net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  */
   8
   9 #include <linux/if.h>
  10 #include <linux/module.h>
  11 #include <linux/err.h>
  12 #include <linux/slab.h>
  13 #include <linux/list.h>
  14 #include <linux/if_ether.h>
  15 #include <linux/ieee80211.h>
  16 #include <linux/nl80211.h>
  17 #include <linux/rtnetlink.h>
  18 #include <linux/netlink.h>
  19 #include <linux/etherdevice.h>
  20 #include <net/net_namespace.h>
  21 #include <net/genetlink.h>
  22 #include <net/cfg80211.h>
  23 #include <net/sock.h>
  24 #include <net/inet_connection_sock.h>
  25 #include "core.h"
  26 #include "nl80211.h"
  27 #include "reg.h"
  28 #include "rdev-ops.h"
  29
  30 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  31                                    struct genl_info *info,
  32                                    struct cfg80211_crypto_settings *settings,
  33                                    int cipher_limit);
  34
  35 /* the netlink family */
  36 static struct genl_family nl80211_fam;
  37
  38 /* multicast groups */
  39 enum nl80211_multicast_groups {
  40         NL80211_MCGRP_CONFIG,
  41         NL80211_MCGRP_SCAN,
  42         NL80211_MCGRP_REGULATORY,
  43         NL80211_MCGRP_MLME,
  44         NL80211_MCGRP_VENDOR,
  45         NL80211_MCGRP_NAN,
  46         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  47 };
  48
  49 static const struct genl_multicast_group nl80211_mcgrps[] = {
  50         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  51         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  52         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  53         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  54         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  55         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  56 #ifdef CONFIG_NL80211_TESTMODE
  57         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  58 #endif
  59 };
  60
  61 /* returns ERR_PTR values */
  62 static struct wireless_dev *
  63 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  64 {
  65         struct cfg80211_registered_device *rdev;
  66         struct wireless_dev *result = NULL;
  67         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  68         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  69         u64 wdev_id;
  70         int wiphy_idx = -1;
  71         int ifidx = -1;
  72
  73         ASSERT_RTNL();
  74
  75         if (!have_ifidx && !have_wdev_id)
  76                 return ERR_PTR(-EINVAL);
  77
  78         if (have_ifidx)
  79                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  80         if (have_wdev_id) {
  81                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  82                 wiphy_idx = wdev_id >> 32;
  83         }
  84
  85         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  86                 struct wireless_dev *wdev;
  87
  88                 if (wiphy_net(&rdev->wiphy) != netns)
  89                         continue;
  90
  91                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  92                         continue;
  93
  94                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  95                         if (have_ifidx && wdev->netdev &&
  96                             wdev->netdev->ifindex == ifidx) {
  97                                 result = wdev;
  98                                 break;
  99                         }
 100                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 101                                 result = wdev;
 102                                 break;
 103                         }
 104                 }
 105
 106                 if (result)
 107                         break;
 108         }
 109
 110         if (result)
 111                 return result;
 112         return ERR_PTR(-ENODEV);
 113 }
 114
 115 static struct cfg80211_registered_device *
 116 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 117 {
 118         struct cfg80211_registered_device *rdev = NULL, *tmp;
 119         struct net_device *netdev;
 120
 121         ASSERT_RTNL();
 122
 123         if (!attrs[NL80211_ATTR_WIPHY] &&
 124             !attrs[NL80211_ATTR_IFINDEX] &&
 125             !attrs[NL80211_ATTR_WDEV])
 126                 return ERR_PTR(-EINVAL);
 127
 128         if (attrs[NL80211_ATTR_WIPHY])
 129                 rdev = cfg80211_rdev_by_wiphy_idx(
 130                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 131
 132         if (attrs[NL80211_ATTR_WDEV]) {
 133                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 134                 struct wireless_dev *wdev;
 135                 bool found = false;
 136
 137                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 138                 if (tmp) {
 139                         /* make sure wdev exists */
 140                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 141                                 if (wdev->identifier != (u32)wdev_id)
 142                                         continue;
 143                                 found = true;
 144                                 break;
 145                         }
 146
 147                         if (!found)
 148                                 tmp = NULL;
 149
 150                         if (rdev && tmp != rdev)
 151                                 return ERR_PTR(-EINVAL);
 152                         rdev = tmp;
 153                 }
 154         }
 155
 156         if (attrs[NL80211_ATTR_IFINDEX]) {
 157                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 158
 159                 netdev = __dev_get_by_index(netns, ifindex);
 160                 if (netdev) {
 161                         if (netdev->ieee80211_ptr)
 162                                 tmp = wiphy_to_rdev(
 163                                         netdev->ieee80211_ptr->wiphy);
 164                         else
 165                                 tmp = NULL;
 166
 167                         /* not wireless device -- return error */
 168                         if (!tmp)
 169                                 return ERR_PTR(-EINVAL);
 170
 171                         /* mismatch -- return error */
 172                         if (rdev && tmp != rdev)
 173                                 return ERR_PTR(-EINVAL);
 174
 175                         rdev = tmp;
 176                 }
 177         }
 178
 179         if (!rdev)
 180                 return ERR_PTR(-ENODEV);
 181
 182         if (netns != wiphy_net(&rdev->wiphy))
 183                 return ERR_PTR(-ENODEV);
 184
 185         return rdev;
 186 }
 187
 188 /*
 189  * This function returns a pointer to the driver
 190  * that the genl_info item that is passed refers to.
 191  *
 192  * The result of this can be a PTR_ERR and hence must
 193  * be checked with IS_ERR() for errors.
 194  */
 195 static struct cfg80211_registered_device *
 196 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 197 {
 198         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 199 }
 200
 201 /* policy for the attributes */
 202 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 203         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 204         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 205                                       .len = 20-1 },
 206         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 207
 208         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 209         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 210         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 211         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 212         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 213
 214         [NL80211_ATTR_WIPHY_RETRY_SHORT] = { .type = NLA_U8 },
 215         [NL80211_ATTR_WIPHY_RETRY_LONG] = { .type = NLA_U8 },
 216         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 217         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 218         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 219         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 220
 221         [NL80211_ATTR_IFTYPE] = { .type = NLA_U32 },
 222         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 223         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 224
 225         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 226         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 227
 228         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 229         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 230                                     .len = WLAN_MAX_KEY_LEN },
 231         [NL80211_ATTR_KEY_IDX] = { .type = NLA_U8 },
 232         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 233         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 234         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 235         [NL80211_ATTR_KEY_TYPE] = { .type = NLA_U32 },
 236
 237         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 238         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 239         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 240                                        .len = IEEE80211_MAX_DATA_LEN },
 241         [NL80211_ATTR_BEACON_TAIL] = { .type = NLA_BINARY,
 242                                        .len = IEEE80211_MAX_DATA_LEN },
 243         [NL80211_ATTR_STA_AID] = { .type = NLA_U16 },
 244         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 245         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 246         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 247                                                .len = NL80211_MAX_SUPP_RATES },
 248         [NL80211_ATTR_STA_PLINK_ACTION] = { .type = NLA_U8 },
 249         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 250         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 251         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 252                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 253         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 254
 255         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 256         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 257
 258         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 259         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 260         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 261         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 262                                            .len = NL80211_MAX_SUPP_RATES },
 263         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 264
 265         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 266         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 267
 268         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 269
 270         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 271         [NL80211_ATTR_IE] = { .type = NLA_BINARY,
 272                               .len = IEEE80211_MAX_DATA_LEN },
 273         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 274         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 275
 276         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 277                                 .len = IEEE80211_MAX_SSID_LEN },
 278         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 279         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 280         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 281         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 282         [NL80211_ATTR_USE_MFP] = { .type = NLA_U32 },
 283         [NL80211_ATTR_STA_FLAGS2] = {
 284                 .len = sizeof(struct nl80211_sta_flag_update),
 285         },
 286         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 287         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 288         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 289         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 290         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 291         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 292         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 293         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 294         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 295         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 296         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 297         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 298         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 299                                  .len = IEEE80211_MAX_DATA_LEN },
 300         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 301         [NL80211_ATTR_PS_STATE] = { .type = NLA_U32 },
 302         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 303         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 304         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 306         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 307         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 308         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 309         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 310         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 311         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 312         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 313         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 314         [NL80211_ATTR_STA_PLINK_STATE] = { .type = NLA_U8 },
 315         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 316         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 317         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 318         [NL80211_ATTR_HIDDEN_SSID] = { .type = NLA_U32 },
 319         [NL80211_ATTR_IE_PROBE_RESP] = { .type = NLA_BINARY,
 320                                          .len = IEEE80211_MAX_DATA_LEN },
 321         [NL80211_ATTR_IE_ASSOC_RESP] = { .type = NLA_BINARY,
 322                                          .len = IEEE80211_MAX_DATA_LEN },
 323         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 324         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 325         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 326         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 327         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 328         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 329         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 330         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 331         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 332         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 333         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 334                                       .len = IEEE80211_MAX_DATA_LEN },
 335         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 336         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 338                 .len = NL80211_HT_CAPABILITY_LEN
 339         },
 340         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 341         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 342         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 343         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 344         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 345         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 346         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 347         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 348         [NL80211_ATTR_P2P_CTWINDOW] = { .type = NLA_U8 },
 349         [NL80211_ATTR_P2P_OPPPS] = { .type = NLA_U8 },
 350         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] = {. type = NLA_U32 },
 351         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 352         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 353         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 354         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 355         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 356         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 357         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 358                 .len = NL80211_VHT_CAPABILITY_LEN,
 359         },
 360         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 361         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 362                                   .len = IEEE80211_MAX_DATA_LEN },
 363         [NL80211_ATTR_PEER_AID] = { .type = NLA_U16 },
 364         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 365         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 366         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 367         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 368         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 369         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 370         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 371         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 372         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 373         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 374         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 375         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 376         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 377                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 378         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 379         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 380         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 381         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 382         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 383         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 384         [NL80211_ATTR_TSID] = { .type = NLA_U8 },
 385         [NL80211_ATTR_USER_PRIO] = { .type = NLA_U8 },
 386         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 387         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 388         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 389         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 391         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 392         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 393         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 394         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 395         [NL80211_ATTR_STA_SUPPORT_P2P_PS] = { .type = NLA_U8 },
 396         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 397                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 398         },
 399         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 400         [NL80211_ATTR_NAN_MASTER_PREF] = { .type = NLA_U8 },
 401         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 402         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 403         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 404                                     .len = FILS_MAX_KEK_LEN },
 405         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 406         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 407         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 408         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 409         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 410                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 411         },
 412         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 413         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 414                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 415         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 416                                           .len = FILS_ERP_MAX_REALM_LEN },
 417         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 418         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 419                                         .len = FILS_ERP_MAX_RRK_LEN },
 420         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 421         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 422         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 423 };
 424
 425 /* policy for the key attributes */
 426 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 427         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 428         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 429         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 430         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 431         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 432         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 433         [NL80211_KEY_TYPE] = { .type = NLA_U32 },
 434         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 435 };
 436
 437 /* policy for the key default flags */
 438 static const struct nla_policy
 439 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 440         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 441         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 442 };
 443
 444 #ifdef CONFIG_PM
 445 /* policy for WoWLAN attributes */
 446 static const struct nla_policy
 447 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 448         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 449         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 450         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 451         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 452         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 453         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 454         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 455         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 456         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 457         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 458 };
 459
 460 static const struct nla_policy
 461 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 462         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 463         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 464         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 465         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 466         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 467         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 468         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 469                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 470         },
 471         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 472                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 473         },
 474         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 475         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 476         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 477 };
 478 #endif /* CONFIG_PM */
 479
 480 /* policy for coalesce rule attributes */
 481 static const struct nla_policy
 482 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 483         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 484         [NL80211_ATTR_COALESCE_RULE_CONDITION] = { .type = NLA_U32 },
 485         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 486 };
 487
 488 /* policy for GTK rekey offload attributes */
 489 static const struct nla_policy
 490 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 491         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 492         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 493         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 494 };
 495
 496 static const struct nla_policy
 497 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 498         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 499                                                  .len = IEEE80211_MAX_SSID_LEN },
 500         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 501         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 502 };
 503
 504 static const struct nla_policy
 505 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 506         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 507         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 508 };
 509
 510 static const struct nla_policy
 511 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 512         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 513         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 514         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 515                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 516         },
 517 };
 518
 519 /* policy for NAN function attributes */
 520 static const struct nla_policy
 521 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 522         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 523         [NL80211_NAN_FUNC_SERVICE_ID] = {
 524                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 525         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 526         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 527         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 528         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 529         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 530         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 531         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 532         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 533         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 534                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 535         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 536         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 537         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 538         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 539         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 540 };
 541
 542 /* policy for Service Response Filter attributes */
 543 static const struct nla_policy
 544 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 545         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 546         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 547                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 548         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 549         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 550 };
 551
 552 /* policy for packet pattern attributes */
 553 static const struct nla_policy
 554 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 555         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 556         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 557         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 558 };
 559
 560 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
 561                                      struct netlink_callback *cb,
 562                                      struct cfg80211_registered_device **rdev,
 563                                      struct wireless_dev **wdev)
 564 {
 565         int err;
 566
 567         if (!cb->args[0]) {
 568                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 569                                   genl_family_attrbuf(&nl80211_fam),
 570                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 571                 if (err)
 572                         return err;
 573
 574                 *wdev = __cfg80211_wdev_from_attrs(
 575                                         sock_net(skb->sk),
 576                                         genl_family_attrbuf(&nl80211_fam));
 577                 if (IS_ERR(*wdev))
 578                         return PTR_ERR(*wdev);
 579                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 580                 /* 0 is the first index - add 1 to parse only once */
 581                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 582                 cb->args[1] = (*wdev)->identifier;
 583         } else {
 584                 /* subtract the 1 again here */
 585                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 586                 struct wireless_dev *tmp;
 587
 588                 if (!wiphy)
 589                         return -ENODEV;
 590                 *rdev = wiphy_to_rdev(wiphy);
 591                 *wdev = NULL;
 592
 593                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 594                         if (tmp->identifier == cb->args[1]) {
 595                                 *wdev = tmp;
 596                                 break;
 597                         }
 598                 }
 599
 600                 if (!*wdev)
 601                         return -ENODEV;
 602         }
 603
 604         return 0;
 605 }
 606
 607 /* IE validation */
 608 static bool is_valid_ie_attr(const struct nlattr *attr)
 609 {
 610         const u8 *pos;
 611         int len;
 612
 613         if (!attr)
 614                 return true;
 615
 616         pos = nla_data(attr);
 617         len = nla_len(attr);
 618
 619         while (len) {
 620                 u8 elemlen;
 621
 622                 if (len < 2)
 623                         return false;
 624                 len -= 2;
 625
 626                 elemlen = pos[1];
 627                 if (elemlen > len)
 628                         return false;
 629
 630                 len -= elemlen;
 631                 pos += 2 + elemlen;
 632         }
 633
 634         return true;
 635 }
 636
 637 /* message building helper */
 638 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 639                                    int flags, u8 cmd)
 640 {
 641         /* since there is no private header just add the generic one */
 642         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 643 }
 644
 645 static int nl80211_msg_put_channel(struct sk_buff *msg,
 646                                    struct ieee80211_channel *chan,
 647                                    bool large)
 648 {
 649         /* Some channels must be completely excluded from the
 650          * list to protect old user-space tools from breaking
 651          */
 652         if (!large && chan->flags &
 653             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 654                 return 0;
 655
 656         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 657                         chan->center_freq))
 658                 goto nla_put_failure;
 659
 660         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 661             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 662                 goto nla_put_failure;
 663         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 664                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 665                         goto nla_put_failure;
 666                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 667                         goto nla_put_failure;
 668         }
 669         if (chan->flags & IEEE80211_CHAN_RADAR) {
 670                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 671                         goto nla_put_failure;
 672                 if (large) {
 673                         u32 time;
 674
 675                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 676
 677                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 678                                         chan->dfs_state))
 679                                 goto nla_put_failure;
 680                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 681                                         time))
 682                                 goto nla_put_failure;
 683                         if (nla_put_u32(msg,
 684                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 685                                         chan->dfs_cac_ms))
 686                                 goto nla_put_failure;
 687                 }
 688         }
 689
 690         if (large) {
 691                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 692                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 693                         goto nla_put_failure;
 694                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 695                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 696                         goto nla_put_failure;
 697                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 698                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 699                         goto nla_put_failure;
 700                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 701                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 702                         goto nla_put_failure;
 703                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 704                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 705                         goto nla_put_failure;
 706                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 707                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 708                         goto nla_put_failure;
 709                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 710                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 711                         goto nla_put_failure;
 712                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 713                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 714                         goto nla_put_failure;
 715         }
 716
 717         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 718                         DBM_TO_MBM(chan->max_power)))
 719                 goto nla_put_failure;
 720
 721         return 0;
 722
 723  nla_put_failure:
 724         return -ENOBUFS;
 725 }
 726
 727 /* netlink command implementations */
 728
 729 struct key_parse {
 730         struct key_params p;
 731         int idx;
 732         int type;
 733         bool def, defmgmt;
 734         bool def_uni, def_multi;
 735 };
 736
 737 static int nl80211_parse_key_new(struct nlattr *key, struct key_parse *k)
 738 {
 739         struct nlattr *tb[NL80211_KEY_MAX + 1];
 740         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 741                                    nl80211_key_policy, NULL);
 742         if (err)
 743                 return err;
 744
 745         k->def = !!tb[NL80211_KEY_DEFAULT];
 746         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 747
 748         if (k->def) {
 749                 k->def_uni = true;
 750                 k->def_multi = true;
 751         }
 752         if (k->defmgmt)
 753                 k->def_multi = true;
 754
 755         if (tb[NL80211_KEY_IDX])
 756                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 757
 758         if (tb[NL80211_KEY_DATA]) {
 759                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 760                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 761         }
 762
 763         if (tb[NL80211_KEY_SEQ]) {
 764                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 765                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 766         }
 767
 768         if (tb[NL80211_KEY_CIPHER])
 769                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 770
 771         if (tb[NL80211_KEY_TYPE]) {
 772                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 773                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 774                         return -EINVAL;
 775         }
 776
 777         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 778                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 779
 780                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 781                                        tb[NL80211_KEY_DEFAULT_TYPES],
 782                                        nl80211_key_default_policy, NULL);
 783                 if (err)
 784                         return err;
 785
 786                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 787                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 788         }
 789
 790         return 0;
 791 }
 792
 793 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 794 {
 795         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 796                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 797                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 798         }
 799
 800         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 801                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 802                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 803         }
 804
 805         if (info->attrs[NL80211_ATTR_KEY_IDX])
 806                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 807
 808         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 809                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 810
 811         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 812         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 813
 814         if (k->def) {
 815                 k->def_uni = true;
 816                 k->def_multi = true;
 817         }
 818         if (k->defmgmt)
 819                 k->def_multi = true;
 820
 821         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
 822                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 823                 if (k->type < 0 || k->type >= NUM_NL80211_KEYTYPES)
 824                         return -EINVAL;
 825         }
 826
 827         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 828                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 829                 int err = nla_parse_nested(kdt,
 830                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 831                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 832                                            nl80211_key_default_policy,
 833                                            info->extack);
 834                 if (err)
 835                         return err;
 836
 837                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 838                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 839         }
