2747                 old_retry_long = rdev->wiphy.retry_long;
2748                 old_frag_threshold = rdev->wiphy.frag_threshold;
2749                 old_rts_threshold = rdev->wiphy.rts_threshold;
2750                 old_coverage_class = rdev->wiphy.coverage_class;
2751                 old_txq_limit = rdev->wiphy.txq_limit;
2752                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2753                 old_txq_quantum = rdev->wiphy.txq_quantum;
2754
2755                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2756                         rdev->wiphy.retry_short = retry_short;
2757                 if (changed & WIPHY_PARAM_RETRY_LONG)
2758                         rdev->wiphy.retry_long = retry_long;
2759                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2760                         rdev->wiphy.frag_threshold = frag_threshold;
2761                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2762                         rdev->wiphy.rts_threshold = rts_threshold;
2763                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2764                         rdev->wiphy.coverage_class = coverage_class;
2765                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2766                         rdev->wiphy.txq_limit = txq_limit;
2767                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2768                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2769                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2770                         rdev->wiphy.txq_quantum = txq_quantum;
2771
2772                 result = rdev_set_wiphy_params(rdev, changed);
2773                 if (result) {
2774                         rdev->wiphy.retry_short = old_retry_short;
2775                         rdev->wiphy.retry_long = old_retry_long;
2776                         rdev->wiphy.frag_threshold = old_frag_threshold;
2777                         rdev->wiphy.rts_threshold = old_rts_threshold;
2778                         rdev->wiphy.coverage_class = old_coverage_class;
2779                         rdev->wiphy.txq_limit = old_txq_limit;
2780                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2781                         rdev->wiphy.txq_quantum = old_txq_quantum;
2782                         return result;
2783                 }
2784         }
2785         return 0;
2786 }
2787
2788 static inline u64 wdev_id(struct wireless_dev *wdev)
2789 {
2790         return (u64)wdev->identifier |
2791                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2792 }
2793
2794 static int nl80211_send_chandef(struct sk_buff *msg,
2795                                 const struct cfg80211_chan_def *chandef)
2796 {
2797         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2798                 return -EINVAL;
2799
2800         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2801                         chandef->chan->center_freq))
2802                 return -ENOBUFS;
2803         switch (chandef->width) {
2804         case NL80211_CHAN_WIDTH_20_NOHT:
2805         case NL80211_CHAN_WIDTH_20:
2806         case NL80211_CHAN_WIDTH_40:
2807                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2808                                 cfg80211_get_chandef_type(chandef)))
2809                         return -ENOBUFS;
2810                 break;
2811         default:
2812                 break;
2813         }
2814         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2815                 return -ENOBUFS;
2816         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2817                 return -ENOBUFS;
2818         if (chandef->center_freq2 &&
2819             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2820                 return -ENOBUFS;
2821         return 0;
2822 }
2823
2824 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2825                               struct cfg80211_registered_device *rdev,
2826                               struct wireless_dev *wdev, bool removal)
2827 {
2828         struct net_device *dev = wdev->netdev;
2829         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2830         void *hdr;
2831
2832         if (removal)
2833                 cmd = NL80211_CMD_DEL_INTERFACE;
2834
2835         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2836         if (!hdr)
2837                 return -1;
2838
2839         if (dev &&
2840             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2841              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2842                 goto nla_put_failure;
2843
2844         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2845             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2846             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2847                               NL80211_ATTR_PAD) ||
2848             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2849             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2850                         rdev->devlist_generation ^
2851                         (cfg80211_rdev_list_generation << 2)) ||
2852             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2853                 goto nla_put_failure;
2854
2855         if (rdev->ops->get_channel) {
2856                 int ret;
2857                 struct cfg80211_chan_def chandef = {};
2858
2859                 ret = rdev_get_channel(rdev, wdev, &chandef);
2860                 if (ret == 0) {
2861                         if (nl80211_send_chandef(msg, &chandef))
2862                                 goto nla_put_failure;
2863                 }
2864         }
2865
2866         if (rdev->ops->get_tx_power) {
2867                 int dbm, ret;
2868
2869                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2870                 if (ret == 0 &&
2871                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2872                                 DBM_TO_MBM(dbm)))
2873                         goto nla_put_failure;
2874         }
2875
2876         wdev_lock(wdev);
2877         switch (wdev->iftype) {
2878         case NL80211_IFTYPE_AP:
2879                 if (wdev->ssid_len &&
2880                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2881                         goto nla_put_failure_locked;
2882                 break;
2883         case NL80211_IFTYPE_STATION:
2884         case NL80211_IFTYPE_P2P_CLIENT:
2885         case NL80211_IFTYPE_ADHOC: {
2886                 const u8 *ssid_ie;
2887                 if (!wdev->current_bss)
2888                         break;
2889                 rcu_read_lock();
2890                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2891                                                WLAN_EID_SSID);
2892                 if (ssid_ie &&
2893                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2894                         goto nla_put_failure_rcu_locked;
2895                 rcu_read_unlock();
2896                 break;
2897                 }
2898         default:
2899                 /* nothing */
2900                 break;
2901         }
2902         wdev_unlock(wdev);
2903
2904         if (rdev->ops->get_txq_stats) {
2905                 struct cfg80211_txq_stats txqstats = {};
2906                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2907
2908                 if (ret == 0 &&
2909                     !nl80211_put_txq_stats(msg, &txqstats,
2910                                            NL80211_ATTR_TXQ_STATS))
2911                         goto nla_put_failure;
2912         }
2913
2914         genlmsg_end(msg, hdr);
2915         return 0;
2916
2917  nla_put_failure_rcu_locked:
2918         rcu_read_unlock();
2919  nla_put_failure_locked:
2920         wdev_unlock(wdev);
2921  nla_put_failure:
2922         genlmsg_cancel(msg, hdr);
2923         return -EMSGSIZE;
2924 }
2925
2926 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2927 {
2928         int wp_idx = 0;
2929         int if_idx = 0;
2930         int wp_start = cb->args[0];
2931         int if_start = cb->args[1];
2932         int filter_wiphy = -1;
2933         struct cfg80211_registered_device *rdev;
2934         struct wireless_dev *wdev;
2935         int ret;
2936
2937         rtnl_lock();
2938         if (!cb->args[2]) {
2939                 struct nl80211_dump_wiphy_state state = {
2940                         .filter_wiphy = -1,
2941                 };
2942
2943                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2944                 if (ret)
2945                         goto out_unlock;
2946
2947                 filter_wiphy = state.filter_wiphy;
2948
2949                 /*
2950                  * if filtering, set cb->args[2] to +1 since 0 is the default
2951                  * value needed to determine that parsing is necessary.
2952                  */
2953                 if (filter_wiphy >= 0)
2954                         cb->args[2] = filter_wiphy + 1;
2955                 else
2956                         cb->args[2] = -1;
2957         } else if (cb->args[2] > 0) {
2958                 filter_wiphy = cb->args[2] - 1;
2959         }
2960
2961         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2962                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2963                         continue;
2964                 if (wp_idx < wp_start) {
2965                         wp_idx++;
2966                         continue;
2967                 }
2968
2969                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2970                         continue;
2971
2972                 if_idx = 0;
2973
2974                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2975                         if (if_idx < if_start) {
2976                                 if_idx++;
2977                                 continue;
2978                         }
2979                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2980                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2981                                                rdev, wdev, false) < 0) {
2982                                 goto out;
2983                         }
2984                         if_idx++;
2985                 }
2986
2987                 wp_idx++;
2988         }
2989  out:
2990         cb->args[0] = wp_idx;
2991         cb->args[1] = if_idx;
2992
2993         ret = skb->len;
2994  out_unlock:
2995         rtnl_unlock();
2996
2997         return ret;
2998 }
2999
3000 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3001 {
3002         struct sk_buff *msg;
3003         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3004         struct wireless_dev *wdev = info->user_ptr[1];
3005
3006         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3007         if (!msg)
3008                 return -ENOMEM;
3009
3010         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3011                                rdev, wdev, false) < 0) {
3012                 nlmsg_free(msg);
3013                 return -ENOBUFS;
3014         }
3015
3016         return genlmsg_reply(msg, info);
3017 }
3018
3019 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3020         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3021         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3022         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3023         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3024         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3025         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3026 };
3027
3028 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3029 {
3030         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3031         int flag;
3032
3033         *mntrflags = 0;
3034
3035         if (!nla)
3036                 return -EINVAL;
3037
3038         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3039                              mntr_flags_policy, NULL))
3040                 return -EINVAL;
3041
3042         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3043                 if (flags[flag])
3044                         *mntrflags |= (1<<flag);
3045
3046         *mntrflags |= MONITOR_FLAG_CHANGED;
3047
3048         return 0;
3049 }
3050
3051 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3052                                      enum nl80211_iftype type,
3053                                      struct genl_info *info,
3054                                      struct vif_params *params)
3055 {
3056         bool change = false;
3057         int err;
3058
3059         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3060                 if (type != NL80211_IFTYPE_MONITOR)
3061                         return -EINVAL;
3062
3063                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3064                                           &params->flags);
3065                 if (err)
3066                         return err;
3067
3068                 change = true;
3069         }
3070
3071         if (params->flags & MONITOR_FLAG_ACTIVE &&
3072             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3073                 return -EOPNOTSUPP;
3074
3075         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3076                 const u8 *mumimo_groups;
3077                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3078
3079                 if (type != NL80211_IFTYPE_MONITOR)
3080                         return -EINVAL;
3081
3082                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3083                         return -EOPNOTSUPP;
3084
3085                 mumimo_groups =
3086                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3087
3088                 /* bits 0 and 63 are reserved and must be zero */
3089                 if ((mumimo_groups[0] & BIT(0)) ||
3090                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3091                         return -EINVAL;
3092
3093                 params->vht_mumimo_groups = mumimo_groups;
3094                 change = true;
3095         }
3096
3097         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3098                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3099
3100                 if (type != NL80211_IFTYPE_MONITOR)
3101                         return -EINVAL;
3102
3103                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3104                         return -EOPNOTSUPP;
3105
3106                 params->vht_mumimo_follow_addr =
3107                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3108                 change = true;
3109         }
3110
3111         return change ? 1 : 0;
3112 }
3113
3114 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3115                                struct net_device *netdev, u8 use_4addr,
3116                                enum nl80211_iftype iftype)
3117 {
3118         if (!use_4addr) {
3119                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3120                         return -EBUSY;
3121                 return 0;
3122         }
3123
3124         switch (iftype) {
3125         case NL80211_IFTYPE_AP_VLAN:
3126                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3127                         return 0;
3128                 break;
3129         case NL80211_IFTYPE_STATION:
3130                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3131                         return 0;
3132                 break;
3133         default:
3134                 break;
3135         }
3136
3137         return -EOPNOTSUPP;
3138 }
3139
3140 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3141 {
3142         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3143         struct vif_params params;
3144         int err;
3145         enum nl80211_iftype otype, ntype;
3146         struct net_device *dev = info->user_ptr[1];
3147         bool change = false;
3148
3149         memset(&params, 0, sizeof(params));
3150
3151         otype = ntype = dev->ieee80211_ptr->iftype;
3152
3153         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3154                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3155                 if (otype != ntype)
3156                         change = true;
3157                 if (ntype > NL80211_IFTYPE_MAX)
3158                         return -EINVAL;
3159         }
3160
3161         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3162                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3163
3164                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3165                         return -EINVAL;
3166                 if (netif_running(dev))
3167                         return -EBUSY;
3168
3169                 wdev_lock(wdev);
3170                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3171                              IEEE80211_MAX_MESH_ID_LEN);
3172                 wdev->mesh_id_up_len =
3173                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3174                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3175                        wdev->mesh_id_up_len);
3176                 wdev_unlock(wdev);
3177         }
3178
3179         if (info->attrs[NL80211_ATTR_4ADDR]) {
3180                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3181                 change = true;
3182                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3183                 if (err)
3184                         return err;
3185         } else {
3186                 params.use_4addr = -1;
3187         }
3188
3189         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3190         if (err < 0)
3191                 return err;
3192         if (err > 0)
3193                 change = true;
3194
3195         if (change)
3196                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3197         else
3198                 err = 0;
3199
3200         if (!err && params.use_4addr != -1)
3201                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3202
3203         return err;
3204 }
3205
3206 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3207 {
3208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3209         struct vif_params params;
3210         struct wireless_dev *wdev;
3211         struct sk_buff *msg;
3212         int err;
3213         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3214
3215         /* to avoid failing a new interface creation due to pending removal */
3216         cfg80211_destroy_ifaces(rdev);
3217
3218         memset(&params, 0, sizeof(params));
3219
3220         if (!info->attrs[NL80211_ATTR_IFNAME])
3221                 return -EINVAL;
3222
3223         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3224                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3225                 if (type > NL80211_IFTYPE_MAX)
3226                         return -EINVAL;
3227         }
3228
3229         if (!rdev->ops->add_virtual_intf)
3230                 return -EOPNOTSUPP;
3231
3232         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3233              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3234             info->attrs[NL80211_ATTR_MAC]) {
3235                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3236                            ETH_ALEN);
3237                 if (!is_valid_ether_addr(params.macaddr))
3238                         return -EADDRNOTAVAIL;
3239         }
3240
3241         if (info->attrs[NL80211_ATTR_4ADDR]) {
3242                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3243                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3244                 if (err)
3245                         return err;
3246         }
3247
3248         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
3249                 return -EOPNOTSUPP;
3250
3251         err = nl80211_parse_mon_options(rdev, type, info, &params);
3252         if (err < 0)
3253                 return err;
3254
3255         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3256         if (!msg)
3257                 return -ENOMEM;
3258
3259         wdev = rdev_add_virtual_intf(rdev,
3260                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3261                                 NET_NAME_USER, type, &params);
3262         if (WARN_ON(!wdev)) {
3263                 nlmsg_free(msg);
3264                 return -EPROTO;
3265         } else if (IS_ERR(wdev)) {
3266                 nlmsg_free(msg);
3267                 return PTR_ERR(wdev);
3268         }
3269
3270         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3271                 wdev->owner_nlportid = info->snd_portid;
3272
3273         switch (type) {
3274         case NL80211_IFTYPE_MESH_POINT:
3275                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3276                         break;
3277                 wdev_lock(wdev);
3278                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3279                              IEEE80211_MAX_MESH_ID_LEN);
3280                 wdev->mesh_id_up_len =
3281                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3282                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3283                        wdev->mesh_id_up_len);
3284                 wdev_unlock(wdev);
3285                 break;
3286         case NL80211_IFTYPE_NAN:
3287         case NL80211_IFTYPE_P2P_DEVICE:
3288                 /*
3289                  * P2P Device and NAN do not have a netdev, so don't go
3290                  * through the netdev notifier and must be added here
3291                  */
3292                 mutex_init(&wdev->mtx);
3293                 INIT_LIST_HEAD(&wdev->event_list);
3294                 spin_lock_init(&wdev->event_lock);
3295                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
3296                 spin_lock_init(&wdev->mgmt_registrations_lock);
3297
3298                 wdev->identifier = ++rdev->wdev_id;
3299                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
3300                 rdev->devlist_generation++;
3301                 break;
3302         default:
3303                 break;
3304         }
3305
3306         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3307                                rdev, wdev, false) < 0) {
3308                 nlmsg_free(msg);
3309                 return -ENOBUFS;
3310         }
3311
3312         /*
3313          * For wdevs which have no associated netdev object (e.g. of type
3314          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3315          * For all other types, the event will be generated from the
3316          * netdev notifier
3317          */
3318         if (!wdev->netdev)
3319                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3320
3321         return genlmsg_reply(msg, info);
3322 }
3323
3324 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3325 {
3326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3327         struct wireless_dev *wdev = info->user_ptr[1];
3328
3329         if (!rdev->ops->del_virtual_intf)
3330                 return -EOPNOTSUPP;
3331
3332         /*
3333          * If we remove a wireless device without a netdev then clear
3334          * user_ptr[1] so that nl80211_post_doit won't dereference it
3335          * to check if it needs to do dev_put(). Otherwise it crashes
3336          * since the wdev has been freed, unlike with a netdev where
3337          * we need the dev_put() for the netdev to really be freed.
3338          */
3339         if (!wdev->netdev)
3340                 info->user_ptr[1] = NULL;
3341
3342         return rdev_del_virtual_intf(rdev, wdev);
3343 }
3344
3345 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3346 {
3347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3348         struct net_device *dev = info->user_ptr[1];
3349         u16 noack_map;
3350
3351         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3352                 return -EINVAL;
3353
3354         if (!rdev->ops->set_noack_map)
3355                 return -EOPNOTSUPP;
3356
3357         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3358
3359         return rdev_set_noack_map(rdev, dev, noack_map);
3360 }
3361
3362 struct get_key_cookie {
3363         struct sk_buff *msg;
3364         int error;
3365         int idx;
3366 };
3367
3368 static void get_key_callback(void *c, struct key_params *params)
3369 {
3370         struct nlattr *key;
3371         struct get_key_cookie *cookie = c;
3372
3373         if ((params->key &&
3374              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3375                      params->key_len, params->key)) ||
3376             (params->seq &&
3377              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3378                      params->seq_len, params->seq)) ||
3379             (params->cipher &&
3380              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3381                          params->cipher)))
3382                 goto nla_put_failure;
3383
3384         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3385         if (!key)
3386                 goto nla_put_failure;
3387
3388         if ((params->key &&
3389              nla_put(cookie->msg, NL80211_KEY_DATA,
3390                      params->key_len, params->key)) ||
3391             (params->seq &&
3392              nla_put(cookie->msg, NL80211_KEY_SEQ,
3393                      params->seq_len, params->seq)) ||
3394             (params->cipher &&
3395              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3396                          params->cipher)))
3397                 goto nla_put_failure;
3398
3399         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3400                 goto nla_put_failure;
3401
3402         nla_nest_end(cookie->msg, key);
3403
3404         return;
3405  nla_put_failure:
3406         cookie->error = 1;
3407 }
3408
3409 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3410 {
3411         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3412         int err;
3413         struct net_device *dev = info->user_ptr[1];
3414         u8 key_idx = 0;
3415         const u8 *mac_addr = NULL;
3416         bool pairwise;
3417         struct get_key_cookie cookie = {
3418                 .error = 0,
3419         };
3420         void *hdr;
3421         struct sk_buff *msg;
3422
3423         if (info->attrs[NL80211_ATTR_KEY_IDX])
3424                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3425
3426         if (key_idx > 5)
3427                 return -EINVAL;
3428
3429         if (info->attrs[NL80211_ATTR_MAC])
3430                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3431
3432         pairwise = !!mac_addr;
3433         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3434                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3435
3436                 if (kt >= NUM_NL80211_KEYTYPES)
3437                         return -EINVAL;
3438                 if (kt != NL80211_KEYTYPE_GROUP &&
3439                     kt != NL80211_KEYTYPE_PAIRWISE)
3440                         return -EINVAL;
3441                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3442         }
3443
3444         if (!rdev->ops->get_key)
3445                 return -EOPNOTSUPP;
3446
3447         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3448                 return -ENOENT;
3449
3450         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3451         if (!msg)
3452                 return -ENOMEM;
3453
3454         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3455                              NL80211_CMD_NEW_KEY);
3456         if (!hdr)
3457                 goto nla_put_failure;
3458
3459         cookie.msg = msg;
3460         cookie.idx = key_idx;
3461
3462         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3463             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3464                 goto nla_put_failure;
3465         if (mac_addr &&
3466             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3467                 goto nla_put_failure;
3468
3469         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3470                            get_key_callback);
3471
3472         if (err)
3473                 goto free_msg;
3474
3475         if (cookie.error)
3476                 goto nla_put_failure;
3477
3478         genlmsg_end(msg, hdr);
3479         return genlmsg_reply(msg, info);
3480
3481  nla_put_failure:
3482         err = -ENOBUFS;
3483  free_msg:
3484         nlmsg_free(msg);
3485         return err;
3486 }
3487
3488 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3489 {
3490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3491         struct key_parse key;
3492         int err;
3493         struct net_device *dev = info->user_ptr[1];
3494
3495         err = nl80211_parse_key(info, &key);
3496         if (err)
3497                 return err;
3498
3499         if (key.idx < 0)
3500                 return -EINVAL;
3501
3502         /* only support setting default key */
3503         if (!key.def && !key.defmgmt)
3504                 return -EINVAL;
3505
3506         wdev_lock(dev->ieee80211_ptr);
3507
3508         if (key.def) {
3509                 if (!rdev->ops->set_default_key) {
3510                         err = -EOPNOTSUPP;
3511                         goto out;
3512                 }
3513
3514                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3515                 if (err)
3516                         goto out;
3517
3518                 err = rdev_set_default_key(rdev, dev, key.idx,
3519                                                  key.def_uni, key.def_multi);
3520
3521                 if (err)
3522                         goto out;
3523
3524 #ifdef CONFIG_CFG80211_WEXT
3525                 dev->ieee80211_ptr->wext.default_key = key.idx;
3526 #endif
3527         } else {
3528                 if (key.def_uni || !key.def_multi) {
3529                         err = -EINVAL;
3530                         goto out;
3531                 }
3532
3533                 if (!rdev->ops->set_default_mgmt_key) {
3534                         err = -EOPNOTSUPP;
3535                         goto out;
3536                 }
3537
3538                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3539                 if (err)
3540                         goto out;
3541
3542                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3543                 if (err)
3544                         goto out;
3545
3546 #ifdef CONFIG_CFG80211_WEXT
3547                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3548 #endif
3549         }
3550
3551  out:
3552         wdev_unlock(dev->ieee80211_ptr);
3553
3554         return err;
3555 }
3556
3557 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3558 {
3559         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3560         int err;
3561         struct net_device *dev = info->user_ptr[1];
3562         struct key_parse key;
3563         const u8 *mac_addr = NULL;
3564
3565         err = nl80211_parse_key(info, &key);
3566         if (err)
3567                 return err;
3568
3569         if (!key.p.key)
3570                 return -EINVAL;
3571
3572         if (info->attrs[NL80211_ATTR_MAC])
3573                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3574
3575         if (key.type == -1) {
3576                 if (mac_addr)
3577                         key.type = NL80211_KEYTYPE_PAIRWISE;
3578                 else
3579                         key.type = NL80211_KEYTYPE_GROUP;
3580         }
3581
3582         /* for now */
3583         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3584             key.type != NL80211_KEYTYPE_GROUP)
3585                 return -EINVAL;
3586
3587         if (!rdev->ops->add_key)
3588                 return -EOPNOTSUPP;
3589
3590         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3591                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3592                                            mac_addr))
3593                 return -EINVAL;
3594
3595         wdev_lock(dev->ieee80211_ptr);
3596         err = nl80211_key_allowed(dev->ieee80211_ptr);
3597         if (!err)
3598                 err = rdev_add_key(rdev, dev, key.idx,
3599                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3600                                     mac_addr, &key.p);
3601         wdev_unlock(dev->ieee80211_ptr);
3602
3603         return err;
3604 }
3605
3606 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3607 {
3608         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3609         int err;
3610         struct net_device *dev = info->user_ptr[1];
3611         u8 *mac_addr = NULL;
3612         struct key_parse key;
3613
3614         err = nl80211_parse_key(info, &key);
3615         if (err)
3616                 return err;
3617
3618         if (info->attrs[NL80211_ATTR_MAC])
3619                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3620
3621         if (key.type == -1) {
3622                 if (mac_addr)
3623                         key.type = NL80211_KEYTYPE_PAIRWISE;
3624                 else
3625                         key.type = NL80211_KEYTYPE_GROUP;
3626         }
3627
3628         /* for now */
3629         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3630             key.type != NL80211_KEYTYPE_GROUP)
3631                 return -EINVAL;
3632
3633         if (!rdev->ops->del_key)
3634                 return -EOPNOTSUPP;
3635
3636         wdev_lock(dev->ieee80211_ptr);
3637         err = nl80211_key_allowed(dev->ieee80211_ptr);
3638
3639         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3640             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3641                 err = -ENOENT;
3642
3643         if (!err)
3644                 err = rdev_del_key(rdev, dev, key.idx,
3645                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3646                                    mac_addr);
3647
3648 #ifdef CONFIG_CFG80211_WEXT
3649         if (!err) {
3650                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3651                         dev->ieee80211_ptr->wext.default_key = -1;
3652                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3653                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3654         }
3655 #endif
3656         wdev_unlock(dev->ieee80211_ptr);
3657
3658         return err;
3659 }
3660
3661 /* This function returns an error or the number of nested attributes */
3662 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3663 {
3664         struct nlattr *attr;
3665         int n_entries = 0, tmp;
3666
3667         nla_for_each_nested(attr, nl_attr, tmp) {
3668                 if (nla_len(attr) != ETH_ALEN)
3669                         return -EINVAL;
3670
3671                 n_entries++;
3672         }
3673
3674         return n_entries;
3675 }
3676
3677 /*
3678  * This function parses ACL information and allocates memory for ACL data.
3679  * On successful return, the calling function is responsible to free the
3680  * ACL buffer returned by this function.
3681  */
3682 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3683                                                 struct genl_info *info)
3684 {
3685         enum nl80211_acl_policy acl_policy;
3686         struct nlattr *attr;
3687         struct cfg80211_acl_data *acl;
3688         int i = 0, n_entries, tmp;
3689
3690         if (!wiphy->max_acl_mac_addrs)
3691                 return ERR_PTR(-EOPNOTSUPP);
3692
3693         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3694                 return ERR_PTR(-EINVAL);
3695
3696         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3697         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3698             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3699                 return ERR_PTR(-EINVAL);
3700
3701         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3702                 return ERR_PTR(-EINVAL);
3703
3704         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3705         if (n_entries < 0)
3706                 return ERR_PTR(n_entries);
3707
3708         if (n_entries > wiphy->max_acl_mac_addrs)
3709                 return ERR_PTR(-ENOTSUPP);
3710
3711         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3712                       GFP_KERNEL);
3713         if (!acl)
3714                 return ERR_PTR(-ENOMEM);
3715
3716         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3717                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3718                 i++;
3719         }
3720
3721         acl->n_acl_entries = n_entries;
3722         acl->acl_policy = acl_policy;
3723
3724         return acl;
3725 }
3726
3727 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3728 {
3729         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3730         struct net_device *dev = info->user_ptr[1];
3731         struct cfg80211_acl_data *acl;
3732         int err;
3733
3734         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3735             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3736                 return -EOPNOTSUPP;
3737
3738         if (!dev->ieee80211_ptr->beacon_interval)
3739                 return -EINVAL;
3740
3741         acl = parse_acl_data(&rdev->wiphy, info);
3742         if (IS_ERR(acl))
3743                 return PTR_ERR(acl);
3744
3745         err = rdev_set_mac_acl(rdev, dev, acl);
3746
3747         kfree(acl);
3748
3749         return err;
3750 }
3751
3752 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3753                            u8 *rates, u8 rates_len)
3754 {
3755         u8 i;
3756         u32 mask = 0;
3757
3758         for (i = 0; i < rates_len; i++) {
3759                 int rate = (rates[i] & 0x7f) * 5;
3760                 int ridx;
3761
3762                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3763                         struct ieee80211_rate *srate =
3764                                 &sband->bitrates[ridx];
3765                         if (rate == srate->bitrate) {
3766                                 mask |= 1 << ridx;
3767                                 break;
3768                         }
3769                 }
3770                 if (ridx == sband->n_bitrates)
3771                         return 0; /* rate not found */
3772         }
3773
3774         return mask;
3775 }
3776
3777 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3778                                u8 *rates, u8 rates_len,
3779                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3780 {
3781         u8 i;
3782
3783         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3784
3785         for (i = 0; i < rates_len; i++) {
3786                 int ridx, rbit;
3787
3788                 ridx = rates[i] / 8;
3789                 rbit = BIT(rates[i] % 8);
3790
3791                 /* check validity */
3792                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3793                         return false;
3794
3795                 /* check availability */
3796                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3797                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3798                         mcs[ridx] |= rbit;
3799                 else
3800                         return false;
3801         }
3802
3803         return true;
3804 }
3805
3806 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3807 {
3808         u16 mcs_mask = 0;
3809
3810         switch (vht_mcs_map) {
3811         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3812                 break;
3813         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3814                 mcs_mask = 0x00FF;
3815                 break;
3816         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3817                 mcs_mask = 0x01FF;
3818                 break;
3819         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3820                 mcs_mask = 0x03FF;
3821                 break;
3822         default:
3823                 break;
3824         }
3825
3826         return mcs_mask;
3827 }
3828
3829 static void vht_build_mcs_mask(u16 vht_mcs_map,
3830                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3831 {
3832         u8 nss;
3833
3834         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3835                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3836                 vht_mcs_map >>= 2;
3837         }
3838 }
3839
3840 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3841                              struct nl80211_txrate_vht *txrate,
3842                              u16 mcs[NL80211_VHT_NSS_MAX])
3843 {
3844         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3845         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3846         u8 i;
3847
3848         if (!sband->vht_cap.vht_supported)
3849                 return false;
3850
3851         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3852
3853         /* Build vht_mcs_mask from VHT capabilities */
3854         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3855
3856         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3857                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3858                         mcs[i] = txrate->mcs[i];
3859                 else
3860                         return false;
3861         }
3862
3863         return true;
3864 }
3865
3866 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3867         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3868                                     .len = NL80211_MAX_SUPP_RATES },
3869         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3870                                 .len = NL80211_MAX_SUPP_HT_RATES },
3871         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3872         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3873 };
3874
3875 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3876                                          struct cfg80211_bitrate_mask *mask)
3877 {
3878         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3879         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3880         int rem, i;
3881         struct nlattr *tx_rates;
3882         struct ieee80211_supported_band *sband;
3883         u16 vht_tx_mcs_map;
3884
3885         memset(mask, 0, sizeof(*mask));
3886         /* Default to all rates enabled */
3887         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3888                 sband = rdev->wiphy.bands[i];
3889
3890                 if (!sband)
3891                         continue;
3892
3893                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3894                 memcpy(mask->control[i].ht_mcs,
3895                        sband->ht_cap.mcs.rx_mask,
3896                        sizeof(mask->control[i].ht_mcs));
3897
3898                 if (!sband->vht_cap.vht_supported)
3899                         continue;
3900
3901                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3902                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3903         }
3904
3905         /* if no rates are given set it back to the defaults */
3906         if (!info->attrs[NL80211_ATTR_TX_RATES])
3907                 goto out;
3908
3909         /* The nested attribute uses enum nl80211_band as the index. This maps
3910          * directly to the enum nl80211_band values used in cfg80211.
3911          */
3912         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3913         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3914                 enum nl80211_band band = nla_type(tx_rates);
3915                 int err;
3916
3917                 if (band < 0 || band >= NUM_NL80211_BANDS)
3918                         return -EINVAL;
3919                 sband = rdev->wiphy.bands[band];
3920                 if (sband == NULL)
3921                         return -EINVAL;
3922                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3923                                        nl80211_txattr_policy, info->extack);
3924                 if (err)
3925                         return err;
3926                 if (tb[NL80211_TXRATE_LEGACY]) {
3927                         mask->control[band].legacy = rateset_to_mask(
3928                                 sband,
3929                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3930                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3931                         if ((mask->control[band].legacy == 0) &&
3932                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3933                                 return -EINVAL;
3934                 }
3935                 if (tb[NL80211_TXRATE_HT]) {
3936                         if (!ht_rateset_to_mask(
3937                                         sband,
3938                                         nla_data(tb[NL80211_TXRATE_HT]),
3939                                         nla_len(tb[NL80211_TXRATE_HT]),
3940                                         mask->control[band].ht_mcs))
3941                                 return -EINVAL;
3942                 }
3943                 if (tb[NL80211_TXRATE_VHT]) {
3944                         if (!vht_set_mcs_mask(
3945                                         sband,
3946                                         nla_data(tb[NL80211_TXRATE_VHT]),
3947                                         mask->control[band].vht_mcs))
3948                                 return -EINVAL;
3949                 }
3950                 if (tb[NL80211_TXRATE_GI]) {
3951                         mask->control[band].gi =
3952                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3953                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3954                                 return -EINVAL;
3955                 }
3956
3957                 if (mask->control[band].legacy == 0) {
3958                         /* don't allow empty legacy rates if HT or VHT
3959                          * are not even supported.
3960                          */
3961                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3962                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3963                                 return -EINVAL;
3964
3965                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3966                                 if (mask->control[band].ht_mcs[i])
3967                                         goto out;
3968
3969                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3970                                 if (mask->control[band].vht_mcs[i])
3971                                         goto out;
3972
3973                         /* legacy and mcs rates may not be both empty */
3974                         return -EINVAL;
3975                 }
3976         }
3977
3978 out:
3979         return 0;
3980 }
3981
3982 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3983                                    enum nl80211_band band,
3984                                    struct cfg80211_bitrate_mask *beacon_rate)
3985 {
3986         u32 count_ht, count_vht, i;
3987         u32 rate = beacon_rate->control[band].legacy;
3988
3989         /* Allow only one rate */
3990         if (hweight32(rate) > 1)
3991                 return -EINVAL;
3992
3993         count_ht = 0;
3994         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3995                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3996                         return -EINVAL;
3997                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3998                         count_ht++;
3999                         if (count_ht > 1)
4000                                 return -EINVAL;
4001                 }
4002                 if (count_ht && rate)
4003                         return -EINVAL;
4004         }
4005
4006         count_vht = 0;
4007         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
4008                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
4009                         return -EINVAL;
4010                 } else if (beacon_rate->control[band].vht_mcs[i]) {
4011                         count_vht++;
4012                         if (count_vht > 1)
4013                                 return -EINVAL;
4014                 }
4015                 if (count_vht && rate)
4016                         return -EINVAL;
4017         }
4018
4019         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4020                 return -EINVAL;
4021
4022         if (rate &&
4023             !wiphy_ext_feature_isset(&rdev->wiphy,
4024                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4025                 return -EINVAL;
4026         if (count_ht &&
4027             !wiphy_ext_feature_isset(&rdev->wiphy,
4028                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4029                 return -EINVAL;
4030         if (count_vht &&
4031             !wiphy_ext_feature_isset(&rdev->wiphy,
4032                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4033                 return -EINVAL;
4034
4035         return 0;
4036 }
4037
4038 static int nl80211_parse_beacon(struct nlattr *attrs[],
4039                                 struct cfg80211_beacon_data *bcn)
4040 {
4041         bool haveinfo = false;
4042
4043         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
4044             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
4045             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
4046             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
4047                 return -EINVAL;
4048
4049         memset(bcn, 0, sizeof(*bcn));
4050
4051         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4052                 int ret = validate_beacon_head(attrs[NL80211_ATTR_BEACON_HEAD],
4053                                                NULL);
4054
4055                 if (ret)
4056                         return ret;
4057
4058                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4059                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4060                 if (!bcn->head_len)
4061                         return -EINVAL;
4062                 haveinfo = true;
4063         }
4064
4065         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4066                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4067                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4068                 haveinfo = true;
4069         }
4070
4071         if (!haveinfo)
4072                 return -EINVAL;
4073
4074         if (attrs[NL80211_ATTR_IE]) {
4075                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4076                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4077         }
4078
4079         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4080                 bcn->proberesp_ies =
4081                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4082                 bcn->proberesp_ies_len =
4083                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4084         }
4085
4086         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4087                 bcn->assocresp_ies =
4088                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4089                 bcn->assocresp_ies_len =
4090                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4091         }
4092
4093         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4094                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4095                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4096         }
4097
4098         return 0;
4099 }
4100
4101 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4102                                             const u8 *rates)
4103 {
4104         int i;
4105
4106         if (!rates)
4107                 return;
4108
4109         for (i = 0; i < rates[1]; i++) {
4110                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4111                         params->ht_required = true;
4112                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4113                         params->vht_required = true;
4114         }
4115 }
4116
4117 /*
4118  * Since the nl80211 API didn't include, from the beginning, attributes about
4119  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4120  * benefit of drivers that rebuild IEs in the firmware.
4121  */
4122 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4123 {
4124         const struct cfg80211_beacon_data *bcn = &params->beacon;
4125         size_t ies_len = bcn->tail_len;
4126         const u8 *ies = bcn->tail;
4127         const u8 *rates;
4128         const u8 *cap;
4129
4130         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4131         nl80211_check_ap_rate_selectors(params, rates);
4132
4133         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4134         nl80211_check_ap_rate_selectors(params, rates);
4135
4136         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4137         if (cap && cap[1] >= sizeof(*params->ht_cap))
4138                 params->ht_cap = (void *)(cap + 2);
4139         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4140         if (cap && cap[1] >= sizeof(*params->vht_cap))
4141                 params->vht_cap = (void *)(cap + 2);
4142 }
4143
4144 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4145                                    struct cfg80211_ap_settings *params)
4146 {
4147         struct wireless_dev *wdev;
4148         bool ret = false;
4149
4150         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4151                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4152                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4153                         continue;
4154
4155                 if (!wdev->preset_chandef.chan)
4156                         continue;
4157
4158                 params->chandef = wdev->preset_chandef;
4159                 ret = true;
4160                 break;
4161         }
4162
4163         return ret;
4164 }
4165
4166 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4167                                     enum nl80211_auth_type auth_type,
4168                                     enum nl80211_commands cmd)
4169 {
4170         if (auth_type > NL80211_AUTHTYPE_MAX)
4171                 return false;
4172
4173         switch (cmd) {
4174         case NL80211_CMD_AUTHENTICATE:
4175                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4176                     auth_type == NL80211_AUTHTYPE_SAE)
4177                         return false;
4178                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4179                                              NL80211_EXT_FEATURE_FILS_STA) &&
4180                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4181                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4182                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4183                         return false;
4184                 return true;
4185         case NL80211_CMD_CONNECT:
4186                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4187                     auth_type == NL80211_AUTHTYPE_SAE)
4188                         return false;
4189
4190                 /* FILS with SK PFS or PK not supported yet */
4191                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4192                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4193                         return false;
4194                 if (!wiphy_ext_feature_isset(
4195                             &rdev->wiphy,
4196                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4197                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4198                         return false;
4199                 return true;
4200         case NL80211_CMD_START_AP:
4201                 /* SAE not supported yet */
4202                 if (auth_type == NL80211_AUTHTYPE_SAE)
4203                         return false;
4204                 /* FILS not supported yet */
4205                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4206                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4207                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4208                         return false;
4209                 return true;
4210         default:
4211                 return false;
4212         }
4213 }
4214
4215 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4216 {
4217         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4218         struct net_device *dev = info->user_ptr[1];
4219         struct wireless_dev *wdev = dev->ieee80211_ptr;
4220         struct cfg80211_ap_settings params;
4221         int err;
4222
4223         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4224             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4225                 return -EOPNOTSUPP;
4226
4227         if (!rdev->ops->start_ap)
4228                 return -EOPNOTSUPP;
4229
4230         if (wdev->beacon_interval)
4231                 return -EALREADY;
4232
4233         memset(&params, 0, sizeof(params));
4234
4235         /* these are required for START_AP */
4236         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4237             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4238             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4239                 return -EINVAL;
4240
4241         err = nl80211_parse_beacon(info->attrs, &params.beacon);
4242         if (err)
4243                 return err;
4244
4245         params.beacon_interval =
4246                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4247         params.dtim_period =
4248                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4249
4250         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4251                                            params.beacon_interval);
4252         if (err)
4253                 return err;
4254
4255         /*
4256          * In theory, some of these attributes should be required here
4257          * but since they were not used when the command was originally
4258          * added, keep them optional for old user space programs to let
4259          * them continue to work with drivers that do not need the
4260          * additional information -- drivers must check!
4261          */
4262         if (info->attrs[NL80211_ATTR_SSID]) {
4263                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4264                 params.ssid_len =
4265                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4266                 if (params.ssid_len == 0 ||
4267                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4268                         return -EINVAL;
4269         }
4270
4271         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
4272                 params.hidden_ssid = nla_get_u32(
4273                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4274                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
4275                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
4276                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
4277                         return -EINVAL;
4278         }
4279
4280         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4281
4282         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4283                 params.auth_type = nla_get_u32(
4284                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4285                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4286                                              NL80211_CMD_START_AP))
4287                         return -EINVAL;
4288         } else
4289                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4290
4291         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4292                                       NL80211_MAX_NR_CIPHER_SUITES);
4293         if (err)
4294                 return err;
4295
4296         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4297                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4298                         return -EOPNOTSUPP;
4299                 params.inactivity_timeout = nla_get_u16(
4300                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4301         }
4302
4303         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4304                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4305                         return -EINVAL;
4306                 params.p2p_ctwindow =
4307                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4308                 if (params.p2p_ctwindow > 127)
4309                         return -EINVAL;
4310                 if (params.p2p_ctwindow != 0 &&
4311                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4312                         return -EINVAL;
4313         }
4314
4315         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4316                 u8 tmp;
4317
4318                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4319                         return -EINVAL;
4320                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4321                 if (tmp > 1)
4322                         return -EINVAL;
4323                 params.p2p_opp_ps = tmp;
4324                 if (params.p2p_opp_ps != 0 &&
4325                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4326                         return -EINVAL;
4327         }
4328
4329         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4330                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4331                 if (err)
4332                         return err;
4333         } else if (wdev->preset_chandef.chan) {
4334                 params.chandef = wdev->preset_chandef;
4335         } else if (!nl80211_get_ap_channel(rdev, &params))
4336                 return -EINVAL;
4337
4338         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4339                                            wdev->iftype))
4340                 return -EINVAL;
4341
4342         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4343                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4344                 if (err)
4345                         return err;
4346
4347                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4348                                               &params.beacon_rate);
4349                 if (err)
4350                         return err;
4351         }
4352
4353         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4354                 params.smps_mode =
4355                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4356                 switch (params.smps_mode) {
4357                 case NL80211_SMPS_OFF:
4358                         break;
4359                 case NL80211_SMPS_STATIC:
4360                         if (!(rdev->wiphy.features &
4361                               NL80211_FEATURE_STATIC_SMPS))
4362                                 return -EINVAL;
4363                         break;
4364                 case NL80211_SMPS_DYNAMIC:
4365                         if (!(rdev->wiphy.features &
4366                               NL80211_FEATURE_DYNAMIC_SMPS))
4367                                 return -EINVAL;
4368                         break;
4369                 default:
4370                         return -EINVAL;
4371                 }
4372         } else {
4373                 params.smps_mode = NL80211_SMPS_OFF;
4374         }
4375
4376         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4377         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4378                 return -EOPNOTSUPP;
4379
4380         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4381                 params.acl = parse_acl_data(&rdev->wiphy, info);
4382                 if (IS_ERR(params.acl))
4383                         return PTR_ERR(params.acl);
4384         }
4385
4386         nl80211_calculate_ap_params(&params);
4387
4388         wdev_lock(wdev);
4389         err = rdev_start_ap(rdev, dev, &params);
4390         if (!err) {
4391                 wdev->preset_chandef = params.chandef;
4392                 wdev->beacon_interval = params.beacon_interval;
4393                 wdev->chandef = params.chandef;
4394                 wdev->ssid_len = params.ssid_len;
4395                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4396
4397                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4398                         wdev->conn_owner_nlportid = info->snd_portid;
4399         }
4400         wdev_unlock(wdev);
4401
4402         kfree(params.acl);
4403
4404         return err;
4405 }
4406
4407 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4408 {
4409         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4410         struct net_device *dev = info->user_ptr[1];
4411         struct wireless_dev *wdev = dev->ieee80211_ptr;
4412         struct cfg80211_beacon_data params;
4413         int err;
4414
4415         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4416             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4417                 return -EOPNOTSUPP;
4418
4419         if (!rdev->ops->change_beacon)
4420                 return -EOPNOTSUPP;
4421
4422         if (!wdev->beacon_interval)
4423                 return -EINVAL;
4424
4425         err = nl80211_parse_beacon(info->attrs, &params);
4426         if (err)
4427                 return err;
4428
4429         wdev_lock(wdev);
4430         err = rdev_change_beacon(rdev, dev, &params);
4431         wdev_unlock(wdev);
4432
4433         return err;
4434 }
4435
4436 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4437 {
4438         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4439         struct net_device *dev = info->user_ptr[1];
4440
4441         return cfg80211_stop_ap(rdev, dev, false);
4442 }
4443
4444 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4445         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4446         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4447         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4448         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4449         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4450         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4451 };
4452
4453 static int parse_station_flags(struct genl_info *info,
4454                                enum nl80211_iftype iftype,
4455                                struct station_parameters *params)
4456 {
4457         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4458         struct nlattr *nla;
4459         int flag;
4460
4461         /*
4462          * Try parsing the new attribute first so userspace
4463          * can specify both for older kernels.