 840
 841         return 0;
 842 }
 843
 844 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 845 {
 846         int err;
 847
 848         memset(k, 0, sizeof(*k));
 849         k->idx = -1;
 850         k->type = -1;
 851
 852         if (info->attrs[NL80211_ATTR_KEY])
 853                 err = nl80211_parse_key_new(info->attrs[NL80211_ATTR_KEY], k);
 854         else
 855                 err = nl80211_parse_key_old(info, k);
 856
 857         if (err)
 858                 return err;
 859
 860         if (k->def && k->defmgmt)
 861                 return -EINVAL;
 862
 863         if (k->defmgmt) {
 864                 if (k->def_uni || !k->def_multi)
 865                         return -EINVAL;
 866         }
 867
 868         if (k->idx != -1) {
 869                 if (k->defmgmt) {
 870                         if (k->idx < 4 || k->idx > 5)
 871                                 return -EINVAL;
 872                 } else if (k->def) {
 873                         if (k->idx < 0 || k->idx > 3)
 874                                 return -EINVAL;
 875                 } else {
 876                         if (k->idx < 0 || k->idx > 5)
 877                                 return -EINVAL;
 878                 }
 879         }
 880
 881         return 0;
 882 }
 883
 884 static struct cfg80211_cached_keys *
 885 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
 886                        struct nlattr *keys, bool *no_ht)
 887 {
 888         struct key_parse parse;
 889         struct nlattr *key;
 890         struct cfg80211_cached_keys *result;
 891         int rem, err, def = 0;
 892         bool have_key = false;
 893
 894         nla_for_each_nested(key, keys, rem) {
 895                 have_key = true;
 896                 break;
 897         }
 898
 899         if (!have_key)
 900                 return NULL;
 901
 902         result = kzalloc(sizeof(*result), GFP_KERNEL);
 903         if (!result)
 904                 return ERR_PTR(-ENOMEM);
 905
 906         result->def = -1;
 907
 908         nla_for_each_nested(key, keys, rem) {
 909                 memset(&parse, 0, sizeof(parse));
 910                 parse.idx = -1;
 911
 912                 err = nl80211_parse_key_new(key, &parse);
 913                 if (err)
 914                         goto error;
 915                 err = -EINVAL;
 916                 if (!parse.p.key)
 917                         goto error;
 918                 if (parse.idx < 0 || parse.idx > 3)
 919                         goto error;
 920                 if (parse.def) {
 921                         if (def)
 922                                 goto error;
 923                         def = 1;
 924                         result->def = parse.idx;
 925                         if (!parse.def_uni || !parse.def_multi)
 926                                 goto error;
 927                 } else if (parse.defmgmt)
 928                         goto error;
 929                 err = cfg80211_validate_key_settings(rdev, &parse.p,
 930                                                      parse.idx, false, NULL);
 931                 if (err)
 932                         goto error;
 933                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
 934                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
 935                         err = -EINVAL;
 936                         goto error;
 937                 }
 938                 result->params[parse.idx].cipher = parse.p.cipher;
 939                 result->params[parse.idx].key_len = parse.p.key_len;
 940                 result->params[parse.idx].key = result->data[parse.idx];
 941                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
 942
 943                 /* must be WEP key if we got here */
 944                 if (no_ht)
 945                         *no_ht = true;
 946         }
 947
 948         if (result->def < 0) {
 949                 err = -EINVAL;
 950                 goto error;
 951         }
 952
 953         return result;
 954  error:
 955         kfree(result);
 956         return ERR_PTR(err);
 957 }
 958
 959 static int nl80211_key_allowed(struct wireless_dev *wdev)
 960 {
 961         ASSERT_WDEV_LOCK(wdev);
 962
 963         switch (wdev->iftype) {
 964         case NL80211_IFTYPE_AP:
 965         case NL80211_IFTYPE_AP_VLAN:
 966         case NL80211_IFTYPE_P2P_GO:
 967         case NL80211_IFTYPE_MESH_POINT:
 968                 break;
 969         case NL80211_IFTYPE_ADHOC:
 970         case NL80211_IFTYPE_STATION:
 971         case NL80211_IFTYPE_P2P_CLIENT:
 972                 if (!wdev->current_bss)
 973                         return -ENOLINK;
 974                 break;
 975         case NL80211_IFTYPE_UNSPECIFIED:
 976         case NL80211_IFTYPE_OCB:
 977         case NL80211_IFTYPE_MONITOR:
 978         case NL80211_IFTYPE_NAN:
 979         case NL80211_IFTYPE_P2P_DEVICE:
 980         case NL80211_IFTYPE_WDS:
 981         case NUM_NL80211_IFTYPES:
 982                 return -EINVAL;
 983         }
 984
 985         return 0;
 986 }
 987
 988 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
 989                                                         struct nlattr *tb)
 990 {
 991         struct ieee80211_channel *chan;
 992
 993         if (tb == NULL)
 994                 return NULL;
 995         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
 996         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
 997                 return NULL;
 998         return chan;
 999 }
1000
1001 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1002 {
1003         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1004         int i;
1005
1006         if (!nl_modes)
1007                 goto nla_put_failure;
1008
1009         i = 0;
1010         while (ifmodes) {
1011                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1012                         goto nla_put_failure;
1013                 ifmodes >>= 1;
1014                 i++;
1015         }
1016
1017         nla_nest_end(msg, nl_modes);
1018         return 0;
1019
1020 nla_put_failure:
1021         return -ENOBUFS;
1022 }
1023
1024 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1025                                           struct sk_buff *msg,
1026                                           bool large)
1027 {
1028         struct nlattr *nl_combis;
1029         int i, j;
1030
1031         nl_combis = nla_nest_start(msg,
1032                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1033         if (!nl_combis)
1034                 goto nla_put_failure;
1035
1036         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1037                 const struct ieee80211_iface_combination *c;
1038                 struct nlattr *nl_combi, *nl_limits;
1039
1040                 c = &wiphy->iface_combinations[i];
1041
1042                 nl_combi = nla_nest_start(msg, i + 1);
1043                 if (!nl_combi)
1044                         goto nla_put_failure;
1045
1046                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1047                 if (!nl_limits)
1048                         goto nla_put_failure;
1049
1050                 for (j = 0; j < c->n_limits; j++) {
1051                         struct nlattr *nl_limit;
1052
1053                         nl_limit = nla_nest_start(msg, j + 1);
1054                         if (!nl_limit)
1055                                 goto nla_put_failure;
1056                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1057                                         c->limits[j].max))
1058                                 goto nla_put_failure;
1059                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1060                                                 c->limits[j].types))
1061                                 goto nla_put_failure;
1062                         nla_nest_end(msg, nl_limit);
1063                 }
1064
1065                 nla_nest_end(msg, nl_limits);
1066
1067                 if (c->beacon_int_infra_match &&
1068                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1069                         goto nla_put_failure;
1070                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1071                                 c->num_different_channels) ||
1072                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1073                                 c->max_interfaces))
1074                         goto nla_put_failure;
1075                 if (large &&
1076                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1077                                 c->radar_detect_widths) ||
1078                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1079                                 c->radar_detect_regions)))
1080                         goto nla_put_failure;
1081                 if (c->beacon_int_min_gcd &&
1082                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1083                                 c->beacon_int_min_gcd))
1084                         goto nla_put_failure;
1085
1086                 nla_nest_end(msg, nl_combi);
1087         }
1088
1089         nla_nest_end(msg, nl_combis);
1090
1091         return 0;
1092 nla_put_failure:
1093         return -ENOBUFS;
1094 }
1095
1096 #ifdef CONFIG_PM
1097 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1098                                         struct sk_buff *msg)
1099 {
1100         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1101         struct nlattr *nl_tcp;
1102
1103         if (!tcp)
1104                 return 0;
1105
1106         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1107         if (!nl_tcp)
1108                 return -ENOBUFS;
1109
1110         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1111                         tcp->data_payload_max))
1112                 return -ENOBUFS;
1113
1114         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1115                         tcp->data_payload_max))
1116                 return -ENOBUFS;
1117
1118         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1119                 return -ENOBUFS;
1120
1121         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1122                                 sizeof(*tcp->tok), tcp->tok))
1123                 return -ENOBUFS;
1124
1125         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1126                         tcp->data_interval_max))
1127                 return -ENOBUFS;
1128
1129         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1130                         tcp->wake_payload_max))
1131                 return -ENOBUFS;
1132
1133         nla_nest_end(msg, nl_tcp);
1134         return 0;
1135 }
1136
1137 static int nl80211_send_wowlan(struct sk_buff *msg,
1138                                struct cfg80211_registered_device *rdev,
1139                                bool large)
1140 {
1141         struct nlattr *nl_wowlan;
1142
1143         if (!rdev->wiphy.wowlan)
1144                 return 0;
1145
1146         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1147         if (!nl_wowlan)
1148                 return -ENOBUFS;
1149
1150         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1151              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1152             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1153              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1154             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1155              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1156             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1157              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1158             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1159              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1160             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1161              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1162             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1163              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1164             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1165              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1166                 return -ENOBUFS;
1167
1168         if (rdev->wiphy.wowlan->n_patterns) {
1169                 struct nl80211_pattern_support pat = {
1170                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1171                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1172                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1173                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1174                 };
1175
1176                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1177                             sizeof(pat), &pat))
1178                         return -ENOBUFS;
1179         }
1180
1181         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1182             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1183                         rdev->wiphy.wowlan->max_nd_match_sets))
1184                 return -ENOBUFS;
1185
1186         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1187                 return -ENOBUFS;
1188
1189         nla_nest_end(msg, nl_wowlan);
1190
1191         return 0;
1192 }
1193 #endif
1194
1195 static int nl80211_send_coalesce(struct sk_buff *msg,
1196                                  struct cfg80211_registered_device *rdev)
1197 {
1198         struct nl80211_coalesce_rule_support rule;
1199
1200         if (!rdev->wiphy.coalesce)
1201                 return 0;
1202
1203         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1204         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1205         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1206         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1207         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1208         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1209
1210         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1211                 return -ENOBUFS;
1212
1213         return 0;
1214 }
1215
1216 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1217                                       struct ieee80211_supported_band *sband)
1218 {
1219         struct nlattr *nl_rates, *nl_rate;
1220         struct ieee80211_rate *rate;
1221         int i;
1222
1223         /* add HT info */
1224         if (sband->ht_cap.ht_supported &&
1225             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1226                      sizeof(sband->ht_cap.mcs),
1227                      &sband->ht_cap.mcs) ||
1228              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1229                          sband->ht_cap.cap) ||
1230              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1231                         sband->ht_cap.ampdu_factor) ||
1232              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1233                         sband->ht_cap.ampdu_density)))
1234                 return -ENOBUFS;
1235
1236         /* add VHT info */
1237         if (sband->vht_cap.vht_supported &&
1238             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1239                      sizeof(sband->vht_cap.vht_mcs),
1240                      &sband->vht_cap.vht_mcs) ||
1241              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1242                          sband->vht_cap.cap)))
1243                 return -ENOBUFS;
1244
1245         /* add bitrates */
1246         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1247         if (!nl_rates)
1248                 return -ENOBUFS;
1249
1250         for (i = 0; i < sband->n_bitrates; i++) {
1251                 nl_rate = nla_nest_start(msg, i);
1252                 if (!nl_rate)
1253                         return -ENOBUFS;
1254
1255                 rate = &sband->bitrates[i];
1256                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1257                                 rate->bitrate))
1258                         return -ENOBUFS;
1259                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1260                     nla_put_flag(msg,
1261                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1262                         return -ENOBUFS;
1263
1264                 nla_nest_end(msg, nl_rate);
1265         }
1266
1267         nla_nest_end(msg, nl_rates);
1268
1269         return 0;
1270 }
1271
1272 static int
1273 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1274                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1275 {
1276         u16 stypes;
1277         struct nlattr *nl_ftypes, *nl_ifs;
1278         enum nl80211_iftype ift;
1279         int i;
1280
1281         if (!mgmt_stypes)
1282                 return 0;
1283
1284         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1285         if (!nl_ifs)
1286                 return -ENOBUFS;
1287
1288         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1289                 nl_ftypes = nla_nest_start(msg, ift);
1290                 if (!nl_ftypes)
1291                         return -ENOBUFS;
1292                 i = 0;
1293                 stypes = mgmt_stypes[ift].tx;
1294                 while (stypes) {
1295                         if ((stypes & 1) &&
1296                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1297                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1298                                 return -ENOBUFS;
1299                         stypes >>= 1;
1300                         i++;
1301                 }
1302                 nla_nest_end(msg, nl_ftypes);
1303         }
1304
1305         nla_nest_end(msg, nl_ifs);
1306
1307         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1308         if (!nl_ifs)
1309                 return -ENOBUFS;
1310
1311         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1312                 nl_ftypes = nla_nest_start(msg, ift);
1313                 if (!nl_ftypes)
1314                         return -ENOBUFS;
1315                 i = 0;
1316                 stypes = mgmt_stypes[ift].rx;
1317                 while (stypes) {
1318                         if ((stypes & 1) &&
1319                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1320                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1321                                 return -ENOBUFS;
1322                         stypes >>= 1;
1323                         i++;
1324                 }
1325                 nla_nest_end(msg, nl_ftypes);
1326         }
1327         nla_nest_end(msg, nl_ifs);
1328
1329         return 0;
1330 }
1331
1332 #define CMD(op, n)                                                      \
1333          do {                                                           \
1334                 if (rdev->ops->op) {                                    \
1335                         i++;                                            \
1336                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1337                                 goto nla_put_failure;                   \
1338                 }                                                       \
1339         } while (0)
1340
1341 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1342                                         struct sk_buff *msg)
1343 {
1344         int i = 0;
1345
1346         /*
1347          * do *NOT* add anything into this function, new things need to be
1348          * advertised only to new versions of userspace that can deal with
1349          * the split (and they can't possibly care about new features...
1350          */
1351         CMD(add_virtual_intf, NEW_INTERFACE);
1352         CMD(change_virtual_intf, SET_INTERFACE);
1353         CMD(add_key, NEW_KEY);
1354         CMD(start_ap, START_AP);
1355         CMD(add_station, NEW_STATION);
1356         CMD(add_mpath, NEW_MPATH);
1357         CMD(update_mesh_config, SET_MESH_CONFIG);
1358         CMD(change_bss, SET_BSS);
1359         CMD(auth, AUTHENTICATE);
1360         CMD(assoc, ASSOCIATE);
1361         CMD(deauth, DEAUTHENTICATE);
1362         CMD(disassoc, DISASSOCIATE);
1363         CMD(join_ibss, JOIN_IBSS);
1364         CMD(join_mesh, JOIN_MESH);
1365         CMD(set_pmksa, SET_PMKSA);
1366         CMD(del_pmksa, DEL_PMKSA);
1367         CMD(flush_pmksa, FLUSH_PMKSA);
1368         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1369                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1370         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1371         CMD(mgmt_tx, FRAME);
1372         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1373         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1374                 i++;
1375                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1376                         goto nla_put_failure;
1377         }
1378         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1379             rdev->ops->join_mesh) {
1380                 i++;
1381                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1382                         goto nla_put_failure;
1383         }
1384         CMD(set_wds_peer, SET_WDS_PEER);
1385         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1386                 CMD(tdls_mgmt, TDLS_MGMT);
1387                 CMD(tdls_oper, TDLS_OPER);
1388         }
1389         if (rdev->wiphy.max_sched_scan_reqs)
1390                 CMD(sched_scan_start, START_SCHED_SCAN);
1391         CMD(probe_client, PROBE_CLIENT);
1392         CMD(set_noack_map, SET_NOACK_MAP);
1393         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1394                 i++;
1395                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1396                         goto nla_put_failure;
1397         }
1398         CMD(start_p2p_device, START_P2P_DEVICE);
1399         CMD(set_mcast_rate, SET_MCAST_RATE);
1400 #ifdef CONFIG_NL80211_TESTMODE
1401         CMD(testmode_cmd, TESTMODE);
1402 #endif
1403
1404         if (rdev->ops->connect || rdev->ops->auth) {
1405                 i++;
1406                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1407                         goto nla_put_failure;
1408         }
1409
1410         if (rdev->ops->disconnect || rdev->ops->deauth) {
1411                 i++;
1412                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1413                         goto nla_put_failure;
1414         }
1415
1416         return i;
1417  nla_put_failure:
1418         return -ENOBUFS;
1419 }
1420
1421 struct nl80211_dump_wiphy_state {
1422         s64 filter_wiphy;
1423         long start;
1424         long split_start, band_start, chan_start, capa_start;
1425         bool split;
1426 };
1427
1428 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1429                               enum nl80211_commands cmd,
1430                               struct sk_buff *msg, u32 portid, u32 seq,
1431                               int flags, struct nl80211_dump_wiphy_state *state)
1432 {
1433         void *hdr;
1434         struct nlattr *nl_bands, *nl_band;
1435         struct nlattr *nl_freqs, *nl_freq;
1436         struct nlattr *nl_cmds;
1437         enum nl80211_band band;
1438         struct ieee80211_channel *chan;
1439         int i;
1440         const struct ieee80211_txrx_stypes *mgmt_stypes =
1441                                 rdev->wiphy.mgmt_stypes;
1442         u32 features;
1443
1444         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1445         if (!hdr)
1446                 return -ENOBUFS;
1447
1448         if (WARN_ON(!state))
1449                 return -EINVAL;
1450
1451         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1452             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1453                            wiphy_name(&rdev->wiphy)) ||
1454             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1455                         cfg80211_rdev_list_generation))
1456                 goto nla_put_failure;
1457
1458         if (cmd != NL80211_CMD_NEW_WIPHY)
1459                 goto finish;
1460
1461         switch (state->split_start) {
1462         case 0:
1463                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1464                                rdev->wiphy.retry_short) ||
1465                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1466                                rdev->wiphy.retry_long) ||
1467                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1468                                 rdev->wiphy.frag_threshold) ||
1469                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1470                                 rdev->wiphy.rts_threshold) ||
1471                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1472                                rdev->wiphy.coverage_class) ||
1473                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1474                                rdev->wiphy.max_scan_ssids) ||
1475                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1476                                rdev->wiphy.max_sched_scan_ssids) ||
1477                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1478                                 rdev->wiphy.max_scan_ie_len) ||
1479                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1480                                 rdev->wiphy.max_sched_scan_ie_len) ||
1481                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1482                                rdev->wiphy.max_match_sets) ||
1483                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1484                                 rdev->wiphy.max_sched_scan_plans) ||
1485                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1486                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1487                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1488                                 rdev->wiphy.max_sched_scan_plan_iterations))
1489                         goto nla_put_failure;
1490
1491                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1492                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1493                         goto nla_put_failure;
1494                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1495                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1496                         goto nla_put_failure;
1497                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1498                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1499                         goto nla_put_failure;
1500                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1501                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1502                         goto nla_put_failure;
1503                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1504                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1505                         goto nla_put_failure;
1506                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1507                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1508                         goto nla_put_failure;
1509                 state->split_start++;
1510                 if (state->split)
1511                         break;
1512         case 1:
1513                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1514                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1515                             rdev->wiphy.cipher_suites))
1516                         goto nla_put_failure;
1517
1518                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1519                                rdev->wiphy.max_num_pmkids))
1520                         goto nla_put_failure;
1521
1522                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1523                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1524                         goto nla_put_failure;
1525
1526                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1527                                 rdev->wiphy.available_antennas_tx) ||
1528                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1529                                 rdev->wiphy.available_antennas_rx))
1530                         goto nla_put_failure;
1531
1532                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1533                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1534                                 rdev->wiphy.probe_resp_offload))
1535                         goto nla_put_failure;
1536
1537                 if ((rdev->wiphy.available_antennas_tx ||
1538                      rdev->wiphy.available_antennas_rx) &&
1539                     rdev->ops->get_antenna) {
1540                         u32 tx_ant = 0, rx_ant = 0;
1541                         int res;
1542
1543                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1544                         if (!res) {
1545                                 if (nla_put_u32(msg,
1546                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1547                                                 tx_ant) ||
1548                                     nla_put_u32(msg,
1549                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1550                                                 rx_ant))
1551                                         goto nla_put_failure;
1552                         }
1553                 }
1554
1555                 state->split_start++;
1556                 if (state->split)
1557                         break;
1558         case 2:
1559                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1560                                         rdev->wiphy.interface_modes))
1561                                 goto nla_put_failure;
1562                 state->split_start++;
1563                 if (state->split)
1564                         break;
1565         case 3:
1566                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1567                 if (!nl_bands)
1568                         goto nla_put_failure;
1569
1570                 for (band = state->band_start;
1571                      band < NUM_NL80211_BANDS; band++) {
1572                         struct ieee80211_supported_band *sband;
1573
1574                         sband = rdev->wiphy.bands[band];
1575
1576                         if (!sband)
1577                                 continue;
1578
1579                         nl_band = nla_nest_start(msg, band);
1580                         if (!nl_band)
1581                                 goto nla_put_failure;
1582
1583                         switch (state->chan_start) {
1584                         case 0:
1585                                 if (nl80211_send_band_rateinfo(msg, sband))
1586                                         goto nla_put_failure;
1587                                 state->chan_start++;
1588                                 if (state->split)
1589                                         break;
1590                         default:
1591                                 /* add frequencies */
1592                                 nl_freqs = nla_nest_start(
1593                                         msg, NL80211_BAND_ATTR_FREQS);
1594                                 if (!nl_freqs)
1595                                         goto nla_put_failure;
1596
1597                                 for (i = state->chan_start - 1;
1598                                      i < sband->n_channels;
1599                                      i++) {
1600                                         nl_freq = nla_nest_start(msg, i);
1601                                         if (!nl_freq)
1602                                                 goto nla_put_failure;
1603
1604                                         chan = &sband->channels[i];
1605
1606                                         if (nl80211_msg_put_channel(
1607                                                         msg, chan,
1608                                                         state->split))
1609                                                 goto nla_put_failure;
1610
1611                                         nla_nest_end(msg, nl_freq);
1612                                         if (state->split)
1613                                                 break;
1614                                 }
1615                                 if (i < sband->n_channels)
1616                                         state->chan_start = i + 2;
1617                                 else
1618                                         state->chan_start = 0;
1619                                 nla_nest_end(msg, nl_freqs);
1620                         }
1621
1622                         nla_nest_end(msg, nl_band);
1623
1624                         if (state->split) {
1625                                 /* start again here */
1626                                 if (state->chan_start)
1627                                         band--;
1628                                 break;
1629                         }
1630                 }
1631                 nla_nest_end(msg, nl_bands);
1632
1633                 if (band < NUM_NL80211_BANDS)
1634                         state->band_start = band + 1;
1635                 else
1636                         state->band_start = 0;
1637
1638                 /* if bands & channels are done, continue outside */
1639                 if (state->band_start == 0 && state->chan_start == 0)
1640                         state->split_start++;
1641                 if (state->split)
1642                         break;
1643         case 4:
1644                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1645                 if (!nl_cmds)
1646                         goto nla_put_failure;
1647
1648                 i = nl80211_add_commands_unsplit(rdev, msg);
1649                 if (i < 0)
1650                         goto nla_put_failure;
1651                 if (state->split) {
1652                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1653                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1654                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1655                                 CMD(channel_switch, CHANNEL_SWITCH);
1656                         CMD(set_qos_map, SET_QOS_MAP);
1657                         if (rdev->wiphy.features &
1658                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1659                                 CMD(add_tx_ts, ADD_TX_TS);
1660                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1661                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1662                 }
1663 #undef CMD
1664
1665                 nla_nest_end(msg, nl_cmds);
1666                 state->split_start++;
1667                 if (state->split)
1668                         break;
1669         case 5:
1670                 if (rdev->ops->remain_on_channel &&
1671                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1672                     nla_put_u32(msg,
1673                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1674                                 rdev->wiphy.max_remain_on_channel_duration))
1675                         goto nla_put_failure;
1676
1677                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1678                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1679                         goto nla_put_failure;
1680
1681                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1682                         goto nla_put_failure;
1683                 state->split_start++;
1684                 if (state->split)
1685                         break;
1686         case 6:
1687 #ifdef CONFIG_PM
1688                 if (nl80211_send_wowlan(msg, rdev, state->split))
1689                         goto nla_put_failure;
1690                 state->split_start++;
1691                 if (state->split)
1692                         break;
1693 #else
1694                 state->split_start++;
1695 #endif
1696         case 7:
1697                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1698                                         rdev->wiphy.software_iftypes))
1699                         goto nla_put_failure;
1700
1701                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1702                                                    state->split))
1703                         goto nla_put_failure;
1704
1705                 state->split_start++;
1706                 if (state->split)
1707                         break;
1708         case 8:
1709                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1710                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1711                                 rdev->wiphy.ap_sme_capa))
1712                         goto nla_put_failure;
1713
1714                 features = rdev->wiphy.features;
1715                 /*
1716                  * We can only add the per-channel limit information if the
1717                  * dump is split, otherwise it makes it too big. Therefore
1718                  * only advertise it in that case.
1719                  */
1720                 if (state->split)
1721                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1722                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1723                         goto nla_put_failure;
1724
1725                 if (rdev->wiphy.ht_capa_mod_mask &&
1726                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1727                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1728                             rdev->wiphy.ht_capa_mod_mask))
1729                         goto nla_put_failure;
1730
1731                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1732                     rdev->wiphy.max_acl_mac_addrs &&
1733                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1734                                 rdev->wiphy.max_acl_mac_addrs))
1735                         goto nla_put_failure;
1736
1737                 /*
1738                  * Any information below this point is only available to
1739                  * applications that can deal with it being split. This
1740                  * helps ensure that newly added capabilities don't break
1741                  * older tools by overrunning their buffers.