4464          */
4465         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4466         if (nla) {
4467                 struct nl80211_sta_flag_update *sta_flags;
4468
4469                 sta_flags = nla_data(nla);
4470                 params->sta_flags_mask = sta_flags->mask;
4471                 params->sta_flags_set = sta_flags->set;
4472                 params->sta_flags_set &= params->sta_flags_mask;
4473                 if ((params->sta_flags_mask |
4474                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4475                         return -EINVAL;
4476                 return 0;
4477         }
4478
4479         /* if present, parse the old attribute */
4480
4481         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4482         if (!nla)
4483                 return 0;
4484
4485         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4486                              sta_flags_policy, info->extack))
4487                 return -EINVAL;
4488
4489         /*
4490          * Only allow certain flags for interface types so that
4491          * other attributes are silently ignored. Remember that
4492          * this is backward compatibility code with old userspace
4493          * and shouldn't be hit in other cases anyway.
4494          */
4495         switch (iftype) {
4496         case NL80211_IFTYPE_AP:
4497         case NL80211_IFTYPE_AP_VLAN:
4498         case NL80211_IFTYPE_P2P_GO:
4499                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4500                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4501                                          BIT(NL80211_STA_FLAG_WME) |
4502                                          BIT(NL80211_STA_FLAG_MFP);
4503                 break;
4504         case NL80211_IFTYPE_P2P_CLIENT:
4505         case NL80211_IFTYPE_STATION:
4506                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4507                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4508                 break;
4509         case NL80211_IFTYPE_MESH_POINT:
4510                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4511                                          BIT(NL80211_STA_FLAG_MFP) |
4512                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4513                 break;
4514         default:
4515                 return -EINVAL;
4516         }
4517
4518         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4519                 if (flags[flag]) {
4520                         params->sta_flags_set |= (1<<flag);
4521
4522                         /* no longer support new API additions in old API */
4523                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4524                                 return -EINVAL;
4525                 }
4526         }
4527
4528         return 0;
4529 }
4530
4531 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4532                                  int attr)
4533 {
4534         struct nlattr *rate;
4535         u32 bitrate;
4536         u16 bitrate_compat;
4537         enum nl80211_rate_info rate_flg;
4538
4539         rate = nla_nest_start(msg, attr);
4540         if (!rate)
4541                 return false;
4542
4543         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4544         bitrate = cfg80211_calculate_bitrate(info);
4545         /* report 16-bit bitrate only if we can */
4546         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4547         if (bitrate > 0 &&
4548             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4549                 return false;
4550         if (bitrate_compat > 0 &&
4551             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4552                 return false;
4553
4554         switch (info->bw) {
4555         case RATE_INFO_BW_5:
4556                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4557                 break;
4558         case RATE_INFO_BW_10:
4559                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4560                 break;
4561         default:
4562                 WARN_ON(1);
4563                 /* fall through */
4564         case RATE_INFO_BW_20:
4565                 rate_flg = 0;
4566                 break;
4567         case RATE_INFO_BW_40:
4568                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4569                 break;
4570         case RATE_INFO_BW_80:
4571                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4572                 break;
4573         case RATE_INFO_BW_160:
4574                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4575                 break;
4576         case RATE_INFO_BW_HE_RU:
4577                 rate_flg = 0;
4578                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4579         }
4580
4581         if (rate_flg && nla_put_flag(msg, rate_flg))
4582                 return false;
4583
4584         if (info->flags & RATE_INFO_FLAGS_MCS) {
4585                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4586                         return false;
4587                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4588                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4589                         return false;
4590         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4591                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4592                         return false;
4593                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4594                         return false;
4595                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4596                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4597                         return false;
4598         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4599                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4600                         return false;
4601                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4602                         return false;
4603                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4604                         return false;
4605                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4606                         return false;
4607                 if (info->bw == RATE_INFO_BW_HE_RU &&
4608                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4609                                info->he_ru_alloc))
4610                         return false;
4611         }
4612
4613         nla_nest_end(msg, rate);
4614         return true;
4615 }
4616
4617 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4618                                int id)
4619 {
4620         void *attr;
4621         int i = 0;
4622
4623         if (!mask)
4624                 return true;
4625
4626         attr = nla_nest_start(msg, id);
4627         if (!attr)
4628                 return false;
4629
4630         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4631                 if (!(mask & BIT(i)))
4632                         continue;
4633
4634                 if (nla_put_u8(msg, i, signal[i]))
4635                         return false;
4636         }
4637
4638         nla_nest_end(msg, attr);
4639
4640         return true;
4641 }
4642
4643 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4644                                 u32 seq, int flags,
4645                                 struct cfg80211_registered_device *rdev,
4646                                 struct net_device *dev,
4647                                 const u8 *mac_addr, struct station_info *sinfo)
4648 {
4649         void *hdr;
4650         struct nlattr *sinfoattr, *bss_param;
4651
4652         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4653         if (!hdr) {
4654                 cfg80211_sinfo_release_content(sinfo);
4655                 return -1;
4656         }
4657
4658         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4659             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4660             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4661                 goto nla_put_failure;
4662
4663         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4664         if (!sinfoattr)
4665                 goto nla_put_failure;
4666
4667 #define PUT_SINFO(attr, memb, type) do {                                \
4668         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4669         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4670             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4671                              sinfo->memb))                              \
4672                 goto nla_put_failure;                                   \
4673         } while (0)
4674 #define PUT_SINFO_U64(attr, memb) do {                                  \
4675         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4676             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4677                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4678                 goto nla_put_failure;                                   \
4679         } while (0)
4680
4681         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4682         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4683
4684         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4685                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4686             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4687                         (u32)sinfo->rx_bytes))
4688                 goto nla_put_failure;
4689
4690         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4691                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4692             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4693                         (u32)sinfo->tx_bytes))
4694                 goto nla_put_failure;
4695
4696         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4697         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4698         PUT_SINFO(LLID, llid, u16);
4699         PUT_SINFO(PLID, plid, u16);
4700         PUT_SINFO(PLINK_STATE, plink_state, u8);
4701         PUT_SINFO_U64(RX_DURATION, rx_duration);
4702
4703         switch (rdev->wiphy.signal_type) {
4704         case CFG80211_SIGNAL_TYPE_MBM:
4705                 PUT_SINFO(SIGNAL, signal, u8);
4706                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4707                 break;
4708         default:
4709                 break;
4710         }
4711         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4712                 if (!nl80211_put_signal(msg, sinfo->chains,
4713                                         sinfo->chain_signal,
4714                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4715                         goto nla_put_failure;
4716         }
4717         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4718                 if (!nl80211_put_signal(msg, sinfo->chains,
4719                                         sinfo->chain_signal_avg,
4720                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4721                         goto nla_put_failure;
4722         }
4723         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4724                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4725                                           NL80211_STA_INFO_TX_BITRATE))
4726                         goto nla_put_failure;
4727         }
4728         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4729                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4730                                           NL80211_STA_INFO_RX_BITRATE))
4731                         goto nla_put_failure;
4732         }
4733
4734         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4735         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4736         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4737         PUT_SINFO(TX_FAILED, tx_failed, u32);
4738         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4739         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4740         PUT_SINFO(LOCAL_PM, local_pm, u32);
4741         PUT_SINFO(PEER_PM, peer_pm, u32);
4742         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4743
4744         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4745                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4746                 if (!bss_param)
4747                         goto nla_put_failure;
4748
4749                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4750                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4751                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4752                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4753                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4754                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4755                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4756                                sinfo->bss_param.dtim_period) ||
4757                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4758                                 sinfo->bss_param.beacon_interval))
4759                         goto nla_put_failure;
4760
4761                 nla_nest_end(msg, bss_param);
4762         }
4763         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4764             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4765                     sizeof(struct nl80211_sta_flag_update),
4766                     &sinfo->sta_flags))
4767                 goto nla_put_failure;
4768
4769         PUT_SINFO_U64(T_OFFSET, t_offset);
4770         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4771         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4772         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4773         PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4774         if (wiphy_ext_feature_isset(&rdev->wiphy,
4775                                     NL80211_EXT_FEATURE_DATA_ACK_SIGNAL_SUPPORT))
4776                 PUT_SINFO(DATA_ACK_SIGNAL_AVG, avg_ack_signal, s8);
4777
4778 #undef PUT_SINFO
4779 #undef PUT_SINFO_U64
4780
4781         if (sinfo->pertid) {
4782                 struct nlattr *tidsattr;
4783                 int tid;
4784
4785                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4786                 if (!tidsattr)
4787                         goto nla_put_failure;
4788
4789                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4790                         struct cfg80211_tid_stats *tidstats;
4791                         struct nlattr *tidattr;
4792
4793                         tidstats = &sinfo->pertid[tid];
4794
4795                         if (!tidstats->filled)
4796                                 continue;
4797
4798                         tidattr = nla_nest_start(msg, tid + 1);
4799                         if (!tidattr)
4800                                 goto nla_put_failure;
4801
4802 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4803         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4804             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4805                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4806                 goto nla_put_failure;                                   \
4807         } while (0)
4808
4809                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4810                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4811                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4812                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4813
4814 #undef PUT_TIDVAL_U64
4815                         if ((tidstats->filled &
4816                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4817                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4818                                                    NL80211_TID_STATS_TXQ_STATS))
4819                                 goto nla_put_failure;
4820
4821                         nla_nest_end(msg, tidattr);
4822                 }
4823
4824                 nla_nest_end(msg, tidsattr);
4825         }
4826
4827         nla_nest_end(msg, sinfoattr);
4828
4829         if (sinfo->assoc_req_ies_len &&
4830             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4831                     sinfo->assoc_req_ies))
4832                 goto nla_put_failure;
4833
4834         cfg80211_sinfo_release_content(sinfo);
4835         genlmsg_end(msg, hdr);
4836         return 0;
4837
4838  nla_put_failure:
4839         cfg80211_sinfo_release_content(sinfo);
4840         genlmsg_cancel(msg, hdr);
4841         return -EMSGSIZE;
4842 }
4843
4844 static int nl80211_dump_station(struct sk_buff *skb,
4845                                 struct netlink_callback *cb)
4846 {
4847         struct station_info sinfo;
4848         struct cfg80211_registered_device *rdev;
4849         struct wireless_dev *wdev;
4850         u8 mac_addr[ETH_ALEN];
4851         int sta_idx = cb->args[2];
4852         int err;
4853
4854         rtnl_lock();
4855         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4856         if (err)
4857                 goto out_err;
4858
4859         if (!wdev->netdev) {
4860                 err = -EINVAL;
4861                 goto out_err;
4862         }
4863
4864         if (!rdev->ops->dump_station) {
4865                 err = -EOPNOTSUPP;
4866                 goto out_err;
4867         }
4868
4869         while (1) {
4870                 memset(&sinfo, 0, sizeof(sinfo));
4871                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4872                                         mac_addr, &sinfo);
4873                 if (err == -ENOENT)
4874                         break;
4875                 if (err)
4876                         goto out_err;
4877
4878                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4879                                 NETLINK_CB(cb->skb).portid,
4880                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4881                                 rdev, wdev->netdev, mac_addr,
4882                                 &sinfo) < 0)
4883                         goto out;
4884
4885                 sta_idx++;
4886         }
4887
4888  out:
4889         cb->args[2] = sta_idx;
4890         err = skb->len;
4891  out_err:
4892         rtnl_unlock();
4893
4894         return err;
4895 }
4896
4897 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4898 {
4899         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4900         struct net_device *dev = info->user_ptr[1];
4901         struct station_info sinfo;
4902         struct sk_buff *msg;
4903         u8 *mac_addr = NULL;
4904         int err;
4905
4906         memset(&sinfo, 0, sizeof(sinfo));
4907
4908         if (!info->attrs[NL80211_ATTR_MAC])
4909                 return -EINVAL;
4910
4911         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4912
4913         if (!rdev->ops->get_station)
4914                 return -EOPNOTSUPP;
4915
4916         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4917         if (err)
4918                 return err;
4919
4920         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4921         if (!msg) {
4922                 cfg80211_sinfo_release_content(&sinfo);
4923                 return -ENOMEM;
4924         }
4925
4926         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4927                                  info->snd_portid, info->snd_seq, 0,
4928                                  rdev, dev, mac_addr, &sinfo) < 0) {
4929                 nlmsg_free(msg);
4930                 return -ENOBUFS;
4931         }
4932
4933         return genlmsg_reply(msg, info);
4934 }
4935
4936 int cfg80211_check_station_change(struct wiphy *wiphy,
4937                                   struct station_parameters *params,
4938                                   enum cfg80211_station_type statype)
4939 {
4940         if (params->listen_interval != -1 &&
4941             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4942                 return -EINVAL;
4943
4944         if (params->support_p2p_ps != -1 &&
4945             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4946                 return -EINVAL;
4947
4948         if (params->aid &&
4949             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4950             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4951                 return -EINVAL;
4952
4953         /* When you run into this, adjust the code below for the new flag */
4954         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4955
4956         switch (statype) {
4957         case CFG80211_STA_MESH_PEER_KERNEL:
4958         case CFG80211_STA_MESH_PEER_USER:
4959                 /*
4960                  * No ignoring the TDLS flag here -- the userspace mesh
4961                  * code doesn't have the bug of including TDLS in the
4962                  * mask everywhere.
4963                  */
4964                 if (params->sta_flags_mask &
4965                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4966                                   BIT(NL80211_STA_FLAG_MFP) |
4967                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4968                         return -EINVAL;
4969                 break;
4970         case CFG80211_STA_TDLS_PEER_SETUP:
4971         case CFG80211_STA_TDLS_PEER_ACTIVE:
4972                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4973                         return -EINVAL;
4974                 /* ignore since it can't change */
4975                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4976                 break;
4977         default:
4978                 /* disallow mesh-specific things */
4979                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4980                         return -EINVAL;
4981                 if (params->local_pm)
4982                         return -EINVAL;
4983                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4984                         return -EINVAL;
4985         }
4986
4987         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4988             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4989                 /* TDLS can't be set, ... */
4990                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4991                         return -EINVAL;
4992                 /*
4993                  * ... but don't bother the driver with it. This works around
4994                  * a hostapd/wpa_supplicant issue -- it always includes the
4995                  * TLDS_PEER flag in the mask even for AP mode.
4996                  */
4997                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4998         }
4999
5000         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
5001             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5002                 /* reject other things that can't change */
5003                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
5004                         return -EINVAL;
5005                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5006                         return -EINVAL;
5007                 if (params->supported_rates)
5008                         return -EINVAL;
5009                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5010                     params->he_capa)
5011                         return -EINVAL;
5012         }
5013
5014         if (statype != CFG80211_STA_AP_CLIENT &&
5015             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5016                 if (params->vlan)
5017                         return -EINVAL;
5018         }
5019
5020         switch (statype) {
5021         case CFG80211_STA_AP_MLME_CLIENT:
5022                 /* Use this only for authorizing/unauthorizing a station */
5023                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5024                         return -EOPNOTSUPP;
5025                 break;
5026         case CFG80211_STA_AP_CLIENT:
5027         case CFG80211_STA_AP_CLIENT_UNASSOC:
5028                 /* accept only the listed bits */
5029                 if (params->sta_flags_mask &
5030                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5031                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5032                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5033                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5034                                   BIT(NL80211_STA_FLAG_WME) |
5035                                   BIT(NL80211_STA_FLAG_MFP)))
5036                         return -EINVAL;
5037
5038                 /* but authenticated/associated only if driver handles it */
5039                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5040                     params->sta_flags_mask &
5041                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5042                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5043                         return -EINVAL;
5044                 break;
5045         case CFG80211_STA_IBSS:
5046         case CFG80211_STA_AP_STA:
5047                 /* reject any changes other than AUTHORIZED */
5048                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5049                         return -EINVAL;
5050                 break;
5051         case CFG80211_STA_TDLS_PEER_SETUP:
5052                 /* reject any changes other than AUTHORIZED or WME */
5053                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5054                                                BIT(NL80211_STA_FLAG_WME)))
5055                         return -EINVAL;
5056                 /* force (at least) rates when authorizing */
5057                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5058                     !params->supported_rates)
5059                         return -EINVAL;
5060                 break;
5061         case CFG80211_STA_TDLS_PEER_ACTIVE:
5062                 /* reject any changes */
5063                 return -EINVAL;
5064         case CFG80211_STA_MESH_PEER_KERNEL:
5065                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5066                         return -EINVAL;
5067                 break;
5068         case CFG80211_STA_MESH_PEER_USER:
5069                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5070                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5071                         return -EINVAL;
5072                 break;
5073         }
5074
5075         /*
5076          * Older kernel versions ignored this attribute entirely, so don't
5077          * reject attempts to update it but mark it as unused instead so the
5078          * driver won't look at the data.
5079          */
5080         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5081             statype != CFG80211_STA_TDLS_PEER_SETUP)
5082                 params->opmode_notif_used = false;
5083
5084         return 0;
5085 }
5086 EXPORT_SYMBOL(cfg80211_check_station_change);
5087
5088 /*
5089  * Get vlan interface making sure it is running and on the right wiphy.
5090  */
5091 static struct net_device *get_vlan(struct genl_info *info,
5092                                    struct cfg80211_registered_device *rdev)
5093 {
5094         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5095         struct net_device *v;
5096         int ret;
5097
5098         if (!vlanattr)
5099                 return NULL;
5100
5101         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5102         if (!v)
5103                 return ERR_PTR(-ENODEV);
5104
5105         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5106                 ret = -EINVAL;
5107                 goto error;
5108         }
5109
5110         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5111             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5112             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5113                 ret = -EINVAL;
5114                 goto error;
5115         }
5116
5117         if (!netif_running(v)) {
5118                 ret = -ENETDOWN;
5119                 goto error;
5120         }
5121
5122         return v;
5123  error:
5124         dev_put(v);
5125         return ERR_PTR(ret);
5126 }
5127
5128 static const struct nla_policy
5129 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5130         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5131         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5132 };
5133
5134 static int nl80211_parse_sta_wme(struct genl_info *info,
5135                                  struct station_parameters *params)
5136 {
5137         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5138         struct nlattr *nla;
5139         int err;
5140
5141         /* parse WME attributes if present */
5142         if (!info->attrs[NL80211_ATTR_STA_WME])
5143                 return 0;
5144
5145         nla = info->attrs[NL80211_ATTR_STA_WME];
5146         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5147                                nl80211_sta_wme_policy, info->extack);
5148         if (err)
5149                 return err;
5150
5151         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5152                 params->uapsd_queues = nla_get_u8(
5153                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5154         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5155                 return -EINVAL;
5156
5157         if (tb[NL80211_STA_WME_MAX_SP])
5158                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5159
5160         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5161                 return -EINVAL;
5162
5163         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5164
5165         return 0;
5166 }
5167
5168 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5169                                       struct station_parameters *params)
5170 {
5171         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5172                 params->supported_channels =
5173                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5174                 params->supported_channels_len =
5175                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5176                 /*
5177                  * Need to include at least one (first channel, number of
5178                  * channels) tuple for each subband, and must have proper
5179                  * tuples for the rest of the data as well.
5180                  */
5181                 if (params->supported_channels_len < 2)
5182                         return -EINVAL;
5183                 if (params->supported_channels_len % 2)
5184                         return -EINVAL;
5185         }
5186
5187         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5188                 params->supported_oper_classes =
5189                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5190                 params->supported_oper_classes_len =
5191                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5192                 /*
5193                  * The value of the Length field of the Supported Operating
5194                  * Classes element is between 2 and 253.
5195                  */
5196                 if (params->supported_oper_classes_len < 2 ||
5197                     params->supported_oper_classes_len > 253)
5198                         return -EINVAL;
5199         }
5200         return 0;
5201 }
5202
5203 static int nl80211_set_station_tdls(struct genl_info *info,
5204                                     struct station_parameters *params)
5205 {
5206         int err;
5207         /* Dummy STA entry gets updated once the peer capabilities are known */
5208         if (info->attrs[NL80211_ATTR_PEER_AID])
5209                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5210         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5211                 params->ht_capa =
5212                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5213         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5214                 params->vht_capa =
5215                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5216         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5217                 params->he_capa =
5218                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5219                 params->he_capa_len =
5220                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5221
5222                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5223                         return -EINVAL;
5224         }
5225
5226         err = nl80211_parse_sta_channel_info(info, params);
5227         if (err)
5228                 return err;
5229
5230         return nl80211_parse_sta_wme(info, params);
5231 }
5232
5233 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5234 {
5235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5236         struct net_device *dev = info->user_ptr[1];
5237         struct station_parameters params;
5238         u8 *mac_addr;
5239         int err;
5240
5241         memset(&params, 0, sizeof(params));
5242
5243         if (!rdev->ops->change_station)
5244                 return -EOPNOTSUPP;
5245
5246         /*
5247          * AID and listen_interval properties can be set only for unassociated
5248          * station. Include these parameters here and will check them in
5249          * cfg80211_check_station_change().
5250          */
5251         if (info->attrs[NL80211_ATTR_STA_AID])
5252                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5253
5254         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5255                 params.listen_interval =
5256                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5257         else
5258                 params.listen_interval = -1;
5259
5260         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5261                 u8 tmp;
5262
5263                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5264                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5265                         return -EINVAL;
5266
5267                 params.support_p2p_ps = tmp;
5268         } else {
5269                 params.support_p2p_ps = -1;
5270         }
5271
5272         if (!info->attrs[NL80211_ATTR_MAC])
5273                 return -EINVAL;
5274
5275         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5276
5277         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5278                 params.supported_rates =
5279                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5280                 params.supported_rates_len =
5281                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5282         }
5283
5284         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5285                 params.capability =
5286                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5287                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5288         }
5289
5290         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5291                 params.ext_capab =
5292                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5293                 params.ext_capab_len =
5294                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5295         }
5296
5297         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5298                 return -EINVAL;
5299
5300         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5301                 params.plink_action =
5302                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5303                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5304                         return -EINVAL;
5305         }
5306
5307         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5308                 params.plink_state =
5309                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5310                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
5311                         return -EINVAL;
5312                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
5313                         params.peer_aid = nla_get_u16(
5314                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5315                         if (params.peer_aid > IEEE80211_MAX_AID)
5316                                 return -EINVAL;
5317                 }
5318                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5319         }
5320
5321         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
5322                 enum nl80211_mesh_power_mode pm = nla_get_u32(
5323                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5324
5325                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
5326                     pm > NL80211_MESH_POWER_MAX)
5327                         return -EINVAL;
5328
5329                 params.local_pm = pm;
5330         }
5331
5332         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5333                 params.opmode_notif_used = true;
5334                 params.opmode_notif =
5335                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5336         }
5337
5338         /* Include parameters for TDLS peer (will check later) */
5339         err = nl80211_set_station_tdls(info, &params);
5340         if (err)
5341                 return err;
5342
5343         params.vlan = get_vlan(info, rdev);
5344         if (IS_ERR(params.vlan))
5345                 return PTR_ERR(params.vlan);
5346
5347         switch (dev->ieee80211_ptr->iftype) {
5348         case NL80211_IFTYPE_AP:
5349         case NL80211_IFTYPE_AP_VLAN:
5350         case NL80211_IFTYPE_P2P_GO:
5351         case NL80211_IFTYPE_P2P_CLIENT:
5352         case NL80211_IFTYPE_STATION:
5353         case NL80211_IFTYPE_ADHOC:
5354         case NL80211_IFTYPE_MESH_POINT:
5355                 break;
5356         default:
5357                 err = -EOPNOTSUPP;
5358                 goto out_put_vlan;
5359         }
5360
5361         /* driver will call cfg80211_check_station_change() */
5362         err = rdev_change_station(rdev, dev, mac_addr, &params);
5363
5364  out_put_vlan:
5365         if (params.vlan)
5366                 dev_put(params.vlan);
5367
5368         return err;
5369 }
5370
5371 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5372 {
5373         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5374         int err;
5375         struct net_device *dev = info->user_ptr[1];
5376         struct station_parameters params;
5377         u8 *mac_addr = NULL;
5378         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5379                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5380
5381         memset(&params, 0, sizeof(params));
5382
5383         if (!rdev->ops->add_station)
5384                 return -EOPNOTSUPP;
5385
5386         if (!info->attrs[NL80211_ATTR_MAC])
5387                 return -EINVAL;
5388
5389         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5390                 return -EINVAL;
5391
5392         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5393                 return -EINVAL;
5394
5395         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5396             !info->attrs[NL80211_ATTR_PEER_AID])
5397                 return -EINVAL;
5398
5399         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5400         params.supported_rates =
5401                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5402         params.supported_rates_len =
5403                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5404         params.listen_interval =
5405                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5406
5407         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5408                 u8 tmp;
5409
5410                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5411                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5412                         return -EINVAL;
5413
5414                 params.support_p2p_ps = tmp;
5415         } else {
5416                 /*
5417                  * if not specified, assume it's supported for P2P GO interface,
5418                  * and is NOT supported for AP interface
5419                  */
5420                 params.support_p2p_ps =
5421                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5422         }
5423
5424         if (info->attrs[NL80211_ATTR_PEER_AID])
5425                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5426         else
5427                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5428         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5429                 return -EINVAL;
5430
5431         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5432                 params.capability =
5433                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5434                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5435         }
5436
5437         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5438                 params.ext_capab =
5439                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5440                 params.ext_capab_len =
5441                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5442         }
5443
5444         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5445                 params.ht_capa =
5446                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5447
5448         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5449                 params.vht_capa =
5450                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5451
5452         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5453                 params.he_capa =
5454                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5455                 params.he_capa_len =
5456                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5457
5458                 /* max len is validated in nla policy */
5459                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5460                         return -EINVAL;
5461         }
5462
5463         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5464                 params.opmode_notif_used = true;
5465                 params.opmode_notif =
5466                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5467         }
5468
5469         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5470                 params.plink_action =
5471                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5472                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5473                         return -EINVAL;
5474         }
5475
5476         err = nl80211_parse_sta_channel_info(info, &params);
5477         if (err)
5478                 return err;
5479
5480         err = nl80211_parse_sta_wme(info, &params);
5481         if (err)
5482                 return err;
5483
5484         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5485                 return -EINVAL;
5486
5487         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5488          * as userspace might just pass through the capabilities from the IEs
5489          * directly, rather than enforcing this restriction and returning an
5490          * error in this case.
5491          */
5492         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5493                 params.ht_capa = NULL;
5494                 params.vht_capa = NULL;
5495
5496                 /* HE requires WME */
5497                 if (params.he_capa_len)
5498                         return -EINVAL;
5499         }
5500
5501         /* When you run into this, adjust the code below for the new flag */
5502         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5503
5504         switch (dev->ieee80211_ptr->iftype) {
5505         case NL80211_IFTYPE_AP:
5506         case NL80211_IFTYPE_AP_VLAN:
5507         case NL80211_IFTYPE_P2P_GO:
5508                 /* ignore WME attributes if iface/sta is not capable */
5509                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5510                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5511                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5512
5513                 /* TDLS peers cannot be added */
5514                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5515                     info->attrs[NL80211_ATTR_PEER_AID])
5516                         return -EINVAL;
5517                 /* but don't bother the driver with it */
5518                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5519
5520                 /* allow authenticated/associated only if driver handles it */
5521                 if (!(rdev->wiphy.features &
5522                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5523                     params.sta_flags_mask & auth_assoc)
5524                         return -EINVAL;
5525
5526                 /* Older userspace, or userspace wanting to be compatible with
5527                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5528                  * and assoc flags in the mask, but assumes the station will be
5529                  * added as associated anyway since this was the required driver
5530                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5531                  * introduced.
5532                  * In order to not bother drivers with this quirk in the API
5533                  * set the flags in both the mask and set for new stations in
5534                  * this case.
5535                  */
5536                 if (!(params.sta_flags_mask & auth_assoc)) {
5537                         params.sta_flags_mask |= auth_assoc;
5538                         params.sta_flags_set |= auth_assoc;
5539                 }
5540
5541                 /* must be last in here for error handling */
5542                 params.vlan = get_vlan(info, rdev);
5543                 if (IS_ERR(params.vlan))
5544                         return PTR_ERR(params.vlan);
5545                 break;
5546         case NL80211_IFTYPE_MESH_POINT:
5547                 /* ignore uAPSD data */
5548                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5549
5550                 /* associated is disallowed */
5551                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5552                         return -EINVAL;
5553                 /* TDLS peers cannot be added */
5554                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5555                     info->attrs[NL80211_ATTR_PEER_AID])
5556                         return -EINVAL;
5557                 break;
5558         case NL80211_IFTYPE_STATION:
5559         case NL80211_IFTYPE_P2P_CLIENT:
5560                 /* ignore uAPSD data */
5561                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5562
5563                 /* these are disallowed */
5564                 if (params.sta_flags_mask &
5565                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5566                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5567                         return -EINVAL;
5568                 /* Only TDLS peers can be added */
5569                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5570                         return -EINVAL;
5571                 /* Can only add if TDLS ... */
5572                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5573                         return -EOPNOTSUPP;
5574                 /* ... with external setup is supported */
5575                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5576                         return -EOPNOTSUPP;
5577                 /*
5578                  * Older wpa_supplicant versions always mark the TDLS peer
5579                  * as authorized, but it shouldn't yet be.
5580                  */
5581                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5582                 break;
5583         default:
5584                 return -EOPNOTSUPP;
5585         }
5586
5587         /* be aware of params.vlan when changing code here */
5588
5589         err = rdev_add_station(rdev, dev, mac_addr, &params);
5590
5591         if (params.vlan)
5592                 dev_put(params.vlan);
5593         return err;
5594 }
5595
5596 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5597 {
5598         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5599         struct net_device *dev = info->user_ptr[1];
5600         struct station_del_parameters params;
5601
5602         memset(&params, 0, sizeof(params));
5603
5604         if (info->attrs[NL80211_ATTR_MAC])
5605                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5606
5607         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5608             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5609             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5610             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5611                 return -EINVAL;
5612
5613         if (!rdev->ops->del_station)
5614                 return -EOPNOTSUPP;
5615
5616         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5617                 params.subtype =
5618                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5619                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5620                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5621                         return -EINVAL;
5622         } else {
5623                 /* Default to Deauthentication frame */
5624                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5625         }
5626
5627         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5628                 params.reason_code =
5629                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5630                 if (params.reason_code == 0)
5631                         return -EINVAL; /* 0 is reserved */
5632         } else {
5633                 /* Default to reason code 2 */
5634                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5635         }
5636
5637         return rdev_del_station(rdev, dev, &params);
5638 }
5639
5640 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5641                                 int flags, struct net_device *dev,
5642                                 u8 *dst, u8 *next_hop,
5643                                 struct mpath_info *pinfo)
5644 {
5645         void *hdr;
5646         struct nlattr *pinfoattr;
5647
5648         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5649         if (!hdr)
5650                 return -1;
5651
5652         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5653             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5654             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5655             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5656                 goto nla_put_failure;
5657
5658         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5659         if (!pinfoattr)
5660                 goto nla_put_failure;
5661         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5662             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5663                         pinfo->frame_qlen))
5664                 goto nla_put_failure;
5665         if (((pinfo->filled & MPATH_INFO_SN) &&
5666              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5667             ((pinfo->filled & MPATH_INFO_METRIC) &&
5668              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5669                          pinfo->metric)) ||
5670             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5671              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5672                          pinfo->exptime)) ||
5673             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5674              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5675                         pinfo->flags)) ||
5676             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5677              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5678                          pinfo->discovery_timeout)) ||
5679             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5680              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5681                         pinfo->discovery_retries)))
5682                 goto nla_put_failure;
5683
5684         nla_nest_end(msg, pinfoattr);
5685
5686         genlmsg_end(msg, hdr);
5687         return 0;
5688
5689  nla_put_failure:
5690         genlmsg_cancel(msg, hdr);
5691         return -EMSGSIZE;
5692 }
5693
5694 static int nl80211_dump_mpath(struct sk_buff *skb,
5695                               struct netlink_callback *cb)
5696 {
5697         struct mpath_info pinfo;
5698         struct cfg80211_registered_device *rdev;
5699         struct wireless_dev *wdev;
5700         u8 dst[ETH_ALEN];
5701         u8 next_hop[ETH_ALEN];
5702         int path_idx = cb->args[2];
5703         int err;
5704
5705         rtnl_lock();
5706         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5707         if (err)
5708                 goto out_err;
5709
5710         if (!rdev->ops->dump_mpath) {
5711                 err = -EOPNOTSUPP;
5712                 goto out_err;
5713         }
5714
5715         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5716                 err = -EOPNOTSUPP;
5717                 goto out_err;
5718         }
5719
5720         while (1) {
5721                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5722                                       next_hop, &pinfo);
5723                 if (err == -ENOENT)
5724                         break;
5725                 if (err)
5726                         goto out_err;
5727
5728                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5729                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5730                                        wdev->netdev, dst, next_hop,
5731                                        &pinfo) < 0)
5732                         goto out;
5733
5734                 path_idx++;
5735         }
5736
5737  out:
5738         cb->args[2] = path_idx;
5739         err = skb->len;
5740  out_err:
5741         rtnl_unlock();
5742         return err;
5743 }
5744
5745 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5746 {
5747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5748         int err;
5749         struct net_device *dev = info->user_ptr[1];
5750         struct mpath_info pinfo;
5751         struct sk_buff *msg;
5752         u8 *dst = NULL;
5753         u8 next_hop[ETH_ALEN];
5754
5755         memset(&pinfo, 0, sizeof(pinfo));
5756
5757         if (!info->attrs[NL80211_ATTR_MAC])
5758                 return -EINVAL;
5759
5760         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5761
5762         if (!rdev->ops->get_mpath)
5763                 return -EOPNOTSUPP;
5764
5765         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5766                 return -EOPNOTSUPP;
5767
5768         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5769         if (err)
5770                 return err;
5771
5772         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5773         if (!msg)
5774                 return -ENOMEM;
5775
5776         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5777                                  dev, dst, next_hop, &pinfo) < 0) {
5778                 nlmsg_free(msg);
5779                 return -ENOBUFS;
5780         }
5781
5782         return genlmsg_reply(msg, info);
5783 }
5784
5785 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5786 {
5787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5788         struct net_device *dev = info->user_ptr[1];
5789         u8 *dst = NULL;
5790         u8 *next_hop = NULL;
5791
5792         if (!info->attrs[NL80211_ATTR_MAC])
5793                 return -EINVAL;
5794
5795         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5796                 return -EINVAL;
5797
5798         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5799         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5800
5801         if (!rdev->ops->change_mpath)
5802                 return -EOPNOTSUPP;
5803
5804         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5805                 return -EOPNOTSUPP;
5806
5807         return rdev_change_mpath(rdev, dev, dst, next_hop);
5808 }
5809
5810 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5811 {
5812         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5813         struct net_device *dev = info->user_ptr[1];
5814         u8 *dst = NULL;
5815         u8 *next_hop = NULL;
5816
5817         if (!info->attrs[NL80211_ATTR_MAC])
5818                 return -EINVAL;
5819
5820         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5821                 return -EINVAL;
5822
5823         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5824         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5825
5826         if (!rdev->ops->add_mpath)
5827                 return -EOPNOTSUPP;
5828
5829         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5830                 return -EOPNOTSUPP;
5831
5832         return rdev_add_mpath(rdev, dev, dst, next_hop);
5833 }
5834
5835 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5836 {
5837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5838         struct net_device *dev = info->user_ptr[1];
5839         u8 *dst = NULL;
5840
5841         if (info->attrs[NL80211_ATTR_MAC])
5842                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5843
5844         if (!rdev->ops->del_mpath)
5845                 return -EOPNOTSUPP;
5846
5847         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5848                 return -EOPNOTSUPP;
5849
5850         return rdev_del_mpath(rdev, dev, dst);
5851 }
5852
5853 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5854 {
5855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5856         int err;
5857         struct net_device *dev = info->user_ptr[1];
5858         struct mpath_info pinfo;
5859         struct sk_buff *msg;
5860         u8 *dst = NULL;
5861         u8 mpp[ETH_ALEN];
5862
5863         memset(&pinfo, 0, sizeof(pinfo));
5864
5865         if (!info->attrs[NL80211_ATTR_MAC])
5866                 return -EINVAL;
5867
5868         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5869
5870         if (!rdev->ops->get_mpp)
5871                 return -EOPNOTSUPP;
5872
5873         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5874                 return -EOPNOTSUPP;
5875
5876         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5877         if (err)
5878                 return err;
5879
5880         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5881         if (!msg)
5882                 return -ENOMEM;
5883
5884         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5885                                dev, dst, mpp, &pinfo) < 0) {
5886                 nlmsg_free(msg);
5887                 return -ENOBUFS;
5888         }
5889
5890         return genlmsg_reply(msg, info);
5891 }
5892
5893 static int nl80211_dump_mpp(struct sk_buff *skb,
5894                             struct netlink_callback *cb)
5895 {
5896         struct mpath_info pinfo;
5897         struct cfg80211_registered_device *rdev;
5898         struct wireless_dev *wdev;
5899         u8 dst[ETH_ALEN];
5900         u8 mpp[ETH_ALEN];
5901         int path_idx = cb->args[2];
5902         int err;
5903
5904         rtnl_lock();
5905         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5906         if (err)
5907                 goto out_err;
5908
5909         if (!rdev->ops->dump_mpp) {
5910                 err = -EOPNOTSUPP;
5911                 goto out_err;
5912         }
5913
5914         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5915                 err = -EOPNOTSUPP;
5916                 goto out_err;
5917         }
5918
5919         while (1) {
5920                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5921                                     mpp, &pinfo);
5922                 if (err == -ENOENT)
5923                         break;
5924                 if (err)
5925                         goto out_err;
5926
5927                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5928                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5929                                        wdev->netdev, dst, mpp,
5930                                        &pinfo) < 0)
5931                         goto out;
5932
5933                 path_idx++;
5934         }
5935
5936  out:
5937         cb->args[2] = path_idx;
5938         err = skb->len;
5939  out_err:
5940         rtnl_unlock();
5941         return err;
5942 }
5943
5944 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5945 {
5946         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5947         struct net_device *dev = info->user_ptr[1];
5948         struct wireless_dev *wdev = dev->ieee80211_ptr;
5949         struct bss_parameters params;
5950         int err;
5951
5952         memset(&params, 0, sizeof(params));
5953         /* default to not changing parameters */
5954         params.use_cts_prot = -1;
5955         params.use_short_preamble = -1;
5956         params.use_short_slot_time = -1;
5957         params.ap_isolate = -1;
5958         params.ht_opmode = -1;
5959         params.p2p_ctwindow = -1;
5960         params.p2p_opp_ps = -1;
5961
5962         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5963                 params.use_cts_prot =
5964                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5965         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5966                 params.use_short_preamble =
5967                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5968         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5969                 params.use_short_slot_time =
5970                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5971         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5972                 params.basic_rates =
5973                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5974                 params.basic_rates_len =
5975                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5976         }
5977         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5978                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5979         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5980                 params.ht_opmode =
5981                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5982
5983         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5984                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5985                         return -EINVAL;
5986                 params.p2p_ctwindow =
5987                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5988                 if (params.p2p_ctwindow < 0)
5989                         return -EINVAL;
5990                 if (params.p2p_ctwindow != 0 &&
5991                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5992                         return -EINVAL;
5993         }
5994
5995         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5996                 u8 tmp;
5997
5998                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5999                         return -EINVAL;
6000                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6001                 if (tmp > 1)
6002                         return -EINVAL;
6003                 params.p2p_opp_ps = tmp;
6004                 if (params.p2p_opp_ps &&
6005                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
6006                         return -EINVAL;
6007         }
6008
6009         if (!rdev->ops->change_bss)
6010                 return -EOPNOTSUPP;
6011
6012         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6013             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6014                 return -EOPNOTSUPP;
6015
6016         wdev_lock(wdev);
6017         err = rdev_change_bss(rdev, dev, &params);
6018         wdev_unlock(wdev);
6019
6020         return err;
6021 }
6022
6023 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
6024 {
6025         char *data = NULL;
6026         bool is_indoor;
6027         enum nl80211_user_reg_hint_type user_reg_hint_type;
6028         u32 owner_nlportid;
6029
6030         /*
6031          * You should only get this when cfg80211 hasn't yet initialized
6032          * completely when built-in to the kernel right between the time
6033          * window between nl80211_init() and regulatory_init(), if that is
6034          * even possible.
6035          */
6036         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
6037                 return -EINPROGRESS;
6038
6039         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
6040                 user_reg_hint_type =
6041                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
6042         else
6043                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6044
6045         switch (user_reg_hint_type) {
6046         case NL80211_USER_REG_HINT_USER:
6047         case NL80211_USER_REG_HINT_CELL_BASE:
6048                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6049                         return -EINVAL;
6050
6051                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6052                 return regulatory_hint_user(data, user_reg_hint_type);
6053         case NL80211_USER_REG_HINT_INDOOR:
6054                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6055                         owner_nlportid = info->snd_portid;
6056                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6057                 } else {
6058                         owner_nlportid = 0;
6059                         is_indoor = true;
6060                 }
6061
6062                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6063         default:
6064                 return -EINVAL;
6065         }
6066 }
6067
6068 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6069 {
6070         return reg_reload_regdb();
6071 }
6072
6073 static int nl80211_get_mesh_config(struct sk_buff *skb,
6074                                    struct genl_info *info)
6075 {
6076         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6077         struct net_device *dev = info->user_ptr[1];
6078         struct wireless_dev *wdev = dev->ieee80211_ptr;
6079         struct mesh_config cur_params;
6080         int err = 0;
6081         void *hdr;
6082         struct nlattr *pinfoattr;
6083         struct sk_buff *msg;
6084
6085         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6086                 return -EOPNOTSUPP;
6087
6088         if (!rdev->ops->get_mesh_config)
6089                 return -EOPNOTSUPP;
6090
6091         wdev_lock(wdev);
6092         /* If not connected, get default parameters */
6093         if (!wdev->mesh_id_len)
6094                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6095         else
6096                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6097         wdev_unlock(wdev);
6098
6099         if (err)
6100                 return err;
6101
6102         /* Draw up a netlink message to send back */
6103         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6104         if (!msg)
6105                 return -ENOMEM;
6106         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6107                              NL80211_CMD_GET_MESH_CONFIG);
6108         if (!hdr)
6109                 goto out;
6110         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6111         if (!pinfoattr)
6112                 goto nla_put_failure;
6113         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6114             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6115                         cur_params.dot11MeshRetryTimeout) ||
6116             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6117                         cur_params.dot11MeshConfirmTimeout) ||
6118             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6119                         cur_params.dot11MeshHoldingTimeout) ||
6120             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6121                         cur_params.dot11MeshMaxPeerLinks) ||
6122             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6123                        cur_params.dot11MeshMaxRetries) ||
6124             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6125                        cur_params.dot11MeshTTL) ||
6126             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6127                        cur_params.element_ttl) ||
6128             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6129                        cur_params.auto_open_plinks) ||
6130             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6131                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6132             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6133                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6134             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6135                         cur_params.path_refresh_time) ||
6136             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6137                         cur_params.min_discovery_timeout) ||
6138             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6139                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6140             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6141                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6142             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6143                         cur_params.dot11MeshHWMPperrMinInterval) ||
6144             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6145                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6146             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6147                        cur_params.dot11MeshHWMPRootMode) ||
6148             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6149                         cur_params.dot11MeshHWMPRannInterval) ||
6150             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6151                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6152             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6153                        cur_params.dot11MeshForwarding) ||
6154             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6155                         cur_params.rssi_threshold) ||
6156             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6157                         cur_params.ht_opmode) ||
6158             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6159                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6160             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6161                         cur_params.dot11MeshHWMProotInterval) ||
6162             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6163                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6164             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6165                         cur_params.power_mode) ||
6166             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6167                         cur_params.dot11MeshAwakeWindowDuration) ||
6168             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6169                         cur_params.plink_timeout))
6170                 goto nla_put_failure;
6171         nla_nest_end(msg, pinfoattr);
6172         genlmsg_end(msg, hdr);
6173         return genlmsg_reply(msg, info);
6174
6175  nla_put_failure:
6176  out:
6177         nlmsg_free(msg);
6178         return -ENOBUFS;
6179 }
6180
6181 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6182         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
6183         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
6184         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
6185         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
6186         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
6187         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
6188         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
6189         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
6190         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
6191         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6192         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6193         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
6194         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6195         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
6196         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
6197         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
6198         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
6199         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
6200         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
6201         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
6202         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
6203         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6204         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6205         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
6206         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
6207         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
6208         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6209         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6210 };
6211
6212 static const struct nla_policy
6213         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6214         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6215         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6216         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6217         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6218         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6219         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6220         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
6221                                     .len = IEEE80211_MAX_DATA_LEN },
6222         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6223 };
6224
6225 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
6226 {
6227         u8 val = nla_get_u8(nla);
6228         if (val < min || val > max)
6229                 return -EINVAL;
6230         *out = val;
6231         return 0;
6232 }
6233
6234 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
6235 {
6236         u8 val = nla_get_u8(nla);
6237         if (val < min || val > max)
6238                 return -EINVAL;
6239         *out = val;
6240         return 0;
6241 }
6242
6243 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
6244 {
6245         u16 val = nla_get_u16(nla);
6246         if (val < min || val > max)
6247                 return -EINVAL;
6248         *out = val;
6249         return 0;
6250 }
6251
6252 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
6253 {
6254         u32 val = nla_get_u32(nla);
6255         if (val < min || val > max)
6256                 return -EINVAL;
6257         *out = val;
6258         return 0;
6259 }
6260
6261 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
6262 {
6263         s32 val = nla_get_s32(nla);
6264         if (val < min || val > max)
6265                 return -EINVAL;
6266         *out = val;
6267         return 0;
6268 }
6269
6270 static int nl80211_check_power_mode(const struct nlattr *nla,
6271                                     enum nl80211_mesh_power_mode min,
6272                                     enum nl80211_mesh_power_mode max,
6273                                     enum nl80211_mesh_power_mode *out)
6274 {
6275         u32 val = nla_get_u32(nla);
6276         if (val < min || val > max)
6277                 return -EINVAL;
6278         *out = val;
6279         return 0;
6280 }
6281
6282 static int nl80211_parse_mesh_config(struct genl_info *info,
6283                                      struct mesh_config *cfg,
6284                                      u32 *mask_out)
6285 {
6286         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6287         u32 mask = 0;
6288         u16 ht_opmode;
6289
6290 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
6291 do {                                                                        \
6292         if (tb[attr]) {                                                     \
6293                 if (fn(tb[attr], min, max, &cfg->param))                    \
6294                         return -EINVAL;                                     \
6295                 mask |= (1 << (attr - 1));                                  \
6296         }                                                                   \
6297 } while (0)
6298
6299         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6300                 return -EINVAL;
6301         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6302                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6303                              nl80211_meshconf_params_policy, info->extack))
6304                 return -EINVAL;
6305
6306         /* This makes sure that there aren't more than 32 mesh config
6307          * parameters (otherwise our bitfield scheme would not work.) */
6308         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6309
6310         /* Fill in the params struct */
6311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
6312                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
6313                                   nl80211_check_u16);
6314         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
6315                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6316                                   nl80211_check_u16);
6317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
6318                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
6319                                   nl80211_check_u16);
6320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
6321                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
6322                                   nl80211_check_u16);
6323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
6324                                   mask, NL80211_MESHCONF_MAX_RETRIES,
6325                                   nl80211_check_u8);
6326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
6327                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
6328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
6329                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
6330                                   nl80211_check_u8);
6331         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
6332                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6333                                   nl80211_check_bool);
6334         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6335                                   1, 255, mask,
6336                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6337                                   nl80211_check_u32);
6338         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
6339                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6340                                   nl80211_check_u8);
6341         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
6342                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
6343                                   nl80211_check_u32);
6344         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
6345                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6346                                   nl80211_check_u16);
6347         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6348                                   1, 65535, mask,
6349                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6350                                   nl80211_check_u32);
6351         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
6352                                   1, 65535, mask,
6353                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6354                                   nl80211_check_u16);
6355         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
6356                                   1, 65535, mask,
6357                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6358                                   nl80211_check_u16);
6359         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6360                                   dot11MeshHWMPnetDiameterTraversalTime,
6361                                   1, 65535, mask,
6362                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6363                                   nl80211_check_u16);
6364         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
6365                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
6366                                   nl80211_check_u8);
6367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
6368                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6369                                   nl80211_check_u16);
6370         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6371                                   dot11MeshGateAnnouncementProtocol, 0, 1,
6372                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6373                                   nl80211_check_bool);
6374         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
6375                                   mask, NL80211_MESHCONF_FORWARDING,
6376                                   nl80211_check_bool);
6377         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6378                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6379                                   nl80211_check_s32);
6380         /*
6381          * Check HT operation mode based on
6382          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6383          */
6384         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6385                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6386
6387                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6388                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6389                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6390                         return -EINVAL;
6391
6392                 /* NON_HT_STA bit is reserved, but some programs set it */
6393                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6394
6395                 cfg->ht_opmode = ht_opmode;
6396                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6397         }
6398         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6399                                   1, 65535, mask,
6400                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6401                                   nl80211_check_u32);
6402         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6403                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6404                                   nl80211_check_u16);
6405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6406                                   dot11MeshHWMPconfirmationInterval,
6407                                   1, 65535, mask,
6408                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6409                                   nl80211_check_u16);
6410         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6411                                   NL80211_MESH_POWER_ACTIVE,
6412                                   NL80211_MESH_POWER_MAX,
6413                                   mask, NL80211_MESHCONF_POWER_MODE,
6414                                   nl80211_check_power_mode);
6415         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6416                                   0, 65535, mask,
6417                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6418         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6419                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6420                                   nl80211_check_u32);
6421         if (mask_out)
6422                 *mask_out = mask;
6423
6424         return 0;
6425
6426 #undef FILL_IN_MESH_PARAM_IF_SET
6427 }
6428
6429 static int nl80211_parse_mesh_setup(struct genl_info *info,
6430                                      struct mesh_setup *setup)
6431 {
6432         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6433         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6434
6435         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6436                 return -EINVAL;
6437         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6438                              info->attrs[NL80211_ATTR_MESH_SETUP],
6439                              nl80211_mesh_setup_params_policy, info->extack))
6440                 return -EINVAL;
6441
6442         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6443                 setup->sync_method =
6444                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6445                  IEEE80211_SYNC_METHOD_VENDOR :
6446                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6447
6448         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6449                 setup->path_sel_proto =
6450                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6451                  IEEE80211_PATH_PROTOCOL_VENDOR :
6452                  IEEE80211_PATH_PROTOCOL_HWMP;
6453
6454         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6455                 setup->path_metric =
6456                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6457                  IEEE80211_PATH_METRIC_VENDOR :
6458                  IEEE80211_PATH_METRIC_AIRTIME;
6459
6460         if (tb[NL80211_MESH_SETUP_IE]) {
6461                 struct nlattr *ieattr =
6462                         tb[NL80211_MESH_SETUP_IE];
6463                 if (!is_valid_ie_attr(ieattr))
6464                         return -EINVAL;
6465                 setup->ie = nla_data(ieattr);
6466                 setup->ie_len = nla_len(ieattr);
6467         }
6468         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6469             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6470                 return -EINVAL;
6471         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6472         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6473         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6474         if (setup->is_secure)
6475                 setup->user_mpm = true;
6476
6477         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6478                 if (!setup->user_mpm)
6479                         return -EINVAL;
6480                 setup->auth_id =
6481                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6482         }
6483
6484         return 0;
6485 }
6486
6487 static int nl80211_update_mesh_config(struct sk_buff *skb,
6488                                       struct genl_info *info)
6489 {
6490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6491         struct net_device *dev = info->user_ptr[1];
6492         struct wireless_dev *wdev = dev->ieee80211_ptr;
6493         struct mesh_config cfg;
6494         u32 mask;
6495         int err;
6496
6497         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6498                 return -EOPNOTSUPP;
6499
6500         if (!rdev->ops->update_mesh_config)
6501                 return -EOPNOTSUPP;
6502
6503         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6504         if (err)
6505                 return err;
6506
6507         wdev_lock(wdev);
6508         if (!wdev->mesh_id_len)
6509                 err = -ENOLINK;
6510
6511         if (!err)
6512                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6513
6514         wdev_unlock(wdev);
6515
6516         return err;
6517 }
6518
6519 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6520                               struct sk_buff *msg)
6521 {
6522         struct nlattr *nl_reg_rules;
6523         unsigned int i;
6524
6525         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6526             (regdom->dfs_region &&
6527              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6528                 goto nla_put_failure;
6529
6530         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6531         if (!nl_reg_rules)
6532                 goto nla_put_failure;
6533
6534         for (i = 0; i < regdom->n_reg_rules; i++) {
6535                 struct nlattr *nl_reg_rule;
6536                 const struct ieee80211_reg_rule *reg_rule;
6537                 const struct ieee80211_freq_range *freq_range;
6538                 const struct ieee80211_power_rule *power_rule;
6539                 unsigned int max_bandwidth_khz;
6540
6541                 reg_rule = &regdom->reg_rules[i];
6542                 freq_range = &reg_rule->freq_range;
6543                 power_rule = &reg_rule->power_rule;
6544
6545                 nl_reg_rule = nla_nest_start(msg, i);
6546                 if (!nl_reg_rule)
6547                         goto nla_put_failure;
6548
6549                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6550                 if (!max_bandwidth_khz)
6551                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6552                                                                   reg_rule);
6553
6554                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6555                                 reg_rule->flags) ||
6556                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6557                                 freq_range->start_freq_khz) ||
6558                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6559                                 freq_range->end_freq_khz) ||
6560                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6561                                 max_bandwidth_khz) ||
6562                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6563                                 power_rule->max_antenna_gain) ||
6564                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6565                                 power_rule->max_eirp) ||
6566                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6567                                 reg_rule->dfs_cac_ms))
6568                         goto nla_put_failure;
6569
6570                 nla_nest_end(msg, nl_reg_rule);
6571         }
6572
6573         nla_nest_end(msg, nl_reg_rules);
6574         return 0;
6575
6576 nla_put_failure:
6577         return -EMSGSIZE;
6578 }
6579
6580 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6581 {
6582         const struct ieee80211_regdomain *regdom = NULL;
6583         struct cfg80211_registered_device *rdev;
6584         struct wiphy *wiphy = NULL;
6585         struct sk_buff *msg;
6586         void *hdr;
6587
6588         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6589         if (!msg)
6590                 return -ENOBUFS;
6591
6592         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6593                              NL80211_CMD_GET_REG);
6594         if (!hdr)
6595                 goto put_failure;
6596
6597         if (info->attrs[NL80211_ATTR_WIPHY]) {
6598                 bool self_managed;
6599
6600                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6601                 if (IS_ERR(rdev)) {
6602                         nlmsg_free(msg);
6603                         return PTR_ERR(rdev);
6604                 }
6605
6606                 wiphy = &rdev->wiphy;
6607                 self_managed = wiphy->regulatory_flags &
6608                                REGULATORY_WIPHY_SELF_MANAGED;
6609                 regdom = get_wiphy_regdom(wiphy);
6610
6611                 /* a self-managed-reg device must have a private regdom */
6612                 if (WARN_ON(!regdom && self_managed)) {
6613                         nlmsg_free(msg);
6614                         return -EINVAL;
6615                 }
6616
6617                 if (regdom &&
6618                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6619                         goto nla_put_failure;
6620         }
6621
6622         if (!wiphy && reg_last_request_cell_base() &&
6623             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6624                         NL80211_USER_REG_HINT_CELL_BASE))
6625                 goto nla_put_failure;
6626
6627         rcu_read_lock();
6628
6629         if (!regdom)
6630                 regdom = rcu_dereference(cfg80211_regdomain);
6631
6632         if (nl80211_put_regdom(regdom, msg))
6633                 goto nla_put_failure_rcu;
6634
6635         rcu_read_unlock();
6636
6637         genlmsg_end(msg, hdr);
6638         return genlmsg_reply(msg, info);
6639
6640 nla_put_failure_rcu:
6641         rcu_read_unlock();
6642 nla_put_failure:
6643 put_failure:
6644         nlmsg_free(msg);
6645         return -EMSGSIZE;
6646 }
6647
6648 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6649                                u32 seq, int flags, struct wiphy *wiphy,
6650                                const struct ieee80211_regdomain *regdom)
6651 {
6652         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6653                                    NL80211_CMD_GET_REG);
6654
6655         if (!hdr)
6656                 return -1;
6657
6658         genl_dump_check_consistent(cb, hdr);
6659
6660         if (nl80211_put_regdom(regdom, msg))
6661                 goto nla_put_failure;
6662
6663         if (!wiphy && reg_last_request_cell_base() &&
6664             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6665                         NL80211_USER_REG_HINT_CELL_BASE))
6666                 goto nla_put_failure;
6667
6668         if (wiphy &&
6669             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6670                 goto nla_put_failure;
6671
6672         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6673             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6674                 goto nla_put_failure;
6675
6676         genlmsg_end(msg, hdr);
6677         return 0;
6678
6679 nla_put_failure:
6680         genlmsg_cancel(msg, hdr);
6681         return -EMSGSIZE;
6682 }
6683
6684 static int nl80211_get_reg_dump(struct sk_buff *skb,
6685                                 struct netlink_callback *cb)
6686 {
6687         const struct ieee80211_regdomain *regdom = NULL;
6688         struct cfg80211_registered_device *rdev;
6689         int err, reg_idx, start = cb->args[2];
6690
6691         rtnl_lock();
6692
6693         if (cfg80211_regdomain && start == 0) {
6694                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6695                                           NLM_F_MULTI, NULL,
6696                                           rtnl_dereference(cfg80211_regdomain));
6697                 if (err < 0)
6698                         goto out_err;
6699         }
6700
6701         /* the global regdom is idx 0 */
6702         reg_idx = 1;
6703         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6704                 regdom = get_wiphy_regdom(&rdev->wiphy);
6705                 if (!regdom)
6706                         continue;
6707
6708                 if (++reg_idx <= start)
6709                         continue;
6710
6711                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6712                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6713                 if (err < 0) {
6714                         reg_idx--;
6715                         break;
6716                 }
6717         }
6718
6719         cb->args[2] = reg_idx;
6720         err = skb->len;
6721 out_err:
6722         rtnl_unlock();
6723         return err;
6724 }
6725
6726 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6727 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6728         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6729         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6730         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6731         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6732         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6733         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6734         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6735 };
6736
6737 static int parse_reg_rule(struct nlattr *tb[],
6738         struct ieee80211_reg_rule *reg_rule)
6739 {
6740         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6741         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6742
6743         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6744                 return -EINVAL;
6745         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6746                 return -EINVAL;
6747         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6748                 return -EINVAL;
6749         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6750                 return -EINVAL;
6751         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6752                 return -EINVAL;
6753
6754         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6755
6756         freq_range->start_freq_khz =
6757                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6758         freq_range->end_freq_khz =
6759                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6760         freq_range->max_bandwidth_khz =
6761                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6762
6763         power_rule->max_eirp =
6764                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6765
6766         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6767                 power_rule->max_antenna_gain =
6768                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6769
6770         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6771                 reg_rule->dfs_cac_ms =
6772                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6773
6774         return 0;
6775 }
6776
6777 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6778 {
6779         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6780         struct nlattr *nl_reg_rule;
6781         char *alpha2;
6782         int rem_reg_rules, r;
6783         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6784         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6785         struct ieee80211_regdomain *rd;
6786
6787         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6788                 return -EINVAL;
6789
6790         if (!info->attrs[NL80211_ATTR_REG_RULES])
6791                 return -EINVAL;
6792
6793         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6794
6795         if (info->attrs[NL80211_ATTR_DFS_REGION])
6796                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6797
6798         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6799                             rem_reg_rules) {
6800                 num_rules++;
6801                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6802                         return -EINVAL;
6803         }
6804
6805         if (!reg_is_valid_request(alpha2))
6806                 return -EINVAL;
6807
6808         size_of_regd = sizeof(struct ieee80211_regdomain) +
6809                        num_rules * sizeof(struct ieee80211_reg_rule);
6810
6811         rd = kzalloc(size_of_regd, GFP_KERNEL);
6812         if (!rd)
6813                 return -ENOMEM;
6814
6815         rd->n_reg_rules = num_rules;
6816         rd->alpha2[0] = alpha2[0];
6817         rd->alpha2[1] = alpha2[1];
6818
6819         /*
6820          * Disable DFS master mode if the DFS region was
6821          * not supported or known on this kernel.
6822          */
6823         if (reg_supported_dfs_region(dfs_region))
6824                 rd->dfs_region = dfs_region;
6825
6826         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6827                             rem_reg_rules) {
6828                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6829                                      nl_reg_rule, reg_rule_policy,
6830                                      info->extack);
6831                 if (r)
6832                         goto bad_reg;
6833                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6834                 if (r)
6835                         goto bad_reg;
6836
6837                 rule_idx++;
6838
6839                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6840                         r = -EINVAL;
6841                         goto bad_reg;
6842                 }
6843         }
6844
6845         /* set_regdom takes ownership of rd */
6846         return set_regdom(rd, REGD_SOURCE_CRDA);
6847  bad_reg:
6848         kfree(rd);
6849         return r;
6850 }
6851 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6852
6853 static int validate_scan_freqs(struct nlattr *freqs)
6854 {
6855         struct nlattr *attr1, *attr2;
6856         int n_channels = 0, tmp1, tmp2;
6857
6858         nla_for_each_nested(attr1, freqs, tmp1)
6859                 if (nla_len(attr1) != sizeof(u32))
6860                         return 0;
6861
6862         nla_for_each_nested(attr1, freqs, tmp1) {
6863                 n_channels++;
6864                 /*
6865                  * Some hardware has a limited channel list for
6866                  * scanning, and it is pretty much nonsensical
6867                  * to scan for a channel twice, so disallow that
6868                  * and don't require drivers to check that the
6869                  * channel list they get isn't longer than what
6870                  * they can scan, as long as they can scan all
6871                  * the channels they registered at once.
6872                  */
6873                 nla_for_each_nested(attr2, freqs, tmp2)
6874                         if (attr1 != attr2 &&
6875                             nla_get_u32(attr1) == nla_get_u32(attr2))
6876                                 return 0;
6877         }
6878
6879         return n_channels;
6880 }
6881
6882 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6883 {
6884         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6885 }
6886
6887 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6888                             struct cfg80211_bss_selection *bss_select)
6889 {
6890         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6891         struct nlattr *nest;
6892         int err;
6893         bool found = false;
6894         int i;
6895
6896         /* only process one nested attribute */
6897         nest = nla_data(nla);
6898         if (!nla_ok(nest, nla_len(nest)))
6899                 return -EINVAL;
6900
6901         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6902                                nl80211_bss_select_policy, NULL);
6903         if (err)
6904                 return err;
6905
6906         /* only one attribute may be given */
6907         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6908                 if (attr[i]) {
6909                         if (found)
6910                                 return -EINVAL;
6911                         found = true;
6912                 }
6913         }
6914
6915         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6916
6917         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6918                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6919
6920         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6921                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6922                 bss_select->param.band_pref =
6923                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6924                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6925                         return -EINVAL;
6926         }
6927
6928         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6929                 struct nl80211_bss_select_rssi_adjust *adj_param;
6930
6931                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6932                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6933                 bss_select->param.adjust.band = adj_param->band;
6934                 bss_select->param.adjust.delta = adj_param->delta;
6935                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6936                         return -EINVAL;
6937         }
6938
6939         /* user-space did not provide behaviour attribute */
6940         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6941                 return -EINVAL;
6942
6943         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6944                 return -EINVAL;
6945
6946         return 0;
6947 }
6948
6949 static int nl80211_parse_random_mac(struct nlattr **attrs,
6950                                     u8 *mac_addr, u8 *mac_addr_mask)
6951 {
6952         int i;
6953
6954         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6955                 eth_zero_addr(mac_addr);
6956                 eth_zero_addr(mac_addr_mask);
6957                 mac_addr[0] = 0x2;
6958                 mac_addr_mask[0] = 0x3;
6959
6960                 return 0;
6961         }
6962
6963         /* need both or none */
6964         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6965                 return -EINVAL;
6966
6967         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6968         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6969
6970         /* don't allow or configure an mcast address */
6971         if (!is_multicast_ether_addr(mac_addr_mask) ||
6972             is_multicast_ether_addr(mac_addr))
6973                 return -EINVAL;
6974
6975         /*
6976          * allow users to pass a MAC address that has bits set outside
6977          * of the mask, but don't bother drivers with having to deal
6978          * with such bits
6979          */
6980         for (i = 0; i < ETH_ALEN; i++)
6981                 mac_addr[i] &= mac_addr_mask[i];
6982
6983         return 0;
6984 }
6985
6986 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6987 {
6988         ASSERT_WDEV_LOCK(wdev);
6989
6990         if (!cfg80211_beaconing_iface_active(wdev))
6991                 return true;
6992
6993         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6994                 return true;
6995
6996         return regulatory_pre_cac_allowed(wdev->wiphy);
6997 }
6998
6999 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
7000                                     enum nl80211_ext_feature_index feat)
7001 {
7002         if (!(flags & flag))
7003                 return true;
7004         if (wiphy_ext_feature_isset(wiphy, feat))
7005                 return true;
7006         return false;
7007 }
7008
7009 static int
7010 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
7011                          void *request, struct nlattr **attrs,
7012                          bool is_sched_scan)
7013 {
7014         u8 *mac_addr, *mac_addr_mask;
7015         u32 *flags;
7016         enum nl80211_feature_flags randomness_flag;
7017
7018         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
7019                 return 0;
7020
7021         if (is_sched_scan) {
7022                 struct cfg80211_sched_scan_request *req = request;
7023
7024                 randomness_flag = wdev ?
7025                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
7026                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
7027                 flags = &req->flags;
7028                 mac_addr = req->mac_addr;
7029                 mac_addr_mask = req->mac_addr_mask;
7030         } else {
7031                 struct cfg80211_scan_request *req = request;
7032
7033                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
7034                 flags = &req->flags;
7035                 mac_addr = req->mac_addr;
7036                 mac_addr_mask = req->mac_addr_mask;
7037         }
7038
7039         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
7040
7041         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
7042              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
7043             !nl80211_check_scan_feat(wiphy, *flags,
7044                                      NL80211_SCAN_FLAG_LOW_SPAN,
7045                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
7046             !nl80211_check_scan_feat(wiphy, *flags,
7047                                      NL80211_SCAN_FLAG_LOW_POWER,
7048                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
7049             !nl80211_check_scan_feat(wiphy, *flags,
7050                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
7051                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
7052             !nl80211_check_scan_feat(wiphy, *flags,
7053                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
7054                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
7055             !nl80211_check_scan_feat(wiphy, *flags,
7056                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
7057                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
7058             !nl80211_check_scan_feat(wiphy, *flags,
7059                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
7060                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
7061             !nl80211_check_scan_feat(wiphy, *flags,
7062                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
7063                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
7064             !nl80211_check_scan_feat(wiphy, *flags,
7065                                      NL80211_SCAN_FLAG_RANDOM_SN,
7066                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
7067             !nl80211_check_scan_feat(wiphy, *flags,
7068                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
7069                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
7070                 return -EOPNOTSUPP;
7071
7072         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
7073                 int err;
7074
7075                 if (!(wiphy->features & randomness_flag) ||
7076                     (wdev && wdev->current_bss))
7077                         return -EOPNOTSUPP;
7078
7079                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
7080                 if (err)
7081                         return err;
7082         }
7083
7084         return 0;
7085 }
7086
7087 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
7088 {
7089         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7090         struct wireless_dev *wdev = info->user_ptr[1];
7091         struct cfg80211_scan_request *request;
7092         struct nlattr *attr;
7093         struct wiphy *wiphy;
7094         int err, tmp, n_ssids = 0, n_channels, i;
7095         size_t ie_len;
7096
7097         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
7098                 return -EINVAL;
7099
7100         wiphy = &rdev->wiphy;
7101
7102         if (wdev->iftype == NL80211_IFTYPE_NAN)
7103                 return -EOPNOTSUPP;
7104
7105         if (!rdev->ops->scan)
7106                 return -EOPNOTSUPP;
7107
7108         if (rdev->scan_req || rdev->scan_msg) {
7109                 err = -EBUSY;
7110                 goto unlock;
7111         }
7112
7113         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7114                 n_channels = validate_scan_freqs(
7115                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7116                 if (!n_channels) {
7117                         err = -EINVAL;
7118                         goto unlock;
7119                 }
7120         } else {
7121                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7122         }
7123
7124         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7125                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7126                         n_ssids++;
7127
7128         if (n_ssids > wiphy->max_scan_ssids) {
7129                 err = -EINVAL;
7130                 goto unlock;
7131         }
7132
7133         if (info->attrs[NL80211_ATTR_IE])
7134                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7135         else
7136                 ie_len = 0;
7137
7138         if (ie_len > wiphy->max_scan_ie_len) {
7139                 err = -EINVAL;
7140                 goto unlock;
7141         }
7142
7143         request = kzalloc(sizeof(*request)
7144                         + sizeof(*request->ssids) * n_ssids
7145                         + sizeof(*request->channels) * n_channels
7146                         + ie_len, GFP_KERNEL);
7147         if (!request) {
7148                 err = -ENOMEM;
7149                 goto unlock;
7150         }
7151
7152         if (n_ssids)
7153                 request->ssids = (void *)&request->channels[n_channels];
7154         request->n_ssids = n_ssids;
7155         if (ie_len) {
7156                 if (n_ssids)
7157                         request->ie = (void *)(request->ssids + n_ssids);
7158                 else
7159                         request->ie = (void *)(request->channels + n_channels);
7160         }
7161
7162         i = 0;
7163         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7164                 /* user specified, bail out if channel not found */
7165                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7166                         struct ieee80211_channel *chan;
7167
7168                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7169
7170                         if (!chan) {
7171                                 err = -EINVAL;
7172                                 goto out_free;
7173                         }
7174
7175                         /* ignore disabled channels */
7176                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7177                                 continue;
7178
7179                         request->channels[i] = chan;
7180                         i++;
7181                 }
7182         } else {
7183                 enum nl80211_band band;
7184
7185                 /* all channels */
7186                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7187                         int j;
7188
7189                         if (!wiphy->bands[band])
7190                                 continue;
7191                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7192                                 struct ieee80211_channel *chan;
7193
7194                                 chan = &wiphy->bands[band]->channels[j];
7195
7196                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7197                                         continue;
7198
7199                                 request->channels[i] = chan;
7200                                 i++;
7201                         }
7202                 }
7203         }
7204
7205         if (!i) {
7206                 err = -EINVAL;
7207                 goto out_free;
7208         }
7209
7210         request->n_channels = i;
7211
7212         wdev_lock(wdev);
7213         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7214                 struct ieee80211_channel *chan;
7215
7216                 if (request->n_channels != 1) {
7217                         wdev_unlock(wdev);
7218                         err = -EBUSY;
7219                         goto out_free;
7220                 }
7221
7222                 chan = request->channels[0];
7223                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7224                         wdev_unlock(wdev);
7225                         err = -EBUSY;
7226                         goto out_free;
7227                 }
7228         }
7229         wdev_unlock(wdev);
7230
7231         i = 0;
7232         if (n_ssids) {
7233                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7234                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7235                                 err = -EINVAL;
7236                                 goto out_free;
7237                         }
7238                         request->ssids[i].ssid_len = nla_len(attr);
7239                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7240                         i++;
7241                 }
7242         }
7243
7244         if (info->attrs[NL80211_ATTR_IE]) {
7245                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7246                 memcpy((void *)request->ie,
7247                        nla_data(info->attrs[NL80211_ATTR_IE]),
7248                        request->ie_len);
7249         }
7250
7251         for (i = 0; i < NUM_NL80211_BANDS; i++)
7252                 if (wiphy->bands[i])
7253                         request->rates[i] =
7254                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7255
7256         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7257                 nla_for_each_nested(attr,
7258                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7259                                     tmp) {
7260                         enum nl80211_band band = nla_type(attr);
7261
7262                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7263                                 err = -EINVAL;
7264                                 goto out_free;
7265                         }
7266
7267                         if (!wiphy->bands[band])
7268                                 continue;
7269
7270                         err = ieee80211_get_ratemask(wiphy->bands[band],
7271                                                      nla_data(attr),
7272                                                      nla_len(attr),
7273                                                      &request->rates[band]);
7274                         if (err)
7275                                 goto out_free;
7276                 }
7277         }
7278
7279         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7280                 if (!wiphy_ext_feature_isset(wiphy,
7281                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7282                         err = -EOPNOTSUPP;
7283                         goto out_free;
7284                 }
7285
7286                 request->duration =
7287                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7288                 request->duration_mandatory =
7289                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7290         }
7291
7292         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7293                                        false);
7294         if (err)
7295                 goto out_free;
7296
7297         request->no_cck =
7298                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7299
7300         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7301          * BSSID to scan for. This was problematic because that same attribute
7302          * was already used for another purpose (local random MAC address). The
7303          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7304          * compatibility with older userspace components, also use the
7305          * NL80211_ATTR_MAC value here if it can be determined to be used for
7306          * the specific BSSID use case instead of the random MAC address
7307          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7308          */
7309         if (info->attrs[NL80211_ATTR_BSSID])
7310                 memcpy(request->bssid,
7311                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7312         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7313                  info->attrs[NL80211_ATTR_MAC])
7314                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7315                        ETH_ALEN);
7316         else
7317                 eth_broadcast_addr(request->bssid);
7318
7319         request->wdev = wdev;
7320         request->wiphy = &rdev->wiphy;
7321         request->scan_start = jiffies;
7322
7323         rdev->scan_req = request;
7324         err = rdev_scan(rdev, request);
7325
7326         if (!err) {
7327                 nl80211_send_scan_start(rdev, wdev);
7328                 if (wdev->netdev)
7329                         dev_hold(wdev->netdev);
7330         } else {
7331  out_free:
7332                 rdev->scan_req = NULL;
7333                 kfree(request);
7334         }
7335
7336  unlock:
7337         return err;
7338 }
7339
7340 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7341 {
7342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7343         struct wireless_dev *wdev = info->user_ptr[1];
7344
7345         if (!rdev->ops->abort_scan)
7346                 return -EOPNOTSUPP;
7347
7348         if (rdev->scan_msg)
7349                 return 0;
7350
7351         if (!rdev->scan_req)
7352                 return -ENOENT;
7353
7354         rdev_abort_scan(rdev, wdev);
7355         return 0;
7356 }
7357
7358 static int
7359 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7360                                struct cfg80211_sched_scan_request *request,
7361                                struct nlattr **attrs)
7362 {
7363         int tmp, err, i = 0;
7364         struct nlattr *attr;
7365
7366         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7367                 u32 interval;
7368
7369                 /*
7370                  * If scan plans are not specified,
7371                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7372                  * case one scan plan will be set with the specified scan
7373                  * interval and infinite number of iterations.
7374                  */
7375                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7376                 if (!interval)
7377                         return -EINVAL;
7378
7379                 request->scan_plans[0].interval =
7380                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7381                 if (!request->scan_plans[0].interval)
7382                         return -EINVAL;
7383
7384                 if (request->scan_plans[0].interval >
7385                     wiphy->max_sched_scan_plan_interval)
7386                         request->scan_plans[0].interval =
7387                                 wiphy->max_sched_scan_plan_interval;
7388
7389                 return 0;
7390         }
7391
7392         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7393                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7394
7395                 if (WARN_ON(i >= n_plans))
7396                         return -EINVAL;
7397
7398                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7399                                        attr, nl80211_plan_policy, NULL);
7400                 if (err)
7401                         return err;
7402
7403                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7404                         return -EINVAL;
7405
7406                 request->scan_plans[i].interval =
7407                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7408                 if (!request->scan_plans[i].interval ||
7409                     request->scan_plans[i].interval >
7410                     wiphy->max_sched_scan_plan_interval)
7411                         return -EINVAL;
7412
7413                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7414                         request->scan_plans[i].iterations =
7415                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7416                         if (!request->scan_plans[i].iterations ||
7417                             (request->scan_plans[i].iterations >
7418                              wiphy->max_sched_scan_plan_iterations))
7419                                 return -EINVAL;
7420                 } else if (i < n_plans - 1) {
7421                         /*
7422                          * All scan plans but the last one must specify
7423                          * a finite number of iterations
7424                          */
7425                         return -EINVAL;
7426                 }
7427
7428                 i++;
7429         }
7430
7431         /*
7432          * The last scan plan must not specify the number of
7433          * iterations, it is supposed to run infinitely
7434          */
7435         if (request->scan_plans[n_plans - 1].iterations)
7436                 return  -EINVAL;
7437
7438         return 0;
7439 }
7440
7441 static struct cfg80211_sched_scan_request *
7442 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7443                          struct nlattr **attrs, int max_match_sets)
7444 {
7445         struct cfg80211_sched_scan_request *request;
7446         struct nlattr *attr;
7447         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7448         enum nl80211_band band;
7449         size_t ie_len;
7450         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7451         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7452
7453         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7454                 return ERR_PTR(-EINVAL);
7455
7456         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7457                 n_channels = validate_scan_freqs(
7458                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7459                 if (!n_channels)
7460                         return ERR_PTR(-EINVAL);
7461         } else {
7462                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7463         }
7464
7465         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7466                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7467                                     tmp)
7468                         n_ssids++;
7469
7470         if (n_ssids > wiphy->max_sched_scan_ssids)
7471                 return ERR_PTR(-EINVAL);
7472
7473         /*
7474          * First, count the number of 'real' matchsets. Due to an issue with
7475          * the old implementation, matchsets containing only the RSSI attribute
7476          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7477          * RSSI for all matchsets, rather than their own matchset for reporting
7478          * all APs with a strong RSSI. This is needed to be compatible with
7479          * older userspace that treated a matchset with only the RSSI as the
7480          * global RSSI for all other matchsets - if there are other matchsets.
7481          */
7482         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7483                 nla_for_each_nested(attr,
7484                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7485                                     tmp) {
7486                         struct nlattr *rssi;
7487
7488                         err = nla_parse_nested(tb,
7489                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7490                                                attr, nl80211_match_policy,
7491                                                NULL);
7492                         if (err)
7493                                 return ERR_PTR(err);
7494
7495                         /* SSID and BSSID are mutually exclusive */
7496                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7497                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7498                                 return ERR_PTR(-EINVAL);
7499
7500                         /* add other standalone attributes here */
7501                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7502                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7503                                 n_match_sets++;
7504                                 continue;
7505                         }
7506                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7507                         if (rssi)
7508                                 default_match_rssi = nla_get_s32(rssi);
7509                 }
7510         }
7511
7512         /* However, if there's no other matchset, add the RSSI one */
7513         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7514                 n_match_sets = 1;
7515
7516         if (n_match_sets > max_match_sets)
7517                 return ERR_PTR(-EINVAL);
7518
7519         if (attrs[NL80211_ATTR_IE])
7520                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7521         else
7522                 ie_len = 0;
7523
7524         if (ie_len > wiphy->max_sched_scan_ie_len)
7525                 return ERR_PTR(-EINVAL);
7526
7527         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7528                 /*
7529                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7530                  * each scan plan already specifies its own interval
7531                  */
7532                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7533                         return ERR_PTR(-EINVAL);
7534
7535                 nla_for_each_nested(attr,
7536                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7537                         n_plans++;
7538         } else {
7539                 /*
7540                  * The scan interval attribute is kept for backward
7541                  * compatibility. If no scan plans are specified and sched scan
7542                  * interval is specified, one scan plan will be set with this
7543                  * scan interval and infinite number of iterations.
7544                  */
7545                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7546                         return ERR_PTR(-EINVAL);
7547
7548                 n_plans = 1;
7549         }
7550
7551         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7552                 return ERR_PTR(-EINVAL);
7553
7554         if (!wiphy_ext_feature_isset(
7555                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7556             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7557              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7558                 return ERR_PTR(-EINVAL);
7559
7560         request = kzalloc(sizeof(*request)
7561                         + sizeof(*request->ssids) * n_ssids
7562                         + sizeof(*request->match_sets) * n_match_sets
7563                         + sizeof(*request->scan_plans) * n_plans
7564                         + sizeof(*request->channels) * n_channels
7565                         + ie_len, GFP_KERNEL);
7566         if (!request)
7567                 return ERR_PTR(-ENOMEM);
7568
7569         if (n_ssids)
7570                 request->ssids = (void *)&request->channels[n_channels];
7571         request->n_ssids = n_ssids;
7572         if (ie_len) {
7573                 if (n_ssids)
7574                         request->ie = (void *)(request->ssids + n_ssids);
7575                 else
7576                         request->ie = (void *)(request->channels + n_channels);
7577         }
7578
7579         if (n_match_sets) {
7580                 if (request->ie)
7581                         request->match_sets = (void *)(request->ie + ie_len);
7582                 else if (n_ssids)
7583                         request->match_sets =
7584                                 (void *)(request->ssids + n_ssids);
7585                 else
7586                         request->match_sets =
7587                                 (void *)(request->channels + n_channels);
7588         }
7589         request->n_match_sets = n_match_sets;
7590
7591         if (n_match_sets)
7592                 request->scan_plans = (void *)(request->match_sets +
7593                                                n_match_sets);
7594         else if (request->ie)
7595                 request->scan_plans = (void *)(request->ie + ie_len);
7596         else if (n_ssids)
7597                 request->scan_plans = (void *)(request->ssids + n_ssids);
7598         else
7599                 request->scan_plans = (void *)(request->channels + n_channels);
7600
7601         request->n_scan_plans = n_plans;
7602
7603         i = 0;
7604         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7605                 /* user specified, bail out if channel not found */
7606                 nla_for_each_nested(attr,
7607                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7608                                     tmp) {
7609                         struct ieee80211_channel *chan;
7610
7611                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7612
7613                         if (!chan) {
7614                                 err = -EINVAL;
7615                                 goto out_free;
7616                         }
7617
7618                         /* ignore disabled channels */
7619                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7620                                 continue;
7621
7622                         request->channels[i] = chan;
7623                         i++;
7624                 }
7625         } else {
7626                 /* all channels */
7627                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7628                         int j;
7629
7630                         if (!wiphy->bands[band])
7631                                 continue;
7632                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7633                                 struct ieee80211_channel *chan;
7634
7635                                 chan = &wiphy->bands[band]->channels[j];
7636
7637                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7638                                         continue;
7639
7640                                 request->channels[i] = chan;
7641                                 i++;
7642                         }
7643                 }
7644         }
7645
7646         if (!i) {
7647                 err = -EINVAL;
7648                 goto out_free;
7649         }
7650
7651         request->n_channels = i;
7652
7653         i = 0;
7654         if (n_ssids) {
7655                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7656                                     tmp) {
7657                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7658                                 err = -EINVAL;
7659                                 goto out_free;
7660                         }
7661                         request->ssids[i].ssid_len = nla_len(attr);
7662                         memcpy(request->ssids[i].ssid, nla_data(attr),
7663                                nla_len(attr));
7664                         i++;
7665                 }
7666         }
7667
7668         i = 0;
7669         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7670                 nla_for_each_nested(attr,
7671                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7672                                     tmp) {
7673                         struct nlattr *ssid, *bssid, *rssi;
7674
7675                         err = nla_parse_nested(tb,
7676                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7677                                                attr, nl80211_match_policy,
7678                                                NULL);
7679                         if (err)
7680                                 goto out_free;
7681                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7682                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7683                         if (ssid || bssid) {
7684                                 if (WARN_ON(i >= n_match_sets)) {
7685                                         /* this indicates a programming error,
7686                                          * the loop above should have verified
7687                                          * things properly
7688                                          */
7689                                         err = -EINVAL;
7690                                         goto out_free;
7691                                 }
7692
7693                                 if (ssid) {
7694                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7695                                                 err = -EINVAL;
7696                                                 goto out_free;
7697                                         }
7698                                         memcpy(request->match_sets[i].ssid.ssid,
7699                                                nla_data(ssid), nla_len(ssid));
7700                                         request->match_sets[i].ssid.ssid_len =
7701                                                 nla_len(ssid);
7702                                 }
7703                                 if (bssid) {
7704                                         if (nla_len(bssid) != ETH_ALEN) {
7705                                                 err = -EINVAL;
7706                                                 goto out_free;
7707                                         }
7708                                         memcpy(request->match_sets[i].bssid,
7709                                                nla_data(bssid), ETH_ALEN);
7710                                 }
7711
7712                                 /* special attribute - old implementation w/a */
7713                                 request->match_sets[i].rssi_thold =
7714                                         default_match_rssi;
7715                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7716                                 if (rssi)
7717                                         request->match_sets[i].rssi_thold =
7718                                                 nla_get_s32(rssi);
7719                         }
7720                         i++;
7721                 }
7722
7723                 /* there was no other matchset, so the RSSI one is alone */
7724                 if (i == 0 && n_match_sets)
7725                         request->match_sets[0].rssi_thold = default_match_rssi;
7726
7727                 request->min_rssi_thold = INT_MAX;
7728                 for (i = 0; i < n_match_sets; i++)
7729                         request->min_rssi_thold =
7730                                 min(request->match_sets[i].rssi_thold,
7731                                     request->min_rssi_thold);
7732         } else {
7733                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7734         }
7735
7736         if (ie_len) {
7737                 request->ie_len = ie_len;
7738                 memcpy((void *)request->ie,
7739                        nla_data(attrs[NL80211_ATTR_IE]),
7740                        request->ie_len);
7741         }
7742
7743         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7744         if (err)
7745                 goto out_free;
7746
7747         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7748                 request->delay =
7749                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7750
7751         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7752                 request->relative_rssi = nla_get_s8(
7753                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7754                 request->relative_rssi_set = true;
7755         }
7756
7757         if (request->relative_rssi_set &&
7758             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7759                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7760
7761                 rssi_adjust = nla_data(
7762                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7763                 request->rssi_adjust.band = rssi_adjust->band;
7764                 request->rssi_adjust.delta = rssi_adjust->delta;
7765                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7766                         err = -EINVAL;
7767                         goto out_free;
7768                 }
7769         }
7770
7771         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7772         if (err)
7773                 goto out_free;
7774
7775         request->scan_start = jiffies;
7776
7777         return request;
7778
7779 out_free:
7780         kfree(request);
7781         return ERR_PTR(err);
7782 }
7783
7784 static int nl80211_start_sched_scan(struct sk_buff *skb,
7785                                     struct genl_info *info)
7786 {
7787         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7788         struct net_device *dev = info->user_ptr[1];
7789         struct wireless_dev *wdev = dev->ieee80211_ptr;
7790         struct cfg80211_sched_scan_request *sched_scan_req;
7791         bool want_multi;
7792         int err;
7793
7794         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7795                 return -EOPNOTSUPP;
7796
7797         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7798         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7799         if (err)
7800                 return err;
7801
7802         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7803                                                   info->attrs,
7804                                                   rdev->wiphy.max_match_sets);
7805
7806         err = PTR_ERR_OR_ZERO(sched_scan_req);
7807         if (err)
7808                 goto out_err;
7809
7810         /* leave request id zero for legacy request
7811          * or if driver does not support multi-scheduled scan
7812          */
7813         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7814                 while (!sched_scan_req->reqid)
7815                         sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7816         }
7817
7818         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7819         if (err)
7820                 goto out_free;
7821
7822         sched_scan_req->dev = dev;
7823         sched_scan_req->wiphy = &rdev->wiphy;
7824
7825         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7826                 sched_scan_req->owner_nlportid = info->snd_portid;
7827
7828         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7829
7830         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7831         return 0;
7832
7833 out_free:
7834         kfree(sched_scan_req);
7835 out_err:
7836         return err;
7837 }
7838
7839 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7840                                    struct genl_info *info)
7841 {
7842         struct cfg80211_sched_scan_request *req;
7843         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7844         u64 cookie;
7845
7846         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7847                 return -EOPNOTSUPP;
7848
7849         if (info->attrs[NL80211_ATTR_COOKIE]) {
7850                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7851                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7852         }
7853
7854         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7855                                      struct cfg80211_sched_scan_request,
7856                                      list);
7857         if (!req || req->reqid ||
7858             (req->owner_nlportid &&
7859              req->owner_nlportid != info->snd_portid))
7860                 return -ENOENT;
7861
7862         return cfg80211_stop_sched_scan_req(rdev, req, false);
7863 }
7864
7865 static int nl80211_start_radar_detection(struct sk_buff *skb,
7866                                          struct genl_info *info)
7867 {
7868         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7869         struct net_device *dev = info->user_ptr[1];
7870         struct wireless_dev *wdev = dev->ieee80211_ptr;
7871         struct wiphy *wiphy = wdev->wiphy;
7872         struct cfg80211_chan_def chandef;
7873         enum nl80211_dfs_regions dfs_region;
7874         unsigned int cac_time_ms;
7875         int err;
7876
7877         dfs_region = reg_get_dfs_region(wiphy);
7878         if (dfs_region == NL80211_DFS_UNSET)
7879                 return -EINVAL;
7880
7881         err = nl80211_parse_chandef(rdev, info, &chandef);
7882         if (err)
7883                 return err;
7884
7885         if (netif_carrier_ok(dev))
7886                 return -EBUSY;
7887
7888         if (wdev->cac_started)
7889                 return -EBUSY;
7890
7891         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7892         if (err < 0)
7893                 return err;
7894
7895         if (err == 0)
7896                 return -EINVAL;
7897
7898         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7899                 return -EINVAL;
7900
7901         /* CAC start is offloaded to HW and can't be started manually */
7902         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7903                 return -EOPNOTSUPP;
7904
7905         if (!rdev->ops->start_radar_detection)
7906                 return -EOPNOTSUPP;
7907
7908         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7909         if (WARN_ON(!cac_time_ms))
7910                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7911
7912         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7913         if (!err) {
7914                 wdev->chandef = chandef;
7915                 wdev->cac_started = true;
7916                 wdev->cac_start_time = jiffies;
7917                 wdev->cac_time_ms = cac_time_ms;
7918         }
7919         return err;
7920 }
7921
7922 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7923 {
7924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7925         struct net_device *dev = info->user_ptr[1];
7926         struct wireless_dev *wdev = dev->ieee80211_ptr;
7927         struct cfg80211_csa_settings params;
7928         /* csa_attrs is defined static to avoid waste of stack size - this
7929          * function is called under RTNL lock, so this should not be a problem.