1742                  *
1743                  * We still increment split_start so that in the split
1744                  * case we'll continue with more data in the next round,
1745                  * but break unconditionally so unsplit data stops here.
1746                  */
1747                 state->split_start++;
1748                 break;
1749         case 9:
1750                 if (rdev->wiphy.extended_capabilities &&
1751                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1752                              rdev->wiphy.extended_capabilities_len,
1753                              rdev->wiphy.extended_capabilities) ||
1754                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1755                              rdev->wiphy.extended_capabilities_len,
1756                              rdev->wiphy.extended_capabilities_mask)))
1757                         goto nla_put_failure;
1758
1759                 if (rdev->wiphy.vht_capa_mod_mask &&
1760                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1761                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1762                             rdev->wiphy.vht_capa_mod_mask))
1763                         goto nla_put_failure;
1764
1765                 state->split_start++;
1766                 break;
1767         case 10:
1768                 if (nl80211_send_coalesce(msg, rdev))
1769                         goto nla_put_failure;
1770
1771                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1772                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1773                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1774                         goto nla_put_failure;
1775
1776                 if (rdev->wiphy.max_ap_assoc_sta &&
1777                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1778                                 rdev->wiphy.max_ap_assoc_sta))
1779                         goto nla_put_failure;
1780
1781                 state->split_start++;
1782                 break;
1783         case 11:
1784                 if (rdev->wiphy.n_vendor_commands) {
1785                         const struct nl80211_vendor_cmd_info *info;
1786                         struct nlattr *nested;
1787
1788                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1789                         if (!nested)
1790                                 goto nla_put_failure;
1791
1792                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1793                                 info = &rdev->wiphy.vendor_commands[i].info;
1794                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1795                                         goto nla_put_failure;
1796                         }
1797                         nla_nest_end(msg, nested);
1798                 }
1799
1800                 if (rdev->wiphy.n_vendor_events) {
1801                         const struct nl80211_vendor_cmd_info *info;
1802                         struct nlattr *nested;
1803
1804                         nested = nla_nest_start(msg,
1805                                                 NL80211_ATTR_VENDOR_EVENTS);
1806                         if (!nested)
1807                                 goto nla_put_failure;
1808
1809                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
1810                                 info = &rdev->wiphy.vendor_events[i];
1811                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1812                                         goto nla_put_failure;
1813                         }
1814                         nla_nest_end(msg, nested);
1815                 }
1816                 state->split_start++;
1817                 break;
1818         case 12:
1819                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
1820                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
1821                                rdev->wiphy.max_num_csa_counters))
1822                         goto nla_put_failure;
1823
1824                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
1825                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
1826                         goto nla_put_failure;
1827
1828                 if (rdev->wiphy.max_sched_scan_reqs &&
1829                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
1830                                 rdev->wiphy.max_sched_scan_reqs))
1831                         goto nla_put_failure;
1832
1833                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
1834                             sizeof(rdev->wiphy.ext_features),
1835                             rdev->wiphy.ext_features))
1836                         goto nla_put_failure;
1837
1838                 if (rdev->wiphy.bss_select_support) {
1839                         struct nlattr *nested;
1840                         u32 bss_select_support = rdev->wiphy.bss_select_support;
1841
1842                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
1843                         if (!nested)
1844                                 goto nla_put_failure;
1845
1846                         i = 0;
1847                         while (bss_select_support) {
1848                                 if ((bss_select_support & 1) &&
1849                                     nla_put_flag(msg, i))
1850                                         goto nla_put_failure;
1851                                 i++;
1852                                 bss_select_support >>= 1;
1853                         }
1854                         nla_nest_end(msg, nested);
1855                 }
1856
1857                 state->split_start++;
1858                 break;
1859         case 13:
1860                 if (rdev->wiphy.num_iftype_ext_capab &&
1861                     rdev->wiphy.iftype_ext_capab) {
1862                         struct nlattr *nested_ext_capab, *nested;
1863
1864                         nested = nla_nest_start(msg,
1865                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
1866                         if (!nested)
1867                                 goto nla_put_failure;
1868
1869                         for (i = state->capa_start;
1870                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
1871                                 const struct wiphy_iftype_ext_capab *capab;
1872
1873                                 capab = &rdev->wiphy.iftype_ext_capab[i];
1874
1875                                 nested_ext_capab = nla_nest_start(msg, i);
1876                                 if (!nested_ext_capab ||
1877                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
1878                                                 capab->iftype) ||
1879                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
1880                                             capab->extended_capabilities_len,
1881                                             capab->extended_capabilities) ||
1882                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1883                                             capab->extended_capabilities_len,
1884                                             capab->extended_capabilities_mask))
1885                                         goto nla_put_failure;
1886
1887                                 nla_nest_end(msg, nested_ext_capab);
1888                                 if (state->split)
1889                                         break;
1890                         }
1891                         nla_nest_end(msg, nested);
1892                         if (i < rdev->wiphy.num_iftype_ext_capab) {
1893                                 state->capa_start = i + 1;
1894                                 break;
1895                         }
1896                 }
1897
1898                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
1899                                 rdev->wiphy.nan_supported_bands))
1900                         goto nla_put_failure;
1901
1902                 /* done */
1903                 state->split_start = 0;
1904                 break;
1905         }
1906  finish:
1907         genlmsg_end(msg, hdr);
1908         return 0;
1909
1910  nla_put_failure:
1911         genlmsg_cancel(msg, hdr);
1912         return -EMSGSIZE;
1913 }
1914
1915 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
1916                                     struct netlink_callback *cb,
1917                                     struct nl80211_dump_wiphy_state *state)
1918 {
1919         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
1920         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
1921                               nl80211_fam.maxattr, nl80211_policy, NULL);
1922         /* ignore parse errors for backward compatibility */
1923         if (ret)
1924                 return 0;
1925
1926         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
1927         if (tb[NL80211_ATTR_WIPHY])
1928                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
1929         if (tb[NL80211_ATTR_WDEV])
1930                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
1931         if (tb[NL80211_ATTR_IFINDEX]) {
1932                 struct net_device *netdev;
1933                 struct cfg80211_registered_device *rdev;
1934                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
1935
1936                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
1937                 if (!netdev)
1938                         return -ENODEV;
1939                 if (netdev->ieee80211_ptr) {
1940                         rdev = wiphy_to_rdev(
1941                                 netdev->ieee80211_ptr->wiphy);
1942                         state->filter_wiphy = rdev->wiphy_idx;
1943                 }
1944         }
1945
1946         return 0;
1947 }
1948
1949 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
1950 {
1951         int idx = 0, ret;
1952         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
1953         struct cfg80211_registered_device *rdev;
1954
1955         rtnl_lock();
1956         if (!state) {
1957                 state = kzalloc(sizeof(*state), GFP_KERNEL);
1958                 if (!state) {
1959                         rtnl_unlock();
1960                         return -ENOMEM;
1961                 }
1962                 state->filter_wiphy = -1;
1963                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
1964                 if (ret) {
1965                         kfree(state);
1966                         rtnl_unlock();
1967                         return ret;
1968                 }
1969                 cb->args[0] = (long)state;
1970         }
1971
1972         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
1973                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
1974                         continue;
1975                 if (++idx <= state->start)
1976                         continue;
1977                 if (state->filter_wiphy != -1 &&
1978                     state->filter_wiphy != rdev->wiphy_idx)
1979                         continue;
1980                 /* attempt to fit multiple wiphy data chunks into the skb */
1981                 do {
1982                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
1983                                                  skb,
1984                                                  NETLINK_CB(cb->skb).portid,
1985                                                  cb->nlh->nlmsg_seq,
1986                                                  NLM_F_MULTI, state);
1987                         if (ret < 0) {
1988                                 /*
1989                                  * If sending the wiphy data didn't fit (ENOBUFS
1990                                  * or EMSGSIZE returned), this SKB is still
1991                                  * empty (so it's not too big because another
1992                                  * wiphy dataset is already in the skb) and
1993                                  * we've not tried to adjust the dump allocation
1994                                  * yet ... then adjust the alloc size to be
1995                                  * bigger, and return 1 but with the empty skb.
1996                                  * This results in an empty message being RX'ed
1997                                  * in userspace, but that is ignored.
1998                                  *
1999                                  * We can then retry with the larger buffer.
2000                                  */
2001                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2002                                     !skb->len && !state->split &&
2003                                     cb->min_dump_alloc < 4096) {
2004                                         cb->min_dump_alloc = 4096;
2005                                         state->split_start = 0;
2006                                         rtnl_unlock();
2007                                         return 1;
2008                                 }
2009                                 idx--;
2010                                 break;
2011                         }
2012                 } while (state->split_start > 0);
2013                 break;
2014         }
2015         rtnl_unlock();
2016
2017         state->start = idx;
2018
2019         return skb->len;
2020 }
2021
2022 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2023 {
2024         kfree((void *)cb->args[0]);
2025         return 0;
2026 }
2027
2028 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2029 {
2030         struct sk_buff *msg;
2031         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2032         struct nl80211_dump_wiphy_state state = {};
2033
2034         msg = nlmsg_new(4096, GFP_KERNEL);
2035         if (!msg)
2036                 return -ENOMEM;
2037
2038         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2039                                info->snd_portid, info->snd_seq, 0,
2040                                &state) < 0) {
2041                 nlmsg_free(msg);
2042                 return -ENOBUFS;
2043         }
2044
2045         return genlmsg_reply(msg, info);
2046 }
2047
2048 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2049         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2050         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2051         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2052         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2053         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2054 };
2055
2056 static int parse_txq_params(struct nlattr *tb[],
2057                             struct ieee80211_txq_params *txq_params)
2058 {
2059         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2060             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2061             !tb[NL80211_TXQ_ATTR_AIFS])
2062                 return -EINVAL;
2063
2064         txq_params->ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2065         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2066         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2067         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2068         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2069
2070         if (txq_params->ac >= NL80211_NUM_ACS)
2071                 return -EINVAL;
2072
2073         return 0;
2074 }
2075
2076 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2077 {
2078         /*
2079          * You can only set the channel explicitly for WDS interfaces,
2080          * all others have their channel managed via their respective
2081          * "establish a connection" command (connect, join, ...)
2082          *
2083          * For AP/GO and mesh mode, the channel can be set with the
2084          * channel userspace API, but is only stored and passed to the
2085          * low-level driver when the AP starts or the mesh is joined.
2086          * This is for backward compatibility, userspace can also give
2087          * the channel in the start-ap or join-mesh commands instead.
2088          *
2089          * Monitors are special as they are normally slaved to
2090          * whatever else is going on, so they have their own special
2091          * operation to set the monitor channel if possible.
2092          */
2093         return !wdev ||
2094                 wdev->iftype == NL80211_IFTYPE_AP ||
2095                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2096                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2097                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2098 }
2099
2100 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2101                                  struct genl_info *info,
2102                                  struct cfg80211_chan_def *chandef)
2103 {
2104         u32 control_freq;
2105
2106         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
2107                 return -EINVAL;
2108
2109         control_freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]);
2110
2111         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2112         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2113         chandef->center_freq1 = control_freq;
2114         chandef->center_freq2 = 0;
2115
2116         /* Primary channel not allowed */
2117         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED)
2118                 return -EINVAL;
2119
2120         if (info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2121                 enum nl80211_channel_type chantype;
2122
2123                 chantype = nla_get_u32(
2124                                 info->attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2125
2126                 switch (chantype) {
2127                 case NL80211_CHAN_NO_HT:
2128                 case NL80211_CHAN_HT20:
2129                 case NL80211_CHAN_HT40PLUS:
2130                 case NL80211_CHAN_HT40MINUS:
2131                         cfg80211_chandef_create(chandef, chandef->chan,
2132                                                 chantype);
2133                         /* user input for center_freq is incorrect */
2134                         if (info->attrs[NL80211_ATTR_CENTER_FREQ1] &&
2135                             chandef->center_freq1 != nla_get_u32(
2136                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]))
2137                                 return -EINVAL;
2138                         /* center_freq2 must be zero */
2139                         if (info->attrs[NL80211_ATTR_CENTER_FREQ2] &&
2140                             nla_get_u32(info->attrs[NL80211_ATTR_CENTER_FREQ2]))
2141                                 return -EINVAL;
2142                         break;
2143                 default:
2144                         return -EINVAL;
2145                 }
2146         } else if (info->attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2147                 chandef->width =
2148                         nla_get_u32(info->attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2149                 if (info->attrs[NL80211_ATTR_CENTER_FREQ1])
2150                         chandef->center_freq1 =
2151                                 nla_get_u32(
2152                                         info->attrs[NL80211_ATTR_CENTER_FREQ1]);
2153                 if (info->attrs[NL80211_ATTR_CENTER_FREQ2])
2154                         chandef->center_freq2 =
2155                                 nla_get_u32(
2156                                         info->attrs[NL80211_ATTR_CENTER_FREQ2]);
2157         }
2158
2159         if (!cfg80211_chandef_valid(chandef))
2160                 return -EINVAL;
2161
2162         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2163                                      IEEE80211_CHAN_DISABLED))
2164                 return -EINVAL;
2165
2166         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2167              chandef->width == NL80211_CHAN_WIDTH_10) &&
2168             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ))
2169                 return -EINVAL;
2170
2171         return 0;
2172 }
2173
2174 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2175                                  struct net_device *dev,
2176                                  struct genl_info *info)
2177 {
2178         struct cfg80211_chan_def chandef;
2179         int result;
2180         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2181         struct wireless_dev *wdev = NULL;
2182
2183         if (dev)
2184                 wdev = dev->ieee80211_ptr;
2185         if (!nl80211_can_set_dev_channel(wdev))
2186                 return -EOPNOTSUPP;
2187         if (wdev)
2188                 iftype = wdev->iftype;
2189
2190         result = nl80211_parse_chandef(rdev, info, &chandef);
2191         if (result)
2192                 return result;
2193
2194         switch (iftype) {
2195         case NL80211_IFTYPE_AP:
2196         case NL80211_IFTYPE_P2P_GO:
2197                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2198                                                    iftype)) {
2199                         result = -EINVAL;
2200                         break;
2201                 }
2202                 if (wdev->beacon_interval) {
2203                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2204                             !(rdev->wiphy.features &
2205                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2206                                 result = -EBUSY;
2207                                 break;
2208                         }
2209
2210                         /* Only allow dynamic channel width changes */
2211                         if (chandef.chan != wdev->preset_chandef.chan) {
2212                                 result = -EBUSY;
2213                                 break;
2214                         }
2215                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2216                         if (result)
2217                                 break;
2218                 }
2219                 wdev->preset_chandef = chandef;
2220                 result = 0;
2221                 break;
2222         case NL80211_IFTYPE_MESH_POINT:
2223                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2224                 break;
2225         case NL80211_IFTYPE_MONITOR:
2226                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2227                 break;
2228         default:
2229                 result = -EINVAL;
2230         }
2231
2232         return result;
2233 }
2234
2235 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2236 {
2237         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2238         struct net_device *netdev = info->user_ptr[1];
2239
2240         return __nl80211_set_channel(rdev, netdev, info);
2241 }
2242
2243 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2244 {
2245         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2246         struct net_device *dev = info->user_ptr[1];
2247         struct wireless_dev *wdev = dev->ieee80211_ptr;
2248         const u8 *bssid;
2249
2250         if (!info->attrs[NL80211_ATTR_MAC])
2251                 return -EINVAL;
2252
2253         if (netif_running(dev))
2254                 return -EBUSY;
2255
2256         if (!rdev->ops->set_wds_peer)
2257                 return -EOPNOTSUPP;
2258
2259         if (wdev->iftype != NL80211_IFTYPE_WDS)
2260                 return -EOPNOTSUPP;
2261
2262         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2263         return rdev_set_wds_peer(rdev, dev, bssid);
2264 }
2265
2266 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2267 {
2268         struct cfg80211_registered_device *rdev;
2269         struct net_device *netdev = NULL;
2270         struct wireless_dev *wdev;
2271         int result = 0, rem_txq_params = 0;
2272         struct nlattr *nl_txq_params;
2273         u32 changed;
2274         u8 retry_short = 0, retry_long = 0;
2275         u32 frag_threshold = 0, rts_threshold = 0;
2276         u8 coverage_class = 0;
2277
2278         ASSERT_RTNL();
2279
2280         /*
2281          * Try to find the wiphy and netdev. Normally this
2282          * function shouldn't need the netdev, but this is
2283          * done for backward compatibility -- previously
2284          * setting the channel was done per wiphy, but now
2285          * it is per netdev. Previous userland like hostapd
2286          * also passed a netdev to set_wiphy, so that it is
2287          * possible to let that go to the right netdev!
2288          */
2289
2290         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2291                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2292
2293                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2294                 if (netdev && netdev->ieee80211_ptr)
2295                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2296                 else
2297                         netdev = NULL;
2298         }
2299
2300         if (!netdev) {
2301                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2302                                                   info->attrs);
2303                 if (IS_ERR(rdev))
2304                         return PTR_ERR(rdev);
2305                 wdev = NULL;
2306                 netdev = NULL;
2307                 result = 0;
2308         } else
2309                 wdev = netdev->ieee80211_ptr;
2310
2311         /*
2312          * end workaround code, by now the rdev is available
2313          * and locked, and wdev may or may not be NULL.
2314          */
2315
2316         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2317                 result = cfg80211_dev_rename(
2318                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2319
2320         if (result)
2321                 return result;
2322
2323         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2324                 struct ieee80211_txq_params txq_params;
2325                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2326
2327                 if (!rdev->ops->set_txq_params)
2328                         return -EOPNOTSUPP;
2329
2330                 if (!netdev)
2331                         return -EINVAL;
2332
2333                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2334                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2335                         return -EINVAL;
2336
2337                 if (!netif_running(netdev))
2338                         return -ENETDOWN;
2339
2340                 nla_for_each_nested(nl_txq_params,
2341                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2342                                     rem_txq_params) {
2343                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2344                                                   nl_txq_params,
2345                                                   txq_params_policy,
2346                                                   info->extack);
2347                         if (result)
2348                                 return result;
2349                         result = parse_txq_params(tb, &txq_params);
2350                         if (result)
2351                                 return result;
2352
2353                         result = rdev_set_txq_params(rdev, netdev,
2354                                                      &txq_params);
2355                         if (result)
2356                                 return result;
2357                 }
2358         }
2359
2360         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2361                 result = __nl80211_set_channel(
2362                         rdev,
2363                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2364                         info);
2365                 if (result)
2366                         return result;
2367         }
2368
2369         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2370                 struct wireless_dev *txp_wdev = wdev;
2371                 enum nl80211_tx_power_setting type;
2372                 int idx, mbm = 0;
2373
2374                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2375                         txp_wdev = NULL;
2376
2377                 if (!rdev->ops->set_tx_power)
2378                         return -EOPNOTSUPP;
2379
2380                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2381                 type = nla_get_u32(info->attrs[idx]);
2382
2383                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2384                     (type != NL80211_TX_POWER_AUTOMATIC))
2385                         return -EINVAL;
2386
2387                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2388                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2389                         mbm = nla_get_u32(info->attrs[idx]);
2390                 }
2391
2392                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2393                 if (result)
2394                         return result;
2395         }
2396
2397         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2398             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2399                 u32 tx_ant, rx_ant;
2400
2401                 if ((!rdev->wiphy.available_antennas_tx &&
2402                      !rdev->wiphy.available_antennas_rx) ||
2403                     !rdev->ops->set_antenna)
2404                         return -EOPNOTSUPP;
2405
2406                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2407                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2408
2409                 /* reject antenna configurations which don't match the
2410                  * available antenna masks, except for the "all" mask */
2411                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2412                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2413                         return -EINVAL;
2414
2415                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2416                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2417
2418                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2419                 if (result)
2420                         return result;
2421         }
2422
2423         changed = 0;
2424
2425         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2426                 retry_short = nla_get_u8(
2427                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2428                 if (retry_short == 0)
2429                         return -EINVAL;
2430
2431                 changed |= WIPHY_PARAM_RETRY_SHORT;
2432         }
2433
2434         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2435                 retry_long = nla_get_u8(
2436                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2437                 if (retry_long == 0)
2438                         return -EINVAL;
2439
2440                 changed |= WIPHY_PARAM_RETRY_LONG;
2441         }
2442
2443         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2444                 frag_threshold = nla_get_u32(
2445                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2446                 if (frag_threshold < 256)
2447                         return -EINVAL;
2448
2449                 if (frag_threshold != (u32) -1) {
2450                         /*
2451                          * Fragments (apart from the last one) are required to
2452                          * have even length. Make the fragmentation code
2453                          * simpler by stripping LSB should someone try to use
2454                          * odd threshold value.