7930          */
7931         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7932         int err;
7933         bool need_new_beacon = false;
7934         bool need_handle_dfs_flag = true;
7935         int len, i;
7936         u32 cs_count;
7937
7938         if (!rdev->ops->channel_switch ||
7939             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7940                 return -EOPNOTSUPP;
7941
7942         switch (dev->ieee80211_ptr->iftype) {
7943         case NL80211_IFTYPE_AP:
7944         case NL80211_IFTYPE_P2P_GO:
7945                 need_new_beacon = true;
7946                 /* For all modes except AP the handle_dfs flag needs to be
7947                  * supplied to tell the kernel that userspace will handle radar
7948                  * events when they happen. Otherwise a switch to a channel
7949                  * requiring DFS will be rejected.
7950                  */
7951                 need_handle_dfs_flag = false;
7952
7953                 /* useless if AP is not running */
7954                 if (!wdev->beacon_interval)
7955                         return -ENOTCONN;
7956                 break;
7957         case NL80211_IFTYPE_ADHOC:
7958                 if (!wdev->ssid_len)
7959                         return -ENOTCONN;
7960                 break;
7961         case NL80211_IFTYPE_MESH_POINT:
7962                 if (!wdev->mesh_id_len)
7963                         return -ENOTCONN;
7964                 break;
7965         default:
7966                 return -EOPNOTSUPP;
7967         }
7968
7969         memset(&params, 0, sizeof(params));
7970
7971         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7972             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7973                 return -EINVAL;
7974
7975         /* only important for AP, IBSS and mesh create IEs internally */
7976         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7977                 return -EINVAL;
7978
7979         /* Even though the attribute is u32, the specification says
7980          * u8, so let's make sure we don't overflow.
7981          */
7982         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7983         if (cs_count > 255)
7984                 return -EINVAL;
7985
7986         params.count = cs_count;
7987
7988         if (!need_new_beacon)
7989                 goto skip_beacons;
7990
7991         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7992         if (err)
7993                 return err;
7994
7995         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7996                                info->attrs[NL80211_ATTR_CSA_IES],
7997                                nl80211_policy, info->extack);
7998         if (err)
7999                 return err;
8000
8001         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
8002         if (err)
8003                 return err;
8004
8005         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
8006                 return -EINVAL;
8007
8008         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8009         if (!len || (len % sizeof(u16)))
8010                 return -EINVAL;
8011
8012         params.n_counter_offsets_beacon = len / sizeof(u16);
8013         if (rdev->wiphy.max_num_csa_counters &&
8014             (params.n_counter_offsets_beacon >
8015              rdev->wiphy.max_num_csa_counters))
8016                 return -EINVAL;
8017
8018         params.counter_offsets_beacon =
8019                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
8020
8021         /* sanity checks - counters should fit and be the same */
8022         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
8023                 u16 offset = params.counter_offsets_beacon[i];
8024
8025                 if (offset >= params.beacon_csa.tail_len)
8026                         return -EINVAL;
8027
8028                 if (params.beacon_csa.tail[offset] != params.count)
8029                         return -EINVAL;
8030         }
8031
8032         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
8033                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8034                 if (!len || (len % sizeof(u16)))
8035                         return -EINVAL;
8036
8037                 params.n_counter_offsets_presp = len / sizeof(u16);
8038                 if (rdev->wiphy.max_num_csa_counters &&
8039                     (params.n_counter_offsets_presp >
8040                      rdev->wiphy.max_num_csa_counters))
8041                         return -EINVAL;
8042
8043                 params.counter_offsets_presp =
8044                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
8045
8046                 /* sanity checks - counters should fit and be the same */
8047                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
8048                         u16 offset = params.counter_offsets_presp[i];
8049
8050                         if (offset >= params.beacon_csa.probe_resp_len)
8051                                 return -EINVAL;
8052
8053                         if (params.beacon_csa.probe_resp[offset] !=
8054                             params.count)
8055                                 return -EINVAL;
8056                 }
8057         }
8058
8059 skip_beacons:
8060         err = nl80211_parse_chandef(rdev, info, &params.chandef);
8061         if (err)
8062                 return err;
8063
8064         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
8065                                            wdev->iftype))
8066                 return -EINVAL;
8067
8068         err = cfg80211_chandef_dfs_required(wdev->wiphy,
8069                                             &params.chandef,
8070                                             wdev->iftype);
8071         if (err < 0)
8072                 return err;
8073
8074         if (err > 0) {
8075                 params.radar_required = true;
8076                 if (need_handle_dfs_flag &&
8077                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
8078                         return -EINVAL;
8079                 }
8080         }
8081
8082         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
8083                 params.block_tx = true;
8084
8085         wdev_lock(wdev);
8086         err = rdev_channel_switch(rdev, dev, &params);
8087         wdev_unlock(wdev);
8088
8089         return err;
8090 }
8091
8092 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
8093                             u32 seq, int flags,
8094                             struct cfg80211_registered_device *rdev,
8095                             struct wireless_dev *wdev,
8096                             struct cfg80211_internal_bss *intbss)
8097 {
8098         struct cfg80211_bss *res = &intbss->pub;
8099         const struct cfg80211_bss_ies *ies;
8100         void *hdr;
8101         struct nlattr *bss;
8102
8103         ASSERT_WDEV_LOCK(wdev);
8104
8105         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8106                              NL80211_CMD_NEW_SCAN_RESULTS);
8107         if (!hdr)
8108                 return -1;
8109
8110         genl_dump_check_consistent(cb, hdr);
8111
8112         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8113                 goto nla_put_failure;
8114         if (wdev->netdev &&
8115             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8116                 goto nla_put_failure;
8117         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8118                               NL80211_ATTR_PAD))
8119                 goto nla_put_failure;
8120
8121         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8122         if (!bss)
8123                 goto nla_put_failure;
8124         if ((!is_zero_ether_addr(res->bssid) &&
8125              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8126                 goto nla_put_failure;
8127
8128         rcu_read_lock();
8129         /* indicate whether we have probe response data or not */
8130         if (rcu_access_pointer(res->proberesp_ies) &&
8131             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8132                 goto fail_unlock_rcu;
8133
8134         /* this pointer prefers to be pointed to probe response data
8135          * but is always valid
8136          */
8137         ies = rcu_dereference(res->ies);
8138         if (ies) {
8139                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8140                                       NL80211_BSS_PAD))
8141                         goto fail_unlock_rcu;
8142                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8143                                         ies->len, ies->data))
8144                         goto fail_unlock_rcu;
8145         }
8146
8147         /* and this pointer is always (unless driver didn't know) beacon data */
8148         ies = rcu_dereference(res->beacon_ies);
8149         if (ies && ies->from_beacon) {
8150                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8151                                       NL80211_BSS_PAD))
8152                         goto fail_unlock_rcu;
8153                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8154                                         ies->len, ies->data))
8155                         goto fail_unlock_rcu;
8156         }
8157         rcu_read_unlock();
8158
8159         if (res->beacon_interval &&
8160             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8161                 goto nla_put_failure;
8162         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8163             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8164             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8165             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8166                         jiffies_to_msecs(jiffies - intbss->ts)))
8167                 goto nla_put_failure;
8168
8169         if (intbss->parent_tsf &&
8170             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8171                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8172              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8173                      intbss->parent_bssid)))
8174                 goto nla_put_failure;
8175
8176         if (intbss->ts_boottime &&
8177             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8178                               intbss->ts_boottime, NL80211_BSS_PAD))
8179                 goto nla_put_failure;
8180
8181         if (!nl80211_put_signal(msg, intbss->pub.chains,
8182                                 intbss->pub.chain_signal,
8183                                 NL80211_BSS_CHAIN_SIGNAL))
8184                 goto nla_put_failure;
8185
8186         switch (rdev->wiphy.signal_type) {
8187         case CFG80211_SIGNAL_TYPE_MBM:
8188                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8189                         goto nla_put_failure;
8190                 break;
8191         case CFG80211_SIGNAL_TYPE_UNSPEC:
8192                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8193                         goto nla_put_failure;
8194                 break;
8195         default:
8196                 break;
8197         }
8198
8199         switch (wdev->iftype) {
8200         case NL80211_IFTYPE_P2P_CLIENT:
8201         case NL80211_IFTYPE_STATION:
8202                 if (intbss == wdev->current_bss &&
8203                     nla_put_u32(msg, NL80211_BSS_STATUS,
8204                                 NL80211_BSS_STATUS_ASSOCIATED))
8205                         goto nla_put_failure;
8206                 break;
8207         case NL80211_IFTYPE_ADHOC:
8208                 if (intbss == wdev->current_bss &&
8209                     nla_put_u32(msg, NL80211_BSS_STATUS,
8210                                 NL80211_BSS_STATUS_IBSS_JOINED))
8211                         goto nla_put_failure;
8212                 break;
8213         default:
8214                 break;
8215         }
8216
8217         nla_nest_end(msg, bss);
8218
8219         genlmsg_end(msg, hdr);
8220         return 0;
8221
8222  fail_unlock_rcu:
8223         rcu_read_unlock();
8224  nla_put_failure:
8225         genlmsg_cancel(msg, hdr);
8226         return -EMSGSIZE;
8227 }
8228
8229 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8230 {
8231         struct cfg80211_registered_device *rdev;
8232         struct cfg80211_internal_bss *scan;
8233         struct wireless_dev *wdev;
8234         int start = cb->args[2], idx = 0;
8235         int err;
8236
8237         rtnl_lock();
8238         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8239         if (err) {
8240                 rtnl_unlock();
8241                 return err;
8242         }
8243
8244         wdev_lock(wdev);
8245         spin_lock_bh(&rdev->bss_lock);
8246
8247         /*
8248          * dump_scan will be called multiple times to break up the scan results
8249          * into multiple messages.  It is unlikely that any more bss-es will be
8250          * expired after the first call, so only call only call this on the
8251          * first dump_scan invocation.
8252          */
8253         if (start == 0)
8254                 cfg80211_bss_expire(rdev);
8255
8256         cb->seq = rdev->bss_generation;
8257
8258         list_for_each_entry(scan, &rdev->bss_list, list) {
8259                 if (++idx <= start)
8260                         continue;
8261                 if (nl80211_send_bss(skb, cb,
8262                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8263                                 rdev, wdev, scan) < 0) {
8264                         idx--;
8265                         break;
8266                 }
8267         }
8268
8269         spin_unlock_bh(&rdev->bss_lock);
8270         wdev_unlock(wdev);
8271
8272         cb->args[2] = idx;
8273         rtnl_unlock();
8274
8275         return skb->len;
8276 }
8277
8278 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8279                                int flags, struct net_device *dev,
8280                                bool allow_radio_stats,
8281                                struct survey_info *survey)
8282 {
8283         void *hdr;
8284         struct nlattr *infoattr;
8285
8286         /* skip radio stats if userspace didn't request them */
8287         if (!survey->channel && !allow_radio_stats)
8288                 return 0;
8289
8290         hdr = nl80211hdr_put(msg, portid, seq, flags,
8291                              NL80211_CMD_NEW_SURVEY_RESULTS);
8292         if (!hdr)
8293                 return -ENOMEM;
8294
8295         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8296                 goto nla_put_failure;
8297
8298         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8299         if (!infoattr)
8300                 goto nla_put_failure;
8301
8302         if (survey->channel &&
8303             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8304                         survey->channel->center_freq))
8305                 goto nla_put_failure;
8306
8307         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8308             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8309                 goto nla_put_failure;
8310         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8311             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8312                 goto nla_put_failure;
8313         if ((survey->filled & SURVEY_INFO_TIME) &&
8314             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8315                         survey->time, NL80211_SURVEY_INFO_PAD))
8316                 goto nla_put_failure;
8317         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8318             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8319                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8320                 goto nla_put_failure;
8321         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8322             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8323                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8324                 goto nla_put_failure;
8325         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8326             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8327                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8328                 goto nla_put_failure;
8329         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8330             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8331                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8332                 goto nla_put_failure;
8333         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8334             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8335                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8336                 goto nla_put_failure;
8337
8338         nla_nest_end(msg, infoattr);
8339
8340         genlmsg_end(msg, hdr);
8341         return 0;
8342
8343  nla_put_failure:
8344         genlmsg_cancel(msg, hdr);
8345         return -EMSGSIZE;
8346 }
8347
8348 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8349 {
8350         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8351         struct survey_info survey;
8352         struct cfg80211_registered_device *rdev;
8353         struct wireless_dev *wdev;
8354         int survey_idx = cb->args[2];
8355         int res;
8356         bool radio_stats;
8357
8358         rtnl_lock();
8359         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
8360         if (res)
8361                 goto out_err;
8362
8363         /* prepare_wdev_dump parsed the attributes */
8364         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8365
8366         if (!wdev->netdev) {
8367                 res = -EINVAL;
8368                 goto out_err;
8369         }
8370
8371         if (!rdev->ops->dump_survey) {
8372                 res = -EOPNOTSUPP;
8373                 goto out_err;
8374         }
8375
8376         while (1) {
8377                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8378                 if (res == -ENOENT)
8379                         break;
8380                 if (res)
8381                         goto out_err;
8382
8383                 /* don't send disabled channels, but do send non-channel data */
8384                 if (survey.channel &&
8385                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8386                         survey_idx++;
8387                         continue;
8388                 }
8389
8390                 if (nl80211_send_survey(skb,
8391                                 NETLINK_CB(cb->skb).portid,
8392                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8393                                 wdev->netdev, radio_stats, &survey) < 0)
8394                         goto out;
8395                 survey_idx++;
8396         }
8397
8398  out:
8399         cb->args[2] = survey_idx;
8400         res = skb->len;
8401  out_err:
8402         rtnl_unlock();
8403         return res;
8404 }
8405
8406 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8407 {
8408         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8409                                   NL80211_WPA_VERSION_2));
8410 }
8411
8412 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8413 {
8414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8415         struct net_device *dev = info->user_ptr[1];
8416         struct ieee80211_channel *chan;
8417         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8418         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8419         enum nl80211_auth_type auth_type;
8420         struct key_parse key;
8421         bool local_state_change;
8422
8423         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8424                 return -EINVAL;
8425
8426         if (!info->attrs[NL80211_ATTR_MAC])
8427                 return -EINVAL;
8428
8429         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8430                 return -EINVAL;
8431
8432         if (!info->attrs[NL80211_ATTR_SSID])
8433                 return -EINVAL;
8434
8435         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8436                 return -EINVAL;
8437
8438         err = nl80211_parse_key(info, &key);
8439         if (err)
8440                 return err;
8441
8442         if (key.idx >= 0) {
8443                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8444                         return -EINVAL;
8445                 if (!key.p.key || !key.p.key_len)
8446                         return -EINVAL;
8447                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8448                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8449                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8450                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8451                         return -EINVAL;
8452                 if (key.idx > 3)
8453                         return -EINVAL;
8454         } else {
8455                 key.p.key_len = 0;
8456                 key.p.key = NULL;
8457         }
8458
8459         if (key.idx >= 0) {
8460                 int i;
8461                 bool ok = false;
8462
8463                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8464                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8465                                 ok = true;
8466                                 break;
8467                         }
8468                 }
8469                 if (!ok)
8470                         return -EINVAL;
8471         }
8472
8473         if (!rdev->ops->auth)
8474                 return -EOPNOTSUPP;
8475
8476         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8477             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8478                 return -EOPNOTSUPP;
8479
8480         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8481         chan = nl80211_get_valid_chan(&rdev->wiphy,
8482                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8483         if (!chan)
8484                 return -EINVAL;
8485
8486         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8487         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8488
8489         if (info->attrs[NL80211_ATTR_IE]) {
8490                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8491                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8492         }
8493
8494         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8495         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8496                 return -EINVAL;
8497
8498         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8499              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8500              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8501              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8502             !info->attrs[NL80211_ATTR_AUTH_DATA])
8503                 return -EINVAL;
8504
8505         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8506                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8507                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8508                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8509                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8510                         return -EINVAL;
8511                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8512                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8513                 /* need to include at least Auth Transaction and Status Code */
8514                 if (auth_data_len < 4)
8515                         return -EINVAL;
8516         }
8517
8518         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8519
8520         /*
8521          * Since we no longer track auth state, ignore
8522          * requests to only change local state.
8523          */
8524         if (local_state_change)
8525                 return 0;
8526
8527         wdev_lock(dev->ieee80211_ptr);
8528         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8529                                  ssid, ssid_len, ie, ie_len,
8530                                  key.p.key, key.p.key_len, key.idx,
8531                                  auth_data, auth_data_len);
8532         wdev_unlock(dev->ieee80211_ptr);
8533         return err;
8534 }
8535
8536 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8537                                      struct genl_info *info)
8538 {
8539         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8540                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8541                 return -EINVAL;
8542         }
8543
8544         if (!rdev->ops->tx_control_port ||
8545             !wiphy_ext_feature_isset(&rdev->wiphy,
8546                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8547                 return -EOPNOTSUPP;
8548
8549         return 0;
8550 }
8551
8552 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8553                                    struct genl_info *info,
8554                                    struct cfg80211_crypto_settings *settings,
8555                                    int cipher_limit)
8556 {
8557         memset(settings, 0, sizeof(*settings));
8558
8559         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8560
8561         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8562                 u16 proto;
8563
8564                 proto = nla_get_u16(
8565                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8566                 settings->control_port_ethertype = cpu_to_be16(proto);
8567                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8568                     proto != ETH_P_PAE)
8569                         return -EINVAL;
8570                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8571                         settings->control_port_no_encrypt = true;
8572         } else
8573                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8574
8575         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8576                 int r = validate_pae_over_nl80211(rdev, info);
8577
8578                 if (r < 0)
8579                         return r;
8580
8581                 settings->control_port_over_nl80211 = true;
8582         }
8583
8584         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8585                 void *data;
8586                 int len, i;
8587
8588                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8589                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8590                 settings->n_ciphers_pairwise = len / sizeof(u32);
8591
8592                 if (len % sizeof(u32))
8593                         return -EINVAL;
8594
8595                 if (settings->n_ciphers_pairwise > cipher_limit)
8596                         return -EINVAL;
8597
8598                 memcpy(settings->ciphers_pairwise, data, len);
8599
8600                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8601                         if (!cfg80211_supported_cipher_suite(
8602                                         &rdev->wiphy,
8603                                         settings->ciphers_pairwise[i]))
8604                                 return -EINVAL;
8605         }
8606
8607         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8608                 settings->cipher_group =
8609                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8610                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8611                                                      settings->cipher_group))
8612                         return -EINVAL;
8613         }
8614
8615         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8616                 settings->wpa_versions =
8617                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8618                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8619                         return -EINVAL;
8620         }
8621
8622         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8623                 void *data;
8624                 int len;
8625
8626                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8627                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8628                 settings->n_akm_suites = len / sizeof(u32);
8629
8630                 if (len % sizeof(u32))
8631                         return -EINVAL;
8632
8633                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8634                         return -EINVAL;
8635
8636                 memcpy(settings->akm_suites, data, len);
8637         }
8638
8639         if (info->attrs[NL80211_ATTR_PMK]) {
8640                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8641                         return -EINVAL;
8642                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8643                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8644                         return -EINVAL;
8645                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8646         }
8647
8648         return 0;
8649 }
8650
8651 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8652 {
8653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8654         struct net_device *dev = info->user_ptr[1];
8655         struct ieee80211_channel *chan;
8656         struct cfg80211_assoc_request req = {};
8657         const u8 *bssid, *ssid;
8658         int err, ssid_len = 0;
8659
8660         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8661             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8662                 return -EPERM;
8663
8664         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8665                 return -EINVAL;
8666
8667         if (!info->attrs[NL80211_ATTR_MAC] ||
8668             !info->attrs[NL80211_ATTR_SSID] ||
8669             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8670                 return -EINVAL;
8671
8672         if (!rdev->ops->assoc)
8673                 return -EOPNOTSUPP;
8674
8675         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8676             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8677                 return -EOPNOTSUPP;
8678
8679         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8680
8681         chan = nl80211_get_valid_chan(&rdev->wiphy,
8682                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8683         if (!chan)
8684                 return -EINVAL;
8685
8686         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8687         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8688
8689         if (info->attrs[NL80211_ATTR_IE]) {
8690                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8691                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8692         }
8693
8694         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8695                 enum nl80211_mfp mfp =
8696                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8697                 if (mfp == NL80211_MFP_REQUIRED)
8698                         req.use_mfp = true;
8699                 else if (mfp != NL80211_MFP_NO)
8700                         return -EINVAL;
8701         }
8702
8703         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8704                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8705
8706         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8707                 req.flags |= ASSOC_REQ_DISABLE_HT;
8708
8709         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8710                 memcpy(&req.ht_capa_mask,
8711                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8712                        sizeof(req.ht_capa_mask));
8713
8714         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8715                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8716                         return -EINVAL;
8717                 memcpy(&req.ht_capa,
8718                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8719                        sizeof(req.ht_capa));
8720         }
8721
8722         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8723                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8724
8725         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8726                 memcpy(&req.vht_capa_mask,
8727                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8728                        sizeof(req.vht_capa_mask));
8729
8730         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8731                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8732                         return -EINVAL;
8733                 memcpy(&req.vht_capa,
8734                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8735                        sizeof(req.vht_capa));
8736         }
8737
8738         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8739                 if (!((rdev->wiphy.features &
8740                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8741                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8742                     !wiphy_ext_feature_isset(&rdev->wiphy,
8743                                              NL80211_EXT_FEATURE_RRM))
8744                         return -EINVAL;
8745                 req.flags |= ASSOC_REQ_USE_RRM;
8746         }
8747
8748         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8749                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8750                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8751                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8752                         return -EINVAL;
8753                 req.fils_nonces =
8754                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8755         }
8756
8757         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8758         if (!err) {
8759                 wdev_lock(dev->ieee80211_ptr);
8760
8761                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8762                                           ssid, ssid_len, &req);
8763
8764                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8765                         dev->ieee80211_ptr->conn_owner_nlportid =
8766                                 info->snd_portid;
8767                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8768                                bssid, ETH_ALEN);
8769                 }
8770
8771                 wdev_unlock(dev->ieee80211_ptr);
8772         }
8773
8774         return err;
8775 }
8776
8777 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8778 {
8779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8780         struct net_device *dev = info->user_ptr[1];
8781         const u8 *ie = NULL, *bssid;
8782         int ie_len = 0, err;
8783         u16 reason_code;
8784         bool local_state_change;
8785
8786         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8787             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8788                 return -EPERM;
8789
8790         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8791                 return -EINVAL;
8792
8793         if (!info->attrs[NL80211_ATTR_MAC])
8794                 return -EINVAL;
8795
8796         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8797                 return -EINVAL;
8798
8799         if (!rdev->ops->deauth)
8800                 return -EOPNOTSUPP;
8801
8802         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8803             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8804                 return -EOPNOTSUPP;
8805
8806         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8807
8808         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8809         if (reason_code == 0) {
8810                 /* Reason Code 0 is reserved */
8811                 return -EINVAL;
8812         }
8813
8814         if (info->attrs[NL80211_ATTR_IE]) {
8815                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8816                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8817         }
8818
8819         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8820
8821         wdev_lock(dev->ieee80211_ptr);
8822         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8823                                    local_state_change);
8824         wdev_unlock(dev->ieee80211_ptr);
8825         return err;
8826 }
8827
8828 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8829 {
8830         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8831         struct net_device *dev = info->user_ptr[1];
8832         const u8 *ie = NULL, *bssid;
8833         int ie_len = 0, err;
8834         u16 reason_code;
8835         bool local_state_change;
8836
8837         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8838             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8839                 return -EPERM;
8840
8841         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8842                 return -EINVAL;
8843
8844         if (!info->attrs[NL80211_ATTR_MAC])
8845                 return -EINVAL;
8846
8847         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8848                 return -EINVAL;
8849
8850         if (!rdev->ops->disassoc)
8851                 return -EOPNOTSUPP;
8852
8853         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8854             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8855                 return -EOPNOTSUPP;
8856
8857         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8858
8859         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8860         if (reason_code == 0) {
8861                 /* Reason Code 0 is reserved */
8862                 return -EINVAL;
8863         }
8864
8865         if (info->attrs[NL80211_ATTR_IE]) {
8866                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8867                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8868         }
8869
8870         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8871
8872         wdev_lock(dev->ieee80211_ptr);
8873         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8874                                      local_state_change);
8875         wdev_unlock(dev->ieee80211_ptr);
8876         return err;
8877 }
8878
8879 static bool
8880 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8881                          int mcast_rate[NUM_NL80211_BANDS],
8882                          int rateval)
8883 {
8884         struct wiphy *wiphy = &rdev->wiphy;
8885         bool found = false;
8886         int band, i;
8887
8888         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8889                 struct ieee80211_supported_band *sband;
8890
8891                 sband = wiphy->bands[band];
8892                 if (!sband)
8893                         continue;
8894
8895                 for (i = 0; i < sband->n_bitrates; i++) {
8896                         if (sband->bitrates[i].bitrate == rateval) {
8897                                 mcast_rate[band] = i + 1;
8898                                 found = true;
8899                                 break;
8900                         }
8901                 }
8902         }
8903
8904         return found;
8905 }
8906
8907 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8908 {
8909         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8910         struct net_device *dev = info->user_ptr[1];
8911         struct cfg80211_ibss_params ibss;
8912         struct wiphy *wiphy;
8913         struct cfg80211_cached_keys *connkeys = NULL;
8914         int err;
8915
8916         memset(&ibss, 0, sizeof(ibss));
8917
8918         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8919                 return -EINVAL;
8920
8921         if (!info->attrs[NL80211_ATTR_SSID] ||
8922             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8923                 return -EINVAL;
8924
8925         ibss.beacon_interval = 100;
8926
8927         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8928                 ibss.beacon_interval =
8929                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8930
8931         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8932                                            ibss.beacon_interval);
8933         if (err)
8934                 return err;
8935
8936         if (!rdev->ops->join_ibss)
8937                 return -EOPNOTSUPP;
8938
8939         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8940                 return -EOPNOTSUPP;
8941
8942         wiphy = &rdev->wiphy;
8943
8944         if (info->attrs[NL80211_ATTR_MAC]) {
8945                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8946
8947                 if (!is_valid_ether_addr(ibss.bssid))
8948                         return -EINVAL;
8949         }
8950         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8951         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8952
8953         if (info->attrs[NL80211_ATTR_IE]) {
8954                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8955                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8956         }
8957
8958         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8959         if (err)
8960                 return err;
8961
8962         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8963                                      NL80211_IFTYPE_ADHOC))
8964                 return -EINVAL;
8965
8966         switch (ibss.chandef.width) {
8967         case NL80211_CHAN_WIDTH_5:
8968         case NL80211_CHAN_WIDTH_10:
8969         case NL80211_CHAN_WIDTH_20_NOHT:
8970                 break;
8971         case NL80211_CHAN_WIDTH_20:
8972         case NL80211_CHAN_WIDTH_40:
8973                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8974                         return -EINVAL;
8975                 break;
8976         case NL80211_CHAN_WIDTH_80:
8977         case NL80211_CHAN_WIDTH_80P80:
8978         case NL80211_CHAN_WIDTH_160:
8979                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8980                         return -EINVAL;
8981                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8982                                              NL80211_EXT_FEATURE_VHT_IBSS))
8983                         return -EINVAL;
8984                 break;
8985         default:
8986                 return -EINVAL;
8987         }
8988
8989         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8990         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8991
8992         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8993                 u8 *rates =
8994                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8995                 int n_rates =
8996                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8997                 struct ieee80211_supported_band *sband =
8998                         wiphy->bands[ibss.chandef.chan->band];
8999
9000                 err = ieee80211_get_ratemask(sband, rates, n_rates,
9001                                              &ibss.basic_rates);
9002                 if (err)
9003                         return err;
9004         }
9005
9006         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9007                 memcpy(&ibss.ht_capa_mask,
9008                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9009                        sizeof(ibss.ht_capa_mask));
9010
9011         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9012                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9013                         return -EINVAL;
9014                 memcpy(&ibss.ht_capa,
9015                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9016                        sizeof(ibss.ht_capa));
9017         }
9018
9019         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9020             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
9021                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9022                 return -EINVAL;
9023
9024         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9025                 bool no_ht = false;
9026
9027                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
9028                 if (IS_ERR(connkeys))
9029                         return PTR_ERR(connkeys);
9030
9031                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
9032                     no_ht) {
9033                         kzfree(connkeys);
9034                         return -EINVAL;
9035                 }
9036         }
9037
9038         ibss.control_port =
9039                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
9040
9041         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
9042                 int r = validate_pae_over_nl80211(rdev, info);
9043
9044                 if (r < 0) {
9045                         kzfree(connkeys);
9046                         return r;
9047                 }
9048
9049                 ibss.control_port_over_nl80211 = true;
9050         }
9051
9052         ibss.userspace_handles_dfs =
9053                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
9054
9055         wdev_lock(dev->ieee80211_ptr);
9056         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
9057         if (err)
9058                 kzfree(connkeys);
9059         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9060                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9061         wdev_unlock(dev->ieee80211_ptr);
9062
9063         return err;
9064 }
9065
9066 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
9067 {
9068         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9069         struct net_device *dev = info->user_ptr[1];
9070
9071         if (!rdev->ops->leave_ibss)
9072                 return -EOPNOTSUPP;
9073
9074         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
9075                 return -EOPNOTSUPP;
9076
9077         return cfg80211_leave_ibss(rdev, dev, false);
9078 }
9079
9080 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
9081 {
9082         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9083         struct net_device *dev = info->user_ptr[1];
9084         int mcast_rate[NUM_NL80211_BANDS];
9085         u32 nla_rate;
9086         int err;
9087
9088         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
9089             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
9090             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
9091                 return -EOPNOTSUPP;
9092
9093         if (!rdev->ops->set_mcast_rate)
9094                 return -EOPNOTSUPP;
9095
9096         memset(mcast_rate, 0, sizeof(mcast_rate));
9097
9098         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
9099                 return -EINVAL;
9100
9101         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
9102         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
9103                 return -EINVAL;
9104
9105         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
9106
9107         return err;
9108 }
9109
9110 static struct sk_buff *
9111 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9112                             struct wireless_dev *wdev, int approxlen,
9113                             u32 portid, u32 seq, enum nl80211_commands cmd,
9114                             enum nl80211_attrs attr,
9115                             const struct nl80211_vendor_cmd_info *info,
9116                             gfp_t gfp)
9117 {
9118         struct sk_buff *skb;
9119         void *hdr;
9120         struct nlattr *data;
9121
9122         skb = nlmsg_new(approxlen + 100, gfp);
9123         if (!skb)
9124                 return NULL;
9125
9126         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9127         if (!hdr) {
9128                 kfree_skb(skb);
9129                 return NULL;
9130         }
9131
9132         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9133                 goto nla_put_failure;
9134
9135         if (info) {
9136                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9137                                 info->vendor_id))
9138                         goto nla_put_failure;
9139                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9140                                 info->subcmd))
9141                         goto nla_put_failure;
9142         }
9143
9144         if (wdev) {
9145                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9146                                       wdev_id(wdev), NL80211_ATTR_PAD))
9147                         goto nla_put_failure;
9148                 if (wdev->netdev &&
9149                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9150                                 wdev->netdev->ifindex))
9151                         goto nla_put_failure;
9152         }
9153
9154         data = nla_nest_start(skb, attr);
9155         if (!data)
9156                 goto nla_put_failure;
9157
9158         ((void **)skb->cb)[0] = rdev;
9159         ((void **)skb->cb)[1] = hdr;
9160         ((void **)skb->cb)[2] = data;
9161
9162         return skb;
9163
9164  nla_put_failure:
9165         kfree_skb(skb);
9166         return NULL;
9167 }
9168
9169 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9170                                            struct wireless_dev *wdev,
9171                                            enum nl80211_commands cmd,
9172                                            enum nl80211_attrs attr,
9173                                            int vendor_event_idx,
9174                                            int approxlen, gfp_t gfp)
9175 {
9176         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9177         const struct nl80211_vendor_cmd_info *info;
9178
9179         switch (cmd) {
9180         case NL80211_CMD_TESTMODE:
9181                 if (WARN_ON(vendor_event_idx != -1))
9182                         return NULL;
9183                 info = NULL;
9184                 break;
9185         case NL80211_CMD_VENDOR:
9186                 if (WARN_ON(vendor_event_idx < 0 ||
9187                             vendor_event_idx >= wiphy->n_vendor_events))
9188                         return NULL;
9189                 info = &wiphy->vendor_events[vendor_event_idx];
9190                 break;
9191         default:
9192                 WARN_ON(1);
9193                 return NULL;
9194         }
9195
9196         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9197                                            cmd, attr, info, gfp);
9198 }
9199 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9200
9201 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9202 {
9203         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9204         void *hdr = ((void **)skb->cb)[1];
9205         struct nlattr *data = ((void **)skb->cb)[2];
9206         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9207
9208         /* clear CB data for netlink core to own from now on */
9209         memset(skb->cb, 0, sizeof(skb->cb));
9210
9211         nla_nest_end(skb, data);
9212         genlmsg_end(skb, hdr);
9213
9214         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9215                 mcgrp = NL80211_MCGRP_VENDOR;
9216
9217         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9218                                 mcgrp, gfp);
9219 }
9220 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9221
9222 #ifdef CONFIG_NL80211_TESTMODE
9223 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9224 {
9225         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9226         struct wireless_dev *wdev =
9227                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9228         int err;
9229
9230         if (!rdev->ops->testmode_cmd)
9231                 return -EOPNOTSUPP;
9232
9233         if (IS_ERR(wdev)) {
9234                 err = PTR_ERR(wdev);
9235                 if (err != -EINVAL)
9236                         return err;
9237                 wdev = NULL;
9238         } else if (wdev->wiphy != &rdev->wiphy) {
9239                 return -EINVAL;
9240         }
9241
9242         if (!info->attrs[NL80211_ATTR_TESTDATA])
9243                 return -EINVAL;
9244
9245         rdev->cur_cmd_info = info;
9246         err = rdev_testmode_cmd(rdev, wdev,
9247                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9248                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9249         rdev->cur_cmd_info = NULL;
9250
9251         return err;
9252 }
9253
9254 static int nl80211_testmode_dump(struct sk_buff *skb,
9255                                  struct netlink_callback *cb)
9256 {
9257         struct cfg80211_registered_device *rdev;
9258         int err;
9259         long phy_idx;
9260         void *data = NULL;
9261         int data_len = 0;
9262
9263         rtnl_lock();
9264
9265         if (cb->args[0]) {
9266                 /*
9267                  * 0 is a valid index, but not valid for args[0],
9268                  * so we need to offset by 1.
9269                  */
9270                 phy_idx = cb->args[0] - 1;
9271
9272                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9273                 if (!rdev) {
9274                         err = -ENOENT;
9275                         goto out_err;
9276                 }
9277         } else {
9278                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9279
9280                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9281                                   attrbuf, nl80211_fam.maxattr,
9282                                   nl80211_policy, NULL);
9283                 if (err)
9284                         goto out_err;
9285
9286                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9287                 if (IS_ERR(rdev)) {
9288                         err = PTR_ERR(rdev);
9289                         goto out_err;
9290                 }
9291                 phy_idx = rdev->wiphy_idx;
9292
9293                 if (attrbuf[NL80211_ATTR_TESTDATA])
9294                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9295         }
9296
9297         if (cb->args[1]) {
9298                 data = nla_data((void *)cb->args[1]);
9299                 data_len = nla_len((void *)cb->args[1]);
9300         }
9301
9302         if (!rdev->ops->testmode_dump) {
9303                 err = -EOPNOTSUPP;
9304                 goto out_err;
9305         }
9306
9307         while (1) {
9308                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9309                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9310                                            NL80211_CMD_TESTMODE);
9311                 struct nlattr *tmdata;
9312
9313                 if (!hdr)
9314                         break;
9315
9316                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9317                         genlmsg_cancel(skb, hdr);
9318                         break;
9319                 }
9320
9321                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9322                 if (!tmdata) {
9323                         genlmsg_cancel(skb, hdr);
9324                         break;
9325                 }
9326                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9327                 nla_nest_end(skb, tmdata);
9328
9329                 if (err == -ENOBUFS || err == -ENOENT) {
9330                         genlmsg_cancel(skb, hdr);
9331                         break;
9332                 } else if (err) {
9333                         genlmsg_cancel(skb, hdr);
9334                         goto out_err;
9335                 }
9336
9337                 genlmsg_end(skb, hdr);
9338         }
9339
9340         err = skb->len;
9341         /* see above */
9342         cb->args[0] = phy_idx + 1;
9343  out_err:
9344         rtnl_unlock();
9345         return err;
9346 }
9347 #endif
9348
9349 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9350 {
9351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9352         struct net_device *dev = info->user_ptr[1];
9353         struct cfg80211_connect_params connect;
9354         struct wiphy *wiphy;
9355         struct cfg80211_cached_keys *connkeys = NULL;
9356         int err;
9357
9358         memset(&connect, 0, sizeof(connect));
9359
9360         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9361                 return -EINVAL;
9362
9363         if (!info->attrs[NL80211_ATTR_SSID] ||
9364             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9365                 return -EINVAL;
9366
9367         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9368                 connect.auth_type =
9369                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9370                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9371                                              NL80211_CMD_CONNECT))
9372                         return -EINVAL;
9373         } else
9374                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9375
9376         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9377
9378         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9379             !wiphy_ext_feature_isset(&rdev->wiphy,
9380                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9381                 return -EINVAL;
9382         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9383
9384         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9385                                       NL80211_MAX_NR_CIPHER_SUITES);
9386         if (err)
9387                 return err;
9388
9389         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9390             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9391                 return -EOPNOTSUPP;
9392
9393         wiphy = &rdev->wiphy;
9394
9395         connect.bg_scan_period = -1;
9396         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9397                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9398                 connect.bg_scan_period =
9399                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9400         }
9401
9402         if (info->attrs[NL80211_ATTR_MAC])
9403                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9404         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9405                 connect.bssid_hint =
9406                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9407         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9408         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9409
9410         if (info->attrs[NL80211_ATTR_IE]) {
9411                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9412                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9413         }
9414
9415         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9416                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9417                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9418                     !wiphy_ext_feature_isset(&rdev->wiphy,
9419                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9420                         return -EOPNOTSUPP;
9421
9422                 if (connect.mfp != NL80211_MFP_REQUIRED &&
9423                     connect.mfp != NL80211_MFP_NO &&
9424                     connect.mfp != NL80211_MFP_OPTIONAL)
9425                         return -EINVAL;
9426         } else {
9427                 connect.mfp = NL80211_MFP_NO;
9428         }
9429
9430         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9431                 connect.prev_bssid =
9432                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9433
9434         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9435                 connect.channel = nl80211_get_valid_chan(
9436                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9437                 if (!connect.channel)
9438                         return -EINVAL;
9439         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9440                 connect.channel_hint = nl80211_get_valid_chan(
9441                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9442                 if (!connect.channel_hint)
9443                         return -EINVAL;
9444         }
9445
9446         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9447                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9448                 if (IS_ERR(connkeys))
9449                         return PTR_ERR(connkeys);
9450         }
9451
9452         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9453                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9454
9455         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9456                 memcpy(&connect.ht_capa_mask,
9457                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9458                        sizeof(connect.ht_capa_mask));
9459
9460         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9461                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9462                         kzfree(connkeys);
9463                         return -EINVAL;
9464                 }
9465                 memcpy(&connect.ht_capa,
9466                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9467                        sizeof(connect.ht_capa));
9468         }
9469
9470         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9471                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9472
9473         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9474                 memcpy(&connect.vht_capa_mask,
9475                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9476                        sizeof(connect.vht_capa_mask));
9477
9478         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9479                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9480                         kzfree(connkeys);
9481                         return -EINVAL;
9482                 }
9483                 memcpy(&connect.vht_capa,
9484                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9485                        sizeof(connect.vht_capa));
9486         }
9487
9488         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9489                 if (!((rdev->wiphy.features &
9490                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9491                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9492                     !wiphy_ext_feature_isset(&rdev->wiphy,
9493                                              NL80211_EXT_FEATURE_RRM)) {
9494                         kzfree(connkeys);
9495                         return -EINVAL;
9496                 }
9497                 connect.flags |= ASSOC_REQ_USE_RRM;
9498         }
9499
9500         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9501         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9502                 kzfree(connkeys);
9503                 return -EOPNOTSUPP;
9504         }
9505
9506         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9507                 /* bss selection makes no sense if bssid is set */
9508                 if (connect.bssid) {
9509                         kzfree(connkeys);
9510                         return -EINVAL;
9511                 }
9512
9513                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9514                                        wiphy, &connect.bss_select);
9515                 if (err) {
9516                         kzfree(connkeys);
9517                         return err;
9518                 }
9519         }
9520
9521         if (wiphy_ext_feature_isset(&rdev->wiphy,
9522                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9523             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9524             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9525             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9526             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9527                 connect.fils_erp_username =
9528                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9529                 connect.fils_erp_username_len =
9530                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9531                 connect.fils_erp_realm =
9532                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9533                 connect.fils_erp_realm_len =
9534                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9535                 connect.fils_erp_next_seq_num =
9536                         nla_get_u16(
9537                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9538                 connect.fils_erp_rrk =
9539                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9540                 connect.fils_erp_rrk_len =
9541                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9542         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9543                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9544                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9545                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9546                 kzfree(connkeys);
9547                 return -EINVAL;
9548         }
9549
9550         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9551                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9552                         kzfree(connkeys);
9553                         GENL_SET_ERR_MSG(info,
9554                                          "external auth requires connection ownership");
9555                         return -EINVAL;
9556                 }
9557                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9558         }
9559
9560         wdev_lock(dev->ieee80211_ptr);
9561
9562         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9563                                connect.prev_bssid);
9564         if (err)
9565                 kzfree(connkeys);
9566
9567         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9568                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9569                 if (connect.bssid)
9570                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9571                                connect.bssid, ETH_ALEN);
9572                 else
9573                         memset(dev->ieee80211_ptr->disconnect_bssid,
9574                                0, ETH_ALEN);
9575         }
9576
9577         wdev_unlock(dev->ieee80211_ptr);
9578
9579         return err;
9580 }
9581
9582 static int nl80211_update_connect_params(struct sk_buff *skb,
9583                                          struct genl_info *info)
9584 {
9585         struct cfg80211_connect_params connect = {};
9586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9587         struct net_device *dev = info->user_ptr[1];
9588         struct wireless_dev *wdev = dev->ieee80211_ptr;
9589         bool fils_sk_offload;
9590         u32 auth_type;
9591         u32 changed = 0;
9592         int ret;
9593
9594         if (!rdev->ops->update_connect_params)
9595                 return -EOPNOTSUPP;
9596
9597         if (info->attrs[NL80211_ATTR_IE]) {
9598                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9599                         return -EINVAL;
9600                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9601                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9602                 changed |= UPDATE_ASSOC_IES;
9603         }
9604
9605         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9606                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9607
9608         /*
9609          * when driver supports fils-sk offload all attributes must be
9610          * provided. So the else covers "fils-sk-not-all" and
9611          * "no-fils-sk-any".