2455                          */
2456                         frag_threshold &= ~0x1;
2457                 }
2458                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2459         }
2460
2461         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2462                 rts_threshold = nla_get_u32(
2463                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2464                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2465         }
2466
2467         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2468                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2469                         return -EINVAL;
2470
2471                 coverage_class = nla_get_u8(
2472                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2473                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2474         }
2475
2476         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2477                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2478                         return -EOPNOTSUPP;
2479
2480                 changed |= WIPHY_PARAM_DYN_ACK;
2481         }
2482
2483         if (changed) {
2484                 u8 old_retry_short, old_retry_long;
2485                 u32 old_frag_threshold, old_rts_threshold;
2486                 u8 old_coverage_class;
2487
2488                 if (!rdev->ops->set_wiphy_params)
2489                         return -EOPNOTSUPP;
2490
2491                 old_retry_short = rdev->wiphy.retry_short;
2492                 old_retry_long = rdev->wiphy.retry_long;
2493                 old_frag_threshold = rdev->wiphy.frag_threshold;
2494                 old_rts_threshold = rdev->wiphy.rts_threshold;
2495                 old_coverage_class = rdev->wiphy.coverage_class;
2496
2497                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2498                         rdev->wiphy.retry_short = retry_short;
2499                 if (changed & WIPHY_PARAM_RETRY_LONG)
2500                         rdev->wiphy.retry_long = retry_long;
2501                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2502                         rdev->wiphy.frag_threshold = frag_threshold;
2503                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2504                         rdev->wiphy.rts_threshold = rts_threshold;
2505                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2506                         rdev->wiphy.coverage_class = coverage_class;
2507
2508                 result = rdev_set_wiphy_params(rdev, changed);
2509                 if (result) {
2510                         rdev->wiphy.retry_short = old_retry_short;
2511                         rdev->wiphy.retry_long = old_retry_long;
2512                         rdev->wiphy.frag_threshold = old_frag_threshold;
2513                         rdev->wiphy.rts_threshold = old_rts_threshold;
2514                         rdev->wiphy.coverage_class = old_coverage_class;
2515                         return result;
2516                 }
2517         }
2518         return 0;
2519 }
2520
2521 static inline u64 wdev_id(struct wireless_dev *wdev)
2522 {
2523         return (u64)wdev->identifier |
2524                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2525 }
2526
2527 static int nl80211_send_chandef(struct sk_buff *msg,
2528                                 const struct cfg80211_chan_def *chandef)
2529 {
2530         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2531                 return -EINVAL;
2532
2533         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2534                         chandef->chan->center_freq))
2535                 return -ENOBUFS;
2536         switch (chandef->width) {
2537         case NL80211_CHAN_WIDTH_20_NOHT:
2538         case NL80211_CHAN_WIDTH_20:
2539         case NL80211_CHAN_WIDTH_40:
2540                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2541                                 cfg80211_get_chandef_type(chandef)))
2542                         return -ENOBUFS;
2543                 break;
2544         default:
2545                 break;
2546         }
2547         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2548                 return -ENOBUFS;
2549         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2550                 return -ENOBUFS;
2551         if (chandef->center_freq2 &&
2552             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2553                 return -ENOBUFS;
2554         return 0;
2555 }
2556
2557 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2558                               struct cfg80211_registered_device *rdev,
2559                               struct wireless_dev *wdev, bool removal)
2560 {
2561         struct net_device *dev = wdev->netdev;
2562         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2563         void *hdr;
2564
2565         if (removal)
2566                 cmd = NL80211_CMD_DEL_INTERFACE;
2567
2568         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2569         if (!hdr)
2570                 return -1;
2571
2572         if (dev &&
2573             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2574              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2575                 goto nla_put_failure;
2576
2577         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2578             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2579             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2580                               NL80211_ATTR_PAD) ||
2581             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2582             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2583                         rdev->devlist_generation ^
2584                         (cfg80211_rdev_list_generation << 2)))
2585                 goto nla_put_failure;
2586
2587         if (rdev->ops->get_channel) {
2588                 int ret;
2589                 struct cfg80211_chan_def chandef;
2590
2591                 ret = rdev_get_channel(rdev, wdev, &chandef);
2592                 if (ret == 0) {
2593                         if (nl80211_send_chandef(msg, &chandef))
2594                                 goto nla_put_failure;
2595                 }
2596         }
2597
2598         if (rdev->ops->get_tx_power) {
2599                 int dbm, ret;
2600
2601                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2602                 if (ret == 0 &&
2603                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2604                                 DBM_TO_MBM(dbm)))
2605                         goto nla_put_failure;
2606         }
2607
2608         if (wdev->ssid_len) {
2609                 if (nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2610                         goto nla_put_failure;
2611         }
2612
2613         genlmsg_end(msg, hdr);
2614         return 0;
2615
2616  nla_put_failure:
2617         genlmsg_cancel(msg, hdr);
2618         return -EMSGSIZE;
2619 }
2620
2621 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2622 {
2623         int wp_idx = 0;
2624         int if_idx = 0;
2625         int wp_start = cb->args[0];
2626         int if_start = cb->args[1];
2627         int filter_wiphy = -1;
2628         struct cfg80211_registered_device *rdev;
2629         struct wireless_dev *wdev;
2630         int ret;
2631
2632         rtnl_lock();
2633         if (!cb->args[2]) {
2634                 struct nl80211_dump_wiphy_state state = {
2635                         .filter_wiphy = -1,
2636                 };
2637
2638                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2639                 if (ret)
2640                         goto out_unlock;
2641
2642                 filter_wiphy = state.filter_wiphy;
2643
2644                 /*
2645                  * if filtering, set cb->args[2] to +1 since 0 is the default
2646                  * value needed to determine that parsing is necessary.
2647                  */
2648                 if (filter_wiphy >= 0)
2649                         cb->args[2] = filter_wiphy + 1;
2650                 else
2651                         cb->args[2] = -1;
2652         } else if (cb->args[2] > 0) {
2653                 filter_wiphy = cb->args[2] - 1;
2654         }
2655
2656         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2657                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2658                         continue;
2659                 if (wp_idx < wp_start) {
2660                         wp_idx++;
2661                         continue;
2662                 }
2663
2664                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2665                         continue;
2666
2667                 if_idx = 0;
2668
2669                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2670                         if (if_idx < if_start) {
2671                                 if_idx++;
2672                                 continue;
2673                         }
2674                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2675                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2676                                                rdev, wdev, false) < 0) {
2677                                 goto out;
2678                         }
2679                         if_idx++;
2680                 }
2681
2682                 wp_idx++;
2683         }
2684  out:
2685         cb->args[0] = wp_idx;
2686         cb->args[1] = if_idx;
2687
2688         ret = skb->len;
2689  out_unlock:
2690         rtnl_unlock();
2691
2692         return ret;
2693 }
2694
2695 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
2696 {
2697         struct sk_buff *msg;
2698         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2699         struct wireless_dev *wdev = info->user_ptr[1];
2700
2701         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2702         if (!msg)
2703                 return -ENOMEM;
2704
2705         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
2706                                rdev, wdev, false) < 0) {
2707                 nlmsg_free(msg);
2708                 return -ENOBUFS;
2709         }
2710
2711         return genlmsg_reply(msg, info);
2712 }
2713
2714 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
2715         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
2716         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
2717         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
2718         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
2719         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
2720         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
2721 };
2722
2723 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
2724 {
2725         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
2726         int flag;
2727
2728         *mntrflags = 0;
2729
2730         if (!nla)
2731                 return -EINVAL;
2732
2733         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
2734                              mntr_flags_policy, NULL))
2735                 return -EINVAL;
2736
2737         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
2738                 if (flags[flag])
2739                         *mntrflags |= (1<<flag);
2740
2741         *mntrflags |= MONITOR_FLAG_CHANGED;
2742
2743         return 0;
2744 }
2745
2746 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
2747                                      enum nl80211_iftype type,
2748                                      struct genl_info *info,
2749                                      struct vif_params *params)
2750 {
2751         bool change = false;
2752         int err;
2753
2754         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
2755                 if (type != NL80211_IFTYPE_MONITOR)
2756                         return -EINVAL;
2757
2758                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
2759                                           &params->flags);
2760                 if (err)
2761                         return err;
2762
2763                 change = true;
2764         }
2765
2766         if (params->flags & MONITOR_FLAG_ACTIVE &&
2767             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
2768                 return -EOPNOTSUPP;
2769
2770         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
2771                 const u8 *mumimo_groups;
2772                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2773
2774                 if (type != NL80211_IFTYPE_MONITOR)
2775                         return -EINVAL;
2776
2777                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2778                         return -EOPNOTSUPP;
2779
2780                 mumimo_groups =
2781                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
2782
2783                 /* bits 0 and 63 are reserved and must be zero */
2784                 if ((mumimo_groups[0] & BIT(0)) ||
2785                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
2786                         return -EINVAL;
2787
2788                 params->vht_mumimo_groups = mumimo_groups;
2789                 change = true;
2790         }
2791
2792         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
2793                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
2794
2795                 if (type != NL80211_IFTYPE_MONITOR)
2796                         return -EINVAL;
2797
2798                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
2799                         return -EOPNOTSUPP;
2800
2801                 params->vht_mumimo_follow_addr =
2802                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
2803                 change = true;
2804         }
2805
2806         return change ? 1 : 0;
2807 }
2808
2809 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
2810                                struct net_device *netdev, u8 use_4addr,
2811                                enum nl80211_iftype iftype)
2812 {
2813         if (!use_4addr) {
2814                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
2815                         return -EBUSY;
2816                 return 0;
2817         }
2818
2819         switch (iftype) {
2820         case NL80211_IFTYPE_AP_VLAN:
2821                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
2822                         return 0;
2823                 break;
2824         case NL80211_IFTYPE_STATION:
2825                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
2826                         return 0;
2827                 break;
2828         default:
2829                 break;
2830         }
2831
2832         return -EOPNOTSUPP;
2833 }
2834
2835 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
2836 {
2837         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2838         struct vif_params params;
2839         int err;
2840         enum nl80211_iftype otype, ntype;
2841         struct net_device *dev = info->user_ptr[1];
2842         bool change = false;
2843
2844         memset(&params, 0, sizeof(params));
2845
2846         otype = ntype = dev->ieee80211_ptr->iftype;
2847
2848         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2849                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2850                 if (otype != ntype)
2851                         change = true;
2852                 if (ntype > NL80211_IFTYPE_MAX)
2853                         return -EINVAL;
2854         }
2855
2856         if (info->attrs[NL80211_ATTR_MESH_ID]) {
2857                 struct wireless_dev *wdev = dev->ieee80211_ptr;
2858
2859                 if (ntype != NL80211_IFTYPE_MESH_POINT)
2860                         return -EINVAL;
2861                 if (netif_running(dev))
2862                         return -EBUSY;
2863
2864                 wdev_lock(wdev);
2865                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2866                              IEEE80211_MAX_MESH_ID_LEN);
2867                 wdev->mesh_id_up_len =
2868                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2869                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2870                        wdev->mesh_id_up_len);
2871                 wdev_unlock(wdev);
2872         }
2873
2874         if (info->attrs[NL80211_ATTR_4ADDR]) {
2875                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2876                 change = true;
2877                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
2878                 if (err)
2879                         return err;
2880         } else {
2881                 params.use_4addr = -1;
2882         }
2883
2884         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
2885         if (err < 0)
2886                 return err;
2887         if (err > 0)
2888                 change = true;
2889
2890         if (change)
2891                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
2892         else
2893                 err = 0;
2894
2895         if (!err && params.use_4addr != -1)
2896                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
2897
2898         return err;
2899 }
2900
2901 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
2902 {
2903         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2904         struct vif_params params;
2905         struct wireless_dev *wdev;
2906         struct sk_buff *msg;
2907         int err;
2908         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
2909
2910         /* to avoid failing a new interface creation due to pending removal */
2911         cfg80211_destroy_ifaces(rdev);
2912
2913         memset(&params, 0, sizeof(params));
2914
2915         if (!info->attrs[NL80211_ATTR_IFNAME])
2916                 return -EINVAL;
2917
2918         if (info->attrs[NL80211_ATTR_IFTYPE]) {
2919                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
2920                 if (type > NL80211_IFTYPE_MAX)
2921                         return -EINVAL;
2922         }
2923
2924         if (!rdev->ops->add_virtual_intf ||
2925             !(rdev->wiphy.interface_modes & (1 << type)))
2926                 return -EOPNOTSUPP;
2927
2928         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
2929              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
2930             info->attrs[NL80211_ATTR_MAC]) {
2931                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
2932                            ETH_ALEN);
2933                 if (!is_valid_ether_addr(params.macaddr))
2934                         return -EADDRNOTAVAIL;
2935         }
2936
2937         if (info->attrs[NL80211_ATTR_4ADDR]) {
2938                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
2939                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
2940                 if (err)
2941                         return err;
2942         }
2943
2944         err = nl80211_parse_mon_options(rdev, type, info, &params);
2945         if (err < 0)
2946                 return err;
2947
2948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
2949         if (!msg)
2950                 return -ENOMEM;
2951
2952         wdev = rdev_add_virtual_intf(rdev,
2953                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
2954                                 NET_NAME_USER, type, &params);
2955         if (WARN_ON(!wdev)) {
2956                 nlmsg_free(msg);
2957                 return -EPROTO;
2958         } else if (IS_ERR(wdev)) {
2959                 nlmsg_free(msg);
2960                 return PTR_ERR(wdev);
2961         }
2962
2963         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
2964                 wdev->owner_nlportid = info->snd_portid;
2965
2966         switch (type) {
2967         case NL80211_IFTYPE_MESH_POINT:
2968                 if (!info->attrs[NL80211_ATTR_MESH_ID])
2969                         break;
2970                 wdev_lock(wdev);
2971                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
2972                              IEEE80211_MAX_MESH_ID_LEN);
2973                 wdev->mesh_id_up_len =
2974                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
2975                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
2976                        wdev->mesh_id_up_len);
2977                 wdev_unlock(wdev);
2978                 break;
2979         case NL80211_IFTYPE_NAN:
2980         case NL80211_IFTYPE_P2P_DEVICE:
2981                 /*
2982                  * P2P Device and NAN do not have a netdev, so don't go
2983                  * through the netdev notifier and must be added here
2984                  */
2985                 mutex_init(&wdev->mtx);
2986                 INIT_LIST_HEAD(&wdev->event_list);
2987                 spin_lock_init(&wdev->event_lock);
2988                 INIT_LIST_HEAD(&wdev->mgmt_registrations);
2989                 spin_lock_init(&wdev->mgmt_registrations_lock);
2990
2991                 wdev->identifier = ++rdev->wdev_id;
2992                 list_add_rcu(&wdev->list, &rdev->wiphy.wdev_list);
2993                 rdev->devlist_generation++;
2994                 break;
2995         default:
2996                 break;
2997         }
2998
2999         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3000                                rdev, wdev, false) < 0) {
3001                 nlmsg_free(msg);
3002                 return -ENOBUFS;
3003         }
3004
3005         /*
3006          * For wdevs which have no associated netdev object (e.g. of type
3007          * NL80211_IFTYPE_P2P_DEVICE), emit the NEW_INTERFACE event here.
3008          * For all other types, the event will be generated from the
3009          * netdev notifier
3010          */
3011         if (!wdev->netdev)
3012                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_NEW_INTERFACE);
3013
3014         return genlmsg_reply(msg, info);
3015 }
3016
3017 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3018 {
3019         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3020         struct wireless_dev *wdev = info->user_ptr[1];
3021
3022         if (!rdev->ops->del_virtual_intf)
3023                 return -EOPNOTSUPP;
3024
3025         /*
3026          * If we remove a wireless device without a netdev then clear
3027          * user_ptr[1] so that nl80211_post_doit won't dereference it
3028          * to check if it needs to do dev_put(). Otherwise it crashes
3029          * since the wdev has been freed, unlike with a netdev where
3030          * we need the dev_put() for the netdev to really be freed.
3031          */
3032         if (!wdev->netdev)
3033                 info->user_ptr[1] = NULL;
3034
3035         return rdev_del_virtual_intf(rdev, wdev);
3036 }
3037
3038 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3039 {
3040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3041         struct net_device *dev = info->user_ptr[1];
3042         u16 noack_map;
3043
3044         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3045                 return -EINVAL;
3046
3047         if (!rdev->ops->set_noack_map)
3048                 return -EOPNOTSUPP;
3049
3050         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3051
3052         return rdev_set_noack_map(rdev, dev, noack_map);
3053 }
3054
3055 struct get_key_cookie {
3056         struct sk_buff *msg;
3057         int error;
3058         int idx;
3059 };
3060
3061 static void get_key_callback(void *c, struct key_params *params)
3062 {
3063         struct nlattr *key;
3064         struct get_key_cookie *cookie = c;
3065
3066         if ((params->key &&
3067              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3068                      params->key_len, params->key)) ||
3069             (params->seq &&
3070              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3071                      params->seq_len, params->seq)) ||
3072             (params->cipher &&
3073              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3074                          params->cipher)))
3075                 goto nla_put_failure;
3076
3077         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3078         if (!key)
3079                 goto nla_put_failure;
3080
3081         if ((params->key &&
3082              nla_put(cookie->msg, NL80211_KEY_DATA,
3083                      params->key_len, params->key)) ||
3084             (params->seq &&
3085              nla_put(cookie->msg, NL80211_KEY_SEQ,
3086                      params->seq_len, params->seq)) ||
3087             (params->cipher &&
3088              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3089                          params->cipher)))
3090                 goto nla_put_failure;
3091
3092         if (nla_put_u8(cookie->msg, NL80211_ATTR_KEY_IDX, cookie->idx))
3093                 goto nla_put_failure;
3094
3095         nla_nest_end(cookie->msg, key);
3096
3097         return;
3098  nla_put_failure:
3099         cookie->error = 1;
3100 }
3101
3102 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3103 {
3104         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3105         int err;
3106         struct net_device *dev = info->user_ptr[1];
3107         u8 key_idx = 0;
3108         const u8 *mac_addr = NULL;
3109         bool pairwise;
3110         struct get_key_cookie cookie = {
3111                 .error = 0,
3112         };
3113         void *hdr;
3114         struct sk_buff *msg;
3115
3116         if (info->attrs[NL80211_ATTR_KEY_IDX])
3117                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3118
3119         if (key_idx > 5)
3120                 return -EINVAL;
3121
3122         if (info->attrs[NL80211_ATTR_MAC])
3123                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3124
3125         pairwise = !!mac_addr;
3126         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3127                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3128
3129                 if (kt >= NUM_NL80211_KEYTYPES)
3130                         return -EINVAL;
3131                 if (kt != NL80211_KEYTYPE_GROUP &&
3132                     kt != NL80211_KEYTYPE_PAIRWISE)
3133                         return -EINVAL;
3134                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3135         }
3136
3137         if (!rdev->ops->get_key)
3138                 return -EOPNOTSUPP;
3139
3140         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3141                 return -ENOENT;
3142
3143         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3144         if (!msg)
3145                 return -ENOMEM;
3146
3147         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3148                              NL80211_CMD_NEW_KEY);
3149         if (!hdr)
3150                 goto nla_put_failure;
3151
3152         cookie.msg = msg;
3153         cookie.idx = key_idx;
3154
3155         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3156             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3157                 goto nla_put_failure;
3158         if (mac_addr &&
3159             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3160                 goto nla_put_failure;
3161
3162         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3163                            get_key_callback);
3164
3165         if (err)
3166                 goto free_msg;
3167
3168         if (cookie.error)
3169                 goto nla_put_failure;
3170
3171         genlmsg_end(msg, hdr);
3172         return genlmsg_reply(msg, info);
3173
3174  nla_put_failure:
3175         err = -ENOBUFS;
3176  free_msg:
3177         nlmsg_free(msg);
3178         return err;
3179 }
3180
3181 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3182 {
3183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3184         struct key_parse key;
3185         int err;
3186         struct net_device *dev = info->user_ptr[1];
3187
3188         err = nl80211_parse_key(info, &key);
3189         if (err)
3190                 return err;
3191
3192         if (key.idx < 0)
3193                 return -EINVAL;
3194
3195         /* only support setting default key */
3196         if (!key.def && !key.defmgmt)
3197                 return -EINVAL;
3198
3199         wdev_lock(dev->ieee80211_ptr);
3200
3201         if (key.def) {
3202                 if (!rdev->ops->set_default_key) {
3203                         err = -EOPNOTSUPP;
3204                         goto out;
3205                 }
3206
3207                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3208                 if (err)
3209                         goto out;
3210
3211                 err = rdev_set_default_key(rdev, dev, key.idx,
3212                                                  key.def_uni, key.def_multi);
3213
3214                 if (err)
3215                         goto out;
3216
3217 #ifdef CONFIG_CFG80211_WEXT
3218                 dev->ieee80211_ptr->wext.default_key = key.idx;
3219 #endif
3220         } else {
3221                 if (key.def_uni || !key.def_multi) {
3222                         err = -EINVAL;
3223                         goto out;
3224                 }
3225
3226                 if (!rdev->ops->set_default_mgmt_key) {
3227                         err = -EOPNOTSUPP;
3228                         goto out;
3229                 }
3230
3231                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3232                 if (err)
3233                         goto out;
3234
3235                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3236                 if (err)
3237                         goto out;
3238
3239 #ifdef CONFIG_CFG80211_WEXT
3240                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3241 #endif
3242         }
3243
3244  out:
3245         wdev_unlock(dev->ieee80211_ptr);
3246
3247         return err;
3248 }
3249
3250 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3251 {
3252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3253         int err;
3254         struct net_device *dev = info->user_ptr[1];
3255         struct key_parse key;
3256         const u8 *mac_addr = NULL;
3257
3258         err = nl80211_parse_key(info, &key);
3259         if (err)
3260                 return err;
3261
3262         if (!key.p.key)
3263                 return -EINVAL;
3264
3265         if (info->attrs[NL80211_ATTR_MAC])
3266                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3267
3268         if (key.type == -1) {
3269                 if (mac_addr)
3270                         key.type = NL80211_KEYTYPE_PAIRWISE;
3271                 else
3272                         key.type = NL80211_KEYTYPE_GROUP;
3273         }
3274
3275         /* for now */
3276         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3277             key.type != NL80211_KEYTYPE_GROUP)
3278                 return -EINVAL;
3279
3280         if (!rdev->ops->add_key)
3281                 return -EOPNOTSUPP;
3282
3283         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3284                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3285                                            mac_addr))
3286                 return -EINVAL;
3287
3288         wdev_lock(dev->ieee80211_ptr);
3289         err = nl80211_key_allowed(dev->ieee80211_ptr);
3290         if (!err)
3291                 err = rdev_add_key(rdev, dev, key.idx,
3292                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3293                                     mac_addr, &key.p);
3294         wdev_unlock(dev->ieee80211_ptr);
3295
3296         return err;
3297 }
3298
3299 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3300 {
3301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3302         int err;
3303         struct net_device *dev = info->user_ptr[1];
3304         u8 *mac_addr = NULL;
3305         struct key_parse key;
3306
3307         err = nl80211_parse_key(info, &key);
3308         if (err)
3309                 return err;
3310
3311         if (info->attrs[NL80211_ATTR_MAC])
3312                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3313
3314         if (key.type == -1) {
3315                 if (mac_addr)
3316                         key.type = NL80211_KEYTYPE_PAIRWISE;
3317                 else
3318                         key.type = NL80211_KEYTYPE_GROUP;
3319         }
3320
3321         /* for now */
3322         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3323             key.type != NL80211_KEYTYPE_GROUP)
3324                 return -EINVAL;
3325
3326         if (!rdev->ops->del_key)
3327                 return -EOPNOTSUPP;
3328
3329         wdev_lock(dev->ieee80211_ptr);
3330         err = nl80211_key_allowed(dev->ieee80211_ptr);
3331
3332         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3333             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3334                 err = -ENOENT;
3335
3336         if (!err)
3337                 err = rdev_del_key(rdev, dev, key.idx,
3338                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3339                                    mac_addr);
3340
3341 #ifdef CONFIG_CFG80211_WEXT
3342         if (!err) {
3343                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3344                         dev->ieee80211_ptr->wext.default_key = -1;
3345                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3346                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3347         }
3348 #endif
3349         wdev_unlock(dev->ieee80211_ptr);
3350
3351         return err;
3352 }
3353
3354 /* This function returns an error or the number of nested attributes */
3355 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3356 {
3357         struct nlattr *attr;
3358         int n_entries = 0, tmp;
3359
3360         nla_for_each_nested(attr, nl_attr, tmp) {
3361                 if (nla_len(attr) != ETH_ALEN)
3362                         return -EINVAL;
3363
3364                 n_entries++;
3365         }
3366
3367         return n_entries;
3368 }
3369
3370 /*
3371  * This function parses ACL information and allocates memory for ACL data.
3372  * On successful return, the calling function is responsible to free the
3373  * ACL buffer returned by this function.
3374  */
3375 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3376                                                 struct genl_info *info)
3377 {
3378         enum nl80211_acl_policy acl_policy;
3379         struct nlattr *attr;
3380         struct cfg80211_acl_data *acl;
3381         int i = 0, n_entries, tmp;
3382
3383         if (!wiphy->max_acl_mac_addrs)
3384                 return ERR_PTR(-EOPNOTSUPP);
3385
3386         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3387                 return ERR_PTR(-EINVAL);
3388
3389         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3390         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3391             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3392                 return ERR_PTR(-EINVAL);
3393
3394         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3395                 return ERR_PTR(-EINVAL);
3396
3397         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3398         if (n_entries < 0)
3399                 return ERR_PTR(n_entries);
3400
3401         if (n_entries > wiphy->max_acl_mac_addrs)
3402                 return ERR_PTR(-ENOTSUPP);
3403
3404         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3405                       GFP_KERNEL);
3406         if (!acl)
3407                 return ERR_PTR(-ENOMEM);
3408
3409         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3410                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3411                 i++;
3412         }
3413
3414         acl->n_acl_entries = n_entries;
3415         acl->acl_policy = acl_policy;
3416
3417         return acl;
3418 }
3419
3420 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3421 {
3422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3423         struct net_device *dev = info->user_ptr[1];
3424         struct cfg80211_acl_data *acl;
3425         int err;
3426
3427         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3428             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3429                 return -EOPNOTSUPP;
3430
3431         if (!dev->ieee80211_ptr->beacon_interval)
3432                 return -EINVAL;
3433
3434         acl = parse_acl_data(&rdev->wiphy, info);
3435         if (IS_ERR(acl))
3436                 return PTR_ERR(acl);
3437
3438         err = rdev_set_mac_acl(rdev, dev, acl);
3439
3440         kfree(acl);
3441
3442         return err;
3443 }
3444
3445 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3446                            u8 *rates, u8 rates_len)
3447 {
3448         u8 i;
3449         u32 mask = 0;
3450
3451         for (i = 0; i < rates_len; i++) {
3452                 int rate = (rates[i] & 0x7f) * 5;
3453                 int ridx;
3454
3455                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3456                         struct ieee80211_rate *srate =
3457                                 &sband->bitrates[ridx];
3458                         if (rate == srate->bitrate) {
3459                                 mask |= 1 << ridx;
3460                                 break;
3461                         }
3462                 }
3463                 if (ridx == sband->n_bitrates)
3464                         return 0; /* rate not found */
3465         }
3466
3467         return mask;
3468 }
3469
3470 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3471                                u8 *rates, u8 rates_len,
3472                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3473 {
3474         u8 i;
3475
3476         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3477
3478         for (i = 0; i < rates_len; i++) {
3479                 int ridx, rbit;
3480
3481                 ridx = rates[i] / 8;
3482                 rbit = BIT(rates[i] % 8);
3483
3484                 /* check validity */
3485                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3486                         return false;
3487
3488                 /* check availability */
3489                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3490                         mcs[ridx] |= rbit;
3491                 else
3492                         return false;
3493         }
3494
3495         return true;
3496 }
3497
3498 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3499 {
3500         u16 mcs_mask = 0;
3501
3502         switch (vht_mcs_map) {
3503         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3504                 break;
3505         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3506                 mcs_mask = 0x00FF;
3507                 break;
3508         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3509                 mcs_mask = 0x01FF;
3510                 break;
3511         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3512                 mcs_mask = 0x03FF;
3513                 break;
3514         default:
3515                 break;
3516         }
3517
3518         return mcs_mask;
3519 }
3520
3521 static void vht_build_mcs_mask(u16 vht_mcs_map,
3522                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3523 {
3524         u8 nss;
3525
3526         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3527                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3528                 vht_mcs_map >>= 2;
3529         }
3530 }
3531
3532 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3533                              struct nl80211_txrate_vht *txrate,
3534                              u16 mcs[NL80211_VHT_NSS_MAX])
3535 {
3536         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3537         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3538         u8 i;
3539
3540         if (!sband->vht_cap.vht_supported)
3541                 return false;
3542
3543         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3544
3545         /* Build vht_mcs_mask from VHT capabilities */
3546         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3547
3548         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3549                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3550                         mcs[i] = txrate->mcs[i];
3551                 else
3552                         return false;
3553         }
3554
3555         return true;
3556 }
3557
3558 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3559         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3560                                     .len = NL80211_MAX_SUPP_RATES },
3561         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3562                                 .len = NL80211_MAX_SUPP_HT_RATES },
3563         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3564         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3565 };
3566
3567 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3568                                          struct cfg80211_bitrate_mask *mask)
3569 {
3570         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3571         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3572         int rem, i;
3573         struct nlattr *tx_rates;
3574         struct ieee80211_supported_band *sband;
3575         u16 vht_tx_mcs_map;
3576
3577         memset(mask, 0, sizeof(*mask));
3578         /* Default to all rates enabled */
3579         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3580                 sband = rdev->wiphy.bands[i];
3581
3582                 if (!sband)
3583                         continue;
3584
3585                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3586                 memcpy(mask->control[i].ht_mcs,
3587                        sband->ht_cap.mcs.rx_mask,
3588                        sizeof(mask->control[i].ht_mcs));
3589
3590                 if (!sband->vht_cap.vht_supported)
3591                         continue;
3592
3593                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3594                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3595         }
3596
3597         /* if no rates are given set it back to the defaults */
3598         if (!info->attrs[NL80211_ATTR_TX_RATES])
3599                 goto out;
3600
3601         /* The nested attribute uses enum nl80211_band as the index. This maps
3602          * directly to the enum nl80211_band values used in cfg80211.
3603          */
3604         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3605         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3606                 enum nl80211_band band = nla_type(tx_rates);
3607                 int err;
3608
3609                 if (band < 0 || band >= NUM_NL80211_BANDS)
3610                         return -EINVAL;
3611                 sband = rdev->wiphy.bands[band];
3612                 if (sband == NULL)
3613                         return -EINVAL;
3614                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3615                                        nl80211_txattr_policy, info->extack);
3616                 if (err)
3617                         return err;
3618                 if (tb[NL80211_TXRATE_LEGACY]) {
3619                         mask->control[band].legacy = rateset_to_mask(
3620                                 sband,
3621                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3622                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3623                         if ((mask->control[band].legacy == 0) &&
3624                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3625                                 return -EINVAL;
3626                 }
3627                 if (tb[NL80211_TXRATE_HT]) {
3628                         if (!ht_rateset_to_mask(
3629                                         sband,
3630                                         nla_data(tb[NL80211_TXRATE_HT]),
3631                                         nla_len(tb[NL80211_TXRATE_HT]),
3632                                         mask->control[band].ht_mcs))
3633                                 return -EINVAL;
3634                 }
3635                 if (tb[NL80211_TXRATE_VHT]) {
3636                         if (!vht_set_mcs_mask(
3637                                         sband,
3638                                         nla_data(tb[NL80211_TXRATE_VHT]),
3639                                         mask->control[band].vht_mcs))
3640                                 return -EINVAL;
3641                 }
3642                 if (tb[NL80211_TXRATE_GI]) {
3643                         mask->control[band].gi =
3644                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3645                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3646                                 return -EINVAL;
3647                 }
3648
3649                 if (mask->control[band].legacy == 0) {
3650                         /* don't allow empty legacy rates if HT or VHT
3651                          * are not even supported.
3652                          */
3653                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3654                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3655                                 return -EINVAL;
3656
3657                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3658                                 if (mask->control[band].ht_mcs[i])
3659                                         goto out;
3660
3661                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3662                                 if (mask->control[band].vht_mcs[i])
3663                                         goto out;
3664
3665                         /* legacy and mcs rates may not be both empty */
3666                         return -EINVAL;
3667                 }
3668         }
3669
3670 out:
3671         return 0;
3672 }
3673
3674 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3675                                    enum nl80211_band band,
3676                                    struct cfg80211_bitrate_mask *beacon_rate)
3677 {
3678         u32 count_ht, count_vht, i;
3679         u32 rate = beacon_rate->control[band].legacy;
3680
3681         /* Allow only one rate */
3682         if (hweight32(rate) > 1)
3683                 return -EINVAL;
3684
3685         count_ht = 0;
3686         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3687                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3688                         return -EINVAL;
3689                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3690                         count_ht++;
3691                         if (count_ht > 1)
3692                                 return -EINVAL;
3693                 }
3694                 if (count_ht && rate)
3695                         return -EINVAL;
3696         }
3697
3698         count_vht = 0;
3699         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3700                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3701                         return -EINVAL;
3702                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3703                         count_vht++;
3704                         if (count_vht > 1)
3705                                 return -EINVAL;
3706                 }
3707                 if (count_vht && rate)
3708                         return -EINVAL;
3709         }
3710
3711         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
3712                 return -EINVAL;
3713
3714         if (rate &&
3715             !wiphy_ext_feature_isset(&rdev->wiphy,
3716                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
3717                 return -EINVAL;
3718         if (count_ht &&
3719             !wiphy_ext_feature_isset(&rdev->wiphy,
3720                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
3721                 return -EINVAL;
3722         if (count_vht &&
3723             !wiphy_ext_feature_isset(&rdev->wiphy,
3724                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
3725                 return -EINVAL;
3726
3727         return 0;
3728 }
3729
3730 static int nl80211_parse_beacon(struct nlattr *attrs[],
3731                                 struct cfg80211_beacon_data *bcn)
3732 {
3733         bool haveinfo = false;
3734
3735         if (!is_valid_ie_attr(attrs[NL80211_ATTR_BEACON_TAIL]) ||
3736             !is_valid_ie_attr(attrs[NL80211_ATTR_IE]) ||
3737             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_PROBE_RESP]) ||
3738             !is_valid_ie_attr(attrs[NL80211_ATTR_IE_ASSOC_RESP]))
3739                 return -EINVAL;
3740
3741         memset(bcn, 0, sizeof(*bcn));
3742
3743         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
3744                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
3745                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
3746                 if (!bcn->head_len)
3747                         return -EINVAL;
3748                 haveinfo = true;
3749         }
3750
3751         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
3752                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
3753                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
3754                 haveinfo = true;
3755         }
3756
3757         if (!haveinfo)
3758                 return -EINVAL;
3759
3760         if (attrs[NL80211_ATTR_IE]) {
3761                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
3762                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
3763         }
3764
3765         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
3766                 bcn->proberesp_ies =
3767                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3768                 bcn->proberesp_ies_len =
3769                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
3770         }
3771
3772         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
3773                 bcn->assocresp_ies =
3774                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3775                 bcn->assocresp_ies_len =
3776                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
3777         }
3778
3779         if (attrs[NL80211_ATTR_PROBE_RESP]) {
3780                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
3781                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
3782         }
3783
3784         return 0;
3785 }
3786
3787 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
3788                                             const u8 *rates)
3789 {
3790         int i;
3791
3792         if (!rates)
3793                 return;
3794
3795         for (i = 0; i < rates[1]; i++) {
3796                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
3797                         params->ht_required = true;
3798                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
3799                         params->vht_required = true;
3800         }
3801 }
3802
3803 /*
3804  * Since the nl80211 API didn't include, from the beginning, attributes about
3805  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
3806  * benefit of drivers that rebuild IEs in the firmware.
3807  */
3808 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
3809 {
3810         const struct cfg80211_beacon_data *bcn = &params->beacon;
3811         size_t ies_len = bcn->tail_len;
3812         const u8 *ies = bcn->tail;
3813         const u8 *rates;
3814         const u8 *cap;
3815
3816         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
3817         nl80211_check_ap_rate_selectors(params, rates);
3818
3819         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
3820         nl80211_check_ap_rate_selectors(params, rates);
3821
3822         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
3823         if (cap && cap[1] >= sizeof(*params->ht_cap))
3824                 params->ht_cap = (void *)(cap + 2);
3825         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
3826         if (cap && cap[1] >= sizeof(*params->vht_cap))
3827                 params->vht_cap = (void *)(cap + 2);
3828 }
3829
3830 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
3831                                    struct cfg80211_ap_settings *params)
3832 {
3833         struct wireless_dev *wdev;
3834         bool ret = false;
3835
3836         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3837                 if (wdev->iftype != NL80211_IFTYPE_AP &&
3838                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
3839                         continue;
3840
3841                 if (!wdev->preset_chandef.chan)
3842                         continue;
3843
3844                 params->chandef = wdev->preset_chandef;
3845                 ret = true;
3846                 break;
3847         }
3848
3849         return ret;
3850 }
3851
3852 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
3853                                     enum nl80211_auth_type auth_type,
3854                                     enum nl80211_commands cmd)
3855 {
3856         if (auth_type > NL80211_AUTHTYPE_MAX)
3857                 return false;
3858
3859         switch (cmd) {
3860         case NL80211_CMD_AUTHENTICATE:
3861                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
3862                     auth_type == NL80211_AUTHTYPE_SAE)
3863                         return false;
3864                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3865                                              NL80211_EXT_FEATURE_FILS_STA) &&
3866                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3867                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3868                      auth_type == NL80211_AUTHTYPE_FILS_PK))
3869                         return false;
3870                 return true;
3871         case NL80211_CMD_CONNECT:
3872                 /* SAE not supported yet */
3873                 if (auth_type == NL80211_AUTHTYPE_SAE)
3874                         return false;
3875                 /* FILS with SK PFS or PK not supported yet */
3876                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3877                     auth_type == NL80211_AUTHTYPE_FILS_PK)
3878                         return false;
3879                 if (!wiphy_ext_feature_isset(
3880                             &rdev->wiphy,
3881                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
3882                     auth_type == NL80211_AUTHTYPE_FILS_SK)
3883                         return false;
3884                 return true;
3885         case NL80211_CMD_START_AP:
3886                 /* SAE not supported yet */
3887                 if (auth_type == NL80211_AUTHTYPE_SAE)
3888                         return false;
3889                 /* FILS not supported yet */
3890                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
3891                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
3892                     auth_type == NL80211_AUTHTYPE_FILS_PK)
3893                         return false;
3894                 return true;
3895         default:
3896                 return false;
3897         }
3898 }
3899
3900 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
3901 {
3902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3903         struct net_device *dev = info->user_ptr[1];
3904         struct wireless_dev *wdev = dev->ieee80211_ptr;
3905         struct cfg80211_ap_settings params;
3906         int err;
3907
3908         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3909             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3910                 return -EOPNOTSUPP;
3911
3912         if (!rdev->ops->start_ap)
3913                 return -EOPNOTSUPP;
3914
3915         if (wdev->beacon_interval)
3916                 return -EALREADY;
3917
3918         memset(&params, 0, sizeof(params));
3919
3920         /* these are required for START_AP */
3921         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
3922             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
3923             !info->attrs[NL80211_ATTR_BEACON_HEAD])
3924                 return -EINVAL;
3925
3926         err = nl80211_parse_beacon(info->attrs, &params.beacon);
3927         if (err)
3928                 return err;
3929
3930         params.beacon_interval =
3931                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
3932         params.dtim_period =
3933                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
3934
3935         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
3936                                            params.beacon_interval);
3937         if (err)
3938                 return err;
3939
3940         /*
3941          * In theory, some of these attributes should be required here
3942          * but since they were not used when the command was originally
3943          * added, keep them optional for old user space programs to let
3944          * them continue to work with drivers that do not need the
3945          * additional information -- drivers must check!
3946          */
3947         if (info->attrs[NL80211_ATTR_SSID]) {
3948                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
3949                 params.ssid_len =
3950                         nla_len(info->attrs[NL80211_ATTR_SSID]);
3951                 if (params.ssid_len == 0 ||
3952                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
3953                         return -EINVAL;
3954         }
3955
3956         if (info->attrs[NL80211_ATTR_HIDDEN_SSID]) {
3957                 params.hidden_ssid = nla_get_u32(
3958                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
3959                 if (params.hidden_ssid != NL80211_HIDDEN_SSID_NOT_IN_USE &&
3960                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_LEN &&
3961                     params.hidden_ssid != NL80211_HIDDEN_SSID_ZERO_CONTENTS)
3962                         return -EINVAL;
3963         }
3964
3965         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
3966
3967         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
3968                 params.auth_type = nla_get_u32(
3969                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
3970                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
3971                                              NL80211_CMD_START_AP))
3972                         return -EINVAL;
3973         } else
3974                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
3975
3976         err = nl80211_crypto_settings(rdev, info, &params.crypto,
3977                                       NL80211_MAX_NR_CIPHER_SUITES);
3978         if (err)
3979                 return err;
3980
3981         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
3982                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
3983                         return -EOPNOTSUPP;
3984                 params.inactivity_timeout = nla_get_u16(
3985                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
3986         }
3987
3988         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
3989                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3990                         return -EINVAL;
3991                 params.p2p_ctwindow =
3992                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
3993                 if (params.p2p_ctwindow > 127)
3994                         return -EINVAL;
3995                 if (params.p2p_ctwindow != 0 &&
3996                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
3997                         return -EINVAL;
3998         }
3999
4000         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4001                 u8 tmp;
4002
4003                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4004                         return -EINVAL;
4005                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4006                 if (tmp > 1)
4007                         return -EINVAL;
4008                 params.p2p_opp_ps = tmp;
4009                 if (params.p2p_opp_ps != 0 &&
4010                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4011                         return -EINVAL;
4012         }
4013
4014         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4015                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4016                 if (err)
4017                         return err;
4018         } else if (wdev->preset_chandef.chan) {
4019                 params.chandef = wdev->preset_chandef;
4020         } else if (!nl80211_get_ap_channel(rdev, &params))
4021                 return -EINVAL;
4022
4023         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4024                                            wdev->iftype))
4025                 return -EINVAL;
4026
4027         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4028                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4029                 if (err)
4030                         return err;
4031
4032                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4033                                               &params.beacon_rate);
4034                 if (err)
4035                         return err;
4036         }
4037
4038         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4039                 params.smps_mode =
4040                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4041                 switch (params.smps_mode) {
4042                 case NL80211_SMPS_OFF:
4043                         break;
4044                 case NL80211_SMPS_STATIC:
4045                         if (!(rdev->wiphy.features &
4046                               NL80211_FEATURE_STATIC_SMPS))
4047                                 return -EINVAL;
4048                         break;
4049                 case NL80211_SMPS_DYNAMIC:
4050                         if (!(rdev->wiphy.features &
4051                               NL80211_FEATURE_DYNAMIC_SMPS))
4052                                 return -EINVAL;
4053                         break;
4054                 default:
4055                         return -EINVAL;
4056                 }
4057         } else {
4058                 params.smps_mode = NL80211_SMPS_OFF;
4059         }
4060
4061         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4062         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4063                 return -EOPNOTSUPP;
4064
4065         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4066                 params.acl = parse_acl_data(&rdev->wiphy, info);
4067                 if (IS_ERR(params.acl))
4068                         return PTR_ERR(params.acl);
4069         }
4070
4071         nl80211_calculate_ap_params(&params);
4072
4073         wdev_lock(wdev);
4074         err = rdev_start_ap(rdev, dev, &params);
4075         if (!err) {
4076                 wdev->preset_chandef = params.chandef;
4077                 wdev->beacon_interval = params.beacon_interval;
4078                 wdev->chandef = params.chandef;
4079                 wdev->ssid_len = params.ssid_len;
4080                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4081         }
4082         wdev_unlock(wdev);
4083
4084         kfree(params.acl);
4085
4086         return err;
4087 }
4088
4089 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4090 {
4091         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4092         struct net_device *dev = info->user_ptr[1];
4093         struct wireless_dev *wdev = dev->ieee80211_ptr;
4094         struct cfg80211_beacon_data params;
4095         int err;
4096
4097         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4098             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4099                 return -EOPNOTSUPP;
4100
4101         if (!rdev->ops->change_beacon)
4102                 return -EOPNOTSUPP;
4103
4104         if (!wdev->beacon_interval)
4105                 return -EINVAL;
4106
4107         err = nl80211_parse_beacon(info->attrs, &params);
4108         if (err)
4109                 return err;
4110
4111         wdev_lock(wdev);
4112         err = rdev_change_beacon(rdev, dev, &params);
4113         wdev_unlock(wdev);
4114
4115         return err;
4116 }
4117
4118 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4119 {
4120         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4121         struct net_device *dev = info->user_ptr[1];
4122
4123         return cfg80211_stop_ap(rdev, dev, false);
4124 }
4125
4126 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4127         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4128         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4129         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4130         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4131         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4132         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4133 };
4134
4135 static int parse_station_flags(struct genl_info *info,
4136                                enum nl80211_iftype iftype,
4137                                struct station_parameters *params)
4138 {
4139         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4140         struct nlattr *nla;
4141         int flag;
4142
4143         /*
4144          * Try parsing the new attribute first so userspace
4145          * can specify both for older kernels.