9612          */
9613         if (fils_sk_offload &&
9614             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9615             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9616             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9617             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9618                 connect.fils_erp_username =
9619                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9620                 connect.fils_erp_username_len =
9621                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9622                 connect.fils_erp_realm =
9623                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9624                 connect.fils_erp_realm_len =
9625                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9626                 connect.fils_erp_next_seq_num =
9627                         nla_get_u16(
9628                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9629                 connect.fils_erp_rrk =
9630                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9631                 connect.fils_erp_rrk_len =
9632                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9633                 changed |= UPDATE_FILS_ERP_INFO;
9634         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9635                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9636                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9637                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9638                 return -EINVAL;
9639         }
9640
9641         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9642                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9643                 if (!nl80211_valid_auth_type(rdev, auth_type,
9644                                              NL80211_CMD_CONNECT))
9645                         return -EINVAL;
9646
9647                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9648                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9649                         return -EINVAL;
9650
9651                 connect.auth_type = auth_type;
9652                 changed |= UPDATE_AUTH_TYPE;
9653         }
9654
9655         wdev_lock(dev->ieee80211_ptr);
9656         if (!wdev->current_bss)
9657                 ret = -ENOLINK;
9658         else
9659                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9660         wdev_unlock(dev->ieee80211_ptr);
9661
9662         return ret;
9663 }
9664
9665 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9666 {
9667         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9668         struct net_device *dev = info->user_ptr[1];
9669         u16 reason;
9670         int ret;
9671
9672         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9673             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9674                 return -EPERM;
9675
9676         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9677                 reason = WLAN_REASON_DEAUTH_LEAVING;
9678         else
9679                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9680
9681         if (reason == 0)
9682                 return -EINVAL;
9683
9684         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9685             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9686                 return -EOPNOTSUPP;
9687
9688         wdev_lock(dev->ieee80211_ptr);
9689         ret = cfg80211_disconnect(rdev, dev, reason, true);
9690         wdev_unlock(dev->ieee80211_ptr);
9691         return ret;
9692 }
9693
9694 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9695 {
9696         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9697         struct net *net;
9698         int err;
9699
9700         if (info->attrs[NL80211_ATTR_PID]) {
9701                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9702
9703                 net = get_net_ns_by_pid(pid);
9704         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9705                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9706
9707                 net = get_net_ns_by_fd(fd);
9708         } else {
9709                 return -EINVAL;
9710         }
9711
9712         if (IS_ERR(net))
9713                 return PTR_ERR(net);
9714
9715         err = 0;
9716
9717         /* check if anything to do */
9718         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9719                 err = cfg80211_switch_netns(rdev, net);
9720
9721         put_net(net);
9722         return err;
9723 }
9724
9725 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9726 {
9727         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9728         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9729                         struct cfg80211_pmksa *pmksa) = NULL;
9730         struct net_device *dev = info->user_ptr[1];
9731         struct cfg80211_pmksa pmksa;
9732
9733         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9734
9735         if (!info->attrs[NL80211_ATTR_PMKID])
9736                 return -EINVAL;
9737
9738         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9739
9740         if (info->attrs[NL80211_ATTR_MAC]) {
9741                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9742         } else if (info->attrs[NL80211_ATTR_SSID] &&
9743                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9744                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9745                     info->attrs[NL80211_ATTR_PMK])) {
9746                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9747                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9748                 pmksa.cache_id =
9749                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9750         } else {
9751                 return -EINVAL;
9752         }
9753         if (info->attrs[NL80211_ATTR_PMK]) {
9754                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9755                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9756         }
9757
9758         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9759             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9760                 return -EOPNOTSUPP;
9761
9762         switch (info->genlhdr->cmd) {
9763         case NL80211_CMD_SET_PMKSA:
9764                 rdev_ops = rdev->ops->set_pmksa;
9765                 break;
9766         case NL80211_CMD_DEL_PMKSA:
9767                 rdev_ops = rdev->ops->del_pmksa;
9768                 break;
9769         default:
9770                 WARN_ON(1);
9771                 break;
9772         }
9773
9774         if (!rdev_ops)
9775                 return -EOPNOTSUPP;
9776
9777         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9778 }
9779
9780 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9781 {
9782         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9783         struct net_device *dev = info->user_ptr[1];
9784
9785         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9786             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9787                 return -EOPNOTSUPP;
9788
9789         if (!rdev->ops->flush_pmksa)
9790                 return -EOPNOTSUPP;
9791
9792         return rdev_flush_pmksa(rdev, dev);
9793 }
9794
9795 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9796 {
9797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9798         struct net_device *dev = info->user_ptr[1];
9799         u8 action_code, dialog_token;
9800         u32 peer_capability = 0;
9801         u16 status_code;
9802         u8 *peer;
9803         bool initiator;
9804
9805         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9806             !rdev->ops->tdls_mgmt)
9807                 return -EOPNOTSUPP;
9808
9809         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9810             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9811             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9812             !info->attrs[NL80211_ATTR_IE] ||
9813             !info->attrs[NL80211_ATTR_MAC])
9814                 return -EINVAL;
9815
9816         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9817         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9818         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9819         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9820         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9821         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9822                 peer_capability =
9823                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9824
9825         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9826                               dialog_token, status_code, peer_capability,
9827                               initiator,
9828                               nla_data(info->attrs[NL80211_ATTR_IE]),
9829                               nla_len(info->attrs[NL80211_ATTR_IE]));
9830 }
9831
9832 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9833 {
9834         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9835         struct net_device *dev = info->user_ptr[1];
9836         enum nl80211_tdls_operation operation;
9837         u8 *peer;
9838
9839         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9840             !rdev->ops->tdls_oper)
9841                 return -EOPNOTSUPP;
9842
9843         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9844             !info->attrs[NL80211_ATTR_MAC])
9845                 return -EINVAL;
9846
9847         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9848         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9849
9850         return rdev_tdls_oper(rdev, dev, peer, operation);
9851 }
9852
9853 static int nl80211_remain_on_channel(struct sk_buff *skb,
9854                                      struct genl_info *info)
9855 {
9856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9857         struct wireless_dev *wdev = info->user_ptr[1];
9858         struct cfg80211_chan_def chandef;
9859         const struct cfg80211_chan_def *compat_chandef;
9860         struct sk_buff *msg;
9861         void *hdr;
9862         u64 cookie;
9863         u32 duration;
9864         int err;
9865
9866         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9867             !info->attrs[NL80211_ATTR_DURATION])
9868                 return -EINVAL;
9869
9870         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9871
9872         if (!rdev->ops->remain_on_channel ||
9873             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9874                 return -EOPNOTSUPP;
9875
9876         /*
9877          * We should be on that channel for at least a minimum amount of
9878          * time (10ms) but no longer than the driver supports.
9879          */
9880         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9881             duration > rdev->wiphy.max_remain_on_channel_duration)
9882                 return -EINVAL;
9883
9884         err = nl80211_parse_chandef(rdev, info, &chandef);
9885         if (err)
9886                 return err;
9887
9888         wdev_lock(wdev);
9889         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9890             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9891                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9892                                                              &chandef);
9893                 if (compat_chandef != &chandef) {
9894                         wdev_unlock(wdev);
9895                         return -EBUSY;
9896                 }
9897         }
9898         wdev_unlock(wdev);
9899
9900         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9901         if (!msg)
9902                 return -ENOMEM;
9903
9904         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9905                              NL80211_CMD_REMAIN_ON_CHANNEL);
9906         if (!hdr) {
9907                 err = -ENOBUFS;
9908                 goto free_msg;
9909         }
9910
9911         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9912                                      duration, &cookie);
9913
9914         if (err)
9915                 goto free_msg;
9916
9917         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9918                               NL80211_ATTR_PAD))
9919                 goto nla_put_failure;
9920
9921         genlmsg_end(msg, hdr);
9922
9923         return genlmsg_reply(msg, info);
9924
9925  nla_put_failure:
9926         err = -ENOBUFS;
9927  free_msg:
9928         nlmsg_free(msg);
9929         return err;
9930 }
9931
9932 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9933                                             struct genl_info *info)
9934 {
9935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9936         struct wireless_dev *wdev = info->user_ptr[1];
9937         u64 cookie;
9938
9939         if (!info->attrs[NL80211_ATTR_COOKIE])
9940                 return -EINVAL;
9941
9942         if (!rdev->ops->cancel_remain_on_channel)
9943                 return -EOPNOTSUPP;
9944
9945         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9946
9947         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9948 }
9949
9950 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9951                                        struct genl_info *info)
9952 {
9953         struct cfg80211_bitrate_mask mask;
9954         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9955         struct net_device *dev = info->user_ptr[1];
9956         int err;
9957
9958         if (!rdev->ops->set_bitrate_mask)
9959                 return -EOPNOTSUPP;
9960
9961         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9962         if (err)
9963                 return err;
9964
9965         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9966 }
9967
9968 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9969 {
9970         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9971         struct wireless_dev *wdev = info->user_ptr[1];
9972         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9973
9974         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9975                 return -EINVAL;
9976
9977         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9978                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9979
9980         switch (wdev->iftype) {
9981         case NL80211_IFTYPE_STATION:
9982         case NL80211_IFTYPE_ADHOC:
9983         case NL80211_IFTYPE_P2P_CLIENT:
9984         case NL80211_IFTYPE_AP:
9985         case NL80211_IFTYPE_AP_VLAN:
9986         case NL80211_IFTYPE_MESH_POINT:
9987         case NL80211_IFTYPE_P2P_GO:
9988         case NL80211_IFTYPE_P2P_DEVICE:
9989                 break;
9990         case NL80211_IFTYPE_NAN:
9991         default:
9992                 return -EOPNOTSUPP;
9993         }
9994
9995         /* not much point in registering if we can't reply */
9996         if (!rdev->ops->mgmt_tx)
9997                 return -EOPNOTSUPP;
9998
9999         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
10000                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
10001                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
10002 }
10003
10004 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
10005 {
10006         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10007         struct wireless_dev *wdev = info->user_ptr[1];
10008         struct cfg80211_chan_def chandef;
10009         int err;
10010         void *hdr = NULL;
10011         u64 cookie;
10012         struct sk_buff *msg = NULL;
10013         struct cfg80211_mgmt_tx_params params = {
10014                 .dont_wait_for_ack =
10015                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
10016         };
10017
10018         if (!info->attrs[NL80211_ATTR_FRAME])
10019                 return -EINVAL;
10020
10021         if (!rdev->ops->mgmt_tx)
10022                 return -EOPNOTSUPP;
10023
10024         switch (wdev->iftype) {
10025         case NL80211_IFTYPE_P2P_DEVICE:
10026                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10027                         return -EINVAL;
10028         case NL80211_IFTYPE_STATION:
10029         case NL80211_IFTYPE_ADHOC:
10030         case NL80211_IFTYPE_P2P_CLIENT:
10031         case NL80211_IFTYPE_AP:
10032         case NL80211_IFTYPE_AP_VLAN:
10033         case NL80211_IFTYPE_MESH_POINT:
10034         case NL80211_IFTYPE_P2P_GO:
10035                 break;
10036         case NL80211_IFTYPE_NAN:
10037         default:
10038                 return -EOPNOTSUPP;
10039         }
10040
10041         if (info->attrs[NL80211_ATTR_DURATION]) {
10042                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10043                         return -EINVAL;
10044                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
10045
10046                 /*
10047                  * We should wait on the channel for at least a minimum amount
10048                  * of time (10ms) but no longer than the driver supports.
10049                  */
10050                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
10051                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
10052                         return -EINVAL;
10053         }
10054
10055         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
10056
10057         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
10058                 return -EINVAL;
10059
10060         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
10061
10062         /* get the channel if any has been specified, otherwise pass NULL to
10063          * the driver. The latter will use the current one
10064          */
10065         chandef.chan = NULL;
10066         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10067                 err = nl80211_parse_chandef(rdev, info, &chandef);
10068                 if (err)
10069                         return err;
10070         }
10071
10072         if (!chandef.chan && params.offchan)
10073                 return -EINVAL;
10074
10075         wdev_lock(wdev);
10076         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
10077                 wdev_unlock(wdev);
10078                 return -EBUSY;
10079         }
10080         wdev_unlock(wdev);
10081
10082         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
10083         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
10084
10085         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
10086                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10087                 int i;
10088
10089                 if (len % sizeof(u16))
10090                         return -EINVAL;
10091
10092                 params.n_csa_offsets = len / sizeof(u16);
10093                 params.csa_offsets =
10094                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
10095
10096                 /* check that all the offsets fit the frame */
10097                 for (i = 0; i < params.n_csa_offsets; i++) {
10098                         if (params.csa_offsets[i] >= params.len)
10099                                 return -EINVAL;
10100                 }
10101         }
10102
10103         if (!params.dont_wait_for_ack) {
10104                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10105                 if (!msg)
10106                         return -ENOMEM;
10107
10108                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10109                                      NL80211_CMD_FRAME);
10110                 if (!hdr) {
10111                         err = -ENOBUFS;
10112                         goto free_msg;
10113                 }
10114         }
10115
10116         params.chan = chandef.chan;
10117         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
10118         if (err)
10119                 goto free_msg;
10120
10121         if (msg) {
10122                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10123                                       NL80211_ATTR_PAD))
10124                         goto nla_put_failure;
10125
10126                 genlmsg_end(msg, hdr);
10127                 return genlmsg_reply(msg, info);
10128         }
10129
10130         return 0;
10131
10132  nla_put_failure:
10133         err = -ENOBUFS;
10134  free_msg:
10135         nlmsg_free(msg);
10136         return err;
10137 }
10138
10139 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10140 {
10141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10142         struct wireless_dev *wdev = info->user_ptr[1];
10143         u64 cookie;
10144
10145         if (!info->attrs[NL80211_ATTR_COOKIE])
10146                 return -EINVAL;
10147
10148         if (!rdev->ops->mgmt_tx_cancel_wait)
10149                 return -EOPNOTSUPP;
10150
10151         switch (wdev->iftype) {
10152         case NL80211_IFTYPE_STATION:
10153         case NL80211_IFTYPE_ADHOC:
10154         case NL80211_IFTYPE_P2P_CLIENT:
10155         case NL80211_IFTYPE_AP:
10156         case NL80211_IFTYPE_AP_VLAN:
10157         case NL80211_IFTYPE_P2P_GO:
10158         case NL80211_IFTYPE_P2P_DEVICE:
10159                 break;
10160         case NL80211_IFTYPE_NAN:
10161         default:
10162                 return -EOPNOTSUPP;
10163         }
10164
10165         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10166
10167         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10168 }
10169
10170 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10171 {
10172         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10173         struct wireless_dev *wdev;
10174         struct net_device *dev = info->user_ptr[1];
10175         u8 ps_state;
10176         bool state;
10177         int err;
10178
10179         if (!info->attrs[NL80211_ATTR_PS_STATE])
10180                 return -EINVAL;
10181
10182         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10183
10184         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
10185                 return -EINVAL;
10186
10187         wdev = dev->ieee80211_ptr;
10188
10189         if (!rdev->ops->set_power_mgmt)
10190                 return -EOPNOTSUPP;
10191
10192         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10193
10194         if (state == wdev->ps)
10195                 return 0;
10196
10197         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10198         if (!err)
10199                 wdev->ps = state;
10200         return err;
10201 }
10202
10203 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10204 {
10205         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10206         enum nl80211_ps_state ps_state;
10207         struct wireless_dev *wdev;
10208         struct net_device *dev = info->user_ptr[1];
10209         struct sk_buff *msg;
10210         void *hdr;
10211         int err;
10212
10213         wdev = dev->ieee80211_ptr;
10214
10215         if (!rdev->ops->set_power_mgmt)
10216                 return -EOPNOTSUPP;
10217
10218         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10219         if (!msg)
10220                 return -ENOMEM;
10221
10222         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10223                              NL80211_CMD_GET_POWER_SAVE);
10224         if (!hdr) {
10225                 err = -ENOBUFS;
10226                 goto free_msg;
10227         }
10228
10229         if (wdev->ps)
10230                 ps_state = NL80211_PS_ENABLED;
10231         else
10232                 ps_state = NL80211_PS_DISABLED;
10233
10234         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10235                 goto nla_put_failure;
10236
10237         genlmsg_end(msg, hdr);
10238         return genlmsg_reply(msg, info);
10239
10240  nla_put_failure:
10241         err = -ENOBUFS;
10242  free_msg:
10243         nlmsg_free(msg);
10244         return err;
10245 }
10246
10247 static const struct nla_policy
10248 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10249         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10250         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10251         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10252         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10253         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10254         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10255         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10256 };
10257
10258 static int nl80211_set_cqm_txe(struct genl_info *info,
10259                                u32 rate, u32 pkts, u32 intvl)
10260 {
10261         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10262         struct net_device *dev = info->user_ptr[1];
10263         struct wireless_dev *wdev = dev->ieee80211_ptr;
10264
10265         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10266                 return -EINVAL;
10267
10268         if (!rdev->ops->set_cqm_txe_config)
10269                 return -EOPNOTSUPP;
10270
10271         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10272             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10273                 return -EOPNOTSUPP;
10274
10275         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10276 }
10277
10278 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10279                                     struct net_device *dev)
10280 {
10281         struct wireless_dev *wdev = dev->ieee80211_ptr;
10282         s32 last, low, high;
10283         u32 hyst;
10284         int i, n, low_index;
10285         int err;
10286
10287         /* RSSI reporting disabled? */
10288         if (!wdev->cqm_config)
10289                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10290
10291         /*
10292          * Obtain current RSSI value if possible, if not and no RSSI threshold
10293          * event has been received yet, we should receive an event after a
10294          * connection is established and enough beacons received to calculate
10295          * the average.
10296          */
10297         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10298             rdev->ops->get_station) {
10299                 struct station_info sinfo = {};
10300                 u8 *mac_addr;
10301
10302                 mac_addr = wdev->current_bss->pub.bssid;
10303
10304                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10305                 if (err)
10306                         return err;
10307
10308                 cfg80211_sinfo_release_content(&sinfo);
10309                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10310                         wdev->cqm_config->last_rssi_event_value =
10311                                 (s8) sinfo.rx_beacon_signal_avg;
10312         }
10313
10314         last = wdev->cqm_config->last_rssi_event_value;
10315         hyst = wdev->cqm_config->rssi_hyst;
10316         n = wdev->cqm_config->n_rssi_thresholds;
10317
10318         for (i = 0; i < n; i++) {
10319                 i = array_index_nospec(i, n);
10320                 if (last < wdev->cqm_config->rssi_thresholds[i])
10321                         break;
10322         }
10323
10324         low_index = i - 1;
10325         if (low_index >= 0) {
10326                 low_index = array_index_nospec(low_index, n);
10327                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10328         } else {
10329                 low = S32_MIN;
10330         }
10331         if (i < n) {
10332                 i = array_index_nospec(i, n);
10333                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10334         } else {
10335                 high = S32_MAX;
10336         }
10337
10338         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10339 }
10340
10341 static int nl80211_set_cqm_rssi(struct genl_info *info,
10342                                 const s32 *thresholds, int n_thresholds,
10343                                 u32 hysteresis)
10344 {
10345         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10346         struct net_device *dev = info->user_ptr[1];
10347         struct wireless_dev *wdev = dev->ieee80211_ptr;
10348         int i, err;
10349         s32 prev = S32_MIN;
10350
10351         /* Check all values negative and sorted */
10352         for (i = 0; i < n_thresholds; i++) {
10353                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10354                         return -EINVAL;
10355
10356                 prev = thresholds[i];
10357         }
10358
10359         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10360             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10361                 return -EOPNOTSUPP;
10362
10363         wdev_lock(wdev);
10364         cfg80211_cqm_config_free(wdev);
10365         wdev_unlock(wdev);
10366
10367         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10368                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10369                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10370
10371                 return rdev_set_cqm_rssi_config(rdev, dev,
10372                                                 thresholds[0], hysteresis);
10373         }
10374
10375         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10376                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10377                 return -EOPNOTSUPP;
10378
10379         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10380                 n_thresholds = 0;
10381
10382         wdev_lock(wdev);
10383         if (n_thresholds) {
10384                 struct cfg80211_cqm_config *cqm_config;
10385
10386                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10387                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10388                 if (!cqm_config) {
10389                         err = -ENOMEM;
10390                         goto unlock;
10391                 }
10392
10393                 cqm_config->rssi_hyst = hysteresis;
10394                 cqm_config->n_rssi_thresholds = n_thresholds;
10395                 memcpy(cqm_config->rssi_thresholds, thresholds,
10396                        n_thresholds * sizeof(s32));
10397
10398                 wdev->cqm_config = cqm_config;
10399         }
10400
10401         err = cfg80211_cqm_rssi_update(rdev, dev);
10402
10403 unlock:
10404         wdev_unlock(wdev);
10405
10406         return err;
10407 }
10408
10409 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10410 {
10411         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10412         struct nlattr *cqm;
10413         int err;
10414
10415         cqm = info->attrs[NL80211_ATTR_CQM];
10416         if (!cqm)
10417                 return -EINVAL;
10418
10419         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10420                                nl80211_attr_cqm_policy, info->extack);
10421         if (err)
10422                 return err;
10423
10424         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10425             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10426                 const s32 *thresholds =
10427                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10428                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10429                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10430
10431                 if (len % 4)
10432                         return -EINVAL;
10433
10434                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10435                                             hysteresis);
10436         }
10437
10438         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10439             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10440             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10441                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10442                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10443                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10444
10445                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10446         }
10447
10448         return -EINVAL;
10449 }
10450
10451 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10452 {
10453         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10454         struct net_device *dev = info->user_ptr[1];
10455         struct ocb_setup setup = {};
10456         int err;
10457
10458         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10459         if (err)
10460                 return err;
10461
10462         return cfg80211_join_ocb(rdev, dev, &setup);
10463 }
10464
10465 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10466 {
10467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10468         struct net_device *dev = info->user_ptr[1];
10469
10470         return cfg80211_leave_ocb(rdev, dev);
10471 }
10472
10473 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10474 {
10475         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10476         struct net_device *dev = info->user_ptr[1];
10477         struct mesh_config cfg;
10478         struct mesh_setup setup;
10479         int err;
10480
10481         /* start with default */
10482         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10483         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10484
10485         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10486                 /* and parse parameters if given */
10487                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10488                 if (err)
10489                         return err;
10490         }
10491
10492         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10493             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10494                 return -EINVAL;
10495
10496         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10497         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10498
10499         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10500             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10501                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10502                         return -EINVAL;
10503
10504         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10505                 setup.beacon_interval =
10506                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10507
10508                 err = cfg80211_validate_beacon_int(rdev,
10509                                                    NL80211_IFTYPE_MESH_POINT,
10510                                                    setup.beacon_interval);
10511                 if (err)
10512                         return err;
10513         }
10514
10515         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10516                 setup.dtim_period =
10517                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10518                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10519                         return -EINVAL;
10520         }
10521
10522         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10523                 /* parse additional setup parameters if given */
10524                 err = nl80211_parse_mesh_setup(info, &setup);
10525                 if (err)
10526                         return err;
10527         }
10528
10529         if (setup.user_mpm)
10530                 cfg.auto_open_plinks = false;
10531
10532         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10533                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10534                 if (err)
10535                         return err;
10536         } else {
10537                 /* __cfg80211_join_mesh() will sort it out */
10538                 setup.chandef.chan = NULL;
10539         }
10540
10541         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10542                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10543                 int n_rates =
10544                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10545                 struct ieee80211_supported_band *sband;
10546
10547                 if (!setup.chandef.chan)
10548                         return -EINVAL;
10549
10550                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10551
10552                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10553                                              &setup.basic_rates);
10554                 if (err)
10555                         return err;
10556         }
10557
10558         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10559                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10560                 if (err)
10561                         return err;
10562
10563                 if (!setup.chandef.chan)
10564                         return -EINVAL;
10565
10566                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10567                                               &setup.beacon_rate);
10568                 if (err)
10569                         return err;
10570         }
10571
10572         setup.userspace_handles_dfs =
10573                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10574
10575         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10576                 int r = validate_pae_over_nl80211(rdev, info);
10577
10578                 if (r < 0)
10579                         return r;
10580
10581                 setup.control_port_over_nl80211 = true;
10582         }
10583
10584         wdev_lock(dev->ieee80211_ptr);
10585         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10586         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10587                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10588         wdev_unlock(dev->ieee80211_ptr);
10589
10590         return err;
10591 }
10592
10593 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10594 {
10595         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10596         struct net_device *dev = info->user_ptr[1];
10597
10598         return cfg80211_leave_mesh(rdev, dev);
10599 }
10600
10601 #ifdef CONFIG_PM
10602 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10603                                         struct cfg80211_registered_device *rdev)
10604 {
10605         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10606         struct nlattr *nl_pats, *nl_pat;
10607         int i, pat_len;
10608
10609         if (!wowlan->n_patterns)
10610                 return 0;
10611
10612         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10613         if (!nl_pats)
10614                 return -ENOBUFS;
10615
10616         for (i = 0; i < wowlan->n_patterns; i++) {
10617                 nl_pat = nla_nest_start(msg, i + 1);
10618                 if (!nl_pat)
10619                         return -ENOBUFS;
10620                 pat_len = wowlan->patterns[i].pattern_len;
10621                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10622                             wowlan->patterns[i].mask) ||
10623                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10624                             wowlan->patterns[i].pattern) ||
10625                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10626                                 wowlan->patterns[i].pkt_offset))
10627                         return -ENOBUFS;
10628                 nla_nest_end(msg, nl_pat);
10629         }
10630         nla_nest_end(msg, nl_pats);
10631
10632         return 0;
10633 }
10634
10635 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10636                                    struct cfg80211_wowlan_tcp *tcp)
10637 {
10638         struct nlattr *nl_tcp;
10639
10640         if (!tcp)
10641                 return 0;
10642
10643         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10644         if (!nl_tcp)
10645                 return -ENOBUFS;
10646
10647         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10648             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10649             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10650             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10651             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10652             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10653                     tcp->payload_len, tcp->payload) ||
10654             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10655                         tcp->data_interval) ||
10656             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10657                     tcp->wake_len, tcp->wake_data) ||
10658             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10659                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10660                 return -ENOBUFS;
10661
10662         if (tcp->payload_seq.len &&
10663             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10664                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10665                 return -ENOBUFS;
10666
10667         if (tcp->payload_tok.len &&
10668             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10669                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10670                     &tcp->payload_tok))
10671                 return -ENOBUFS;
10672
10673         nla_nest_end(msg, nl_tcp);
10674
10675         return 0;
10676 }
10677
10678 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10679                                   struct cfg80211_sched_scan_request *req)
10680 {
10681         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10682         int i;
10683
10684         if (!req)
10685                 return 0;
10686
10687         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10688         if (!nd)
10689                 return -ENOBUFS;
10690
10691         if (req->n_scan_plans == 1 &&
10692             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10693                         req->scan_plans[0].interval * 1000))
10694                 return -ENOBUFS;
10695
10696         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10697                 return -ENOBUFS;
10698
10699         if (req->relative_rssi_set) {
10700                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10701
10702                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10703                                req->relative_rssi))
10704                         return -ENOBUFS;
10705
10706                 rssi_adjust.band = req->rssi_adjust.band;
10707                 rssi_adjust.delta = req->rssi_adjust.delta;
10708                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10709                             sizeof(rssi_adjust), &rssi_adjust))
10710                         return -ENOBUFS;
10711         }
10712
10713         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10714         if (!freqs)
10715                 return -ENOBUFS;
10716
10717         for (i = 0; i < req->n_channels; i++) {
10718                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10719                         return -ENOBUFS;
10720         }
10721
10722         nla_nest_end(msg, freqs);
10723
10724         if (req->n_match_sets) {
10725                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10726                 if (!matches)
10727                         return -ENOBUFS;
10728
10729                 for (i = 0; i < req->n_match_sets; i++) {
10730                         match = nla_nest_start(msg, i);
10731                         if (!match)
10732                                 return -ENOBUFS;
10733
10734                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10735                                     req->match_sets[i].ssid.ssid_len,
10736                                     req->match_sets[i].ssid.ssid))
10737                                 return -ENOBUFS;
10738                         nla_nest_end(msg, match);
10739                 }
10740                 nla_nest_end(msg, matches);
10741         }
10742
10743         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10744         if (!scan_plans)
10745                 return -ENOBUFS;
10746
10747         for (i = 0; i < req->n_scan_plans; i++) {
10748                 scan_plan = nla_nest_start(msg, i + 1);
10749                 if (!scan_plan)
10750                         return -ENOBUFS;
10751
10752                 if (!scan_plan ||
10753                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10754                                 req->scan_plans[i].interval) ||
10755                     (req->scan_plans[i].iterations &&
10756                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10757                                  req->scan_plans[i].iterations)))
10758                         return -ENOBUFS;
10759                 nla_nest_end(msg, scan_plan);
10760         }
10761         nla_nest_end(msg, scan_plans);
10762
10763         nla_nest_end(msg, nd);
10764
10765         return 0;
10766 }
10767
10768 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10769 {
10770         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10771         struct sk_buff *msg;
10772         void *hdr;
10773         u32 size = NLMSG_DEFAULT_SIZE;
10774
10775         if (!rdev->wiphy.wowlan)
10776                 return -EOPNOTSUPP;
10777
10778         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10779                 /* adjust size to have room for all the data */
10780                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10781                         rdev->wiphy.wowlan_config->tcp->payload_len +
10782                         rdev->wiphy.wowlan_config->tcp->wake_len +
10783                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10784         }
10785
10786         msg = nlmsg_new(size, GFP_KERNEL);
10787         if (!msg)
10788                 return -ENOMEM;
10789
10790         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10791                              NL80211_CMD_GET_WOWLAN);
10792         if (!hdr)
10793                 goto nla_put_failure;
10794
10795         if (rdev->wiphy.wowlan_config) {
10796                 struct nlattr *nl_wowlan;
10797
10798                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10799                 if (!nl_wowlan)
10800                         goto nla_put_failure;
10801
10802                 if ((rdev->wiphy.wowlan_config->any &&
10803                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10804                     (rdev->wiphy.wowlan_config->disconnect &&
10805                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10806                     (rdev->wiphy.wowlan_config->magic_pkt &&
10807                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10808                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10809                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10810                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10811                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10812                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10813                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10814                     (rdev->wiphy.wowlan_config->rfkill_release &&
10815                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10816                         goto nla_put_failure;
10817
10818                 if (nl80211_send_wowlan_patterns(msg, rdev))
10819                         goto nla_put_failure;
10820
10821                 if (nl80211_send_wowlan_tcp(msg,
10822                                             rdev->wiphy.wowlan_config->tcp))
10823                         goto nla_put_failure;
10824
10825                 if (nl80211_send_wowlan_nd(
10826                             msg,
10827                             rdev->wiphy.wowlan_config->nd_config))
10828                         goto nla_put_failure;
10829
10830                 nla_nest_end(msg, nl_wowlan);
10831         }
10832
10833         genlmsg_end(msg, hdr);
10834         return genlmsg_reply(msg, info);
10835
10836 nla_put_failure:
10837         nlmsg_free(msg);
10838         return -ENOBUFS;
10839 }
10840
10841 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10842                                     struct nlattr *attr,
10843                                     struct cfg80211_wowlan *trig)
10844 {
10845         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10846         struct cfg80211_wowlan_tcp *cfg;
10847         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10848         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10849         u32 size;
10850         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10851         int err, port;
10852
10853         if (!rdev->wiphy.wowlan->tcp)
10854                 return -EINVAL;
10855
10856         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10857                                nl80211_wowlan_tcp_policy, NULL);
10858         if (err)
10859                 return err;
10860
10861         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10862             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10863             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10864             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10865             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10866             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10867             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10868             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10869                 return -EINVAL;
10870
10871         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10872         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10873                 return -EINVAL;
10874
10875         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10876                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10877             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10878                 return -EINVAL;
10879
10880         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10881         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10882                 return -EINVAL;
10883
10884         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10885         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10886                 return -EINVAL;
10887
10888         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10889                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10890
10891                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10892                 tokens_size = tokln - sizeof(*tok);
10893
10894                 if (!tok->len || tokens_size % tok->len)
10895                         return -EINVAL;
10896                 if (!rdev->wiphy.wowlan->tcp->tok)
10897                         return -EINVAL;
10898                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10899                         return -EINVAL;
10900                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10901                         return -EINVAL;
10902                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10903                         return -EINVAL;
10904                 if (tok->offset + tok->len > data_size)
10905                         return -EINVAL;
10906         }
10907
10908         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10909                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10910                 if (!rdev->wiphy.wowlan->tcp->seq)
10911                         return -EINVAL;
10912                 if (seq->len == 0 || seq->len > 4)
10913                         return -EINVAL;
10914                 if (seq->len + seq->offset > data_size)
10915                         return -EINVAL;
10916         }
10917
10918         size = sizeof(*cfg);
10919         size += data_size;
10920         size += wake_size + wake_mask_size;
10921         size += tokens_size;
10922
10923         cfg = kzalloc(size, GFP_KERNEL);
10924         if (!cfg)
10925                 return -ENOMEM;
10926         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10927         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10928         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10929                ETH_ALEN);
10930         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10931                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10932         else
10933                 port = 0;
10934 #ifdef CONFIG_INET
10935         /* allocate a socket and port for it and use it */
10936         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10937                             IPPROTO_TCP, &cfg->sock, 1);
10938         if (err) {
10939                 kfree(cfg);
10940                 return err;
10941         }
10942         if (inet_csk_get_port(cfg->sock->sk, port)) {
10943                 sock_release(cfg->sock);
10944                 kfree(cfg);
10945                 return -EADDRINUSE;
10946         }
10947         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10948 #else
10949         if (!port) {
10950                 kfree(cfg);
10951                 return -EINVAL;
10952         }
10953         cfg->src_port = port;
10954 #endif
10955
10956         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10957         cfg->payload_len = data_size;
10958         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10959         memcpy((void *)cfg->payload,
10960                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10961                data_size);
10962         if (seq)
10963                 cfg->payload_seq = *seq;
10964         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10965         cfg->wake_len = wake_size;
10966         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10967         memcpy((void *)cfg->wake_data,
10968                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10969                wake_size);
10970         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10971                          data_size + wake_size;
10972         memcpy((void *)cfg->wake_mask,
10973                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10974                wake_mask_size);
10975         if (tok) {
10976                 cfg->tokens_size = tokens_size;
10977                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10978         }
10979
10980         trig->tcp = cfg;
10981
10982         return 0;
10983 }
10984
10985 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10986                                    const struct wiphy_wowlan_support *wowlan,
10987                                    struct nlattr *attr,
10988                                    struct cfg80211_wowlan *trig)
10989 {
10990         struct nlattr **tb;
10991         int err;
10992
10993         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10994         if (!tb)
10995                 return -ENOMEM;
10996
10997         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10998                 err = -EOPNOTSUPP;
10999                 goto out;
11000         }
11001
11002         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
11003                                NULL);
11004         if (err)
11005                 goto out;
11006
11007         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
11008                                                    wowlan->max_nd_match_sets);
11009         err = PTR_ERR_OR_ZERO(trig->nd_config);
11010         if (err)
11011                 trig->nd_config = NULL;
11012
11013 out:
11014         kfree(tb);
11015         return err;
11016 }
11017
11018 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
11019 {
11020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11021         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
11022         struct cfg80211_wowlan new_triggers = {};
11023         struct cfg80211_wowlan *ntrig;
11024         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
11025         int err, i;
11026         bool prev_enabled = rdev->wiphy.wowlan_config;
11027         bool regular = false;
11028
11029         if (!wowlan)
11030                 return -EOPNOTSUPP;
11031
11032         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
11033                 cfg80211_rdev_free_wowlan(rdev);
11034                 rdev->wiphy.wowlan_config = NULL;
11035                 goto set_wakeup;
11036         }
11037
11038         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
11039                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
11040                                nl80211_wowlan_policy, info->extack);
11041         if (err)
11042                 return err;
11043
11044         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
11045                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
11046                         return -EINVAL;
11047                 new_triggers.any = true;
11048         }
11049
11050         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
11051                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
11052                         return -EINVAL;
11053                 new_triggers.disconnect = true;
11054                 regular = true;
11055         }
11056
11057         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
11058                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
11059                         return -EINVAL;
11060                 new_triggers.magic_pkt = true;
11061                 regular = true;
11062         }
11063
11064         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
11065                 return -EINVAL;
11066
11067         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
11068                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
11069                         return -EINVAL;
11070                 new_triggers.gtk_rekey_failure = true;
11071                 regular = true;
11072         }
11073
11074         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
11075                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
11076                         return -EINVAL;
11077                 new_triggers.eap_identity_req = true;
11078                 regular = true;
11079         }
11080
11081         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
11082                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
11083                         return -EINVAL;
11084                 new_triggers.four_way_handshake = true;
11085                 regular = true;
11086         }
11087
11088         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
11089                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
11090                         return -EINVAL;
11091                 new_triggers.rfkill_release = true;
11092                 regular = true;
11093         }
11094
11095         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
11096                 struct nlattr *pat;
11097                 int n_patterns = 0;
11098                 int rem, pat_len, mask_len, pkt_offset;
11099                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11100
11101                 regular = true;
11102
11103                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11104                                     rem)
11105                         n_patterns++;
11106                 if (n_patterns > wowlan->n_patterns)
11107                         return -EINVAL;
11108
11109                 new_triggers.patterns = kcalloc(n_patterns,
11110                                                 sizeof(new_triggers.patterns[0]),
11111                                                 GFP_KERNEL);
11112                 if (!new_triggers.patterns)
11113                         return -ENOMEM;
11114
11115                 new_triggers.n_patterns = n_patterns;
11116                 i = 0;
11117
11118                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
11119                                     rem) {
11120                         u8 *mask_pat;
11121
11122                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11123                                                nl80211_packet_pattern_policy,
11124                                                info->extack);
11125                         if (err)
11126                                 goto error;
11127
11128                         err = -EINVAL;
11129                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11130                             !pat_tb[NL80211_PKTPAT_PATTERN])
11131                                 goto error;
11132                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11133                         mask_len = DIV_ROUND_UP(pat_len, 8);
11134                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11135                                 goto error;
11136                         if (pat_len > wowlan->pattern_max_len ||
11137                             pat_len < wowlan->pattern_min_len)
11138                                 goto error;
11139
11140                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11141                                 pkt_offset = 0;
11142                         else
11143                                 pkt_offset = nla_get_u32(
11144                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11145                         if (pkt_offset > wowlan->max_pkt_offset)
11146                                 goto error;
11147                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11148
11149                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11150                         if (!mask_pat) {
11151                                 err = -ENOMEM;
11152                                 goto error;
11153                         }
11154                         new_triggers.patterns[i].mask = mask_pat;
11155                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11156                                mask_len);
11157                         mask_pat += mask_len;
11158                         new_triggers.patterns[i].pattern = mask_pat;
11159                         new_triggers.patterns[i].pattern_len = pat_len;
11160                         memcpy(mask_pat,
11161                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11162                                pat_len);
11163                         i++;
11164                 }
11165         }
11166
11167         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11168                 regular = true;
11169                 err = nl80211_parse_wowlan_tcp(
11170                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11171                         &new_triggers);
11172                 if (err)
11173                         goto error;
11174         }
11175
11176         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11177                 regular = true;
11178                 err = nl80211_parse_wowlan_nd(
11179                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11180                         &new_triggers);
11181                 if (err)
11182                         goto error;
11183         }
11184
11185         /* The 'any' trigger means the device continues operating more or less
11186          * as in its normal operation mode and wakes up the host on most of the
11187          * normal interrupts (like packet RX, ...)
11188          * It therefore makes little sense to combine with the more constrained
11189          * wakeup trigger modes.