4146          */
4147         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4148         if (nla) {
4149                 struct nl80211_sta_flag_update *sta_flags;
4150
4151                 sta_flags = nla_data(nla);
4152                 params->sta_flags_mask = sta_flags->mask;
4153                 params->sta_flags_set = sta_flags->set;
4154                 params->sta_flags_set &= params->sta_flags_mask;
4155                 if ((params->sta_flags_mask |
4156                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4157                         return -EINVAL;
4158                 return 0;
4159         }
4160
4161         /* if present, parse the old attribute */
4162
4163         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4164         if (!nla)
4165                 return 0;
4166
4167         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4168                              sta_flags_policy, info->extack))
4169                 return -EINVAL;
4170
4171         /*
4172          * Only allow certain flags for interface types so that
4173          * other attributes are silently ignored. Remember that
4174          * this is backward compatibility code with old userspace
4175          * and shouldn't be hit in other cases anyway.
4176          */
4177         switch (iftype) {
4178         case NL80211_IFTYPE_AP:
4179         case NL80211_IFTYPE_AP_VLAN:
4180         case NL80211_IFTYPE_P2P_GO:
4181                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4182                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4183                                          BIT(NL80211_STA_FLAG_WME) |
4184                                          BIT(NL80211_STA_FLAG_MFP);
4185                 break;
4186         case NL80211_IFTYPE_P2P_CLIENT:
4187         case NL80211_IFTYPE_STATION:
4188                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4189                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4190                 break;
4191         case NL80211_IFTYPE_MESH_POINT:
4192                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4193                                          BIT(NL80211_STA_FLAG_MFP) |
4194                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4195         default:
4196                 return -EINVAL;
4197         }
4198
4199         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4200                 if (flags[flag]) {
4201                         params->sta_flags_set |= (1<<flag);
4202
4203                         /* no longer support new API additions in old API */
4204                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4205                                 return -EINVAL;
4206                 }
4207         }
4208
4209         return 0;
4210 }
4211
4212 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4213                                  int attr)
4214 {
4215         struct nlattr *rate;
4216         u32 bitrate;
4217         u16 bitrate_compat;
4218         enum nl80211_rate_info rate_flg;
4219
4220         rate = nla_nest_start(msg, attr);
4221         if (!rate)
4222                 return false;
4223
4224         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4225         bitrate = cfg80211_calculate_bitrate(info);
4226         /* report 16-bit bitrate only if we can */
4227         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4228         if (bitrate > 0 &&
4229             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4230                 return false;
4231         if (bitrate_compat > 0 &&
4232             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4233                 return false;
4234
4235         switch (info->bw) {
4236         case RATE_INFO_BW_5:
4237                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4238                 break;
4239         case RATE_INFO_BW_10:
4240                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4241                 break;
4242         default:
4243                 WARN_ON(1);
4244                 /* fall through */
4245         case RATE_INFO_BW_20:
4246                 rate_flg = 0;
4247                 break;
4248         case RATE_INFO_BW_40:
4249                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4250                 break;
4251         case RATE_INFO_BW_80:
4252                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4253                 break;
4254         case RATE_INFO_BW_160:
4255                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4256                 break;
4257         }
4258
4259         if (rate_flg && nla_put_flag(msg, rate_flg))
4260                 return false;
4261
4262         if (info->flags & RATE_INFO_FLAGS_MCS) {
4263                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4264                         return false;
4265                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4266                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4267                         return false;
4268         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4269                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4270                         return false;
4271                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4272                         return false;
4273                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4274                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4275                         return false;
4276         }
4277
4278         nla_nest_end(msg, rate);
4279         return true;
4280 }
4281
4282 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4283                                int id)
4284 {
4285         void *attr;
4286         int i = 0;
4287
4288         if (!mask)
4289                 return true;
4290
4291         attr = nla_nest_start(msg, id);
4292         if (!attr)
4293                 return false;
4294
4295         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4296                 if (!(mask & BIT(i)))
4297                         continue;
4298
4299                 if (nla_put_u8(msg, i, signal[i]))
4300                         return false;
4301         }
4302
4303         nla_nest_end(msg, attr);
4304
4305         return true;
4306 }
4307
4308 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4309                                 u32 seq, int flags,
4310                                 struct cfg80211_registered_device *rdev,
4311                                 struct net_device *dev,
4312                                 const u8 *mac_addr, struct station_info *sinfo)
4313 {
4314         void *hdr;
4315         struct nlattr *sinfoattr, *bss_param;
4316
4317         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4318         if (!hdr)
4319                 return -1;
4320
4321         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4322             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4323             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4324                 goto nla_put_failure;
4325
4326         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4327         if (!sinfoattr)
4328                 goto nla_put_failure;
4329
4330 #define PUT_SINFO(attr, memb, type) do {                                \
4331         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4332         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4333             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4334                              sinfo->memb))                              \
4335                 goto nla_put_failure;                                   \
4336         } while (0)
4337 #define PUT_SINFO_U64(attr, memb) do {                                  \
4338         if (sinfo->filled & (1ULL << NL80211_STA_INFO_ ## attr) &&      \
4339             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4340                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4341                 goto nla_put_failure;                                   \
4342         } while (0)
4343
4344         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4345         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4346
4347         if (sinfo->filled & (BIT(NL80211_STA_INFO_RX_BYTES) |
4348                              BIT(NL80211_STA_INFO_RX_BYTES64)) &&
4349             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4350                         (u32)sinfo->rx_bytes))
4351                 goto nla_put_failure;
4352
4353         if (sinfo->filled & (BIT(NL80211_STA_INFO_TX_BYTES) |
4354                              BIT(NL80211_STA_INFO_TX_BYTES64)) &&
4355             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4356                         (u32)sinfo->tx_bytes))
4357                 goto nla_put_failure;
4358
4359         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4360         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4361         PUT_SINFO(LLID, llid, u16);
4362         PUT_SINFO(PLID, plid, u16);
4363         PUT_SINFO(PLINK_STATE, plink_state, u8);
4364         PUT_SINFO_U64(RX_DURATION, rx_duration);
4365
4366         switch (rdev->wiphy.signal_type) {
4367         case CFG80211_SIGNAL_TYPE_MBM:
4368                 PUT_SINFO(SIGNAL, signal, u8);
4369                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4370                 break;
4371         default:
4372                 break;
4373         }
4374         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4375                 if (!nl80211_put_signal(msg, sinfo->chains,
4376                                         sinfo->chain_signal,
4377                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4378                         goto nla_put_failure;
4379         }
4380         if (sinfo->filled & BIT(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4381                 if (!nl80211_put_signal(msg, sinfo->chains,
4382                                         sinfo->chain_signal_avg,
4383                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4384                         goto nla_put_failure;
4385         }
4386         if (sinfo->filled & BIT(NL80211_STA_INFO_TX_BITRATE)) {
4387                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4388                                           NL80211_STA_INFO_TX_BITRATE))
4389                         goto nla_put_failure;
4390         }
4391         if (sinfo->filled & BIT(NL80211_STA_INFO_RX_BITRATE)) {
4392                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4393                                           NL80211_STA_INFO_RX_BITRATE))
4394                         goto nla_put_failure;
4395         }
4396
4397         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4398         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4399         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4400         PUT_SINFO(TX_FAILED, tx_failed, u32);
4401         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4402         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4403         PUT_SINFO(LOCAL_PM, local_pm, u32);
4404         PUT_SINFO(PEER_PM, peer_pm, u32);
4405         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4406
4407         if (sinfo->filled & BIT(NL80211_STA_INFO_BSS_PARAM)) {
4408                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4409                 if (!bss_param)
4410                         goto nla_put_failure;
4411
4412                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4413                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4414                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4415                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4416                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4417                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4418                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4419                                sinfo->bss_param.dtim_period) ||
4420                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4421                                 sinfo->bss_param.beacon_interval))
4422                         goto nla_put_failure;
4423
4424                 nla_nest_end(msg, bss_param);
4425         }
4426         if ((sinfo->filled & BIT(NL80211_STA_INFO_STA_FLAGS)) &&
4427             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4428                     sizeof(struct nl80211_sta_flag_update),
4429                     &sinfo->sta_flags))
4430                 goto nla_put_failure;
4431
4432         PUT_SINFO_U64(T_OFFSET, t_offset);
4433         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4434         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4435         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4436
4437 #undef PUT_SINFO
4438 #undef PUT_SINFO_U64
4439
4440         if (sinfo->filled & BIT(NL80211_STA_INFO_TID_STATS)) {
4441                 struct nlattr *tidsattr;
4442                 int tid;
4443
4444                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4445                 if (!tidsattr)
4446                         goto nla_put_failure;
4447
4448                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4449                         struct cfg80211_tid_stats *tidstats;
4450                         struct nlattr *tidattr;
4451
4452                         tidstats = &sinfo->pertid[tid];
4453
4454                         if (!tidstats->filled)
4455                                 continue;
4456
4457                         tidattr = nla_nest_start(msg, tid + 1);
4458                         if (!tidattr)
4459                                 goto nla_put_failure;
4460
4461 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4462         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4463             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4464                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4465                 goto nla_put_failure;                                   \
4466         } while (0)
4467
4468                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4469                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4470                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4471                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4472
4473 #undef PUT_TIDVAL_U64
4474                         nla_nest_end(msg, tidattr);
4475                 }
4476
4477                 nla_nest_end(msg, tidsattr);
4478         }
4479
4480         nla_nest_end(msg, sinfoattr);
4481
4482         if (sinfo->assoc_req_ies_len &&
4483             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4484                     sinfo->assoc_req_ies))
4485                 goto nla_put_failure;
4486
4487         genlmsg_end(msg, hdr);
4488         return 0;
4489
4490  nla_put_failure:
4491         genlmsg_cancel(msg, hdr);
4492         return -EMSGSIZE;
4493 }
4494
4495 static int nl80211_dump_station(struct sk_buff *skb,
4496                                 struct netlink_callback *cb)
4497 {
4498         struct station_info sinfo;
4499         struct cfg80211_registered_device *rdev;
4500         struct wireless_dev *wdev;
4501         u8 mac_addr[ETH_ALEN];
4502         int sta_idx = cb->args[2];
4503         int err;
4504
4505         rtnl_lock();
4506         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
4507         if (err)
4508                 goto out_err;
4509
4510         if (!wdev->netdev) {
4511                 err = -EINVAL;
4512                 goto out_err;
4513         }
4514
4515         if (!rdev->ops->dump_station) {
4516                 err = -EOPNOTSUPP;
4517                 goto out_err;
4518         }
4519
4520         while (1) {
4521                 memset(&sinfo, 0, sizeof(sinfo));
4522                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4523                                         mac_addr, &sinfo);
4524                 if (err == -ENOENT)
4525                         break;
4526                 if (err)
4527                         goto out_err;
4528
4529                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4530                                 NETLINK_CB(cb->skb).portid,
4531                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4532                                 rdev, wdev->netdev, mac_addr,
4533                                 &sinfo) < 0)
4534                         goto out;
4535
4536                 sta_idx++;
4537         }
4538
4539  out:
4540         cb->args[2] = sta_idx;
4541         err = skb->len;
4542  out_err:
4543         rtnl_unlock();
4544
4545         return err;
4546 }
4547
4548 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4549 {
4550         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4551         struct net_device *dev = info->user_ptr[1];
4552         struct station_info sinfo;
4553         struct sk_buff *msg;
4554         u8 *mac_addr = NULL;
4555         int err;
4556
4557         memset(&sinfo, 0, sizeof(sinfo));
4558
4559         if (!info->attrs[NL80211_ATTR_MAC])
4560                 return -EINVAL;
4561
4562         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4563
4564         if (!rdev->ops->get_station)
4565                 return -EOPNOTSUPP;
4566
4567         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4568         if (err)
4569                 return err;
4570
4571         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4572         if (!msg)
4573                 return -ENOMEM;
4574
4575         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4576                                  info->snd_portid, info->snd_seq, 0,
4577                                  rdev, dev, mac_addr, &sinfo) < 0) {
4578                 nlmsg_free(msg);
4579                 return -ENOBUFS;
4580         }
4581
4582         return genlmsg_reply(msg, info);
4583 }
4584
4585 int cfg80211_check_station_change(struct wiphy *wiphy,
4586                                   struct station_parameters *params,
4587                                   enum cfg80211_station_type statype)
4588 {
4589         if (params->listen_interval != -1 &&
4590             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4591                 return -EINVAL;
4592
4593         if (params->support_p2p_ps != -1 &&
4594             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4595                 return -EINVAL;
4596
4597         if (params->aid &&
4598             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4599             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4600                 return -EINVAL;
4601
4602         /* When you run into this, adjust the code below for the new flag */
4603         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4604
4605         switch (statype) {
4606         case CFG80211_STA_MESH_PEER_KERNEL:
4607         case CFG80211_STA_MESH_PEER_USER:
4608                 /*
4609                  * No ignoring the TDLS flag here -- the userspace mesh
4610                  * code doesn't have the bug of including TDLS in the
4611                  * mask everywhere.
4612                  */
4613                 if (params->sta_flags_mask &
4614                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4615                                   BIT(NL80211_STA_FLAG_MFP) |
4616                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4617                         return -EINVAL;
4618                 break;
4619         case CFG80211_STA_TDLS_PEER_SETUP:
4620         case CFG80211_STA_TDLS_PEER_ACTIVE:
4621                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4622                         return -EINVAL;
4623                 /* ignore since it can't change */
4624                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4625                 break;
4626         default:
4627                 /* disallow mesh-specific things */
4628                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4629                         return -EINVAL;
4630                 if (params->local_pm)
4631                         return -EINVAL;
4632                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4633                         return -EINVAL;
4634         }
4635
4636         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4637             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4638                 /* TDLS can't be set, ... */
4639                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4640                         return -EINVAL;
4641                 /*
4642                  * ... but don't bother the driver with it. This works around
4643                  * a hostapd/wpa_supplicant issue -- it always includes the
4644                  * TLDS_PEER flag in the mask even for AP mode.
4645                  */
4646                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4647         }
4648
4649         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4650             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4651                 /* reject other things that can't change */
4652                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4653                         return -EINVAL;
4654                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
4655                         return -EINVAL;
4656                 if (params->supported_rates)
4657                         return -EINVAL;
4658                 if (params->ext_capab || params->ht_capa || params->vht_capa)
4659                         return -EINVAL;
4660         }
4661
4662         if (statype != CFG80211_STA_AP_CLIENT &&
4663             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4664                 if (params->vlan)
4665                         return -EINVAL;
4666         }
4667
4668         switch (statype) {
4669         case CFG80211_STA_AP_MLME_CLIENT:
4670                 /* Use this only for authorizing/unauthorizing a station */
4671                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
4672                         return -EOPNOTSUPP;
4673                 break;
4674         case CFG80211_STA_AP_CLIENT:
4675         case CFG80211_STA_AP_CLIENT_UNASSOC:
4676                 /* accept only the listed bits */
4677                 if (params->sta_flags_mask &
4678                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4679                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4680                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
4681                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4682                                   BIT(NL80211_STA_FLAG_WME) |
4683                                   BIT(NL80211_STA_FLAG_MFP)))
4684                         return -EINVAL;
4685
4686                 /* but authenticated/associated only if driver handles it */
4687                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
4688                     params->sta_flags_mask &
4689                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4690                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
4691                         return -EINVAL;
4692                 break;
4693         case CFG80211_STA_IBSS:
4694         case CFG80211_STA_AP_STA:
4695                 /* reject any changes other than AUTHORIZED */
4696                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
4697                         return -EINVAL;
4698                 break;
4699         case CFG80211_STA_TDLS_PEER_SETUP:
4700                 /* reject any changes other than AUTHORIZED or WME */
4701                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
4702                                                BIT(NL80211_STA_FLAG_WME)))
4703                         return -EINVAL;
4704                 /* force (at least) rates when authorizing */
4705                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
4706                     !params->supported_rates)
4707                         return -EINVAL;
4708                 break;
4709         case CFG80211_STA_TDLS_PEER_ACTIVE:
4710                 /* reject any changes */
4711                 return -EINVAL;
4712         case CFG80211_STA_MESH_PEER_KERNEL:
4713                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4714                         return -EINVAL;
4715                 break;
4716         case CFG80211_STA_MESH_PEER_USER:
4717                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
4718                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
4719                         return -EINVAL;
4720                 break;
4721         }
4722
4723         /*
4724          * Older kernel versions ignored this attribute entirely, so don't
4725          * reject attempts to update it but mark it as unused instead so the
4726          * driver won't look at the data.
4727          */
4728         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
4729             statype != CFG80211_STA_TDLS_PEER_SETUP)
4730                 params->opmode_notif_used = false;
4731
4732         return 0;
4733 }
4734 EXPORT_SYMBOL(cfg80211_check_station_change);
4735
4736 /*
4737  * Get vlan interface making sure it is running and on the right wiphy.
4738  */
4739 static struct net_device *get_vlan(struct genl_info *info,
4740                                    struct cfg80211_registered_device *rdev)
4741 {
4742         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
4743         struct net_device *v;
4744         int ret;
4745
4746         if (!vlanattr)
4747                 return NULL;
4748
4749         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
4750         if (!v)
4751                 return ERR_PTR(-ENODEV);
4752
4753         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
4754                 ret = -EINVAL;
4755                 goto error;
4756         }
4757
4758         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
4759             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4760             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
4761                 ret = -EINVAL;
4762                 goto error;
4763         }
4764
4765         if (!netif_running(v)) {
4766                 ret = -ENETDOWN;
4767                 goto error;
4768         }
4769
4770         return v;
4771  error:
4772         dev_put(v);
4773         return ERR_PTR(ret);
4774 }
4775
4776 static const struct nla_policy
4777 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
4778         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
4779         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
4780 };
4781
4782 static int nl80211_parse_sta_wme(struct genl_info *info,
4783                                  struct station_parameters *params)
4784 {
4785         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
4786         struct nlattr *nla;
4787         int err;
4788
4789         /* parse WME attributes if present */
4790         if (!info->attrs[NL80211_ATTR_STA_WME])
4791                 return 0;
4792
4793         nla = info->attrs[NL80211_ATTR_STA_WME];
4794         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
4795                                nl80211_sta_wme_policy, info->extack);
4796         if (err)
4797                 return err;
4798
4799         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
4800                 params->uapsd_queues = nla_get_u8(
4801                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
4802         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
4803                 return -EINVAL;
4804
4805         if (tb[NL80211_STA_WME_MAX_SP])
4806                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
4807
4808         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
4809                 return -EINVAL;
4810
4811         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
4812
4813         return 0;
4814 }
4815
4816 static int nl80211_parse_sta_channel_info(struct genl_info *info,
4817                                       struct station_parameters *params)
4818 {
4819         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
4820                 params->supported_channels =
4821                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4822                 params->supported_channels_len =
4823                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
4824                 /*
4825                  * Need to include at least one (first channel, number of
4826                  * channels) tuple for each subband, and must have proper
4827                  * tuples for the rest of the data as well.
4828                  */
4829                 if (params->supported_channels_len < 2)
4830                         return -EINVAL;
4831                 if (params->supported_channels_len % 2)
4832                         return -EINVAL;
4833         }
4834
4835         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
4836                 params->supported_oper_classes =
4837                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4838                 params->supported_oper_classes_len =
4839                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
4840                 /*
4841                  * The value of the Length field of the Supported Operating
4842                  * Classes element is between 2 and 253.
4843                  */
4844                 if (params->supported_oper_classes_len < 2 ||
4845                     params->supported_oper_classes_len > 253)
4846                         return -EINVAL;
4847         }
4848         return 0;
4849 }
4850
4851 static int nl80211_set_station_tdls(struct genl_info *info,
4852                                     struct station_parameters *params)
4853 {
4854         int err;
4855         /* Dummy STA entry gets updated once the peer capabilities are known */
4856         if (info->attrs[NL80211_ATTR_PEER_AID])
4857                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
4858         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
4859                 params->ht_capa =
4860                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
4861         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
4862                 params->vht_capa =
4863                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
4864
4865         err = nl80211_parse_sta_channel_info(info, params);
4866         if (err)
4867                 return err;
4868
4869         return nl80211_parse_sta_wme(info, params);
4870 }
4871
4872 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
4873 {
4874         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4875         struct net_device *dev = info->user_ptr[1];
4876         struct station_parameters params;
4877         u8 *mac_addr;
4878         int err;
4879
4880         memset(&params, 0, sizeof(params));
4881
4882         if (!rdev->ops->change_station)
4883                 return -EOPNOTSUPP;
4884
4885         /*
4886          * AID and listen_interval properties can be set only for unassociated
4887          * station. Include these parameters here and will check them in
4888          * cfg80211_check_station_change().
4889          */
4890         if (info->attrs[NL80211_ATTR_STA_AID])
4891                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
4892
4893         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
4894                 params.listen_interval =
4895                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
4896         else
4897                 params.listen_interval = -1;
4898
4899         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
4900                 u8 tmp;
4901
4902                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
4903                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
4904                         return -EINVAL;
4905
4906                 params.support_p2p_ps = tmp;
4907         } else {
4908                 params.support_p2p_ps = -1;
4909         }
4910
4911         if (!info->attrs[NL80211_ATTR_MAC])
4912                 return -EINVAL;
4913
4914         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4915
4916         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
4917                 params.supported_rates =
4918                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4919                 params.supported_rates_len =
4920                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
4921         }
4922
4923         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
4924                 params.capability =
4925                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
4926                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
4927         }
4928
4929         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
4930                 params.ext_capab =
4931                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4932                 params.ext_capab_len =
4933                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
4934         }
4935
4936         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
4937                 return -EINVAL;
4938
4939         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
4940                 params.plink_action =
4941                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
4942                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
4943                         return -EINVAL;
4944         }
4945
4946         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
4947                 params.plink_state =
4948                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
4949                 if (params.plink_state >= NUM_NL80211_PLINK_STATES)
4950                         return -EINVAL;
4951                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID]) {
4952                         params.peer_aid = nla_get_u16(
4953                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
4954                         if (params.peer_aid > IEEE80211_MAX_AID)
4955                                 return -EINVAL;
4956                 }
4957                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
4958         }
4959
4960         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]) {
4961                 enum nl80211_mesh_power_mode pm = nla_get_u32(
4962                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
4963
4964                 if (pm <= NL80211_MESH_POWER_UNKNOWN ||
4965                     pm > NL80211_MESH_POWER_MAX)
4966                         return -EINVAL;
4967
4968                 params.local_pm = pm;
4969         }
4970
4971         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
4972                 params.opmode_notif_used = true;
4973                 params.opmode_notif =
4974                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
4975         }
4976
4977         /* Include parameters for TDLS peer (will check later) */
4978         err = nl80211_set_station_tdls(info, &params);
4979         if (err)
4980                 return err;
4981
4982         params.vlan = get_vlan(info, rdev);
4983         if (IS_ERR(params.vlan))
4984                 return PTR_ERR(params.vlan);
4985
4986         switch (dev->ieee80211_ptr->iftype) {
4987         case NL80211_IFTYPE_AP:
4988         case NL80211_IFTYPE_AP_VLAN:
4989         case NL80211_IFTYPE_P2P_GO:
4990         case NL80211_IFTYPE_P2P_CLIENT:
4991         case NL80211_IFTYPE_STATION:
4992         case NL80211_IFTYPE_ADHOC:
4993         case NL80211_IFTYPE_MESH_POINT:
4994                 break;
4995         default:
4996                 err = -EOPNOTSUPP;
4997                 goto out_put_vlan;
4998         }
4999
5000         /* driver will call cfg80211_check_station_change() */
5001         err = rdev_change_station(rdev, dev, mac_addr, &params);
5002
5003  out_put_vlan:
5004         if (params.vlan)
5005                 dev_put(params.vlan);
5006
5007         return err;
5008 }
5009
5010 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5011 {
5012         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5013         int err;
5014         struct net_device *dev = info->user_ptr[1];
5015         struct station_parameters params;
5016         u8 *mac_addr = NULL;
5017         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5018                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5019
5020         memset(&params, 0, sizeof(params));
5021
5022         if (!rdev->ops->add_station)
5023                 return -EOPNOTSUPP;
5024
5025         if (!info->attrs[NL80211_ATTR_MAC])
5026                 return -EINVAL;
5027
5028         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5029                 return -EINVAL;
5030
5031         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5032                 return -EINVAL;
5033
5034         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5035             !info->attrs[NL80211_ATTR_PEER_AID])
5036                 return -EINVAL;
5037
5038         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5039         params.supported_rates =
5040                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5041         params.supported_rates_len =
5042                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5043         params.listen_interval =
5044                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5045
5046         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5047                 u8 tmp;
5048
5049                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5050                 if (tmp >= NUM_NL80211_P2P_PS_STATUS)
5051                         return -EINVAL;
5052
5053                 params.support_p2p_ps = tmp;
5054         } else {
5055                 /*
5056                  * if not specified, assume it's supported for P2P GO interface,
5057                  * and is NOT supported for AP interface
5058                  */
5059                 params.support_p2p_ps =
5060                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5061         }
5062
5063         if (info->attrs[NL80211_ATTR_PEER_AID])
5064                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5065         else
5066                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5067         if (!params.aid || params.aid > IEEE80211_MAX_AID)
5068                 return -EINVAL;
5069
5070         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5071                 params.capability =
5072                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5073                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5074         }
5075
5076         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5077                 params.ext_capab =
5078                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5079                 params.ext_capab_len =
5080                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5081         }
5082
5083         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5084                 params.ht_capa =
5085                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5086
5087         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5088                 params.vht_capa =
5089                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5090
5091         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5092                 params.opmode_notif_used = true;
5093                 params.opmode_notif =
5094                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5095         }
5096
5097         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION]) {
5098                 params.plink_action =
5099                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5100                 if (params.plink_action >= NUM_NL80211_PLINK_ACTIONS)
5101                         return -EINVAL;
5102         }
5103
5104         err = nl80211_parse_sta_channel_info(info, &params);
5105         if (err)
5106                 return err;
5107
5108         err = nl80211_parse_sta_wme(info, &params);
5109         if (err)
5110                 return err;
5111
5112         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5113                 return -EINVAL;
5114
5115         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5116          * as userspace might just pass through the capabilities from the IEs
5117          * directly, rather than enforcing this restriction and returning an
5118          * error in this case.
5119          */
5120         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5121                 params.ht_capa = NULL;
5122                 params.vht_capa = NULL;
5123         }
5124
5125         /* When you run into this, adjust the code below for the new flag */
5126         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5127
5128         switch (dev->ieee80211_ptr->iftype) {
5129         case NL80211_IFTYPE_AP:
5130         case NL80211_IFTYPE_AP_VLAN:
5131         case NL80211_IFTYPE_P2P_GO:
5132                 /* ignore WME attributes if iface/sta is not capable */
5133                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5134                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5135                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5136
5137                 /* TDLS peers cannot be added */
5138                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5139                     info->attrs[NL80211_ATTR_PEER_AID])
5140                         return -EINVAL;
5141                 /* but don't bother the driver with it */
5142                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5143
5144                 /* allow authenticated/associated only if driver handles it */
5145                 if (!(rdev->wiphy.features &
5146                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5147                     params.sta_flags_mask & auth_assoc)
5148                         return -EINVAL;
5149
5150                 /* Older userspace, or userspace wanting to be compatible with
5151                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5152                  * and assoc flags in the mask, but assumes the station will be
5153                  * added as associated anyway since this was the required driver
5154                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5155                  * introduced.
5156                  * In order to not bother drivers with this quirk in the API
5157                  * set the flags in both the mask and set for new stations in
5158                  * this case.
5159                  */
5160                 if (!(params.sta_flags_mask & auth_assoc)) {
5161                         params.sta_flags_mask |= auth_assoc;
5162                         params.sta_flags_set |= auth_assoc;
5163                 }
5164
5165                 /* must be last in here for error handling */
5166                 params.vlan = get_vlan(info, rdev);
5167                 if (IS_ERR(params.vlan))
5168                         return PTR_ERR(params.vlan);
5169                 break;
5170         case NL80211_IFTYPE_MESH_POINT:
5171                 /* ignore uAPSD data */
5172                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5173
5174                 /* associated is disallowed */
5175                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5176                         return -EINVAL;
5177                 /* TDLS peers cannot be added */
5178                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5179                     info->attrs[NL80211_ATTR_PEER_AID])
5180                         return -EINVAL;
5181                 break;
5182         case NL80211_IFTYPE_STATION:
5183         case NL80211_IFTYPE_P2P_CLIENT:
5184                 /* ignore uAPSD data */
5185                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5186
5187                 /* these are disallowed */
5188                 if (params.sta_flags_mask &
5189                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5190                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5191                         return -EINVAL;
5192                 /* Only TDLS peers can be added */
5193                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5194                         return -EINVAL;
5195                 /* Can only add if TDLS ... */
5196                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5197                         return -EOPNOTSUPP;
5198                 /* ... with external setup is supported */
5199                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5200                         return -EOPNOTSUPP;
5201                 /*
5202                  * Older wpa_supplicant versions always mark the TDLS peer
5203                  * as authorized, but it shouldn't yet be.
5204                  */
5205                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5206                 break;
5207         default:
5208                 return -EOPNOTSUPP;
5209         }
5210
5211         /* be aware of params.vlan when changing code here */
5212
5213         err = rdev_add_station(rdev, dev, mac_addr, &params);
5214
5215         if (params.vlan)
5216                 dev_put(params.vlan);
5217         return err;
5218 }
5219
5220 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5221 {
5222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5223         struct net_device *dev = info->user_ptr[1];
5224         struct station_del_parameters params;
5225
5226         memset(&params, 0, sizeof(params));
5227
5228         if (info->attrs[NL80211_ATTR_MAC])
5229                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5230
5231         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5232             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5233             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5234             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5235                 return -EINVAL;
5236
5237         if (!rdev->ops->del_station)
5238                 return -EOPNOTSUPP;
5239
5240         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5241                 params.subtype =
5242                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5243                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5244                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5245                         return -EINVAL;
5246         } else {
5247                 /* Default to Deauthentication frame */
5248                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5249         }
5250
5251         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5252                 params.reason_code =
5253                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5254                 if (params.reason_code == 0)
5255                         return -EINVAL; /* 0 is reserved */
5256         } else {
5257                 /* Default to reason code 2 */
5258                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5259         }
5260
5261         return rdev_del_station(rdev, dev, &params);
5262 }
5263
5264 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5265                                 int flags, struct net_device *dev,
5266                                 u8 *dst, u8 *next_hop,
5267                                 struct mpath_info *pinfo)
5268 {
5269         void *hdr;
5270         struct nlattr *pinfoattr;
5271
5272         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5273         if (!hdr)
5274                 return -1;
5275
5276         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5277             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5278             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5279             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5280                 goto nla_put_failure;
5281
5282         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5283         if (!pinfoattr)
5284                 goto nla_put_failure;
5285         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5286             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5287                         pinfo->frame_qlen))
5288                 goto nla_put_failure;
5289         if (((pinfo->filled & MPATH_INFO_SN) &&
5290              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5291             ((pinfo->filled & MPATH_INFO_METRIC) &&
5292              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5293                          pinfo->metric)) ||
5294             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5295              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5296                          pinfo->exptime)) ||
5297             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5298              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5299                         pinfo->flags)) ||
5300             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5301              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5302                          pinfo->discovery_timeout)) ||
5303             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5304              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5305                         pinfo->discovery_retries)))
5306                 goto nla_put_failure;
5307
5308         nla_nest_end(msg, pinfoattr);
5309
5310         genlmsg_end(msg, hdr);
5311         return 0;
5312
5313  nla_put_failure:
5314         genlmsg_cancel(msg, hdr);
5315         return -EMSGSIZE;
5316 }
5317
5318 static int nl80211_dump_mpath(struct sk_buff *skb,
5319                               struct netlink_callback *cb)
5320 {
5321         struct mpath_info pinfo;
5322         struct cfg80211_registered_device *rdev;
5323         struct wireless_dev *wdev;
5324         u8 dst[ETH_ALEN];
5325         u8 next_hop[ETH_ALEN];
5326         int path_idx = cb->args[2];
5327         int err;
5328
5329         rtnl_lock();
5330         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5331         if (err)
5332                 goto out_err;
5333
5334         if (!rdev->ops->dump_mpath) {
5335                 err = -EOPNOTSUPP;
5336                 goto out_err;
5337         }
5338
5339         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5340                 err = -EOPNOTSUPP;
5341                 goto out_err;
5342         }
5343
5344         while (1) {
5345                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5346                                       next_hop, &pinfo);
5347                 if (err == -ENOENT)
5348                         break;
5349                 if (err)
5350                         goto out_err;
5351
5352                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5353                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5354                                        wdev->netdev, dst, next_hop,
5355                                        &pinfo) < 0)
5356                         goto out;
5357
5358                 path_idx++;
5359         }
5360
5361  out:
5362         cb->args[2] = path_idx;
5363         err = skb->len;
5364  out_err:
5365         rtnl_unlock();
5366         return err;
5367 }
5368
5369 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5370 {
5371         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5372         int err;
5373         struct net_device *dev = info->user_ptr[1];
5374         struct mpath_info pinfo;
5375         struct sk_buff *msg;
5376         u8 *dst = NULL;
5377         u8 next_hop[ETH_ALEN];
5378
5379         memset(&pinfo, 0, sizeof(pinfo));
5380
5381         if (!info->attrs[NL80211_ATTR_MAC])
5382                 return -EINVAL;
5383
5384         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5385
5386         if (!rdev->ops->get_mpath)
5387                 return -EOPNOTSUPP;
5388
5389         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5390                 return -EOPNOTSUPP;
5391
5392         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5393         if (err)
5394                 return err;
5395
5396         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5397         if (!msg)
5398                 return -ENOMEM;
5399
5400         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5401                                  dev, dst, next_hop, &pinfo) < 0) {
5402                 nlmsg_free(msg);
5403                 return -ENOBUFS;
5404         }
5405
5406         return genlmsg_reply(msg, info);
5407 }
5408
5409 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5410 {
5411         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5412         struct net_device *dev = info->user_ptr[1];
5413         u8 *dst = NULL;
5414         u8 *next_hop = NULL;
5415
5416         if (!info->attrs[NL80211_ATTR_MAC])
5417                 return -EINVAL;
5418
5419         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5420                 return -EINVAL;
5421
5422         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5423         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5424
5425         if (!rdev->ops->change_mpath)
5426                 return -EOPNOTSUPP;
5427
5428         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5429                 return -EOPNOTSUPP;
5430
5431         return rdev_change_mpath(rdev, dev, dst, next_hop);
5432 }
5433
5434 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5435 {
5436         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5437         struct net_device *dev = info->user_ptr[1];
5438         u8 *dst = NULL;
5439         u8 *next_hop = NULL;
5440
5441         if (!info->attrs[NL80211_ATTR_MAC])
5442                 return -EINVAL;
5443
5444         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5445                 return -EINVAL;
5446
5447         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5448         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5449
5450         if (!rdev->ops->add_mpath)
5451                 return -EOPNOTSUPP;
5452
5453         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5454                 return -EOPNOTSUPP;
5455
5456         return rdev_add_mpath(rdev, dev, dst, next_hop);
5457 }
5458
5459 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5460 {
5461         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5462         struct net_device *dev = info->user_ptr[1];
5463         u8 *dst = NULL;
5464
5465         if (info->attrs[NL80211_ATTR_MAC])
5466                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5467
5468         if (!rdev->ops->del_mpath)
5469                 return -EOPNOTSUPP;
5470
5471         return rdev_del_mpath(rdev, dev, dst);
5472 }
5473
5474 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5475 {
5476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5477         int err;
5478         struct net_device *dev = info->user_ptr[1];
5479         struct mpath_info pinfo;
5480         struct sk_buff *msg;
5481         u8 *dst = NULL;
5482         u8 mpp[ETH_ALEN];
5483
5484         memset(&pinfo, 0, sizeof(pinfo));
5485
5486         if (!info->attrs[NL80211_ATTR_MAC])
5487                 return -EINVAL;
5488
5489         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5490
5491         if (!rdev->ops->get_mpp)
5492                 return -EOPNOTSUPP;
5493
5494         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5495                 return -EOPNOTSUPP;
5496
5497         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5498         if (err)
5499                 return err;
5500
5501         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5502         if (!msg)
5503                 return -ENOMEM;
5504
5505         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5506                                dev, dst, mpp, &pinfo) < 0) {
5507                 nlmsg_free(msg);
5508                 return -ENOBUFS;
5509         }
5510
5511         return genlmsg_reply(msg, info);
5512 }
5513
5514 static int nl80211_dump_mpp(struct sk_buff *skb,
5515                             struct netlink_callback *cb)
5516 {
5517         struct mpath_info pinfo;
5518         struct cfg80211_registered_device *rdev;
5519         struct wireless_dev *wdev;
5520         u8 dst[ETH_ALEN];
5521         u8 mpp[ETH_ALEN];
5522         int path_idx = cb->args[2];
5523         int err;
5524
5525         rtnl_lock();
5526         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
5527         if (err)
5528                 goto out_err;
5529
5530         if (!rdev->ops->dump_mpp) {
5531                 err = -EOPNOTSUPP;
5532                 goto out_err;
5533         }
5534
5535         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5536                 err = -EOPNOTSUPP;
5537                 goto out_err;
5538         }
5539
5540         while (1) {
5541                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5542                                     mpp, &pinfo);
5543                 if (err == -ENOENT)
5544                         break;
5545                 if (err)
5546                         goto out_err;
5547
5548                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5549                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5550                                        wdev->netdev, dst, mpp,
5551                                        &pinfo) < 0)
5552                         goto out;
5553
5554                 path_idx++;
5555         }
5556
5557  out:
5558         cb->args[2] = path_idx;
5559         err = skb->len;
5560  out_err:
5561         rtnl_unlock();
5562         return err;
5563 }
5564
5565 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5566 {
5567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5568         struct net_device *dev = info->user_ptr[1];
5569         struct wireless_dev *wdev = dev->ieee80211_ptr;
5570         struct bss_parameters params;
5571         int err;
5572
5573         memset(&params, 0, sizeof(params));
5574         /* default to not changing parameters */
5575         params.use_cts_prot = -1;
5576         params.use_short_preamble = -1;
5577         params.use_short_slot_time = -1;
5578         params.ap_isolate = -1;
5579         params.ht_opmode = -1;
5580         params.p2p_ctwindow = -1;
5581         params.p2p_opp_ps = -1;
5582
5583         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5584                 params.use_cts_prot =
5585                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5586         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5587                 params.use_short_preamble =
5588                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5589         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5590                 params.use_short_slot_time =
5591                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5592         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5593                 params.basic_rates =
5594                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5595                 params.basic_rates_len =
5596                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5597         }
5598         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5599                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5600         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5601                 params.ht_opmode =
5602                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5603
5604         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5605                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5606                         return -EINVAL;
5607                 params.p2p_ctwindow =
5608                         nla_get_s8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5609                 if (params.p2p_ctwindow < 0)
5610                         return -EINVAL;
5611                 if (params.p2p_ctwindow != 0 &&
5612                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5613                         return -EINVAL;
5614         }
5615
5616         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5617                 u8 tmp;
5618
5619                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5620                         return -EINVAL;
5621                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5622                 if (tmp > 1)
5623                         return -EINVAL;
5624                 params.p2p_opp_ps = tmp;
5625                 if (params.p2p_opp_ps &&
5626                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5627                         return -EINVAL;
5628         }
5629
5630         if (!rdev->ops->change_bss)
5631                 return -EOPNOTSUPP;
5632
5633         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5634             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5635                 return -EOPNOTSUPP;
5636
5637         wdev_lock(wdev);
5638         err = rdev_change_bss(rdev, dev, &params);
5639         wdev_unlock(wdev);
5640
5641         return err;
5642 }
5643
5644 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5645 {
5646         char *data = NULL;
5647         bool is_indoor;
5648         enum nl80211_user_reg_hint_type user_reg_hint_type;
5649         u32 owner_nlportid;
5650
5651         /*
5652          * You should only get this when cfg80211 hasn't yet initialized
5653          * completely when built-in to the kernel right between the time
5654          * window between nl80211_init() and regulatory_init(), if that is
5655          * even possible.