11190          */
11191         if (new_triggers.any && regular) {
11192                 err = -EINVAL;
11193                 goto error;
11194         }
11195
11196         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11197         if (!ntrig) {
11198                 err = -ENOMEM;
11199                 goto error;
11200         }
11201         cfg80211_rdev_free_wowlan(rdev);
11202         rdev->wiphy.wowlan_config = ntrig;
11203
11204  set_wakeup:
11205         if (rdev->ops->set_wakeup &&
11206             prev_enabled != !!rdev->wiphy.wowlan_config)
11207                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11208
11209         return 0;
11210  error:
11211         for (i = 0; i < new_triggers.n_patterns; i++)
11212                 kfree(new_triggers.patterns[i].mask);
11213         kfree(new_triggers.patterns);
11214         if (new_triggers.tcp && new_triggers.tcp->sock)
11215                 sock_release(new_triggers.tcp->sock);
11216         kfree(new_triggers.tcp);
11217         kfree(new_triggers.nd_config);
11218         return err;
11219 }
11220 #endif
11221
11222 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11223                                        struct cfg80211_registered_device *rdev)
11224 {
11225         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11226         int i, j, pat_len;
11227         struct cfg80211_coalesce_rules *rule;
11228
11229         if (!rdev->coalesce->n_rules)
11230                 return 0;
11231
11232         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11233         if (!nl_rules)
11234                 return -ENOBUFS;
11235
11236         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11237                 nl_rule = nla_nest_start(msg, i + 1);
11238                 if (!nl_rule)
11239                         return -ENOBUFS;
11240
11241                 rule = &rdev->coalesce->rules[i];
11242                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11243                                 rule->delay))
11244                         return -ENOBUFS;
11245
11246                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11247                                 rule->condition))
11248                         return -ENOBUFS;
11249
11250                 nl_pats = nla_nest_start(msg,
11251                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11252                 if (!nl_pats)
11253                         return -ENOBUFS;
11254
11255                 for (j = 0; j < rule->n_patterns; j++) {
11256                         nl_pat = nla_nest_start(msg, j + 1);
11257                         if (!nl_pat)
11258                                 return -ENOBUFS;
11259                         pat_len = rule->patterns[j].pattern_len;
11260                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11261                                     DIV_ROUND_UP(pat_len, 8),
11262                                     rule->patterns[j].mask) ||
11263                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11264                                     rule->patterns[j].pattern) ||
11265                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11266                                         rule->patterns[j].pkt_offset))
11267                                 return -ENOBUFS;
11268                         nla_nest_end(msg, nl_pat);
11269                 }
11270                 nla_nest_end(msg, nl_pats);
11271                 nla_nest_end(msg, nl_rule);
11272         }
11273         nla_nest_end(msg, nl_rules);
11274
11275         return 0;
11276 }
11277
11278 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11279 {
11280         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11281         struct sk_buff *msg;
11282         void *hdr;
11283
11284         if (!rdev->wiphy.coalesce)
11285                 return -EOPNOTSUPP;
11286
11287         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11288         if (!msg)
11289                 return -ENOMEM;
11290
11291         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11292                              NL80211_CMD_GET_COALESCE);
11293         if (!hdr)
11294                 goto nla_put_failure;
11295
11296         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11297                 goto nla_put_failure;
11298
11299         genlmsg_end(msg, hdr);
11300         return genlmsg_reply(msg, info);
11301
11302 nla_put_failure:
11303         nlmsg_free(msg);
11304         return -ENOBUFS;
11305 }
11306
11307 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11308 {
11309         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11310         int i, j;
11311         struct cfg80211_coalesce_rules *rule;
11312
11313         if (!coalesce)
11314                 return;
11315
11316         for (i = 0; i < coalesce->n_rules; i++) {
11317                 rule = &coalesce->rules[i];
11318                 for (j = 0; j < rule->n_patterns; j++)
11319                         kfree(rule->patterns[j].mask);
11320                 kfree(rule->patterns);
11321         }
11322         kfree(coalesce->rules);
11323         kfree(coalesce);
11324         rdev->coalesce = NULL;
11325 }
11326
11327 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11328                                        struct nlattr *rule,
11329                                        struct cfg80211_coalesce_rules *new_rule)
11330 {
11331         int err, i;
11332         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11333         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11334         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11335         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11336
11337         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11338                                nl80211_coalesce_policy, NULL);
11339         if (err)
11340                 return err;
11341
11342         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11343                 new_rule->delay =
11344                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11345         if (new_rule->delay > coalesce->max_delay)
11346                 return -EINVAL;
11347
11348         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11349                 new_rule->condition =
11350                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11351         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
11352             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
11353                 return -EINVAL;
11354
11355         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11356                 return -EINVAL;
11357
11358         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11359                             rem)
11360                 n_patterns++;
11361         if (n_patterns > coalesce->n_patterns)
11362                 return -EINVAL;
11363
11364         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11365                                      GFP_KERNEL);
11366         if (!new_rule->patterns)
11367                 return -ENOMEM;
11368
11369         new_rule->n_patterns = n_patterns;
11370         i = 0;
11371
11372         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11373                             rem) {
11374                 u8 *mask_pat;
11375
11376                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11377                                        nl80211_packet_pattern_policy, NULL);
11378                 if (err)
11379                         return err;
11380
11381                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11382                     !pat_tb[NL80211_PKTPAT_PATTERN])
11383                         return -EINVAL;
11384                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11385                 mask_len = DIV_ROUND_UP(pat_len, 8);
11386                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11387                         return -EINVAL;
11388                 if (pat_len > coalesce->pattern_max_len ||
11389                     pat_len < coalesce->pattern_min_len)
11390                         return -EINVAL;
11391
11392                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11393                         pkt_offset = 0;
11394                 else
11395                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11396                 if (pkt_offset > coalesce->max_pkt_offset)
11397                         return -EINVAL;
11398                 new_rule->patterns[i].pkt_offset = pkt_offset;
11399
11400                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11401                 if (!mask_pat)
11402                         return -ENOMEM;
11403
11404                 new_rule->patterns[i].mask = mask_pat;
11405                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11406                        mask_len);
11407
11408                 mask_pat += mask_len;
11409                 new_rule->patterns[i].pattern = mask_pat;
11410                 new_rule->patterns[i].pattern_len = pat_len;
11411                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11412                        pat_len);
11413                 i++;
11414         }
11415
11416         return 0;
11417 }
11418
11419 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11420 {
11421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11422         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11423         struct cfg80211_coalesce new_coalesce = {};
11424         struct cfg80211_coalesce *n_coalesce;
11425         int err, rem_rule, n_rules = 0, i, j;
11426         struct nlattr *rule;
11427         struct cfg80211_coalesce_rules *tmp_rule;
11428
11429         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11430                 return -EOPNOTSUPP;
11431
11432         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11433                 cfg80211_rdev_free_coalesce(rdev);
11434                 rdev_set_coalesce(rdev, NULL);
11435                 return 0;
11436         }
11437
11438         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11439                             rem_rule)
11440                 n_rules++;
11441         if (n_rules > coalesce->n_rules)
11442                 return -EINVAL;
11443
11444         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11445                                      GFP_KERNEL);
11446         if (!new_coalesce.rules)
11447                 return -ENOMEM;
11448
11449         new_coalesce.n_rules = n_rules;
11450         i = 0;
11451
11452         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11453                             rem_rule) {
11454                 err = nl80211_parse_coalesce_rule(rdev, rule,
11455                                                   &new_coalesce.rules[i]);
11456                 if (err)
11457                         goto error;
11458
11459                 i++;
11460         }
11461
11462         err = rdev_set_coalesce(rdev, &new_coalesce);
11463         if (err)
11464                 goto error;
11465
11466         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11467         if (!n_coalesce) {
11468                 err = -ENOMEM;
11469                 goto error;
11470         }
11471         cfg80211_rdev_free_coalesce(rdev);
11472         rdev->coalesce = n_coalesce;
11473
11474         return 0;
11475 error:
11476         for (i = 0; i < new_coalesce.n_rules; i++) {
11477                 tmp_rule = &new_coalesce.rules[i];
11478                 for (j = 0; j < tmp_rule->n_patterns; j++)
11479                         kfree(tmp_rule->patterns[j].mask);
11480                 kfree(tmp_rule->patterns);
11481         }
11482         kfree(new_coalesce.rules);
11483
11484         return err;
11485 }
11486
11487 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11488 {
11489         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11490         struct net_device *dev = info->user_ptr[1];
11491         struct wireless_dev *wdev = dev->ieee80211_ptr;
11492         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11493         struct cfg80211_gtk_rekey_data rekey_data;
11494         int err;
11495
11496         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11497                 return -EINVAL;
11498
11499         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11500                                info->attrs[NL80211_ATTR_REKEY_DATA],
11501                                nl80211_rekey_policy, info->extack);
11502         if (err)
11503                 return err;
11504
11505         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11506             !tb[NL80211_REKEY_DATA_KCK])
11507                 return -EINVAL;
11508         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11509                 return -ERANGE;
11510         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11511                 return -ERANGE;
11512         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11513                 return -ERANGE;
11514
11515         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11516         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11517         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11518
11519         wdev_lock(wdev);
11520         if (!wdev->current_bss) {
11521                 err = -ENOTCONN;
11522                 goto out;
11523         }
11524
11525         if (!rdev->ops->set_rekey_data) {
11526                 err = -EOPNOTSUPP;
11527                 goto out;
11528         }
11529
11530         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11531  out:
11532         wdev_unlock(wdev);
11533         return err;
11534 }
11535
11536 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11537                                              struct genl_info *info)
11538 {
11539         struct net_device *dev = info->user_ptr[1];
11540         struct wireless_dev *wdev = dev->ieee80211_ptr;
11541
11542         if (wdev->iftype != NL80211_IFTYPE_AP &&
11543             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11544                 return -EINVAL;
11545
11546         if (wdev->ap_unexpected_nlportid)
11547                 return -EBUSY;
11548
11549         wdev->ap_unexpected_nlportid = info->snd_portid;
11550         return 0;
11551 }
11552
11553 static int nl80211_probe_client(struct sk_buff *skb,
11554                                 struct genl_info *info)
11555 {
11556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11557         struct net_device *dev = info->user_ptr[1];
11558         struct wireless_dev *wdev = dev->ieee80211_ptr;
11559         struct sk_buff *msg;
11560         void *hdr;
11561         const u8 *addr;
11562         u64 cookie;
11563         int err;
11564
11565         if (wdev->iftype != NL80211_IFTYPE_AP &&
11566             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11567                 return -EOPNOTSUPP;
11568
11569         if (!info->attrs[NL80211_ATTR_MAC])
11570                 return -EINVAL;
11571
11572         if (!rdev->ops->probe_client)
11573                 return -EOPNOTSUPP;
11574
11575         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11576         if (!msg)
11577                 return -ENOMEM;
11578
11579         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11580                              NL80211_CMD_PROBE_CLIENT);
11581         if (!hdr) {
11582                 err = -ENOBUFS;
11583                 goto free_msg;
11584         }
11585
11586         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11587
11588         err = rdev_probe_client(rdev, dev, addr, &cookie);
11589         if (err)
11590                 goto free_msg;
11591
11592         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11593                               NL80211_ATTR_PAD))
11594                 goto nla_put_failure;
11595
11596         genlmsg_end(msg, hdr);
11597
11598         return genlmsg_reply(msg, info);
11599
11600  nla_put_failure:
11601         err = -ENOBUFS;
11602  free_msg:
11603         nlmsg_free(msg);
11604         return err;
11605 }
11606
11607 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11608 {
11609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11610         struct cfg80211_beacon_registration *reg, *nreg;
11611         int rv;
11612
11613         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11614                 return -EOPNOTSUPP;
11615
11616         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11617         if (!nreg)
11618                 return -ENOMEM;
11619
11620         /* First, check if already registered. */
11621         spin_lock_bh(&rdev->beacon_registrations_lock);
11622         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11623                 if (reg->nlportid == info->snd_portid) {
11624                         rv = -EALREADY;
11625                         goto out_err;
11626                 }
11627         }
11628         /* Add it to the list */
11629         nreg->nlportid = info->snd_portid;
11630         list_add(&nreg->list, &rdev->beacon_registrations);
11631
11632         spin_unlock_bh(&rdev->beacon_registrations_lock);
11633
11634         return 0;
11635 out_err:
11636         spin_unlock_bh(&rdev->beacon_registrations_lock);
11637         kfree(nreg);
11638         return rv;
11639 }
11640
11641 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11642 {
11643         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11644         struct wireless_dev *wdev = info->user_ptr[1];
11645         int err;
11646
11647         if (!rdev->ops->start_p2p_device)
11648                 return -EOPNOTSUPP;
11649
11650         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11651                 return -EOPNOTSUPP;
11652
11653         if (wdev_running(wdev))
11654                 return 0;
11655
11656         if (rfkill_blocked(rdev->rfkill))
11657                 return -ERFKILL;
11658
11659         err = rdev_start_p2p_device(rdev, wdev);
11660         if (err)
11661                 return err;
11662
11663         wdev->is_running = true;
11664         rdev->opencount++;
11665
11666         return 0;
11667 }
11668
11669 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11670 {
11671         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11672         struct wireless_dev *wdev = info->user_ptr[1];
11673
11674         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11675                 return -EOPNOTSUPP;
11676
11677         if (!rdev->ops->stop_p2p_device)
11678                 return -EOPNOTSUPP;
11679
11680         cfg80211_stop_p2p_device(rdev, wdev);
11681
11682         return 0;
11683 }
11684
11685 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11686 {
11687         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11688         struct wireless_dev *wdev = info->user_ptr[1];
11689         struct cfg80211_nan_conf conf = {};
11690         int err;
11691
11692         if (wdev->iftype != NL80211_IFTYPE_NAN)
11693                 return -EOPNOTSUPP;
11694
11695         if (wdev_running(wdev))
11696                 return -EEXIST;
11697
11698         if (rfkill_blocked(rdev->rfkill))
11699                 return -ERFKILL;
11700
11701         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11702                 return -EINVAL;
11703
11704         conf.master_pref =
11705                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11706         if (!conf.master_pref)
11707                 return -EINVAL;
11708
11709         if (info->attrs[NL80211_ATTR_BANDS]) {
11710                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11711
11712                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11713                         return -EOPNOTSUPP;
11714
11715                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11716                         return -EINVAL;
11717
11718                 conf.bands = bands;
11719         }
11720
11721         err = rdev_start_nan(rdev, wdev, &conf);
11722         if (err)
11723                 return err;
11724
11725         wdev->is_running = true;
11726         rdev->opencount++;
11727
11728         return 0;
11729 }
11730
11731 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11732 {
11733         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11734         struct wireless_dev *wdev = info->user_ptr[1];
11735
11736         if (wdev->iftype != NL80211_IFTYPE_NAN)
11737                 return -EOPNOTSUPP;
11738
11739         cfg80211_stop_nan(rdev, wdev);
11740
11741         return 0;
11742 }
11743
11744 static int validate_nan_filter(struct nlattr *filter_attr)
11745 {
11746         struct nlattr *attr;
11747         int len = 0, n_entries = 0, rem;
11748
11749         nla_for_each_nested(attr, filter_attr, rem) {
11750                 len += nla_len(attr);
11751                 n_entries++;
11752         }
11753
11754         if (len >= U8_MAX)
11755                 return -EINVAL;
11756
11757         return n_entries;
11758 }
11759
11760 static int handle_nan_filter(struct nlattr *attr_filter,
11761                              struct cfg80211_nan_func *func,
11762                              bool tx)
11763 {
11764         struct nlattr *attr;
11765         int n_entries, rem, i;
11766         struct cfg80211_nan_func_filter *filter;
11767
11768         n_entries = validate_nan_filter(attr_filter);
11769         if (n_entries < 0)
11770                 return n_entries;
11771
11772         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11773
11774         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11775         if (!filter)
11776                 return -ENOMEM;
11777
11778         i = 0;
11779         nla_for_each_nested(attr, attr_filter, rem) {
11780                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11781                 filter[i].len = nla_len(attr);
11782                 i++;
11783         }
11784         if (tx) {
11785                 func->num_tx_filters = n_entries;
11786                 func->tx_filters = filter;
11787         } else {
11788                 func->num_rx_filters = n_entries;
11789                 func->rx_filters = filter;
11790         }
11791
11792         return 0;
11793 }
11794
11795 static int nl80211_nan_add_func(struct sk_buff *skb,
11796                                 struct genl_info *info)
11797 {
11798         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11799         struct wireless_dev *wdev = info->user_ptr[1];
11800         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11801         struct cfg80211_nan_func *func;
11802         struct sk_buff *msg = NULL;
11803         void *hdr = NULL;
11804         int err = 0;
11805
11806         if (wdev->iftype != NL80211_IFTYPE_NAN)
11807                 return -EOPNOTSUPP;
11808
11809         if (!wdev_running(wdev))
11810                 return -ENOTCONN;
11811
11812         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11813                 return -EINVAL;
11814
11815         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11816                                info->attrs[NL80211_ATTR_NAN_FUNC],
11817                                nl80211_nan_func_policy, info->extack);
11818         if (err)
11819                 return err;
11820
11821         func = kzalloc(sizeof(*func), GFP_KERNEL);
11822         if (!func)
11823                 return -ENOMEM;
11824
11825         func->cookie = wdev->wiphy->cookie_counter++;
11826
11827         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11828             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11829                 err = -EINVAL;
11830                 goto out;
11831         }
11832
11833
11834         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11835
11836         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11837                 err = -EINVAL;
11838                 goto out;
11839         }
11840
11841         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11842                sizeof(func->service_id));
11843
11844         func->close_range =
11845                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11846
11847         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11848                 func->serv_spec_info_len =
11849                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11850                 func->serv_spec_info =
11851                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11852                                 func->serv_spec_info_len,
11853                                 GFP_KERNEL);
11854                 if (!func->serv_spec_info) {
11855                         err = -ENOMEM;
11856                         goto out;
11857                 }
11858         }
11859
11860         if (tb[NL80211_NAN_FUNC_TTL])
11861                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11862
11863         switch (func->type) {
11864         case NL80211_NAN_FUNC_PUBLISH:
11865                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11866                         err = -EINVAL;
11867                         goto out;
11868                 }
11869
11870                 func->publish_type =
11871                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11872                 func->publish_bcast =
11873                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11874
11875                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11876                         func->publish_bcast) {
11877                         err = -EINVAL;
11878                         goto out;
11879                 }
11880                 break;
11881         case NL80211_NAN_FUNC_SUBSCRIBE:
11882                 func->subscribe_active =
11883                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11884                 break;
11885         case NL80211_NAN_FUNC_FOLLOW_UP:
11886                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11887                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11888                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11889                         err = -EINVAL;
11890                         goto out;
11891                 }
11892
11893                 func->followup_id =
11894                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11895                 func->followup_reqid =
11896                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11897                 memcpy(func->followup_dest.addr,
11898                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11899                        sizeof(func->followup_dest.addr));
11900                 if (func->ttl) {
11901                         err = -EINVAL;
11902                         goto out;
11903                 }
11904                 break;
11905         default:
11906                 err = -EINVAL;
11907                 goto out;
11908         }
11909
11910         if (tb[NL80211_NAN_FUNC_SRF]) {
11911                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11912
11913                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11914                                        tb[NL80211_NAN_FUNC_SRF],
11915                                        nl80211_nan_srf_policy, info->extack);
11916                 if (err)
11917                         goto out;
11918
11919                 func->srf_include =
11920                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11921
11922                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11923                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11924                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11925                                 err = -EINVAL;
11926                                 goto out;
11927                         }
11928
11929                         func->srf_bf_len =
11930                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11931                         func->srf_bf =
11932                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11933                                         func->srf_bf_len, GFP_KERNEL);
11934                         if (!func->srf_bf) {
11935                                 err = -ENOMEM;
11936                                 goto out;
11937                         }
11938
11939                         func->srf_bf_idx =
11940                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11941                 } else {
11942                         struct nlattr *attr, *mac_attr =
11943                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11944                         int n_entries, rem, i = 0;
11945
11946                         if (!mac_attr) {
11947                                 err = -EINVAL;
11948                                 goto out;
11949                         }
11950
11951                         n_entries = validate_acl_mac_addrs(mac_attr);
11952                         if (n_entries <= 0) {
11953                                 err = -EINVAL;
11954                                 goto out;
11955                         }
11956
11957                         func->srf_num_macs = n_entries;
11958                         func->srf_macs =
11959                                 kcalloc(n_entries, sizeof(*func->srf_macs),
11960                                         GFP_KERNEL);
11961                         if (!func->srf_macs) {
11962                                 err = -ENOMEM;
11963                                 goto out;
11964                         }
11965
11966                         nla_for_each_nested(attr, mac_attr, rem)
11967                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11968                                        sizeof(*func->srf_macs));
11969                 }
11970         }
11971
11972         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11973                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11974                                         func, true);
11975                 if (err)
11976                         goto out;
11977         }
11978
11979         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11980                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11981                                         func, false);
11982                 if (err)
11983                         goto out;
11984         }
11985
11986         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11987         if (!msg) {
11988                 err = -ENOMEM;
11989                 goto out;
11990         }
11991
11992         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11993                              NL80211_CMD_ADD_NAN_FUNCTION);
11994         /* This can't really happen - we just allocated 4KB */
11995         if (WARN_ON(!hdr)) {
11996                 err = -ENOMEM;
11997                 goto out;
11998         }
11999
12000         err = rdev_add_nan_func(rdev, wdev, func);
12001 out:
12002         if (err < 0) {
12003                 cfg80211_free_nan_func(func);
12004                 nlmsg_free(msg);
12005                 return err;
12006         }
12007
12008         /* propagate the instance id and cookie to userspace  */
12009         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
12010                               NL80211_ATTR_PAD))
12011                 goto nla_put_failure;
12012
12013         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12014         if (!func_attr)
12015                 goto nla_put_failure;
12016
12017         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
12018                        func->instance_id))
12019                 goto nla_put_failure;
12020
12021         nla_nest_end(msg, func_attr);
12022
12023         genlmsg_end(msg, hdr);
12024         return genlmsg_reply(msg, info);
12025
12026 nla_put_failure:
12027         nlmsg_free(msg);
12028         return -ENOBUFS;
12029 }
12030
12031 static int nl80211_nan_del_func(struct sk_buff *skb,
12032                                struct genl_info *info)
12033 {
12034         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12035         struct wireless_dev *wdev = info->user_ptr[1];
12036         u64 cookie;
12037
12038         if (wdev->iftype != NL80211_IFTYPE_NAN)
12039                 return -EOPNOTSUPP;
12040
12041         if (!wdev_running(wdev))
12042                 return -ENOTCONN;
12043
12044         if (!info->attrs[NL80211_ATTR_COOKIE])
12045                 return -EINVAL;
12046
12047         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12048
12049         rdev_del_nan_func(rdev, wdev, cookie);
12050
12051         return 0;
12052 }
12053
12054 static int nl80211_nan_change_config(struct sk_buff *skb,
12055                                      struct genl_info *info)
12056 {
12057         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12058         struct wireless_dev *wdev = info->user_ptr[1];
12059         struct cfg80211_nan_conf conf = {};
12060         u32 changed = 0;
12061
12062         if (wdev->iftype != NL80211_IFTYPE_NAN)
12063                 return -EOPNOTSUPP;
12064
12065         if (!wdev_running(wdev))
12066                 return -ENOTCONN;
12067
12068         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
12069                 conf.master_pref =
12070                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
12071                 if (conf.master_pref <= 1 || conf.master_pref == 255)
12072                         return -EINVAL;
12073
12074                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
12075         }
12076
12077         if (info->attrs[NL80211_ATTR_BANDS]) {
12078                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
12079
12080                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
12081                         return -EOPNOTSUPP;
12082
12083                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
12084                         return -EINVAL;
12085
12086                 conf.bands = bands;
12087                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
12088         }
12089
12090         if (!changed)
12091                 return -EINVAL;
12092
12093         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
12094 }
12095
12096 void cfg80211_nan_match(struct wireless_dev *wdev,
12097                         struct cfg80211_nan_match_params *match, gfp_t gfp)
12098 {
12099         struct wiphy *wiphy = wdev->wiphy;
12100         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12101         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
12102         struct sk_buff *msg;
12103         void *hdr;
12104
12105         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
12106                 return;
12107
12108         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12109         if (!msg)
12110                 return;
12111
12112         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
12113         if (!hdr) {
12114                 nlmsg_free(msg);
12115                 return;
12116         }
12117
12118         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12119             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12120                                          wdev->netdev->ifindex)) ||
12121             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12122                               NL80211_ATTR_PAD))
12123                 goto nla_put_failure;
12124
12125         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
12126                               NL80211_ATTR_PAD) ||
12127             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
12128                 goto nla_put_failure;
12129
12130         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
12131         if (!match_attr)
12132                 goto nla_put_failure;
12133
12134         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12135         if (!local_func_attr)
12136                 goto nla_put_failure;
12137
12138         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12139                 goto nla_put_failure;
12140
12141         nla_nest_end(msg, local_func_attr);
12142
12143         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12144         if (!peer_func_attr)
12145                 goto nla_put_failure;
12146
12147         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12148             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12149                 goto nla_put_failure;
12150
12151         if (match->info && match->info_len &&
12152             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12153                     match->info))
12154                 goto nla_put_failure;
12155
12156         nla_nest_end(msg, peer_func_attr);
12157         nla_nest_end(msg, match_attr);
12158         genlmsg_end(msg, hdr);
12159
12160         if (!wdev->owner_nlportid)
12161                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12162                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12163         else
12164                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12165                                 wdev->owner_nlportid);
12166
12167         return;
12168
12169 nla_put_failure:
12170         nlmsg_free(msg);
12171 }
12172 EXPORT_SYMBOL(cfg80211_nan_match);
12173
12174 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12175                                   u8 inst_id,
12176                                   enum nl80211_nan_func_term_reason reason,
12177                                   u64 cookie, gfp_t gfp)
12178 {
12179         struct wiphy *wiphy = wdev->wiphy;
12180         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12181         struct sk_buff *msg;
12182         struct nlattr *func_attr;
12183         void *hdr;
12184
12185         if (WARN_ON(!inst_id))
12186                 return;
12187
12188         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12189         if (!msg)
12190                 return;
12191
12192         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12193         if (!hdr) {
12194                 nlmsg_free(msg);
12195                 return;
12196         }
12197
12198         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12199             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12200                                          wdev->netdev->ifindex)) ||
12201             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12202                               NL80211_ATTR_PAD))
12203                 goto nla_put_failure;
12204
12205         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12206                               NL80211_ATTR_PAD))
12207                 goto nla_put_failure;
12208
12209         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12210         if (!func_attr)
12211                 goto nla_put_failure;
12212
12213         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12214             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12215                 goto nla_put_failure;
12216
12217         nla_nest_end(msg, func_attr);
12218         genlmsg_end(msg, hdr);
12219
12220         if (!wdev->owner_nlportid)
12221                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12222                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12223         else
12224                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12225                                 wdev->owner_nlportid);
12226
12227         return;
12228
12229 nla_put_failure:
12230         nlmsg_free(msg);
12231 }
12232 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12233
12234 static int nl80211_get_protocol_features(struct sk_buff *skb,
12235                                          struct genl_info *info)
12236 {
12237         void *hdr;
12238         struct sk_buff *msg;
12239
12240         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12241         if (!msg)
12242                 return -ENOMEM;
12243
12244         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12245                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12246         if (!hdr)
12247                 goto nla_put_failure;
12248
12249         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12250                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12251                 goto nla_put_failure;
12252
12253         genlmsg_end(msg, hdr);
12254         return genlmsg_reply(msg, info);
12255
12256  nla_put_failure:
12257         kfree_skb(msg);
12258         return -ENOBUFS;
12259 }
12260
12261 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12262 {
12263         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12264         struct cfg80211_update_ft_ies_params ft_params;
12265         struct net_device *dev = info->user_ptr[1];
12266
12267         if (!rdev->ops->update_ft_ies)
12268                 return -EOPNOTSUPP;
12269
12270         if (!info->attrs[NL80211_ATTR_MDID] ||
12271             !info->attrs[NL80211_ATTR_IE] ||
12272             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
12273                 return -EINVAL;
12274
12275         memset(&ft_params, 0, sizeof(ft_params));
12276         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12277         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12278         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12279
12280         return rdev_update_ft_ies(rdev, dev, &ft_params);
12281 }
12282
12283 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12284                                        struct genl_info *info)
12285 {
12286         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12287         struct wireless_dev *wdev = info->user_ptr[1];
12288         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12289         u16 duration;
12290         int ret;
12291
12292         if (!rdev->ops->crit_proto_start)
12293                 return -EOPNOTSUPP;
12294
12295         if (WARN_ON(!rdev->ops->crit_proto_stop))
12296                 return -EINVAL;
12297
12298         if (rdev->crit_proto_nlportid)
12299                 return -EBUSY;
12300
12301         /* determine protocol if provided */
12302         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12303                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12304
12305         if (proto >= NUM_NL80211_CRIT_PROTO)
12306                 return -EINVAL;
12307
12308         /* timeout must be provided */
12309         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12310                 return -EINVAL;
12311
12312         duration =
12313                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12314
12315         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12316                 return -ERANGE;
12317
12318         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12319         if (!ret)
12320                 rdev->crit_proto_nlportid = info->snd_portid;
12321
12322         return ret;
12323 }
12324
12325 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12326                                       struct genl_info *info)
12327 {
12328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12329         struct wireless_dev *wdev = info->user_ptr[1];
12330
12331         if (!rdev->ops->crit_proto_stop)
12332                 return -EOPNOTSUPP;
12333
12334         if (rdev->crit_proto_nlportid) {
12335                 rdev->crit_proto_nlportid = 0;
12336                 rdev_crit_proto_stop(rdev, wdev);
12337         }
12338         return 0;
12339 }
12340
12341 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12342 {
12343         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12344         struct wireless_dev *wdev =
12345                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12346         int i, err;
12347         u32 vid, subcmd;
12348
12349         if (!rdev->wiphy.vendor_commands)
12350                 return -EOPNOTSUPP;
12351
12352         if (IS_ERR(wdev)) {
12353                 err = PTR_ERR(wdev);
12354                 if (err != -EINVAL)
12355                         return err;
12356                 wdev = NULL;
12357         } else if (wdev->wiphy != &rdev->wiphy) {
12358                 return -EINVAL;
12359         }
12360
12361         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12362             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12363                 return -EINVAL;
12364
12365         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12366         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12367         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12368                 const struct wiphy_vendor_command *vcmd;
12369                 void *data = NULL;
12370                 int len = 0;
12371
12372                 vcmd = &rdev->wiphy.vendor_commands[i];
12373
12374                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12375                         continue;
12376
12377                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12378                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12379                         if (!wdev)
12380                                 return -EINVAL;
12381                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12382                             !wdev->netdev)
12383                                 return -EINVAL;
12384
12385                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12386                                 if (!wdev_running(wdev))
12387                                         return -ENETDOWN;
12388                         }
12389
12390                         if (!vcmd->doit)
12391                                 return -EOPNOTSUPP;
12392                 } else {
12393                         wdev = NULL;
12394                 }
12395
12396                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12397                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12398                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12399                 }
12400
12401                 rdev->cur_cmd_info = info;
12402                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12403                                                           data, len);
12404                 rdev->cur_cmd_info = NULL;
12405                 return err;
12406         }
12407
12408         return -EOPNOTSUPP;
12409 }
12410
12411 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12412                                        struct netlink_callback *cb,
12413                                        struct cfg80211_registered_device **rdev,
12414                                        struct wireless_dev **wdev)
12415 {
12416         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12417         u32 vid, subcmd;
12418         unsigned int i;
12419         int vcmd_idx = -1;
12420         int err;
12421         void *data = NULL;
12422         unsigned int data_len = 0;
12423
12424         if (cb->args[0]) {
12425                 /* subtract the 1 again here */
12426                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12427                 struct wireless_dev *tmp;
12428
12429                 if (!wiphy)
12430                         return -ENODEV;
12431                 *rdev = wiphy_to_rdev(wiphy);
12432                 *wdev = NULL;
12433
12434                 if (cb->args[1]) {
12435                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12436                                 if (tmp->identifier == cb->args[1] - 1) {
12437                                         *wdev = tmp;
12438                                         break;
12439                                 }
12440                         }
12441                 }
12442
12443                 /* keep rtnl locked in successful case */
12444                 return 0;
12445         }
12446
12447         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12448                           nl80211_fam.maxattr, nl80211_policy, NULL);
12449         if (err)
12450                 return err;
12451
12452         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12453             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12454                 return -EINVAL;
12455
12456         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12457         if (IS_ERR(*wdev))
12458                 *wdev = NULL;
12459
12460         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12461         if (IS_ERR(*rdev))
12462                 return PTR_ERR(*rdev);
12463
12464         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12465         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12466
12467         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12468                 const struct wiphy_vendor_command *vcmd;
12469
12470                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12471
12472                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12473                         continue;
12474
12475                 if (!vcmd->dumpit)
12476                         return -EOPNOTSUPP;
12477
12478                 vcmd_idx = i;
12479                 break;
12480         }
12481
12482         if (vcmd_idx < 0)
12483                 return -EOPNOTSUPP;
12484
12485         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12486                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12487                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12488         }
12489
12490         /* 0 is the first index - add 1 to parse only once */
12491         cb->args[0] = (*rdev)->wiphy_idx + 1;
12492         /* add 1 to know if it was NULL */
12493         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12494         cb->args[2] = vcmd_idx;
12495         cb->args[3] = (unsigned long)data;
12496         cb->args[4] = data_len;
12497
12498         /* keep rtnl locked in successful case */
12499         return 0;
12500 }
12501
12502 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12503                                    struct netlink_callback *cb)
12504 {
12505         struct cfg80211_registered_device *rdev;
12506         struct wireless_dev *wdev;
12507         unsigned int vcmd_idx;
12508         const struct wiphy_vendor_command *vcmd;
12509         void *data;
12510         int data_len;
12511         int err;
12512         struct nlattr *vendor_data;
12513
12514         rtnl_lock();
12515         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12516         if (err)
12517                 goto out;
12518
12519         vcmd_idx = cb->args[2];
12520         data = (void *)cb->args[3];
12521         data_len = cb->args[4];
12522         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12523
12524         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12525                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12526                 if (!wdev) {
12527                         err = -EINVAL;
12528                         goto out;
12529                 }
12530                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12531                     !wdev->netdev) {
12532                         err = -EINVAL;
12533                         goto out;
12534                 }
12535
12536                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12537                         if (!wdev_running(wdev)) {
12538                                 err = -ENETDOWN;
12539                                 goto out;
12540                         }
12541                 }
12542         }
12543
12544         while (1) {
12545                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12546                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12547                                            NL80211_CMD_VENDOR);
12548                 if (!hdr)
12549                         break;
12550
12551                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12552                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12553                                                wdev_id(wdev),
12554                                                NL80211_ATTR_PAD))) {
12555                         genlmsg_cancel(skb, hdr);
12556                         break;
12557                 }
12558
12559                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12560                 if (!vendor_data) {
12561                         genlmsg_cancel(skb, hdr);
12562                         break;
12563                 }
12564
12565                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12566                                    (unsigned long *)&cb->args[5]);
12567                 nla_nest_end(skb, vendor_data);
12568
12569                 if (err == -ENOBUFS || err == -ENOENT) {
12570                         genlmsg_cancel(skb, hdr);
12571                         break;
12572                 } else if (err) {
12573                         genlmsg_cancel(skb, hdr);
12574                         goto out;
12575                 }
12576
12577                 genlmsg_end(skb, hdr);
12578         }
12579
12580         err = skb->len;
12581  out:
12582         rtnl_unlock();
12583         return err;
12584 }
12585
12586 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12587                                            enum nl80211_commands cmd,
12588                                            enum nl80211_attrs attr,
12589                                            int approxlen)
12590 {
12591         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12592
12593         if (WARN_ON(!rdev->cur_cmd_info))
12594                 return NULL;
12595
12596         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12597                                            rdev->cur_cmd_info->snd_portid,
12598                                            rdev->cur_cmd_info->snd_seq,
12599                                            cmd, attr, NULL, GFP_KERNEL);
12600 }
12601 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12602
12603 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12604 {
12605         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12606         void *hdr = ((void **)skb->cb)[1];
12607         struct nlattr *data = ((void **)skb->cb)[2];
12608
12609         /* clear CB data for netlink core to own from now on */
12610         memset(skb->cb, 0, sizeof(skb->cb));
12611
12612         if (WARN_ON(!rdev->cur_cmd_info)) {
12613                 kfree_skb(skb);
12614                 return -EINVAL;
12615         }
12616
12617         nla_nest_end(skb, data);
12618         genlmsg_end(skb, hdr);
12619         return genlmsg_reply(skb, rdev->cur_cmd_info);
12620 }
12621 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12622
12623 static int nl80211_set_qos_map(struct sk_buff *skb,
12624                                struct genl_info *info)
12625 {
12626         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12627         struct cfg80211_qos_map *qos_map = NULL;
12628         struct net_device *dev = info->user_ptr[1];
12629         u8 *pos, len, num_des, des_len, des;
12630         int ret;
12631
12632         if (!rdev->ops->set_qos_map)
12633                 return -EOPNOTSUPP;
12634
12635         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12636                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12637                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12638
12639                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12640                     len > IEEE80211_QOS_MAP_LEN_MAX)
12641                         return -EINVAL;
12642
12643                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12644                 if (!qos_map)
12645                         return -ENOMEM;
12646
12647                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12648                 if (num_des) {
12649                         des_len = num_des *
12650                                 sizeof(struct cfg80211_dscp_exception);
12651                         memcpy(qos_map->dscp_exception, pos, des_len);
12652                         qos_map->num_des = num_des;
12653                         for (des = 0; des < num_des; des++) {
12654                                 if (qos_map->dscp_exception[des].up > 7) {
12655                                         kfree(qos_map);
12656                                         return -EINVAL;
12657                                 }
12658                         }
12659                         pos += des_len;
12660                 }
12661                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12662         }
12663
12664         wdev_lock(dev->ieee80211_ptr);
12665         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12666         if (!ret)
12667                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12668         wdev_unlock(dev->ieee80211_ptr);
12669
12670         kfree(qos_map);
12671         return ret;
12672 }
12673
12674 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12675 {
12676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12677         struct net_device *dev = info->user_ptr[1];
12678         struct wireless_dev *wdev = dev->ieee80211_ptr;
12679         const u8 *peer;
12680         u8 tsid, up;
12681         u16 admitted_time = 0;
12682         int err;
12683
12684         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12685                 return -EOPNOTSUPP;
12686
12687         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12688             !info->attrs[NL80211_ATTR_USER_PRIO])
12689                 return -EINVAL;
12690
12691         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12692         if (tsid >= IEEE80211_NUM_TIDS)
12693                 return -EINVAL;
12694
12695         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12696         if (up >= IEEE80211_NUM_UPS)
12697                 return -EINVAL;
12698
12699         /* WMM uses TIDs 0-7 even for TSPEC */
12700         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12701                 /* TODO: handle 802.11 TSPEC/admission control
12702                  * need more attributes for that (e.g. BA session requirement);
12703                  * change the WMM adminssion test above to allow both then
12704                  */
12705                 return -EINVAL;
12706         }
12707
12708         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12709
12710         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12711                 admitted_time =
12712                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12713                 if (!admitted_time)
12714                         return -EINVAL;
12715         }
12716
12717         wdev_lock(wdev);
12718         switch (wdev->iftype) {
12719         case NL80211_IFTYPE_STATION:
12720         case NL80211_IFTYPE_P2P_CLIENT:
12721                 if (wdev->current_bss)
12722                         break;
12723                 err = -ENOTCONN;
12724                 goto out;
12725         default:
12726                 err = -EOPNOTSUPP;
12727                 goto out;
12728         }
12729
12730         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12731
12732  out:
12733         wdev_unlock(wdev);
12734         return err;
12735 }
12736
12737 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12738 {
12739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12740         struct net_device *dev = info->user_ptr[1];
12741         struct wireless_dev *wdev = dev->ieee80211_ptr;
12742         const u8 *peer;
12743         u8 tsid;
12744         int err;
12745
12746         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12747                 return -EINVAL;
12748
12749         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12750         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12751
12752         wdev_lock(wdev);
12753         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12754         wdev_unlock(wdev);
12755
12756         return err;
12757 }
12758
12759 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12760                                        struct genl_info *info)
12761 {
12762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12763         struct net_device *dev = info->user_ptr[1];
12764         struct wireless_dev *wdev = dev->ieee80211_ptr;
12765         struct cfg80211_chan_def chandef = {};
12766         const u8 *addr;
12767         u8 oper_class;
12768         int err;
12769
12770         if (!rdev->ops->tdls_channel_switch ||
12771             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12772                 return -EOPNOTSUPP;
12773
12774         switch (dev->ieee80211_ptr->iftype) {
12775         case NL80211_IFTYPE_STATION:
12776         case NL80211_IFTYPE_P2P_CLIENT:
12777                 break;
12778         default:
12779                 return -EOPNOTSUPP;
12780         }
12781
12782         if (!info->attrs[NL80211_ATTR_MAC] ||
12783             !info->attrs[NL80211_ATTR_OPER_CLASS])
12784                 return -EINVAL;
12785
12786         err = nl80211_parse_chandef(rdev, info, &chandef);
12787         if (err)
12788                 return err;
12789
12790         /*
12791          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12792          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12793          * specification is not defined for them.
12794          */
12795         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12796             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12797             chandef.width != NL80211_CHAN_WIDTH_20)
12798                 return -EINVAL;
12799
12800         /* we will be active on the TDLS link */
12801         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12802                                            wdev->iftype))
12803                 return -EINVAL;
12804
12805         /* don't allow switching to DFS channels */
12806         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12807                 return -EINVAL;
12808
12809         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12810         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12811
12812         wdev_lock(wdev);
12813         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12814         wdev_unlock(wdev);
12815
12816         return err;
12817 }
12818
12819 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12820                                               struct genl_info *info)
12821 {
12822         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12823         struct net_device *dev = info->user_ptr[1];
12824         struct wireless_dev *wdev = dev->ieee80211_ptr;
12825         const u8 *addr;
12826
12827         if (!rdev->ops->tdls_channel_switch ||
12828             !rdev->ops->tdls_cancel_channel_switch ||
12829             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12830                 return -EOPNOTSUPP;
12831
12832         switch (dev->ieee80211_ptr->iftype) {
12833         case NL80211_IFTYPE_STATION:
12834         case NL80211_IFTYPE_P2P_CLIENT:
12835                 break;
12836         default:
12837                 return -EOPNOTSUPP;
12838         }
12839
12840         if (!info->attrs[NL80211_ATTR_MAC])
12841                 return -EINVAL;
12842
12843         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12844
12845         wdev_lock(wdev);
12846         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12847         wdev_unlock(wdev);
12848
12849         return 0;
12850 }
12851
12852 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12853                                             struct genl_info *info)
12854 {
12855         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12856         struct net_device *dev = info->user_ptr[1];
12857         struct wireless_dev *wdev = dev->ieee80211_ptr;
12858         const struct nlattr *nla;
12859         bool enabled;
12860
12861         if (!rdev->ops->set_multicast_to_unicast)
12862                 return -EOPNOTSUPP;
12863
12864         if (wdev->iftype != NL80211_IFTYPE_AP &&
12865             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12866                 return -EOPNOTSUPP;
12867
12868         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12869         enabled = nla_get_flag(nla);
12870
12871         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12872 }
12873
12874 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12875 {
12876         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12877         struct net_device *dev = info->user_ptr[1];
12878         struct wireless_dev *wdev = dev->ieee80211_ptr;
12879         struct cfg80211_pmk_conf pmk_conf = {};
12880         int ret;
12881
12882         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12883             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12884                 return -EOPNOTSUPP;
12885
12886         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12887                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12888                 return -EOPNOTSUPP;
12889
12890         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12891                 return -EINVAL;
12892
12893         wdev_lock(wdev);
12894         if (!wdev->current_bss) {
12895                 ret = -ENOTCONN;
12896                 goto out;
12897         }
12898
12899         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12900         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12901                 ret = -EINVAL;
12902                 goto out;
12903         }
12904
12905         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12906         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12907         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12908             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12909                 ret = -EINVAL;
12910                 goto out;
12911         }
12912
12913         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12914                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12915
12916                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12917                         ret = -EINVAL;
12918                         goto out;
12919                 }
12920
12921                 pmk_conf.pmk_r0_name =
12922                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12923         }
12924
12925         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12926 out:
12927         wdev_unlock(wdev);
12928         return ret;
12929 }
12930
12931 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12932 {
12933         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12934         struct net_device *dev = info->user_ptr[1];
12935         struct wireless_dev *wdev = dev->ieee80211_ptr;
12936         const u8 *aa;
12937         int ret;
12938
12939         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12940             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12941                 return -EOPNOTSUPP;
12942
12943         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12944                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12945                 return -EOPNOTSUPP;
12946
12947         if (!info->attrs[NL80211_ATTR_MAC])
12948                 return -EINVAL;
12949
12950         wdev_lock(wdev);
12951         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12952         ret = rdev_del_pmk(rdev, dev, aa);
12953         wdev_unlock(wdev);
12954
12955         return ret;
12956 }
12957
12958 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12959 {
12960         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12961         struct net_device *dev = info->user_ptr[1];
12962         struct cfg80211_external_auth_params params;
12963
12964         if (!rdev->ops->external_auth)
12965                 return -EOPNOTSUPP;
12966
12967         if (!info->attrs[NL80211_ATTR_SSID])
12968                 return -EINVAL;
12969
12970         if (!info->attrs[NL80211_ATTR_BSSID])
12971                 return -EINVAL;
12972
12973         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12974                 return -EINVAL;
12975
12976         memset(&params, 0, sizeof(params));
12977
12978         params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12979         if (params.ssid.ssid_len == 0 ||
12980             params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12981                 return -EINVAL;
12982         memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12983                params.ssid.ssid_len);
12984
12985         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12986                ETH_ALEN);
12987
12988         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12989
12990         return rdev_external_auth(rdev, dev, &params);
12991 }
12992
12993 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12994 {
12995         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12996         struct net_device *dev = info->user_ptr[1];
12997         struct wireless_dev *wdev = dev->ieee80211_ptr;
12998         const u8 *buf;
12999         size_t len;
13000         u8 *dest;
13001         u16 proto;
13002         bool noencrypt;
13003         int err;
13004
13005         if (!wiphy_ext_feature_isset(&rdev->wiphy,
13006                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
13007                 return -EOPNOTSUPP;
13008
13009         if (!rdev->ops->tx_control_port)
13010                 return -EOPNOTSUPP;
13011
13012         if (!info->attrs[NL80211_ATTR_FRAME] ||
13013             !info->attrs[NL80211_ATTR_MAC] ||
13014             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
13015                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
13016                 return -EINVAL;
13017         }
13018
13019         wdev_lock(wdev);
13020
13021         switch (wdev->iftype) {
13022         case NL80211_IFTYPE_AP:
13023         case NL80211_IFTYPE_P2P_GO:
13024         case NL80211_IFTYPE_MESH_POINT:
13025                 break;
13026         case NL80211_IFTYPE_ADHOC:
13027         case NL80211_IFTYPE_STATION:
13028         case NL80211_IFTYPE_P2P_CLIENT:
13029                 if (wdev->current_bss)
13030                         break;
13031                 err = -ENOTCONN;
13032                 goto out;
13033         default:
13034                 err = -EOPNOTSUPP;
13035                 goto out;
13036         }
13037
13038         wdev_unlock(wdev);
13039
13040         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
13041         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
13042         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
13043         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
13044         noencrypt =
13045                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
13046
13047         return rdev_tx_control_port(rdev, dev, buf, len,
13048                                     dest, cpu_to_be16(proto), noencrypt);
13049
13050  out:
13051         wdev_unlock(wdev);
13052         return err;
13053 }
13054
13055 #define NL80211_FLAG_NEED_WIPHY         0x01
13056 #define NL80211_FLAG_NEED_NETDEV        0x02
13057 #define NL80211_FLAG_NEED_RTNL          0x04
13058 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
13059 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
13060                                          NL80211_FLAG_CHECK_NETDEV_UP)
13061 #define NL80211_FLAG_NEED_WDEV          0x10
13062 /* If a netdev is associated, it must be UP, P2P must be started */
13063 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
13064                                          NL80211_FLAG_CHECK_NETDEV_UP)
13065 #define NL80211_FLAG_CLEAR_SKB          0x20
13066
13067 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
13068                             struct genl_info *info)
13069 {
13070         struct cfg80211_registered_device *rdev;
13071         struct wireless_dev *wdev;
13072         struct net_device *dev;
13073         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13074
13075         if (rtnl)
13076                 rtnl_lock();
13077
13078         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13079                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13080                 if (IS_ERR(rdev)) {
13081                         if (rtnl)
13082                                 rtnl_unlock();
13083                         return PTR_ERR(rdev);
13084                 }
13085                 info->user_ptr[0] = rdev;
13086         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13087                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13088                 ASSERT_RTNL();
13089
13090                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13091                                                   info->attrs);
13092                 if (IS_ERR(wdev)) {
13093                         if (rtnl)
13094                                 rtnl_unlock();
13095                         return PTR_ERR(wdev);
13096                 }
13097
13098                 dev = wdev->netdev;
13099                 rdev = wiphy_to_rdev(wdev->wiphy);
13100
13101                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13102                         if (!dev) {
13103                                 if (rtnl)
13104                                         rtnl_unlock();
13105                                 return -EINVAL;
13106                         }
13107
13108                         info->user_ptr[1] = dev;
13109                 } else {
13110                         info->user_ptr[1] = wdev;
13111                 }
13112
13113                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13114                     !wdev_running(wdev)) {
13115                         if (rtnl)
13116                                 rtnl_unlock();
13117                         return -ENETDOWN;
13118                 }
13119
13120                 if (dev)
13121                         dev_hold(dev);
13122
13123                 info->user_ptr[0] = rdev;
13124         }
13125
13126         return 0;
13127 }
13128
13129 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13130                               struct genl_info *info)
13131 {
13132         if (info->user_ptr[1]) {
13133                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13134                         struct wireless_dev *wdev = info->user_ptr[1];
13135
13136                         if (wdev->netdev)
13137                                 dev_put(wdev->netdev);
13138                 } else {
13139                         dev_put(info->user_ptr[1]);
13140                 }
13141         }
13142
13143         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13144                 rtnl_unlock();
13145
13146         /* If needed, clear the netlink message payload from the SKB
13147          * as it might contain key data that shouldn't stick around on
13148          * the heap after the SKB is freed. The netlink message header
13149          * is still needed for further processing, so leave it intact.
13150          */
13151         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13152                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13153
13154                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13155         }
13156 }
13157
13158 static const struct genl_ops nl80211_ops[] = {
13159         {
13160                 .cmd = NL80211_CMD_GET_WIPHY,
13161                 .doit = nl80211_get_wiphy,
13162                 .dumpit = nl80211_dump_wiphy,
13163                 .done = nl80211_dump_wiphy_done,
13164                 .policy = nl80211_policy,
13165                 /* can be retrieved by unprivileged users */
13166                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13167                                   NL80211_FLAG_NEED_RTNL,
13168         },
13169         {
13170                 .cmd = NL80211_CMD_SET_WIPHY,
13171                 .doit = nl80211_set_wiphy,
13172                 .policy = nl80211_policy,
13173                 .flags = GENL_UNS_ADMIN_PERM,
13174                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13175         },
13176         {
13177                 .cmd = NL80211_CMD_GET_INTERFACE,
13178                 .doit = nl80211_get_interface,
13179                 .dumpit = nl80211_dump_interface,
13180                 .policy = nl80211_policy,
13181                 /* can be retrieved by unprivileged users */
13182                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13183                                   NL80211_FLAG_NEED_RTNL,
13184         },
13185         {
13186                 .cmd = NL80211_CMD_SET_INTERFACE,
13187                 .doit = nl80211_set_interface,
13188                 .policy = nl80211_policy,
13189                 .flags = GENL_UNS_ADMIN_PERM,
13190                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13191                                   NL80211_FLAG_NEED_RTNL,
13192         },
13193         {
13194                 .cmd = NL80211_CMD_NEW_INTERFACE,
13195                 .doit = nl80211_new_interface,
13196                 .policy = nl80211_policy,
13197                 .flags = GENL_UNS_ADMIN_PERM,
13198                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13199                                   NL80211_FLAG_NEED_RTNL,
13200         },
13201         {
13202                 .cmd = NL80211_CMD_DEL_INTERFACE,
13203                 .doit = nl80211_del_interface,
13204                 .policy = nl80211_policy,
13205                 .flags = GENL_UNS_ADMIN_PERM,
13206                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13207                                   NL80211_FLAG_NEED_RTNL,
13208         },
13209         {
13210                 .cmd = NL80211_CMD_GET_KEY,
13211                 .doit = nl80211_get_key,
13212                 .policy = nl80211_policy,
13213                 .flags = GENL_UNS_ADMIN_PERM,
13214                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13215                                   NL80211_FLAG_NEED_RTNL,
13216         },
13217         {
13218                 .cmd = NL80211_CMD_SET_KEY,
13219                 .doit = nl80211_set_key,
13220                 .policy = nl80211_policy,
13221                 .flags = GENL_UNS_ADMIN_PERM,
13222                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13223                                   NL80211_FLAG_NEED_RTNL |
13224                                   NL80211_FLAG_CLEAR_SKB,
13225         },
13226         {
13227                 .cmd = NL80211_CMD_NEW_KEY,
13228                 .doit = nl80211_new_key,
13229                 .policy = nl80211_policy,
13230                 .flags = GENL_UNS_ADMIN_PERM,
13231                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13232                                   NL80211_FLAG_NEED_RTNL |
13233                                   NL80211_FLAG_CLEAR_SKB,
13234         },
13235         {
13236                 .cmd = NL80211_CMD_DEL_KEY,
13237                 .doit = nl80211_del_key,
13238                 .policy = nl80211_policy,
13239                 .flags = GENL_UNS_ADMIN_PERM,
13240                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13241                                   NL80211_FLAG_NEED_RTNL,
13242         },
13243         {
13244                 .cmd = NL80211_CMD_SET_BEACON,
13245                 .policy = nl80211_policy,
13246                 .flags = GENL_UNS_ADMIN_PERM,
13247                 .doit = nl80211_set_beacon,
13248                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13249                                   NL80211_FLAG_NEED_RTNL,
13250         },
13251         {
13252                 .cmd = NL80211_CMD_START_AP,
13253                 .policy = nl80211_policy,
13254                 .flags = GENL_UNS_ADMIN_PERM,
13255                 .doit = nl80211_start_ap,
13256                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13257                                   NL80211_FLAG_NEED_RTNL,
13258         },
13259         {
13260                 .cmd = NL80211_CMD_STOP_AP,
13261                 .policy = nl80211_policy,
13262                 .flags = GENL_UNS_ADMIN_PERM,
13263                 .doit = nl80211_stop_ap,
13264                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13265                                   NL80211_FLAG_NEED_RTNL,
13266         },
13267         {
13268                 .cmd = NL80211_CMD_GET_STATION,
13269                 .doit = nl80211_get_station,
13270                 .dumpit = nl80211_dump_station,
13271                 .policy = nl80211_policy,
13272                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13273                                   NL80211_FLAG_NEED_RTNL,
13274         },
13275         {
13276                 .cmd = NL80211_CMD_SET_STATION,
13277                 .doit = nl80211_set_station,
13278                 .policy = nl80211_policy,
13279                 .flags = GENL_UNS_ADMIN_PERM,
13280                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13281                                   NL80211_FLAG_NEED_RTNL,
13282         },
13283         {
13284                 .cmd = NL80211_CMD_NEW_STATION,
13285                 .doit = nl80211_new_station,
13286                 .policy = nl80211_policy,
13287                 .flags = GENL_UNS_ADMIN_PERM,
13288                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13289                                   NL80211_FLAG_NEED_RTNL,
13290         },
13291         {
13292                 .cmd = NL80211_CMD_DEL_STATION,
13293                 .doit = nl80211_del_station,
13294                 .policy = nl80211_policy,
13295                 .flags = GENL_UNS_ADMIN_PERM,
13296                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13297                                   NL80211_FLAG_NEED_RTNL,
13298         },
13299         {
13300                 .cmd = NL80211_CMD_GET_MPATH,
13301                 .doit = nl80211_get_mpath,
13302                 .dumpit = nl80211_dump_mpath,
13303                 .policy = nl80211_policy,
13304                 .flags = GENL_UNS_ADMIN_PERM,
13305                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13306                                   NL80211_FLAG_NEED_RTNL,
13307         },
13308         {
13309                 .cmd = NL80211_CMD_GET_MPP,
13310                 .doit = nl80211_get_mpp,
13311                 .dumpit = nl80211_dump_mpp,
13312                 .policy = nl80211_policy,
13313                 .flags = GENL_UNS_ADMIN_PERM,
13314                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13315                                   NL80211_FLAG_NEED_RTNL,
13316         },
13317         {
13318                 .cmd = NL80211_CMD_SET_MPATH,
13319                 .doit = nl80211_set_mpath,
13320                 .policy = nl80211_policy,
13321                 .flags = GENL_UNS_ADMIN_PERM,
13322                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13323                                   NL80211_FLAG_NEED_RTNL,
13324         },
13325         {
13326                 .cmd = NL80211_CMD_NEW_MPATH,
13327                 .doit = nl80211_new_mpath,
13328                 .policy = nl80211_policy,
13329                 .flags = GENL_UNS_ADMIN_PERM,
13330                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13331                                   NL80211_FLAG_NEED_RTNL,
13332         },
13333         {
13334                 .cmd = NL80211_CMD_DEL_MPATH,
13335                 .doit = nl80211_del_mpath,
13336                 .policy = nl80211_policy,
13337                 .flags = GENL_UNS_ADMIN_PERM,
13338                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13339                                   NL80211_FLAG_NEED_RTNL,
13340         },
13341         {
13342                 .cmd = NL80211_CMD_SET_BSS,
13343                 .doit = nl80211_set_bss,
13344                 .policy = nl80211_policy,
13345                 .flags = GENL_UNS_ADMIN_PERM,
13346                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13347                                   NL80211_FLAG_NEED_RTNL,
13348         },
13349         {
13350                 .cmd = NL80211_CMD_GET_REG,
13351                 .doit = nl80211_get_reg_do,
13352                 .dumpit = nl80211_get_reg_dump,
13353                 .policy = nl80211_policy,
13354                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13355                 /* can be retrieved by unprivileged users */
13356         },
13357 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13358         {
13359                 .cmd = NL80211_CMD_SET_REG,
13360                 .doit = nl80211_set_reg,
13361                 .policy = nl80211_policy,
13362                 .flags = GENL_ADMIN_PERM,
13363                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13364         },
13365 #endif
13366         {
13367                 .cmd = NL80211_CMD_REQ_SET_REG,
13368                 .doit = nl80211_req_set_reg,
13369                 .policy = nl80211_policy,
13370                 .flags = GENL_ADMIN_PERM,
13371         },
13372         {
13373                 .cmd = NL80211_CMD_RELOAD_REGDB,
13374                 .doit = nl80211_reload_regdb,
13375                 .policy = nl80211_policy,
13376                 .flags = GENL_ADMIN_PERM,
13377         },
13378         {
13379                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13380                 .doit = nl80211_get_mesh_config,
13381                 .policy = nl80211_policy,
13382                 /* can be retrieved by unprivileged users */
13383                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13384                                   NL80211_FLAG_NEED_RTNL,
13385         },
13386         {
13387                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13388                 .doit = nl80211_update_mesh_config,
13389                 .policy = nl80211_policy,
13390                 .flags = GENL_UNS_ADMIN_PERM,
13391                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13392                                   NL80211_FLAG_NEED_RTNL,
13393         },
13394         {
13395                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13396                 .doit = nl80211_trigger_scan,
13397                 .policy = nl80211_policy,
13398                 .flags = GENL_UNS_ADMIN_PERM,
13399                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13400                                   NL80211_FLAG_NEED_RTNL,
13401         },
13402         {
13403                 .cmd = NL80211_CMD_ABORT_SCAN,
13404                 .doit = nl80211_abort_scan,
13405                 .policy = nl80211_policy,
13406                 .flags = GENL_UNS_ADMIN_PERM,
13407                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13408                                   NL80211_FLAG_NEED_RTNL,
13409         },
13410         {
13411                 .cmd = NL80211_CMD_GET_SCAN,
13412                 .policy = nl80211_policy,
13413                 .dumpit = nl80211_dump_scan,
13414         },
13415         {
13416                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13417                 .doit = nl80211_start_sched_scan,
13418                 .policy = nl80211_policy,
13419                 .flags = GENL_UNS_ADMIN_PERM,
13420                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13421                                   NL80211_FLAG_NEED_RTNL,
13422         },
13423         {
13424                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13425                 .doit = nl80211_stop_sched_scan,
13426                 .policy = nl80211_policy,
13427                 .flags = GENL_UNS_ADMIN_PERM,
13428                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13429                                   NL80211_FLAG_NEED_RTNL,
13430         },
13431         {
13432                 .cmd = NL80211_CMD_AUTHENTICATE,
13433                 .doit = nl80211_authenticate,
13434                 .policy = nl80211_policy,
13435                 .flags = GENL_UNS_ADMIN_PERM,
13436                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13437                                   NL80211_FLAG_NEED_RTNL |
13438                                   NL80211_FLAG_CLEAR_SKB,
13439         },
13440         {
13441                 .cmd = NL80211_CMD_ASSOCIATE,
13442                 .doit = nl80211_associate,
13443                 .policy = nl80211_policy,
13444                 .flags = GENL_UNS_ADMIN_PERM,
13445                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13446                                   NL80211_FLAG_NEED_RTNL |
13447                                   NL80211_FLAG_CLEAR_SKB,
13448         },
13449         {
13450                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13451                 .doit = nl80211_deauthenticate,
13452                 .policy = nl80211_policy,
13453                 .flags = GENL_UNS_ADMIN_PERM,
13454                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13455                                   NL80211_FLAG_NEED_RTNL,
13456         },
13457         {
13458                 .cmd = NL80211_CMD_DISASSOCIATE,
13459                 .doit = nl80211_disassociate,
13460                 .policy = nl80211_policy,
13461                 .flags = GENL_UNS_ADMIN_PERM,
13462                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13463                                   NL80211_FLAG_NEED_RTNL,
13464         },
13465         {
13466                 .cmd = NL80211_CMD_JOIN_IBSS,
13467                 .doit = nl80211_join_ibss,
13468                 .policy = nl80211_policy,
13469                 .flags = GENL_UNS_ADMIN_PERM,
13470                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13471                                   NL80211_FLAG_NEED_RTNL,
13472         },
13473         {
13474                 .cmd = NL80211_CMD_LEAVE_IBSS,
13475                 .doit = nl80211_leave_ibss,
13476                 .policy = nl80211_policy,
13477                 .flags = GENL_UNS_ADMIN_PERM,
13478                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13479                                   NL80211_FLAG_NEED_RTNL,
13480         },
13481 #ifdef CONFIG_NL80211_TESTMODE
13482         {
13483                 .cmd = NL80211_CMD_TESTMODE,
13484                 .doit = nl80211_testmode_do,
13485                 .dumpit = nl80211_testmode_dump,
13486                 .policy = nl80211_policy,
13487                 .flags = GENL_UNS_ADMIN_PERM,
13488                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13489                                   NL80211_FLAG_NEED_RTNL,
13490         },
13491 #endif
13492         {
13493                 .cmd = NL80211_CMD_CONNECT,
13494                 .doit = nl80211_connect,
13495                 .policy = nl80211_policy,
13496                 .flags = GENL_UNS_ADMIN_PERM,
13497                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13498                                   NL80211_FLAG_NEED_RTNL |
13499                                   NL80211_FLAG_CLEAR_SKB,
13500         },
13501         {
13502                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13503                 .doit = nl80211_update_connect_params,
13504                 .policy = nl80211_policy,
13505                 .flags = GENL_ADMIN_PERM,
13506                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13507                                   NL80211_FLAG_NEED_RTNL |
13508                                   NL80211_FLAG_CLEAR_SKB,
13509         },
13510         {
13511                 .cmd = NL80211_CMD_DISCONNECT,
13512                 .doit = nl80211_disconnect,
13513                 .policy = nl80211_policy,
13514                 .flags = GENL_UNS_ADMIN_PERM,
13515                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13516                                   NL80211_FLAG_NEED_RTNL,
13517         },
13518         {
13519                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13520                 .doit = nl80211_wiphy_netns,
13521                 .policy = nl80211_policy,
13522                 .flags = GENL_UNS_ADMIN_PERM,
13523                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13524                                   NL80211_FLAG_NEED_RTNL,
13525         },
13526         {
13527                 .cmd = NL80211_CMD_GET_SURVEY,
13528                 .policy = nl80211_policy,
13529                 .dumpit = nl80211_dump_survey,
13530         },
13531         {
13532                 .cmd = NL80211_CMD_SET_PMKSA,
13533                 .doit = nl80211_setdel_pmksa,
13534                 .policy = nl80211_policy,
13535                 .flags = GENL_UNS_ADMIN_PERM,
13536                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13537                                   NL80211_FLAG_NEED_RTNL |
13538                                   NL80211_FLAG_CLEAR_SKB,
13539         },
13540         {
13541                 .cmd = NL80211_CMD_DEL_PMKSA,
13542                 .doit = nl80211_setdel_pmksa,
13543                 .policy = nl80211_policy,
13544                 .flags = GENL_UNS_ADMIN_PERM,
13545                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13546                                   NL80211_FLAG_NEED_RTNL,
13547         },
13548         {
13549                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13550                 .doit = nl80211_flush_pmksa,
13551                 .policy = nl80211_policy,
13552                 .flags = GENL_UNS_ADMIN_PERM,
13553                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13554                                   NL80211_FLAG_NEED_RTNL,
13555         },
13556         {
13557                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13558                 .doit = nl80211_remain_on_channel,
13559                 .policy = nl80211_policy,
13560                 .flags = GENL_UNS_ADMIN_PERM,
13561                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13562                                   NL80211_FLAG_NEED_RTNL,
13563         },
13564         {
13565                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13566                 .doit = nl80211_cancel_remain_on_channel,
13567                 .policy = nl80211_policy,
13568                 .flags = GENL_UNS_ADMIN_PERM,
13569                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13570                                   NL80211_FLAG_NEED_RTNL,
13571         },
13572         {
13573                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13574                 .doit = nl80211_set_tx_bitrate_mask,
13575                 .policy = nl80211_policy,
13576                 .flags = GENL_UNS_ADMIN_PERM,
13577                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13578                                   NL80211_FLAG_NEED_RTNL,
13579         },
13580         {
13581                 .cmd = NL80211_CMD_REGISTER_FRAME,
13582                 .doit = nl80211_register_mgmt,
13583                 .policy = nl80211_policy,
13584                 .flags = GENL_UNS_ADMIN_PERM,
13585                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13586                                   NL80211_FLAG_NEED_RTNL,
13587         },
13588         {
13589                 .cmd = NL80211_CMD_FRAME,
13590                 .doit = nl80211_tx_mgmt,
13591                 .policy = nl80211_policy,
13592                 .flags = GENL_UNS_ADMIN_PERM,
13593                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13594                                   NL80211_FLAG_NEED_RTNL,
13595         },
13596         {
13597                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13598                 .doit = nl80211_tx_mgmt_cancel_wait,
13599                 .policy = nl80211_policy,
13600                 .flags = GENL_UNS_ADMIN_PERM,
13601                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13602                                   NL80211_FLAG_NEED_RTNL,
13603         },
13604         {
13605                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13606                 .doit = nl80211_set_power_save,
13607                 .policy = nl80211_policy,
13608                 .flags = GENL_UNS_ADMIN_PERM,
13609                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13610                                   NL80211_FLAG_NEED_RTNL,
13611         },
13612         {
13613                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13614                 .doit = nl80211_get_power_save,
13615                 .policy = nl80211_policy,
13616                 /* can be retrieved by unprivileged users */
13617                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13618                                   NL80211_FLAG_NEED_RTNL,
13619         },
13620         {
13621                 .cmd = NL80211_CMD_SET_CQM,
13622                 .doit = nl80211_set_cqm,
13623                 .policy = nl80211_policy,
13624                 .flags = GENL_UNS_ADMIN_PERM,
13625                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13626                                   NL80211_FLAG_NEED_RTNL,
13627         },
13628         {
13629                 .cmd = NL80211_CMD_SET_CHANNEL,
13630                 .doit = nl80211_set_channel,
13631                 .policy = nl80211_policy,
13632                 .flags = GENL_UNS_ADMIN_PERM,
13633                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13634                                   NL80211_FLAG_NEED_RTNL,
13635         },
13636         {
13637                 .cmd = NL80211_CMD_SET_WDS_PEER,
13638                 .doit = nl80211_set_wds_peer,
13639                 .policy = nl80211_policy,
13640                 .flags = GENL_UNS_ADMIN_PERM,
13641                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13642                                   NL80211_FLAG_NEED_RTNL,
13643         },
13644         {
13645                 .cmd = NL80211_CMD_JOIN_MESH,
13646                 .doit = nl80211_join_mesh,
13647                 .policy = nl80211_policy,
13648                 .flags = GENL_UNS_ADMIN_PERM,
13649                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13650                                   NL80211_FLAG_NEED_RTNL,
13651         },
13652         {
13653                 .cmd = NL80211_CMD_LEAVE_MESH,
13654                 .doit = nl80211_leave_mesh,
13655                 .policy = nl80211_policy,
13656                 .flags = GENL_UNS_ADMIN_PERM,
13657                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13658                                   NL80211_FLAG_NEED_RTNL,
13659         },
13660         {
13661                 .cmd = NL80211_CMD_JOIN_OCB,
13662                 .doit = nl80211_join_ocb,
13663                 .policy = nl80211_policy,
13664                 .flags = GENL_UNS_ADMIN_PERM,
13665                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13666                                   NL80211_FLAG_NEED_RTNL,
13667         },
13668         {
13669                 .cmd = NL80211_CMD_LEAVE_OCB,
13670                 .doit = nl80211_leave_ocb,
13671                 .policy = nl80211_policy,
13672                 .flags = GENL_UNS_ADMIN_PERM,
13673                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13674                                   NL80211_FLAG_NEED_RTNL,
13675         },
13676 #ifdef CONFIG_PM
13677         {
13678                 .cmd = NL80211_CMD_GET_WOWLAN,
13679                 .doit = nl80211_get_wowlan,
13680                 .policy = nl80211_policy,
13681                 /* can be retrieved by unprivileged users */
13682                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13683                                   NL80211_FLAG_NEED_RTNL,
13684         },
13685         {
13686                 .cmd = NL80211_CMD_SET_WOWLAN,
13687                 .doit = nl80211_set_wowlan,
13688                 .policy = nl80211_policy,
13689                 .flags = GENL_UNS_ADMIN_PERM,
13690                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13691                                   NL80211_FLAG_NEED_RTNL,
13692         },
13693 #endif
13694         {
13695                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13696                 .doit = nl80211_set_rekey_data,
13697                 .policy = nl80211_policy,
13698                 .flags = GENL_UNS_ADMIN_PERM,
13699                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13700                                   NL80211_FLAG_NEED_RTNL |
13701                                   NL80211_FLAG_CLEAR_SKB,
13702         },
13703         {
13704                 .cmd = NL80211_CMD_TDLS_MGMT,
13705                 .doit = nl80211_tdls_mgmt,
13706                 .policy = nl80211_policy,
13707                 .flags = GENL_UNS_ADMIN_PERM,
13708                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13709                                   NL80211_FLAG_NEED_RTNL,
13710         },
13711         {
13712                 .cmd = NL80211_CMD_TDLS_OPER,
13713                 .doit = nl80211_tdls_oper,
13714                 .policy = nl80211_policy,
13715                 .flags = GENL_UNS_ADMIN_PERM,
13716                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13717                                   NL80211_FLAG_NEED_RTNL,
13718         },
13719         {
13720                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13721                 .doit = nl80211_register_unexpected_frame,
13722                 .policy = nl80211_policy,
13723                 .flags = GENL_UNS_ADMIN_PERM,
13724                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13725                                   NL80211_FLAG_NEED_RTNL,
13726         },
13727         {
13728                 .cmd = NL80211_CMD_PROBE_CLIENT,
13729                 .doit = nl80211_probe_client,
13730                 .policy = nl80211_policy,
13731                 .flags = GENL_UNS_ADMIN_PERM,
13732                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13733                                   NL80211_FLAG_NEED_RTNL,
13734         },
13735         {
13736                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13737                 .doit = nl80211_register_beacons,
13738                 .policy = nl80211_policy,
13739                 .flags = GENL_UNS_ADMIN_PERM,
13740                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13741                                   NL80211_FLAG_NEED_RTNL,
13742         },
13743         {
13744                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13745                 .doit = nl80211_set_noack_map,
13746                 .policy = nl80211_policy,
13747                 .flags = GENL_UNS_ADMIN_PERM,
13748                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13749                                   NL80211_FLAG_NEED_RTNL,
13750         },
13751         {
13752                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13753                 .doit = nl80211_start_p2p_device,
13754                 .policy = nl80211_policy,
13755                 .flags = GENL_UNS_ADMIN_PERM,
13756                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13757                                   NL80211_FLAG_NEED_RTNL,
13758         },
13759         {
13760                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13761                 .doit = nl80211_stop_p2p_device,
13762                 .policy = nl80211_policy,
13763                 .flags = GENL_UNS_ADMIN_PERM,
13764                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13765                                   NL80211_FLAG_NEED_RTNL,
13766         },
13767         {
13768                 .cmd = NL80211_CMD_START_NAN,
13769                 .doit = nl80211_start_nan,
13770                 .policy = nl80211_policy,
13771                 .flags = GENL_ADMIN_PERM,
13772                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13773                                   NL80211_FLAG_NEED_RTNL,
13774         },
13775         {
13776                 .cmd = NL80211_CMD_STOP_NAN,
13777                 .doit = nl80211_stop_nan,
13778                 .policy = nl80211_policy,
13779                 .flags = GENL_ADMIN_PERM,
13780                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13781                                   NL80211_FLAG_NEED_RTNL,
13782         },
13783         {
13784                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13785                 .doit = nl80211_nan_add_func,
13786                 .policy = nl80211_policy,
13787                 .flags = GENL_ADMIN_PERM,
13788                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13789                                   NL80211_FLAG_NEED_RTNL,
13790         },
13791         {
13792                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13793                 .doit = nl80211_nan_del_func,
13794                 .policy = nl80211_policy,
13795                 .flags = GENL_ADMIN_PERM,
13796                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13797                                   NL80211_FLAG_NEED_RTNL,
13798         },
13799         {
13800                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13801                 .doit = nl80211_nan_change_config,
13802                 .policy = nl80211_policy,
13803                 .flags = GENL_ADMIN_PERM,
13804                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13805                                   NL80211_FLAG_NEED_RTNL,
13806         },
13807         {
13808                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13809                 .doit = nl80211_set_mcast_rate,
13810                 .policy = nl80211_policy,
13811                 .flags = GENL_UNS_ADMIN_PERM,
13812                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13813                                   NL80211_FLAG_NEED_RTNL,
13814         },
13815         {
13816                 .cmd = NL80211_CMD_SET_MAC_ACL,
13817                 .doit = nl80211_set_mac_acl,
13818                 .policy = nl80211_policy,
13819                 .flags = GENL_UNS_ADMIN_PERM,
13820                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13821                                   NL80211_FLAG_NEED_RTNL,
13822         },
13823         {
13824                 .cmd = NL80211_CMD_RADAR_DETECT,
13825                 .doit = nl80211_start_radar_detection,
13826                 .policy = nl80211_policy,
13827                 .flags = GENL_UNS_ADMIN_PERM,
13828                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13829                                   NL80211_FLAG_NEED_RTNL,
13830         },
13831         {
13832                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13833                 .doit = nl80211_get_protocol_features,
13834                 .policy = nl80211_policy,
13835         },
13836         {
13837                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13838                 .doit = nl80211_update_ft_ies,
13839                 .policy = nl80211_policy,
13840                 .flags = GENL_UNS_ADMIN_PERM,
13841                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13842                                   NL80211_FLAG_NEED_RTNL,
13843         },
13844         {
13845                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13846                 .doit = nl80211_crit_protocol_start,
13847                 .policy = nl80211_policy,
13848                 .flags = GENL_UNS_ADMIN_PERM,
13849                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13850                                   NL80211_FLAG_NEED_RTNL,
13851         },
13852         {
13853                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13854                 .doit = nl80211_crit_protocol_stop,
13855                 .policy = nl80211_policy,
13856                 .flags = GENL_UNS_ADMIN_PERM,
13857                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13858                                   NL80211_FLAG_NEED_RTNL,
13859         },
13860         {
13861                 .cmd = NL80211_CMD_GET_COALESCE,
13862                 .doit = nl80211_get_coalesce,
13863                 .policy = nl80211_policy,
13864                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13865                                   NL80211_FLAG_NEED_RTNL,
13866         },
13867         {
13868                 .cmd = NL80211_CMD_SET_COALESCE,
13869                 .doit = nl80211_set_coalesce,
13870                 .policy = nl80211_policy,
13871                 .flags = GENL_UNS_ADMIN_PERM,
13872                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13873                                   NL80211_FLAG_NEED_RTNL,
13874         },
13875         {
13876                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13877                 .doit = nl80211_channel_switch,
13878                 .policy = nl80211_policy,
13879                 .flags = GENL_UNS_ADMIN_PERM,
13880                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13881                                   NL80211_FLAG_NEED_RTNL,
13882         },
13883         {
13884                 .cmd = NL80211_CMD_VENDOR,
13885                 .doit = nl80211_vendor_cmd,
13886                 .dumpit = nl80211_vendor_cmd_dump,
13887                 .policy = nl80211_policy,
13888                 .flags = GENL_UNS_ADMIN_PERM,
13889                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13890                                   NL80211_FLAG_NEED_RTNL |
13891                                   NL80211_FLAG_CLEAR_SKB,
13892         },
13893         {
13894                 .cmd = NL80211_CMD_SET_QOS_MAP,
13895                 .doit = nl80211_set_qos_map,
13896                 .policy = nl80211_policy,
13897                 .flags = GENL_UNS_ADMIN_PERM,
13898                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13899                                   NL80211_FLAG_NEED_RTNL,
13900         },
13901         {
13902                 .cmd = NL80211_CMD_ADD_TX_TS,
13903                 .doit = nl80211_add_tx_ts,
13904                 .policy = nl80211_policy,
13905                 .flags = GENL_UNS_ADMIN_PERM,
13906                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13907                                   NL80211_FLAG_NEED_RTNL,
13908         },
13909         {
13910                 .cmd = NL80211_CMD_DEL_TX_TS,
13911                 .doit = nl80211_del_tx_ts,
13912                 .policy = nl80211_policy,
13913                 .flags = GENL_UNS_ADMIN_PERM,
13914                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13915                                   NL80211_FLAG_NEED_RTNL,
13916         },
13917         {
13918                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13919                 .doit = nl80211_tdls_channel_switch,
13920                 .policy = nl80211_policy,
13921                 .flags = GENL_UNS_ADMIN_PERM,
13922                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13923                                   NL80211_FLAG_NEED_RTNL,
13924         },
13925         {
13926                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13927                 .doit = nl80211_tdls_cancel_channel_switch,
13928                 .policy = nl80211_policy,
13929                 .flags = GENL_UNS_ADMIN_PERM,
13930                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13931                                   NL80211_FLAG_NEED_RTNL,
13932         },
13933         {
13934                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13935                 .doit = nl80211_set_multicast_to_unicast,
13936                 .policy = nl80211_policy,
13937                 .flags = GENL_UNS_ADMIN_PERM,
13938                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13939                                   NL80211_FLAG_NEED_RTNL,
13940         },
13941         {
13942                 .cmd = NL80211_CMD_SET_PMK,
13943                 .doit = nl80211_set_pmk,
13944                 .policy = nl80211_policy,
13945                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13946                                   NL80211_FLAG_NEED_RTNL |
13947                                   NL80211_FLAG_CLEAR_SKB,
13948         },
13949         {
13950                 .cmd = NL80211_CMD_DEL_PMK,
13951                 .doit = nl80211_del_pmk,
13952                 .policy = nl80211_policy,
13953                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13954                                   NL80211_FLAG_NEED_RTNL,
13955         },
13956         {
13957                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13958                 .doit = nl80211_external_auth,
13959                 .policy = nl80211_policy,
13960                 .flags = GENL_ADMIN_PERM,
13961                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13962                                   NL80211_FLAG_NEED_RTNL,
13963         },
13964         {
13965                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13966                 .doit = nl80211_tx_control_port,
13967                 .policy = nl80211_policy,
13968                 .flags = GENL_UNS_ADMIN_PERM,
13969                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13970                                   NL80211_FLAG_NEED_RTNL,
13971         },
13972 };
13973
13974 static struct genl_family nl80211_fam __ro_after_init = {
13975         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13976         .hdrsize = 0,                   /* no private header */
13977         .version = 1,                   /* no particular meaning now */
13978         .maxattr = NL80211_ATTR_MAX,
13979         .netnsok = true,
13980         .pre_doit = nl80211_pre_doit,
13981         .post_doit = nl80211_post_doit,
13982         .module = THIS_MODULE,
13983         .ops = nl80211_ops,
13984         .n_ops = ARRAY_SIZE(nl80211_ops),
13985         .mcgrps = nl80211_mcgrps,
13986         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13987 };
13988
13989 /* notification functions */
13990
13991 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13992                           enum nl80211_commands cmd)
13993 {
13994         struct sk_buff *msg;
13995         struct nl80211_dump_wiphy_state state = {};
13996
13997         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13998                 cmd != NL80211_CMD_DEL_WIPHY);
13999
14000         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14001         if (!msg)
14002                 return;
14003
14004         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
14005                 nlmsg_free(msg);
14006                 return;
14007         }
14008
14009         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14010                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14011 }
14012
14013 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
14014                                 struct wireless_dev *wdev,
14015                                 enum nl80211_commands cmd)
14016 {
14017         struct sk_buff *msg;
14018
14019         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
14020                 cmd != NL80211_CMD_DEL_INTERFACE);
14021
14022         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14023         if (!msg)
14024                 return;
14025
14026         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
14027                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
14028                 nlmsg_free(msg);
14029                 return;
14030         }
14031
14032         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14033                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
14034 }
14035
14036 static int nl80211_add_scan_req(struct sk_buff *msg,
14037                                 struct cfg80211_registered_device *rdev)
14038 {
14039         struct cfg80211_scan_request *req = rdev->scan_req;
14040         struct nlattr *nest;
14041         int i;
14042
14043         if (WARN_ON(!req))
14044                 return 0;
14045
14046         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
14047         if (!nest)
14048                 goto nla_put_failure;
14049         for (i = 0; i < req->n_ssids; i++) {
14050                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
14051                         goto nla_put_failure;
14052         }
14053         nla_nest_end(msg, nest);
14054
14055         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
14056         if (!nest)
14057                 goto nla_put_failure;
14058         for (i = 0; i < req->n_channels; i++) {
14059                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
14060                         goto nla_put_failure;
14061         }
14062         nla_nest_end(msg, nest);
14063
14064         if (req->ie &&
14065             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
14066                 goto nla_put_failure;
14067
14068         if (req->flags &&
14069             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14070                 goto nla_put_failure;
14071
14072         if (req->info.scan_start_tsf &&
14073             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14074                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14075              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14076                      req->info.tsf_bssid)))
14077                 goto nla_put_failure;
14078
14079         return 0;
14080  nla_put_failure:
14081         return -ENOBUFS;
14082 }
14083
14084 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14085                                  struct cfg80211_registered_device *rdev,
14086                                  struct wireless_dev *wdev,
14087                                  u32 portid, u32 seq, int flags,
14088                                  u32 cmd)
14089 {
14090         void *hdr;
14091
14092         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14093         if (!hdr)
14094                 return -1;
14095
14096         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14097             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14098                                          wdev->netdev->ifindex)) ||
14099             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14100                               NL80211_ATTR_PAD))
14101                 goto nla_put_failure;
14102
14103         /* ignore errors and send incomplete event anyway */
14104         nl80211_add_scan_req(msg, rdev);
14105
14106         genlmsg_end(msg, hdr);
14107         return 0;
14108
14109  nla_put_failure:
14110         genlmsg_cancel(msg, hdr);
14111         return -EMSGSIZE;
14112 }
14113
14114 static int
14115 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14116                             struct cfg80211_sched_scan_request *req, u32 cmd)
14117 {
14118         void *hdr;
14119
14120         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14121         if (!hdr)
14122                 return -1;
14123
14124         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14125                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14126             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14127             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14128                               NL80211_ATTR_PAD))
14129                 goto nla_put_failure;
14130
14131         genlmsg_end(msg, hdr);
14132         return 0;
14133
14134  nla_put_failure:
14135         genlmsg_cancel(msg, hdr);
14136         return -EMSGSIZE;
14137 }
14138
14139 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14140                              struct wireless_dev *wdev)
14141 {
14142         struct sk_buff *msg;
14143
14144         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14145         if (!msg)
14146                 return;
14147
14148         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14149                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14150                 nlmsg_free(msg);
14151                 return;
14152         }
14153
14154         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14155                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14156 }
14157
14158 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14159                                        struct wireless_dev *wdev, bool aborted)
14160 {
14161         struct sk_buff *msg;
14162
14163         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14164         if (!msg)
14165                 return NULL;
14166
14167         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14168                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14169                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14170                 nlmsg_free(msg);
14171                 return NULL;
14172         }
14173
14174         return msg;
14175 }
14176
14177 /* send message created by nl80211_build_scan_msg() */
14178 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14179                            struct sk_buff *msg)
14180 {
14181         if (!msg)
14182                 return;
14183
14184         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14185                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14186 }
14187
14188 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14189 {
14190         struct sk_buff *msg;
14191
14192         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14193         if (!msg)
14194                 return;
14195
14196         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14197                 nlmsg_free(msg);
14198                 return;
14199         }
14200
14201         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14202                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14203 }
14204
14205 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14206                                           struct regulatory_request *request)
14207 {
14208         /* Userspace can always count this one always being set */
14209         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14210                 goto nla_put_failure;
14211
14212         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14213                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14214                                NL80211_REGDOM_TYPE_WORLD))
14215                         goto nla_put_failure;
14216         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14217                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14218                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14219                         goto nla_put_failure;
14220         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14221                    request->intersect) {
14222                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14223                                NL80211_REGDOM_TYPE_INTERSECTION))
14224                         goto nla_put_failure;
14225         } else {
14226                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14227                                NL80211_REGDOM_TYPE_COUNTRY) ||
14228                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14229                                    request->alpha2))
14230                         goto nla_put_failure;
14231         }
14232
14233         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14234                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14235
14236                 if (wiphy &&
14237                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14238                         goto nla_put_failure;
14239
14240                 if (wiphy &&
14241                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14242                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14243                         goto nla_put_failure;
14244         }
14245
14246         return true;
14247
14248 nla_put_failure:
14249         return false;
14250 }
14251
14252 /*
14253  * This can happen on global regulatory changes or device specific settings
14254  * based on custom regulatory domains.
14255  */
14256 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14257                                      struct regulatory_request *request)
14258 {
14259         struct sk_buff *msg;
14260         void *hdr;
14261
14262         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14263         if (!msg)
14264                 return;
14265
14266         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14267         if (!hdr) {
14268                 nlmsg_free(msg);
14269                 return;
14270         }
14271
14272         if (nl80211_reg_change_event_fill(msg, request) == false)
14273                 goto nla_put_failure;
14274
14275         genlmsg_end(msg, hdr);
14276
14277         rcu_read_lock();
14278         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14279                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14280         rcu_read_unlock();
14281
14282         return;
14283
14284 nla_put_failure:
14285         nlmsg_free(msg);
14286 }
14287
14288 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14289                                     struct net_device *netdev,
14290                                     const u8 *buf, size_t len,
14291                                     enum nl80211_commands cmd, gfp_t gfp,
14292                                     int uapsd_queues)
14293 {
14294         struct sk_buff *msg;
14295         void *hdr;
14296
14297         msg = nlmsg_new(100 + len, gfp);
14298         if (!msg)
14299                 return;
14300
14301         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14302         if (!hdr) {
14303                 nlmsg_free(msg);
14304                 return;
14305         }
14306
14307         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14308             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14309             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14310                 goto nla_put_failure;
14311
14312         if (uapsd_queues >= 0) {
14313                 struct nlattr *nla_wmm =
14314                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14315                 if (!nla_wmm)
14316                         goto nla_put_failure;
14317
14318                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14319                                uapsd_queues))
14320                         goto nla_put_failure;
14321
14322                 nla_nest_end(msg, nla_wmm);
14323         }
14324
14325         genlmsg_end(msg, hdr);
14326
14327         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14328                                 NL80211_MCGRP_MLME, gfp);
14329         return;
14330
14331  nla_put_failure:
14332         nlmsg_free(msg);
14333 }
14334
14335 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14336                           struct net_device *netdev, const u8 *buf,
14337                           size_t len, gfp_t gfp)
14338 {
14339         nl80211_send_mlme_event(rdev, netdev, buf, len,
14340                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
14341 }
14342
14343 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14344                            struct net_device *netdev, const u8 *buf,
14345                            size_t len, gfp_t gfp, int uapsd_queues)
14346 {
14347         nl80211_send_mlme_event(rdev, netdev, buf, len,
14348                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14349 }
14350
14351 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14352                          struct net_device *netdev, const u8 *buf,
14353                          size_t len, gfp_t gfp)
14354 {
14355         nl80211_send_mlme_event(rdev, netdev, buf, len,
14356                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14357 }
14358
14359 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14360                            struct net_device *netdev, const u8 *buf,
14361                            size_t len, gfp_t gfp)
14362 {
14363         nl80211_send_mlme_event(rdev, netdev, buf, len,
14364                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
14365 }
14366
14367 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14368                                   size_t len)
14369 {
14370         struct wireless_dev *wdev = dev->ieee80211_ptr;
14371         struct wiphy *wiphy = wdev->wiphy;
14372         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14373         const struct ieee80211_mgmt *mgmt = (void *)buf;
14374         u32 cmd;
14375
14376         if (WARN_ON(len < 2))
14377                 return;
14378
14379         if (ieee80211_is_deauth(mgmt->frame_control))
14380                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14381         else
14382                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14383
14384         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14385         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14386 }
14387 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14388
14389 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14390                                       struct net_device *netdev, int cmd,
14391                                       const u8 *addr, gfp_t gfp)
14392 {
14393         struct sk_buff *msg;
14394         void *hdr;
14395
14396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14397         if (!msg)
14398                 return;
14399
14400         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14401         if (!hdr) {
14402                 nlmsg_free(msg);
14403                 return;
14404         }
14405
14406         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14407             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14408             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14409             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14410                 goto nla_put_failure;
14411
14412         genlmsg_end(msg, hdr);
14413
14414         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14415                                 NL80211_MCGRP_MLME, gfp);
14416         return;
14417
14418  nla_put_failure:
14419         nlmsg_free(msg);
14420 }
14421
14422 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14423                                struct net_device *netdev, const u8 *addr,
14424                                gfp_t gfp)
14425 {
14426         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14427                                   addr, gfp);
14428 }
14429
14430 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14431                                 struct net_device *netdev, const u8 *addr,
14432                                 gfp_t gfp)
14433 {
14434         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14435                                   addr, gfp);
14436 }
14437
14438 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14439                                  struct net_device *netdev,
14440                                  struct cfg80211_connect_resp_params *cr,
14441                                  gfp_t gfp)
14442 {
14443         struct sk_buff *msg;
14444         void *hdr;
14445
14446         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14447                         cr->fils.kek_len + cr->fils.pmk_len +
14448                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14449         if (!msg)
14450                 return;
14451
14452         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14453         if (!hdr) {
14454                 nlmsg_free(msg);
14455                 return;
14456         }
14457
14458         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14459             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14460             (cr->bssid &&
14461              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14462             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14463                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14464                         cr->status) ||
14465             (cr->status < 0 &&
14466              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14467               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14468                           cr->timeout_reason))) ||
14469             (cr->req_ie &&
14470              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14471             (cr->resp_ie &&
14472              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14473                      cr->resp_ie)) ||
14474             (cr->fils.update_erp_next_seq_num &&
14475              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14476                          cr->fils.erp_next_seq_num)) ||
14477             (cr->status == WLAN_STATUS_SUCCESS &&
14478              ((cr->fils.kek &&
14479                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14480                        cr->fils.kek)) ||
14481               (cr->fils.pmk &&
14482                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14483               (cr->fils.pmkid &&
14484                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14485                 goto nla_put_failure;
14486
14487         genlmsg_end(msg, hdr);
14488
14489         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14490                                 NL80211_MCGRP_MLME, gfp);
14491         return;
14492
14493  nla_put_failure:
14494         nlmsg_free(msg);
14495 }
14496
14497 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14498                          struct net_device *netdev,
14499                          struct cfg80211_roam_info *info, gfp_t gfp)
14500 {
14501         struct sk_buff *msg;
14502         void *hdr;
14503         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14504
14505         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14506                         info->fils.kek_len + info->fils.pmk_len +
14507                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14508         if (!msg)
14509                 return;
14510
14511         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14512         if (!hdr) {
14513                 nlmsg_free(msg);
14514                 return;
14515         }
14516
14517         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14518             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14519             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14520             (info->req_ie &&
14521              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14522                      info->req_ie)) ||
14523             (info->resp_ie &&
14524              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14525                      info->resp_ie)) ||
14526             (info->fils.update_erp_next_seq_num &&
14527              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14528                          info->fils.erp_next_seq_num)) ||
14529             (info->fils.kek &&
14530              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14531                      info->fils.kek)) ||
14532             (info->fils.pmk &&
14533              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14534             (info->fils.pmkid &&
14535              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14536                 goto nla_put_failure;
14537
14538         genlmsg_end(msg, hdr);
14539
14540         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14541                                 NL80211_MCGRP_MLME, gfp);
14542         return;
14543
14544  nla_put_failure:
14545         nlmsg_free(msg);
14546 }
14547
14548 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14549                                   struct net_device *netdev, const u8 *bssid)
14550 {
14551         struct sk_buff *msg;
14552         void *hdr;
14553
14554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14555         if (!msg)
14556                 return;
14557
14558         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14559         if (!hdr) {
14560                 nlmsg_free(msg);
14561                 return;
14562         }
14563
14564         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14565                 goto nla_put_failure;
14566
14567         genlmsg_end(msg, hdr);
14568
14569         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14570                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14571         return;
14572
14573  nla_put_failure:
14574         nlmsg_free(msg);
14575 }
14576
14577 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14578                                struct net_device *netdev, u16 reason,
14579                                const u8 *ie, size_t ie_len, bool from_ap)
14580 {
14581         struct sk_buff *msg;
14582         void *hdr;
14583
14584         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14585         if (!msg)
14586                 return;
14587
14588         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14589         if (!hdr) {
14590                 nlmsg_free(msg);
14591                 return;
14592         }
14593
14594         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14595             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14596             (reason &&
14597              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14598             (from_ap &&
14599              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14600             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14601                 goto nla_put_failure;
14602
14603         genlmsg_end(msg, hdr);
14604
14605         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14606                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14607         return;
14608
14609  nla_put_failure:
14610         nlmsg_free(msg);
14611 }
14612
14613 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14614                              struct net_device *netdev, const u8 *bssid,
14615                              gfp_t gfp)
14616 {
14617         struct sk_buff *msg;
14618         void *hdr;
14619
14620         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14621         if (!msg)
14622                 return;
14623
14624         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14625         if (!hdr) {
14626                 nlmsg_free(msg);
14627                 return;
14628         }
14629
14630         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14631             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14632             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14633                 goto nla_put_failure;
14634
14635         genlmsg_end(msg, hdr);
14636
14637         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14638                                 NL80211_MCGRP_MLME, gfp);
14639         return;
14640
14641  nla_put_failure:
14642         nlmsg_free(msg);
14643 }
14644
14645 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14646                                         const u8* ie, u8 ie_len, gfp_t gfp)
14647 {
14648         struct wireless_dev *wdev = dev->ieee80211_ptr;
14649         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14650         struct sk_buff *msg;
14651         void *hdr;
14652
14653         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14654                 return;
14655
14656         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14657
14658         msg = nlmsg_new(100 + ie_len, gfp);
14659         if (!msg)
14660                 return;
14661
14662         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14663         if (!hdr) {
14664                 nlmsg_free(msg);
14665                 return;
14666         }
14667
14668         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14669             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14670             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14671             (ie_len && ie &&
14672              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14673                 goto nla_put_failure;
14674
14675         genlmsg_end(msg, hdr);
14676
14677         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14678                                 NL80211_MCGRP_MLME, gfp);
14679         return;
14680
14681  nla_put_failure:
14682         nlmsg_free(msg);
14683 }
14684 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14685
14686 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14687                                  struct net_device *netdev, const u8 *addr,
14688                                  enum nl80211_key_type key_type, int key_id,
14689                                  const u8 *tsc, gfp_t gfp)
14690 {
14691         struct sk_buff *msg;
14692         void *hdr;
14693
14694         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14695         if (!msg)
14696                 return;
14697
14698         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14699         if (!hdr) {
14700                 nlmsg_free(msg);
14701                 return;
14702         }
14703
14704         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14705             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14706             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14707             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14708             (key_id != -1 &&
14709              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14710             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14711                 goto nla_put_failure;
14712
14713         genlmsg_end(msg, hdr);
14714
14715         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14716                                 NL80211_MCGRP_MLME, gfp);
14717         return;
14718
14719  nla_put_failure:
14720         nlmsg_free(msg);
14721 }
14722
14723 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14724                                     struct ieee80211_channel *channel_before,
14725                                     struct ieee80211_channel *channel_after)
14726 {
14727         struct sk_buff *msg;
14728         void *hdr;
14729         struct nlattr *nl_freq;
14730
14731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14732         if (!msg)
14733                 return;
14734
14735         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14736         if (!hdr) {
14737                 nlmsg_free(msg);
14738                 return;
14739         }
14740
14741         /*
14742          * Since we are applying the beacon hint to a wiphy we know its
14743          * wiphy_idx is valid
14744          */
14745         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14746                 goto nla_put_failure;
14747
14748         /* Before */
14749         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14750         if (!nl_freq)
14751                 goto nla_put_failure;
14752
14753         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14754                 goto nla_put_failure;
14755         nla_nest_end(msg, nl_freq);
14756
14757         /* After */
14758         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14759         if (!nl_freq)
14760                 goto nla_put_failure;
14761
14762         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14763                 goto nla_put_failure;
14764         nla_nest_end(msg, nl_freq);
14765
14766         genlmsg_end(msg, hdr);
14767
14768         rcu_read_lock();
14769         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14770                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14771         rcu_read_unlock();
14772
14773         return;
14774
14775 nla_put_failure:
14776         nlmsg_free(msg);
14777 }
14778
14779 static void nl80211_send_remain_on_chan_event(
14780         int cmd, struct cfg80211_registered_device *rdev,
14781         struct wireless_dev *wdev, u64 cookie,
14782         struct ieee80211_channel *chan,
14783         unsigned int duration, gfp_t gfp)
14784 {
14785         struct sk_buff *msg;
14786         void *hdr;
14787
14788         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14789         if (!msg)
14790                 return;
14791
14792         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14793         if (!hdr) {
14794                 nlmsg_free(msg);
14795                 return;
14796         }
14797
14798         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14799             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14800                                          wdev->netdev->ifindex)) ||
14801             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14802                               NL80211_ATTR_PAD) ||
14803             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14804             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14805                         NL80211_CHAN_NO_HT) ||
14806             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14807                               NL80211_ATTR_PAD))
14808                 goto nla_put_failure;
14809
14810         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14811             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14812                 goto nla_put_failure;
14813
14814         genlmsg_end(msg, hdr);
14815
14816         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14817                                 NL80211_MCGRP_MLME, gfp);
14818         return;
14819
14820  nla_put_failure:
14821         nlmsg_free(msg);
14822 }
14823
14824 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14825                                struct ieee80211_channel *chan,
14826                                unsigned int duration, gfp_t gfp)
14827 {
14828         struct wiphy *wiphy = wdev->wiphy;
14829         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14830
14831         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14832         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14833                                           rdev, wdev, cookie, chan,
14834                                           duration, gfp);
14835 }
14836 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14837
14838 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14839                                         struct ieee80211_channel *chan,
14840                                         gfp_t gfp)
14841 {
14842         struct wiphy *wiphy = wdev->wiphy;
14843         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14844
14845         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14846         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14847                                           rdev, wdev, cookie, chan, 0, gfp);
14848 }
14849 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14850
14851 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14852                       struct station_info *sinfo, gfp_t gfp)
14853 {
14854         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14855         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14856         struct sk_buff *msg;
14857
14858         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14859
14860         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14861         if (!msg)
14862                 return;
14863
14864         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14865                                  rdev, dev, mac_addr, sinfo) < 0) {
14866                 nlmsg_free(msg);
14867                 return;
14868         }
14869
14870         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14871                                 NL80211_MCGRP_MLME, gfp);
14872 }
14873 EXPORT_SYMBOL(cfg80211_new_sta);
14874
14875 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14876                             struct station_info *sinfo, gfp_t gfp)
14877 {
14878         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14879         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14880         struct sk_buff *msg;
14881         struct station_info empty_sinfo = {};
14882
14883         if (!sinfo)
14884                 sinfo = &empty_sinfo;
14885
14886         trace_cfg80211_del_sta(dev, mac_addr);
14887
14888         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14889         if (!msg) {
14890                 cfg80211_sinfo_release_content(sinfo);
14891                 return;
14892         }
14893
14894         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14895                                  rdev, dev, mac_addr, sinfo) < 0) {
14896                 nlmsg_free(msg);
14897                 return;
14898         }
14899
14900         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14901                                 NL80211_MCGRP_MLME, gfp);
14902 }
14903 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14904
14905 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14906                           enum nl80211_connect_failed_reason reason,
14907                           gfp_t gfp)
14908 {
14909         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14910         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14911         struct sk_buff *msg;
14912         void *hdr;
14913
14914         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14915         if (!msg)
14916                 return;
14917
14918         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14919         if (!hdr) {
14920                 nlmsg_free(msg);
14921                 return;
14922         }
14923
14924         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14925             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14926             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14927                 goto nla_put_failure;
14928
14929         genlmsg_end(msg, hdr);
14930
14931         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14932                                 NL80211_MCGRP_MLME, gfp);
14933         return;
14934
14935  nla_put_failure:
14936         nlmsg_free(msg);
14937 }
14938 EXPORT_SYMBOL(cfg80211_conn_failed);
14939
14940 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14941                                        const u8 *addr, gfp_t gfp)
14942 {
14943         struct wireless_dev *wdev = dev->ieee80211_ptr;
14944         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14945         struct sk_buff *msg;
14946         void *hdr;
14947         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14948
14949         if (!nlportid)
14950                 return false;
14951
14952         msg = nlmsg_new(100, gfp);
14953         if (!msg)
14954                 return true;
14955
14956         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14957         if (!hdr) {
14958                 nlmsg_free(msg);
14959                 return true;
14960         }
14961
14962         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14963             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14964             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14965                 goto nla_put_failure;
14966
14967         genlmsg_end(msg, hdr);
14968         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14969         return true;
14970
14971  nla_put_failure:
14972         nlmsg_free(msg);
14973         return true;
14974 }
14975
14976 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14977                                 const u8 *addr, gfp_t gfp)
14978 {
14979         struct wireless_dev *wdev = dev->ieee80211_ptr;
14980         bool ret;
14981
14982         trace_cfg80211_rx_spurious_frame(dev, addr);
14983
14984         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14985                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14986                 trace_cfg80211_return_bool(false);
14987                 return false;
14988         }
14989         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14990                                          addr, gfp);
14991         trace_cfg80211_return_bool(ret);
14992         return ret;
14993 }
14994 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14995
14996 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14997                                         const u8 *addr, gfp_t gfp)
14998 {
14999         struct wireless_dev *wdev = dev->ieee80211_ptr;
15000         bool ret;
15001
15002         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
15003
15004         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
15005                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
15006                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
15007                 trace_cfg80211_return_bool(false);
15008                 return false;
15009         }
15010         ret = __nl80211_unexpected_frame(dev,
15011                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
15012                                          addr, gfp);
15013         trace_cfg80211_return_bool(ret);
15014         return ret;
15015 }
15016 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
15017
15018 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
15019                       struct wireless_dev *wdev, u32 nlportid,
15020                       int freq, int sig_dbm,
15021                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
15022 {
15023         struct net_device *netdev = wdev->netdev;
15024         struct sk_buff *msg;
15025         void *hdr;
15026
15027         msg = nlmsg_new(100 + len, gfp);
15028         if (!msg)
15029                 return -ENOMEM;
15030
15031         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15032         if (!hdr) {
15033                 nlmsg_free(msg);
15034                 return -ENOMEM;
15035         }
15036
15037         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15038             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15039                                         netdev->ifindex)) ||
15040             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15041                               NL80211_ATTR_PAD) ||
15042             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
15043             (sig_dbm &&
15044              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15045             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15046             (flags &&
15047              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
15048                 goto nla_put_failure;
15049
15050         genlmsg_end(msg, hdr);
15051
15052         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15053
15054  nla_put_failure:
15055         nlmsg_free(msg);
15056         return -ENOBUFS;
15057 }
15058
15059 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
15060                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
15061 {
15062         struct wiphy *wiphy = wdev->wiphy;
15063         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15064         struct net_device *netdev = wdev->netdev;
15065         struct sk_buff *msg;
15066         void *hdr;
15067
15068         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15069
15070         msg = nlmsg_new(100 + len, gfp);
15071         if (!msg)
15072                 return;
15073
15074         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15075         if (!hdr) {
15076                 nlmsg_free(msg);
15077                 return;
15078         }
15079
15080         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15081             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15082                                    netdev->ifindex)) ||
15083             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15084                               NL80211_ATTR_PAD) ||
15085             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15086             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15087                               NL80211_ATTR_PAD) ||
15088             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15089                 goto nla_put_failure;
15090
15091         genlmsg_end(msg, hdr);
15092
15093         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15094                                 NL80211_MCGRP_MLME, gfp);
15095         return;
15096
15097  nla_put_failure:
15098         nlmsg_free(msg);
15099 }
15100 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15101
15102 static int __nl80211_rx_control_port(struct net_device *dev,
15103                                      struct sk_buff *skb,
15104                                      bool unencrypted, gfp_t gfp)
15105 {
15106         struct wireless_dev *wdev = dev->ieee80211_ptr;
15107         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15108         struct ethhdr *ehdr = eth_hdr(skb);
15109         const u8 *addr = ehdr->h_source;
15110         u16 proto = be16_to_cpu(skb->protocol);
15111         struct sk_buff *msg;
15112         void *hdr;
15113         struct nlattr *frame;
15114
15115         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15116
15117         if (!nlportid)
15118                 return -ENOENT;
15119
15120         msg = nlmsg_new(100 + skb->len, gfp);
15121         if (!msg)
15122                 return -ENOMEM;
15123
15124         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15125         if (!hdr) {
15126                 nlmsg_free(msg);
15127                 return -ENOBUFS;
15128         }
15129
15130         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15131             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15132             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15133                               NL80211_ATTR_PAD) ||
15134             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15135             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15136             (unencrypted && nla_put_flag(msg,
15137                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15138                 goto nla_put_failure;
15139
15140         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15141         if (!frame)
15142                 goto nla_put_failure;
15143
15144         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15145         genlmsg_end(msg, hdr);
15146
15147         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15148
15149  nla_put_failure:
15150         nlmsg_free(msg);
15151         return -ENOBUFS;
15152 }
15153
15154 bool cfg80211_rx_control_port(struct net_device *dev,
15155                               struct sk_buff *skb, bool unencrypted)
15156 {
15157         int ret;
15158
15159         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15160         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15161         trace_cfg80211_return_bool(ret == 0);
15162         return ret == 0;
15163 }
15164 EXPORT_SYMBOL(cfg80211_rx_control_port);
15165
15166 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15167                                             const char *mac, gfp_t gfp)
15168 {
15169         struct wireless_dev *wdev = dev->ieee80211_ptr;
15170         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15171         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15172         void **cb;
15173
15174         if (!msg)
15175                 return NULL;
15176
15177         cb = (void **)msg->cb;
15178
15179         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15180         if (!cb[0]) {
15181                 nlmsg_free(msg);
15182                 return NULL;
15183         }
15184
15185         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15186             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15187                 goto nla_put_failure;
15188
15189         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15190                 goto nla_put_failure;
15191
15192         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15193         if (!cb[1])
15194                 goto nla_put_failure;
15195
15196         cb[2] = rdev;
15197
15198         return msg;
15199  nla_put_failure:
15200         nlmsg_free(msg);
15201         return NULL;
15202 }
15203
15204 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15205 {
15206         void **cb = (void **)msg->cb;
15207         struct cfg80211_registered_device *rdev = cb[2];
15208
15209         nla_nest_end(msg, cb[1]);
15210         genlmsg_end(msg, cb[0]);
15211
15212         memset(msg->cb, 0, sizeof(msg->cb));
15213
15214         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15215                                 NL80211_MCGRP_MLME, gfp);
15216 }
15217
15218 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15219                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15220                               s32 rssi_level, gfp_t gfp)
15221 {
15222         struct sk_buff *msg;
15223         struct wireless_dev *wdev = dev->ieee80211_ptr;
15224         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15225
15226         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15227
15228         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15229                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15230                 return;
15231
15232         if (wdev->cqm_config) {
15233                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15234
15235                 cfg80211_cqm_rssi_update(rdev, dev);
15236
15237                 if (rssi_level == 0)
15238                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15239         }
15240
15241         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15242         if (!msg)
15243                 return;
15244
15245         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15246                         rssi_event))
15247                 goto nla_put_failure;
15248
15249         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15250                                       rssi_level))
15251                 goto nla_put_failure;
15252
15253         cfg80211_send_cqm(msg, gfp);
15254
15255         return;
15256
15257  nla_put_failure:
15258         nlmsg_free(msg);
15259 }
15260 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15261
15262 void cfg80211_cqm_txe_notify(struct net_device *dev,
15263                              const u8 *peer, u32 num_packets,
15264                              u32 rate, u32 intvl, gfp_t gfp)
15265 {
15266         struct sk_buff *msg;
15267
15268         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15269         if (!msg)
15270                 return;
15271
15272         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15273                 goto nla_put_failure;
15274
15275         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15276                 goto nla_put_failure;
15277
15278         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15279                 goto nla_put_failure;
15280
15281         cfg80211_send_cqm(msg, gfp);
15282         return;
15283
15284  nla_put_failure:
15285         nlmsg_free(msg);
15286 }
15287 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15288
15289 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15290                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15291 {
15292         struct sk_buff *msg;
15293
15294         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15295
15296         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15297         if (!msg)
15298                 return;
15299
15300         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15301                 goto nla_put_failure;
15302
15303         cfg80211_send_cqm(msg, gfp);
15304         return;
15305
15306  nla_put_failure:
15307         nlmsg_free(msg);
15308 }
15309 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15310
15311 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15312 {
15313         struct sk_buff *msg;
15314
15315         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15316         if (!msg)
15317                 return;
15318
15319         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15320                 goto nla_put_failure;
15321
15322         cfg80211_send_cqm(msg, gfp);
15323         return;
15324
15325  nla_put_failure:
15326         nlmsg_free(msg);
15327 }
15328 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15329
15330 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15331                                      struct net_device *netdev, const u8 *bssid,
15332                                      const u8 *replay_ctr, gfp_t gfp)
15333 {
15334         struct sk_buff *msg;
15335         struct nlattr *rekey_attr;
15336         void *hdr;
15337
15338         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15339         if (!msg)
15340                 return;
15341
15342         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15343         if (!hdr) {
15344                 nlmsg_free(msg);
15345                 return;
15346         }
15347
15348         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15349             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15350             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15351                 goto nla_put_failure;
15352
15353         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15354         if (!rekey_attr)
15355                 goto nla_put_failure;
15356
15357         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15358                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15359                 goto nla_put_failure;
15360
15361         nla_nest_end(msg, rekey_attr);
15362
15363         genlmsg_end(msg, hdr);
15364
15365         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15366                                 NL80211_MCGRP_MLME, gfp);
15367         return;
15368
15369  nla_put_failure:
15370         nlmsg_free(msg);
15371 }
15372
15373 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15374                                const u8 *replay_ctr, gfp_t gfp)
15375 {
15376         struct wireless_dev *wdev = dev->ieee80211_ptr;
15377         struct wiphy *wiphy = wdev->wiphy;
15378         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15379
15380         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15381         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15382 }
15383 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15384
15385 static void
15386 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15387                                struct net_device *netdev, int index,
15388                                const u8 *bssid, bool preauth, gfp_t gfp)
15389 {
15390         struct sk_buff *msg;
15391         struct nlattr *attr;
15392         void *hdr;
15393
15394         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15395         if (!msg)
15396                 return;
15397
15398         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15399         if (!hdr) {
15400                 nlmsg_free(msg);
15401                 return;
15402         }
15403
15404         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15405             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15406                 goto nla_put_failure;
15407
15408         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15409         if (!attr)
15410                 goto nla_put_failure;
15411
15412         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15413             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15414             (preauth &&
15415              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15416                 goto nla_put_failure;
15417
15418         nla_nest_end(msg, attr);
15419
15420         genlmsg_end(msg, hdr);
15421
15422         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15423                                 NL80211_MCGRP_MLME, gfp);
15424         return;
15425
15426  nla_put_failure:
15427         nlmsg_free(msg);
15428 }
15429
15430 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15431                                      const u8 *bssid, bool preauth, gfp_t gfp)
15432 {
15433         struct wireless_dev *wdev = dev->ieee80211_ptr;
15434         struct wiphy *wiphy = wdev->wiphy;
15435         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15436
15437         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15438         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15439 }
15440 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15441
15442 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15443                                      struct net_device *netdev,
15444                                      struct cfg80211_chan_def *chandef,
15445                                      gfp_t gfp,
15446                                      enum nl80211_commands notif,
15447                                      u8 count)
15448 {
15449         struct sk_buff *msg;
15450         void *hdr;
15451
15452         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15453         if (!msg)
15454                 return;
15455
15456         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15457         if (!hdr) {
15458                 nlmsg_free(msg);
15459                 return;
15460         }
15461
15462         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15463                 goto nla_put_failure;
15464
15465         if (nl80211_send_chandef(msg, chandef))
15466                 goto nla_put_failure;
15467
15468         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15469             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15470                         goto nla_put_failure;
15471
15472         genlmsg_end(msg, hdr);
15473
15474         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15475                                 NL80211_MCGRP_MLME, gfp);
15476         return;
15477
15478  nla_put_failure:
15479         nlmsg_free(msg);
15480 }
15481
15482 void cfg80211_ch_switch_notify(struct net_device *dev,
15483                                struct cfg80211_chan_def *chandef)
15484 {
15485         struct wireless_dev *wdev = dev->ieee80211_ptr;
15486         struct wiphy *wiphy = wdev->wiphy;
15487         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15488
15489         ASSERT_WDEV_LOCK(wdev);
15490
15491         trace_cfg80211_ch_switch_notify(dev, chandef);
15492
15493         wdev->chandef = *chandef;
15494         wdev->preset_chandef = *chandef;
15495
15496         if (wdev->iftype == NL80211_IFTYPE_STATION &&
15497             !WARN_ON(!wdev->current_bss))
15498                 wdev->current_bss->pub.channel = chandef->chan;
15499
15500         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15501                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15502 }
15503 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15504
15505 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15506                                        struct cfg80211_chan_def *chandef,
15507                                        u8 count)
15508 {
15509         struct wireless_dev *wdev = dev->ieee80211_ptr;
15510         struct wiphy *wiphy = wdev->wiphy;
15511         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15512
15513         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15514
15515         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15516                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15517 }
15518 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15519
15520 void
15521 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15522                      const struct cfg80211_chan_def *chandef,
15523                      enum nl80211_radar_event event,
15524                      struct net_device *netdev, gfp_t gfp)
15525 {
15526         struct sk_buff *msg;
15527         void *hdr;
15528
15529         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15530         if (!msg)
15531                 return;
15532
15533         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15534         if (!hdr) {
15535                 nlmsg_free(msg);
15536                 return;
15537         }
15538
15539         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15540                 goto nla_put_failure;
15541
15542         /* NOP and radar events don't need a netdev parameter */
15543         if (netdev) {
15544                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15545
15546                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15547                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15548                                       NL80211_ATTR_PAD))
15549                         goto nla_put_failure;
15550         }
15551
15552         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15553                 goto nla_put_failure;
15554
15555         if (nl80211_send_chandef(msg, chandef))
15556                 goto nla_put_failure;
15557
15558         genlmsg_end(msg, hdr);
15559
15560         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15561                                 NL80211_MCGRP_MLME, gfp);
15562         return;
15563
15564  nla_put_failure:
15565         nlmsg_free(msg);
15566 }
15567
15568 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15569                                        struct sta_opmode_info *sta_opmode,
15570                                        gfp_t gfp)
15571 {
15572         struct sk_buff *msg;
15573         struct wireless_dev *wdev = dev->ieee80211_ptr;
15574         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15575         void *hdr;
15576
15577         if (WARN_ON(!mac))
15578                 return;
15579
15580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15581         if (!msg)
15582                 return;
15583
15584         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15585         if (!hdr) {
15586                 nlmsg_free(msg);
15587                 return;
15588         }
15589
15590         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15591                 goto nla_put_failure;
15592
15593         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15594                 goto nla_put_failure;
15595
15596         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15597                 goto nla_put_failure;
15598
15599         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15600             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15601                 goto nla_put_failure;
15602
15603         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15604             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15605                 goto nla_put_failure;
15606
15607         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15608             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15609                 goto nla_put_failure;
15610
15611         genlmsg_end(msg, hdr);
15612
15613         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15614                                 NL80211_MCGRP_MLME, gfp);
15615
15616         return;
15617
15618 nla_put_failure:
15619         nlmsg_free(msg);
15620 }
15621 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15622
15623 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15624                            u64 cookie, bool acked, s32 ack_signal,
15625                            bool is_valid_ack_signal, gfp_t gfp)
15626 {
15627         struct wireless_dev *wdev = dev->ieee80211_ptr;
15628         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15629         struct sk_buff *msg;
15630         void *hdr;
15631
15632         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15633
15634         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15635
15636         if (!msg)
15637                 return;
15638
15639         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15640         if (!hdr) {
15641                 nlmsg_free(msg);
15642                 return;
15643         }
15644
15645         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15646             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15647             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15648             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15649                               NL80211_ATTR_PAD) ||
15650             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15651             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15652                                                 ack_signal)))
15653                 goto nla_put_failure;
15654
15655         genlmsg_end(msg, hdr);
15656
15657         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15658                                 NL80211_MCGRP_MLME, gfp);
15659         return;
15660
15661  nla_put_failure:
15662         nlmsg_free(msg);
15663 }
15664 EXPORT_SYMBOL(cfg80211_probe_status);
15665
15666 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15667                                  const u8 *frame, size_t len,
15668                                  int freq, int sig_dbm)
15669 {
15670         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15671         struct sk_buff *msg;
15672         void *hdr;
15673         struct cfg80211_beacon_registration *reg;
15674
15675         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15676
15677         spin_lock_bh(&rdev->beacon_registrations_lock);
15678         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15679                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15680                 if (!msg) {
15681                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15682                         return;
15683                 }
15684
15685                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15686                 if (!hdr)
15687                         goto nla_put_failure;
15688
15689                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15690                     (freq &&
15691                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15692                     (sig_dbm &&
15693                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15694                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15695                         goto nla_put_failure;
15696
15697                 genlmsg_end(msg, hdr);
15698
15699                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15700         }
15701         spin_unlock_bh(&rdev->beacon_registrations_lock);
15702         return;
15703
15704  nla_put_failure:
15705         spin_unlock_bh(&rdev->beacon_registrations_lock);
15706         nlmsg_free(msg);
15707 }
15708 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15709
15710 #ifdef CONFIG_PM
15711 static int cfg80211_net_detect_results(struct sk_buff *msg,
15712                                        struct cfg80211_wowlan_wakeup *wakeup)
15713 {
15714         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15715         struct nlattr *nl_results, *nl_match, *nl_freqs;
15716         int i, j;
15717
15718         nl_results = nla_nest_start(
15719                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15720         if (!nl_results)
15721                 return -EMSGSIZE;
15722
15723         for (i = 0; i < nd->n_matches; i++) {
15724                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15725
15726                 nl_match = nla_nest_start(msg, i);
15727                 if (!nl_match)
15728                         break;
15729
15730                 /* The SSID attribute is optional in nl80211, but for
15731                  * simplicity reasons it's always present in the
15732                  * cfg80211 structure.  If a driver can't pass the
15733                  * SSID, that needs to be changed.  A zero length SSID
15734                  * is still a valid SSID (wildcard), so it cannot be
15735                  * used for this purpose.
15736                  */
15737                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15738                             match->ssid.ssid)) {
15739                         nla_nest_cancel(msg, nl_match);
15740                         goto out;
15741                 }
15742
15743                 if (match->n_channels) {
15744                         nl_freqs = nla_nest_start(
15745                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15746                         if (!nl_freqs) {
15747                                 nla_nest_cancel(msg, nl_match);
15748                                 goto out;
15749                         }
15750
15751                         for (j = 0; j < match->n_channels; j++) {
15752                                 if (nla_put_u32(msg, j, match->channels[j])) {
15753                                         nla_nest_cancel(msg, nl_freqs);
15754                                         nla_nest_cancel(msg, nl_match);
15755                                         goto out;
15756                                 }
15757                         }
15758
15759                         nla_nest_end(msg, nl_freqs);
15760                 }
15761
15762                 nla_nest_end(msg, nl_match);
15763         }
15764
15765 out:
15766         nla_nest_end(msg, nl_results);
15767         return 0;
15768 }
15769
15770 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15771                                    struct cfg80211_wowlan_wakeup *wakeup,
15772                                    gfp_t gfp)
15773 {
15774         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15775         struct sk_buff *msg;
15776         void *hdr;
15777         int size = 200;
15778
15779         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15780
15781         if (wakeup)
15782                 size += wakeup->packet_present_len;
15783
15784         msg = nlmsg_new(size, gfp);
15785         if (!msg)
15786                 return;
15787
15788         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15789         if (!hdr)
15790                 goto free_msg;
15791
15792         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15793             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15794                               NL80211_ATTR_PAD))
15795                 goto free_msg;
15796
15797         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15798                                         wdev->netdev->ifindex))
15799                 goto free_msg;
15800
15801         if (wakeup) {
15802                 struct nlattr *reasons;
15803
15804                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15805                 if (!reasons)
15806                         goto free_msg;
15807
15808                 if (wakeup->disconnect &&
15809                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15810                         goto free_msg;
15811                 if (wakeup->magic_pkt &&
15812                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15813                         goto free_msg;
15814                 if (wakeup->gtk_rekey_failure &&
15815                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15816                         goto free_msg;
15817                 if (wakeup->eap_identity_req &&
15818                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15819                         goto free_msg;
15820                 if (wakeup->four_way_handshake &&
15821                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15822                         goto free_msg;
15823                 if (wakeup->rfkill_release &&
15824                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15825                         goto free_msg;
15826
15827                 if (wakeup->pattern_idx >= 0 &&
15828                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15829                                 wakeup->pattern_idx))
15830                         goto free_msg;
15831
15832                 if (wakeup->tcp_match &&
15833                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15834                         goto free_msg;
15835
15836                 if (wakeup->tcp_connlost &&
15837                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15838                         goto free_msg;
15839
15840                 if (wakeup->tcp_nomoretokens &&
15841                     nla_put_flag(msg,
15842                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15843                         goto free_msg;
15844
15845                 if (wakeup->packet) {
15846                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15847                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15848
15849                         if (!wakeup->packet_80211) {
15850                                 pkt_attr =
15851                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15852                                 len_attr =
15853                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15854                         }
15855
15856                         if (wakeup->packet_len &&
15857                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15858                                 goto free_msg;
15859
15860                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15861                                     wakeup->packet))
15862                                 goto free_msg;
15863                 }
15864
15865                 if (wakeup->net_detect &&
15866                     cfg80211_net_detect_results(msg, wakeup))
15867                                 goto free_msg;
15868
15869                 nla_nest_end(msg, reasons);
15870         }
15871
15872         genlmsg_end(msg, hdr);
15873
15874         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15875                                 NL80211_MCGRP_MLME, gfp);
15876         return;
15877
15878  free_msg:
15879         nlmsg_free(msg);
15880 }
15881 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15882 #endif
15883
15884 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15885                                 enum nl80211_tdls_operation oper,
15886                                 u16 reason_code, gfp_t gfp)
15887 {
15888         struct wireless_dev *wdev = dev->ieee80211_ptr;
15889         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15890         struct sk_buff *msg;
15891         void *hdr;
15892
15893         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15894                                          reason_code);
15895
15896         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15897         if (!msg)
15898                 return;
15899
15900         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15901         if (!hdr) {
15902                 nlmsg_free(msg);
15903                 return;
15904         }
15905
15906         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15907             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15908             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15909             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15910             (reason_code > 0 &&
15911              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15912                 goto nla_put_failure;
15913
15914         genlmsg_end(msg, hdr);
15915
15916         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15917                                 NL80211_MCGRP_MLME, gfp);
15918         return;
15919
15920  nla_put_failure:
15921         nlmsg_free(msg);
15922 }
15923 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15924
15925 static int nl80211_netlink_notify(struct notifier_block * nb,
15926                                   unsigned long state,
15927                                   void *_notify)
15928 {
15929         struct netlink_notify *notify = _notify;
15930         struct cfg80211_registered_device *rdev;
15931         struct wireless_dev *wdev;
15932         struct cfg80211_beacon_registration *reg, *tmp;
15933
15934         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15935                 return NOTIFY_DONE;
15936
15937         rcu_read_lock();
15938
15939         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15940                 struct cfg80211_sched_scan_request *sched_scan_req;
15941
15942                 list_for_each_entry_rcu(sched_scan_req,
15943                                         &rdev->sched_scan_req_list,
15944                                         list) {
15945                         if (sched_scan_req->owner_nlportid == notify->portid) {
15946                                 sched_scan_req->nl_owner_dead = true;
15947                                 schedule_work(&rdev->sched_scan_stop_wk);
15948                         }
15949                 }
15950
15951                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15952                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15953
15954                         if (wdev->owner_nlportid == notify->portid) {
15955                                 wdev->nl_owner_dead = true;
15956                                 schedule_work(&rdev->destroy_work);
15957                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15958                                 schedule_work(&wdev->disconnect_wk);
15959                         }
15960                 }
15961
15962                 spin_lock_bh(&rdev->beacon_registrations_lock);
15963                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15964                                          list) {
15965                         if (reg->nlportid == notify->portid) {
15966                                 list_del(&reg->list);
15967                                 kfree(reg);
15968                                 break;
15969                         }
15970                 }
15971                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15972         }
15973
15974         rcu_read_unlock();
15975
15976         /*
15977          * It is possible that the user space process that is controlling the
15978          * indoor setting disappeared, so notify the regulatory core.
15979          */
15980         regulatory_netlink_notify(notify->portid);
15981         return NOTIFY_OK;
15982 }
15983
15984 static struct notifier_block nl80211_netlink_notifier = {
15985         .notifier_call = nl80211_netlink_notify,
15986 };
15987
15988 void cfg80211_ft_event(struct net_device *netdev,
15989                        struct cfg80211_ft_event_params *ft_event)
15990 {
15991         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15992         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15993         struct sk_buff *msg;
15994         void *hdr;
15995
15996         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15997
15998         if (!ft_event->target_ap)
15999                 return;
16000
16001         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
16002                         GFP_KERNEL);
16003         if (!msg)
16004                 return;
16005
16006         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
16007         if (!hdr)
16008                 goto out;
16009
16010         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16011             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
16012             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
16013                 goto out;
16014
16015         if (ft_event->ies &&
16016             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
16017                 goto out;
16018         if (ft_event->ric_ies &&
16019             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
16020                     ft_event->ric_ies))
16021                 goto out;
16022
16023         genlmsg_end(msg, hdr);
16024
16025         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
16026                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16027         return;
16028  out:
16029         nlmsg_free(msg);
16030 }
16031 EXPORT_SYMBOL(cfg80211_ft_event);
16032
16033 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
16034 {
16035         struct cfg80211_registered_device *rdev;
16036         struct sk_buff *msg;
16037         void *hdr;
16038         u32 nlportid;
16039
16040         rdev = wiphy_to_rdev(wdev->wiphy);
16041         if (!rdev->crit_proto_nlportid)
16042                 return;
16043
16044         nlportid = rdev->crit_proto_nlportid;
16045         rdev->crit_proto_nlportid = 0;
16046
16047         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16048         if (!msg)
16049                 return;
16050
16051         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
16052         if (!hdr)
16053                 goto nla_put_failure;
16054
16055         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16056             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16057                               NL80211_ATTR_PAD))
16058                 goto nla_put_failure;
16059
16060         genlmsg_end(msg, hdr);
16061
16062         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
16063         return;
16064
16065  nla_put_failure:
16066         nlmsg_free(msg);
16067 }
16068 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
16069
16070 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
16071 {
16072         struct wiphy *wiphy = wdev->wiphy;
16073         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16074         struct sk_buff *msg;
16075         void *hdr;
16076
16077         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16078         if (!msg)
16079                 return;
16080
16081         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16082         if (!hdr)
16083                 goto out;
16084
16085         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16086             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16087             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16088                               NL80211_ATTR_PAD))
16089                 goto out;
16090
16091         genlmsg_end(msg, hdr);
16092
16093         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16094                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16095         return;
16096  out:
16097         nlmsg_free(msg);
16098 }
16099
16100 int cfg80211_external_auth_request(struct net_device *dev,
16101                                    struct cfg80211_external_auth_params *params,
16102                                    gfp_t gfp)
16103 {
16104         struct wireless_dev *wdev = dev->ieee80211_ptr;
16105         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16106         struct sk_buff *msg;
16107         void *hdr;
16108
16109         if (!wdev->conn_owner_nlportid)
16110                 return -EINVAL;
16111
16112         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16113         if (!msg)
16114                 return -ENOMEM;
16115
16116         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16117         if (!hdr)
16118                 goto nla_put_failure;
16119
16120         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16121             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16122             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16123             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16124                         params->action) ||
16125             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16126             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16127                     params->ssid.ssid))
16128                 goto nla_put_failure;
16129
16130         genlmsg_end(msg, hdr);
16131         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16132                         wdev->conn_owner_nlportid);
16133         return 0;
16134
16135  nla_put_failure:
16136         nlmsg_free(msg);
16137         return -ENOBUFS;
16138 }
16139 EXPORT_SYMBOL(cfg80211_external_auth_request);
16140
16141 /* initialisation/exit functions */
16142
16143 int __init nl80211_init(void)
16144 {
16145         int err;
16146
16147         err = genl_register_family(&nl80211_fam);
16148         if (err)
16149                 return err;
16150
16151         err = netlink_register_notifier(&nl80211_netlink_notifier);
16152         if (err)
16153                 goto err_out;
16154
16155         return 0;
16156  err_out:
16157         genl_unregister_family(&nl80211_fam);
16158         return err;
16159 }
16160
16161 void nl80211_exit(void)
16162 {
16163         netlink_unregister_notifier(&nl80211_netlink_notifier);
16164         genl_unregister_family(&nl80211_fam);
16165 }