5656          */
5657         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5658                 return -EINPROGRESS;
5659
5660         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5661                 user_reg_hint_type =
5662                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5663         else
5664                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
5665
5666         switch (user_reg_hint_type) {
5667         case NL80211_USER_REG_HINT_USER:
5668         case NL80211_USER_REG_HINT_CELL_BASE:
5669                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
5670                         return -EINVAL;
5671
5672                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
5673                 return regulatory_hint_user(data, user_reg_hint_type);
5674         case NL80211_USER_REG_HINT_INDOOR:
5675                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
5676                         owner_nlportid = info->snd_portid;
5677                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
5678                 } else {
5679                         owner_nlportid = 0;
5680                         is_indoor = true;
5681                 }
5682
5683                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
5684         default:
5685                 return -EINVAL;
5686         }
5687 }
5688
5689 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
5690 {
5691         return reg_reload_regdb();
5692 }
5693
5694 static int nl80211_get_mesh_config(struct sk_buff *skb,
5695                                    struct genl_info *info)
5696 {
5697         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5698         struct net_device *dev = info->user_ptr[1];
5699         struct wireless_dev *wdev = dev->ieee80211_ptr;
5700         struct mesh_config cur_params;
5701         int err = 0;
5702         void *hdr;
5703         struct nlattr *pinfoattr;
5704         struct sk_buff *msg;
5705
5706         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
5707                 return -EOPNOTSUPP;
5708
5709         if (!rdev->ops->get_mesh_config)
5710                 return -EOPNOTSUPP;
5711
5712         wdev_lock(wdev);
5713         /* If not connected, get default parameters */
5714         if (!wdev->mesh_id_len)
5715                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
5716         else
5717                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
5718         wdev_unlock(wdev);
5719
5720         if (err)
5721                 return err;
5722
5723         /* Draw up a netlink message to send back */
5724         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5725         if (!msg)
5726                 return -ENOMEM;
5727         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
5728                              NL80211_CMD_GET_MESH_CONFIG);
5729         if (!hdr)
5730                 goto out;
5731         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
5732         if (!pinfoattr)
5733                 goto nla_put_failure;
5734         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5735             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
5736                         cur_params.dot11MeshRetryTimeout) ||
5737             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5738                         cur_params.dot11MeshConfirmTimeout) ||
5739             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
5740                         cur_params.dot11MeshHoldingTimeout) ||
5741             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
5742                         cur_params.dot11MeshMaxPeerLinks) ||
5743             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
5744                        cur_params.dot11MeshMaxRetries) ||
5745             nla_put_u8(msg, NL80211_MESHCONF_TTL,
5746                        cur_params.dot11MeshTTL) ||
5747             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
5748                        cur_params.element_ttl) ||
5749             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5750                        cur_params.auto_open_plinks) ||
5751             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5752                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
5753             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5754                        cur_params.dot11MeshHWMPmaxPREQretries) ||
5755             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
5756                         cur_params.path_refresh_time) ||
5757             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5758                         cur_params.min_discovery_timeout) ||
5759             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5760                         cur_params.dot11MeshHWMPactivePathTimeout) ||
5761             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5762                         cur_params.dot11MeshHWMPpreqMinInterval) ||
5763             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5764                         cur_params.dot11MeshHWMPperrMinInterval) ||
5765             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5766                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
5767             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
5768                        cur_params.dot11MeshHWMPRootMode) ||
5769             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5770                         cur_params.dot11MeshHWMPRannInterval) ||
5771             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5772                        cur_params.dot11MeshGateAnnouncementProtocol) ||
5773             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
5774                        cur_params.dot11MeshForwarding) ||
5775             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
5776                         cur_params.rssi_threshold) ||
5777             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
5778                         cur_params.ht_opmode) ||
5779             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
5780                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
5781             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
5782                         cur_params.dot11MeshHWMProotInterval) ||
5783             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
5784                         cur_params.dot11MeshHWMPconfirmationInterval) ||
5785             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
5786                         cur_params.power_mode) ||
5787             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
5788                         cur_params.dot11MeshAwakeWindowDuration) ||
5789             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
5790                         cur_params.plink_timeout))
5791                 goto nla_put_failure;
5792         nla_nest_end(msg, pinfoattr);
5793         genlmsg_end(msg, hdr);
5794         return genlmsg_reply(msg, info);
5795
5796  nla_put_failure:
5797         genlmsg_cancel(msg, hdr);
5798  out:
5799         nlmsg_free(msg);
5800         return -ENOBUFS;
5801 }
5802
5803 static const struct nla_policy nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
5804         [NL80211_MESHCONF_RETRY_TIMEOUT] = { .type = NLA_U16 },
5805         [NL80211_MESHCONF_CONFIRM_TIMEOUT] = { .type = NLA_U16 },
5806         [NL80211_MESHCONF_HOLDING_TIMEOUT] = { .type = NLA_U16 },
5807         [NL80211_MESHCONF_MAX_PEER_LINKS] = { .type = NLA_U16 },
5808         [NL80211_MESHCONF_MAX_RETRIES] = { .type = NLA_U8 },
5809         [NL80211_MESHCONF_TTL] = { .type = NLA_U8 },
5810         [NL80211_MESHCONF_ELEMENT_TTL] = { .type = NLA_U8 },
5811         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = { .type = NLA_U8 },
5812         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] = { .type = NLA_U32 },
5813         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
5814         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
5815         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = { .type = NLA_U16 },
5816         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
5817         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] = { .type = NLA_U16 },
5818         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] = { .type = NLA_U16 },
5819         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] = { .type = NLA_U16 },
5820         [NL80211_MESHCONF_HWMP_ROOTMODE] = { .type = NLA_U8 },
5821         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] = { .type = NLA_U16 },
5822         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = { .type = NLA_U8 },
5823         [NL80211_MESHCONF_FORWARDING] = { .type = NLA_U8 },
5824         [NL80211_MESHCONF_RSSI_THRESHOLD] = { .type = NLA_U32 },
5825         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
5826         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
5827         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] = { .type = NLA_U16 },
5828         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] = { .type = NLA_U16 },
5829         [NL80211_MESHCONF_POWER_MODE] = { .type = NLA_U32 },
5830         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
5831         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
5832 };
5833
5834 static const struct nla_policy
5835         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
5836         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
5837         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
5838         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
5839         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
5840         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
5841         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
5842         [NL80211_MESH_SETUP_IE] = { .type = NLA_BINARY,
5843                                     .len = IEEE80211_MAX_DATA_LEN },
5844         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
5845 };
5846
5847 static int nl80211_check_bool(const struct nlattr *nla, u8 min, u8 max, bool *out)
5848 {
5849         u8 val = nla_get_u8(nla);
5850         if (val < min || val > max)
5851                 return -EINVAL;
5852         *out = val;
5853         return 0;
5854 }
5855
5856 static int nl80211_check_u8(const struct nlattr *nla, u8 min, u8 max, u8 *out)
5857 {
5858         u8 val = nla_get_u8(nla);
5859         if (val < min || val > max)
5860                 return -EINVAL;
5861         *out = val;
5862         return 0;
5863 }
5864
5865 static int nl80211_check_u16(const struct nlattr *nla, u16 min, u16 max, u16 *out)
5866 {
5867         u16 val = nla_get_u16(nla);
5868         if (val < min || val > max)
5869                 return -EINVAL;
5870         *out = val;
5871         return 0;
5872 }
5873
5874 static int nl80211_check_u32(const struct nlattr *nla, u32 min, u32 max, u32 *out)
5875 {
5876         u32 val = nla_get_u32(nla);
5877         if (val < min || val > max)
5878                 return -EINVAL;
5879         *out = val;
5880         return 0;
5881 }
5882
5883 static int nl80211_check_s32(const struct nlattr *nla, s32 min, s32 max, s32 *out)
5884 {
5885         s32 val = nla_get_s32(nla);
5886         if (val < min || val > max)
5887                 return -EINVAL;
5888         *out = val;
5889         return 0;
5890 }
5891
5892 static int nl80211_check_power_mode(const struct nlattr *nla,
5893                                     enum nl80211_mesh_power_mode min,
5894                                     enum nl80211_mesh_power_mode max,
5895                                     enum nl80211_mesh_power_mode *out)
5896 {
5897         u32 val = nla_get_u32(nla);
5898         if (val < min || val > max)
5899                 return -EINVAL;
5900         *out = val;
5901         return 0;
5902 }
5903
5904 static int nl80211_parse_mesh_config(struct genl_info *info,
5905                                      struct mesh_config *cfg,
5906                                      u32 *mask_out)
5907 {
5908         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
5909         u32 mask = 0;
5910         u16 ht_opmode;
5911
5912 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, min, max, mask, attr, fn) \
5913 do {                                                                        \
5914         if (tb[attr]) {                                                     \
5915                 if (fn(tb[attr], min, max, &cfg->param))                    \
5916                         return -EINVAL;                                     \
5917                 mask |= (1 << (attr - 1));                                  \
5918         }                                                                   \
5919 } while (0)
5920
5921         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
5922                 return -EINVAL;
5923         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
5924                              info->attrs[NL80211_ATTR_MESH_CONFIG],
5925                              nl80211_meshconf_params_policy, info->extack))
5926                 return -EINVAL;
5927
5928         /* This makes sure that there aren't more than 32 mesh config
5929          * parameters (otherwise our bitfield scheme would not work.) */
5930         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
5931
5932         /* Fill in the params struct */
5933         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, 1, 255,
5934                                   mask, NL80211_MESHCONF_RETRY_TIMEOUT,
5935                                   nl80211_check_u16);
5936         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, 1, 255,
5937                                   mask, NL80211_MESHCONF_CONFIRM_TIMEOUT,
5938                                   nl80211_check_u16);
5939         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, 1, 255,
5940                                   mask, NL80211_MESHCONF_HOLDING_TIMEOUT,
5941                                   nl80211_check_u16);
5942         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, 0, 255,
5943                                   mask, NL80211_MESHCONF_MAX_PEER_LINKS,
5944                                   nl80211_check_u16);
5945         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, 0, 16,
5946                                   mask, NL80211_MESHCONF_MAX_RETRIES,
5947                                   nl80211_check_u8);
5948         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, 1, 255,
5949                                   mask, NL80211_MESHCONF_TTL, nl80211_check_u8);
5950         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, 1, 255,
5951                                   mask, NL80211_MESHCONF_ELEMENT_TTL,
5952                                   nl80211_check_u8);
5953         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, 0, 1,
5954                                   mask, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
5955                                   nl80211_check_bool);
5956         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
5957                                   1, 255, mask,
5958                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
5959                                   nl80211_check_u32);
5960         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, 0, 255,
5961                                   mask, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
5962                                   nl80211_check_u8);
5963         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, 1, 65535,
5964                                   mask, NL80211_MESHCONF_PATH_REFRESH_TIME,
5965                                   nl80211_check_u32);
5966         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, 1, 65535,
5967                                   mask, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
5968                                   nl80211_check_u16);
5969         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
5970                                   1, 65535, mask,
5971                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
5972                                   nl80211_check_u32);
5973         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval,
5974                                   1, 65535, mask,
5975                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
5976                                   nl80211_check_u16);
5977         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval,
5978                                   1, 65535, mask,
5979                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
5980                                   nl80211_check_u16);
5981         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5982                                   dot11MeshHWMPnetDiameterTraversalTime,
5983                                   1, 65535, mask,
5984                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
5985                                   nl80211_check_u16);
5986         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, 0, 4,
5987                                   mask, NL80211_MESHCONF_HWMP_ROOTMODE,
5988                                   nl80211_check_u8);
5989         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, 1, 65535,
5990                                   mask, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
5991                                   nl80211_check_u16);
5992         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
5993                                   dot11MeshGateAnnouncementProtocol, 0, 1,
5994                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
5995                                   nl80211_check_bool);
5996         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, 0, 1,
5997                                   mask, NL80211_MESHCONF_FORWARDING,
5998                                   nl80211_check_bool);
5999         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, -255, 0,
6000                                   mask, NL80211_MESHCONF_RSSI_THRESHOLD,
6001                                   nl80211_check_s32);
6002         /*
6003          * Check HT operation mode based on
6004          * IEEE 802.11 2012 8.4.2.59 HT Operation element.
6005          */
6006         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6007                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6008
6009                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6010                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6011                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6012                         return -EINVAL;
6013
6014                 if ((ht_opmode & IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT) &&
6015                     (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6016                         return -EINVAL;
6017
6018                 switch (ht_opmode & IEEE80211_HT_OP_MODE_PROTECTION) {
6019                 case IEEE80211_HT_OP_MODE_PROTECTION_NONE:
6020                 case IEEE80211_HT_OP_MODE_PROTECTION_20MHZ:
6021                         if (ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT)
6022                                 return -EINVAL;
6023                         break;
6024                 case IEEE80211_HT_OP_MODE_PROTECTION_NONMEMBER:
6025                 case IEEE80211_HT_OP_MODE_PROTECTION_NONHT_MIXED:
6026                         if (!(ht_opmode & IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6027                                 return -EINVAL;
6028                         break;
6029                 }
6030                 cfg->ht_opmode = ht_opmode;
6031                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6032         }
6033         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathToRootTimeout,
6034                                   1, 65535, mask,
6035                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6036                                   nl80211_check_u32);
6037         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, 1, 65535,
6038                                   mask, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6039                                   nl80211_check_u16);
6040         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6041                                   dot11MeshHWMPconfirmationInterval,
6042                                   1, 65535, mask,
6043                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6044                                   nl80211_check_u16);
6045         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode,
6046                                   NL80211_MESH_POWER_ACTIVE,
6047                                   NL80211_MESH_POWER_MAX,
6048                                   mask, NL80211_MESHCONF_POWER_MODE,
6049                                   nl80211_check_power_mode);
6050         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration,
6051                                   0, 65535, mask,
6052                                   NL80211_MESHCONF_AWAKE_WINDOW, nl80211_check_u16);
6053         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, 0, 0xffffffff,
6054                                   mask, NL80211_MESHCONF_PLINK_TIMEOUT,
6055                                   nl80211_check_u32);
6056         if (mask_out)
6057                 *mask_out = mask;
6058
6059         return 0;
6060
6061 #undef FILL_IN_MESH_PARAM_IF_SET
6062 }
6063
6064 static int nl80211_parse_mesh_setup(struct genl_info *info,
6065                                      struct mesh_setup *setup)
6066 {
6067         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6068         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6069
6070         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6071                 return -EINVAL;
6072         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6073                              info->attrs[NL80211_ATTR_MESH_SETUP],
6074                              nl80211_mesh_setup_params_policy, info->extack))
6075                 return -EINVAL;
6076
6077         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6078                 setup->sync_method =
6079                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6080                  IEEE80211_SYNC_METHOD_VENDOR :
6081                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6082
6083         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6084                 setup->path_sel_proto =
6085                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6086                  IEEE80211_PATH_PROTOCOL_VENDOR :
6087                  IEEE80211_PATH_PROTOCOL_HWMP;
6088
6089         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6090                 setup->path_metric =
6091                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6092                  IEEE80211_PATH_METRIC_VENDOR :
6093                  IEEE80211_PATH_METRIC_AIRTIME;
6094
6095         if (tb[NL80211_MESH_SETUP_IE]) {
6096                 struct nlattr *ieattr =
6097                         tb[NL80211_MESH_SETUP_IE];
6098                 if (!is_valid_ie_attr(ieattr))
6099                         return -EINVAL;
6100                 setup->ie = nla_data(ieattr);
6101                 setup->ie_len = nla_len(ieattr);
6102         }
6103         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6104             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6105                 return -EINVAL;
6106         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6107         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6108         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6109         if (setup->is_secure)
6110                 setup->user_mpm = true;
6111
6112         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6113                 if (!setup->user_mpm)
6114                         return -EINVAL;
6115                 setup->auth_id =
6116                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6117         }
6118
6119         return 0;
6120 }
6121
6122 static int nl80211_update_mesh_config(struct sk_buff *skb,
6123                                       struct genl_info *info)
6124 {
6125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6126         struct net_device *dev = info->user_ptr[1];
6127         struct wireless_dev *wdev = dev->ieee80211_ptr;
6128         struct mesh_config cfg;
6129         u32 mask;
6130         int err;
6131
6132         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6133                 return -EOPNOTSUPP;
6134
6135         if (!rdev->ops->update_mesh_config)
6136                 return -EOPNOTSUPP;
6137
6138         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6139         if (err)
6140                 return err;
6141
6142         wdev_lock(wdev);
6143         if (!wdev->mesh_id_len)
6144                 err = -ENOLINK;
6145
6146         if (!err)
6147                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6148
6149         wdev_unlock(wdev);
6150
6151         return err;
6152 }
6153
6154 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6155                               struct sk_buff *msg)
6156 {
6157         struct nlattr *nl_reg_rules;
6158         unsigned int i;
6159
6160         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6161             (regdom->dfs_region &&
6162              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6163                 goto nla_put_failure;
6164
6165         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6166         if (!nl_reg_rules)
6167                 goto nla_put_failure;
6168
6169         for (i = 0; i < regdom->n_reg_rules; i++) {
6170                 struct nlattr *nl_reg_rule;
6171                 const struct ieee80211_reg_rule *reg_rule;
6172                 const struct ieee80211_freq_range *freq_range;
6173                 const struct ieee80211_power_rule *power_rule;
6174                 unsigned int max_bandwidth_khz;
6175
6176                 reg_rule = &regdom->reg_rules[i];
6177                 freq_range = &reg_rule->freq_range;
6178                 power_rule = &reg_rule->power_rule;
6179
6180                 nl_reg_rule = nla_nest_start(msg, i);
6181                 if (!nl_reg_rule)
6182                         goto nla_put_failure;
6183
6184                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6185                 if (!max_bandwidth_khz)
6186                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6187                                                                   reg_rule);
6188
6189                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6190                                 reg_rule->flags) ||
6191                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6192                                 freq_range->start_freq_khz) ||
6193                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6194                                 freq_range->end_freq_khz) ||
6195                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6196                                 max_bandwidth_khz) ||
6197                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6198                                 power_rule->max_antenna_gain) ||
6199                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6200                                 power_rule->max_eirp) ||
6201                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6202                                 reg_rule->dfs_cac_ms))
6203                         goto nla_put_failure;
6204
6205                 nla_nest_end(msg, nl_reg_rule);
6206         }
6207
6208         nla_nest_end(msg, nl_reg_rules);
6209         return 0;
6210
6211 nla_put_failure:
6212         return -EMSGSIZE;
6213 }
6214
6215 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6216 {
6217         const struct ieee80211_regdomain *regdom = NULL;
6218         struct cfg80211_registered_device *rdev;
6219         struct wiphy *wiphy = NULL;
6220         struct sk_buff *msg;
6221         void *hdr;
6222
6223         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6224         if (!msg)
6225                 return -ENOBUFS;
6226
6227         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6228                              NL80211_CMD_GET_REG);
6229         if (!hdr)
6230                 goto put_failure;
6231
6232         if (info->attrs[NL80211_ATTR_WIPHY]) {
6233                 bool self_managed;
6234
6235                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6236                 if (IS_ERR(rdev)) {
6237                         nlmsg_free(msg);
6238                         return PTR_ERR(rdev);
6239                 }
6240
6241                 wiphy = &rdev->wiphy;
6242                 self_managed = wiphy->regulatory_flags &
6243                                REGULATORY_WIPHY_SELF_MANAGED;
6244                 regdom = get_wiphy_regdom(wiphy);
6245
6246                 /* a self-managed-reg device must have a private regdom */
6247                 if (WARN_ON(!regdom && self_managed)) {
6248                         nlmsg_free(msg);
6249                         return -EINVAL;
6250                 }
6251
6252                 if (regdom &&
6253                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6254                         goto nla_put_failure;
6255         }
6256
6257         if (!wiphy && reg_last_request_cell_base() &&
6258             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6259                         NL80211_USER_REG_HINT_CELL_BASE))
6260                 goto nla_put_failure;
6261
6262         rcu_read_lock();
6263
6264         if (!regdom)
6265                 regdom = rcu_dereference(cfg80211_regdomain);
6266
6267         if (nl80211_put_regdom(regdom, msg))
6268                 goto nla_put_failure_rcu;
6269
6270         rcu_read_unlock();
6271
6272         genlmsg_end(msg, hdr);
6273         return genlmsg_reply(msg, info);
6274
6275 nla_put_failure_rcu:
6276         rcu_read_unlock();
6277 nla_put_failure:
6278         genlmsg_cancel(msg, hdr);
6279 put_failure:
6280         nlmsg_free(msg);
6281         return -EMSGSIZE;
6282 }
6283
6284 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6285                                u32 seq, int flags, struct wiphy *wiphy,
6286                                const struct ieee80211_regdomain *regdom)
6287 {
6288         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6289                                    NL80211_CMD_GET_REG);
6290
6291         if (!hdr)
6292                 return -1;
6293
6294         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
6295
6296         if (nl80211_put_regdom(regdom, msg))
6297                 goto nla_put_failure;
6298
6299         if (!wiphy && reg_last_request_cell_base() &&
6300             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6301                         NL80211_USER_REG_HINT_CELL_BASE))
6302                 goto nla_put_failure;
6303
6304         if (wiphy &&
6305             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6306                 goto nla_put_failure;
6307
6308         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6309             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6310                 goto nla_put_failure;
6311
6312         genlmsg_end(msg, hdr);
6313         return 0;
6314
6315 nla_put_failure:
6316         genlmsg_cancel(msg, hdr);
6317         return -EMSGSIZE;
6318 }
6319
6320 static int nl80211_get_reg_dump(struct sk_buff *skb,
6321                                 struct netlink_callback *cb)
6322 {
6323         const struct ieee80211_regdomain *regdom = NULL;
6324         struct cfg80211_registered_device *rdev;
6325         int err, reg_idx, start = cb->args[2];
6326
6327         rtnl_lock();
6328
6329         if (cfg80211_regdomain && start == 0) {
6330                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6331                                           NLM_F_MULTI, NULL,
6332                                           rtnl_dereference(cfg80211_regdomain));
6333                 if (err < 0)
6334                         goto out_err;
6335         }
6336
6337         /* the global regdom is idx 0 */
6338         reg_idx = 1;
6339         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6340                 regdom = get_wiphy_regdom(&rdev->wiphy);
6341                 if (!regdom)
6342                         continue;
6343
6344                 if (++reg_idx <= start)
6345                         continue;
6346
6347                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6348                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6349                 if (err < 0) {
6350                         reg_idx--;
6351                         break;
6352                 }
6353         }
6354
6355         cb->args[2] = reg_idx;
6356         err = skb->len;
6357 out_err:
6358         rtnl_unlock();
6359         return err;
6360 }
6361
6362 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6363 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6364         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6365         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6366         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6367         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6368         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6369         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6370         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6371 };
6372
6373 static int parse_reg_rule(struct nlattr *tb[],
6374         struct ieee80211_reg_rule *reg_rule)
6375 {
6376         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6377         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6378
6379         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6380                 return -EINVAL;
6381         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6382                 return -EINVAL;
6383         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6384                 return -EINVAL;
6385         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6386                 return -EINVAL;
6387         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6388                 return -EINVAL;
6389
6390         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6391
6392         freq_range->start_freq_khz =
6393                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6394         freq_range->end_freq_khz =
6395                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6396         freq_range->max_bandwidth_khz =
6397                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6398
6399         power_rule->max_eirp =
6400                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6401
6402         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6403                 power_rule->max_antenna_gain =
6404                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6405
6406         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6407                 reg_rule->dfs_cac_ms =
6408                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6409
6410         return 0;
6411 }
6412
6413 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6414 {
6415         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6416         struct nlattr *nl_reg_rule;
6417         char *alpha2;
6418         int rem_reg_rules, r;
6419         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6420         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6421         struct ieee80211_regdomain *rd;
6422
6423         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6424                 return -EINVAL;
6425
6426         if (!info->attrs[NL80211_ATTR_REG_RULES])
6427                 return -EINVAL;
6428
6429         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6430
6431         if (info->attrs[NL80211_ATTR_DFS_REGION])
6432                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6433
6434         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6435                             rem_reg_rules) {
6436                 num_rules++;
6437                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6438                         return -EINVAL;
6439         }
6440
6441         if (!reg_is_valid_request(alpha2))
6442                 return -EINVAL;
6443
6444         size_of_regd = sizeof(struct ieee80211_regdomain) +
6445                        num_rules * sizeof(struct ieee80211_reg_rule);
6446
6447         rd = kzalloc(size_of_regd, GFP_KERNEL);
6448         if (!rd)
6449                 return -ENOMEM;
6450
6451         rd->n_reg_rules = num_rules;
6452         rd->alpha2[0] = alpha2[0];
6453         rd->alpha2[1] = alpha2[1];
6454
6455         /*
6456          * Disable DFS master mode if the DFS region was
6457          * not supported or known on this kernel.
6458          */
6459         if (reg_supported_dfs_region(dfs_region))
6460                 rd->dfs_region = dfs_region;
6461
6462         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6463                             rem_reg_rules) {
6464                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6465                                      nl_reg_rule, reg_rule_policy,
6466                                      info->extack);
6467                 if (r)
6468                         goto bad_reg;
6469                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6470                 if (r)
6471                         goto bad_reg;
6472
6473                 rule_idx++;
6474
6475                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6476                         r = -EINVAL;
6477                         goto bad_reg;
6478                 }
6479         }
6480
6481         /* set_regdom takes ownership of rd */
6482         return set_regdom(rd, REGD_SOURCE_CRDA);
6483  bad_reg:
6484         kfree(rd);
6485         return r;
6486 }
6487 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6488
6489 static int validate_scan_freqs(struct nlattr *freqs)
6490 {
6491         struct nlattr *attr1, *attr2;
6492         int n_channels = 0, tmp1, tmp2;
6493
6494         nla_for_each_nested(attr1, freqs, tmp1)
6495                 if (nla_len(attr1) != sizeof(u32))
6496                         return 0;
6497
6498         nla_for_each_nested(attr1, freqs, tmp1) {
6499                 n_channels++;
6500                 /*
6501                  * Some hardware has a limited channel list for
6502                  * scanning, and it is pretty much nonsensical
6503                  * to scan for a channel twice, so disallow that
6504                  * and don't require drivers to check that the
6505                  * channel list they get isn't longer than what
6506                  * they can scan, as long as they can scan all
6507                  * the channels they registered at once.
6508                  */
6509                 nla_for_each_nested(attr2, freqs, tmp2)
6510                         if (attr1 != attr2 &&
6511                             nla_get_u32(attr1) == nla_get_u32(attr2))
6512                                 return 0;
6513         }
6514
6515         return n_channels;
6516 }
6517
6518 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6519 {
6520         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6521 }
6522
6523 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6524                             struct cfg80211_bss_selection *bss_select)
6525 {
6526         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6527         struct nlattr *nest;
6528         int err;
6529         bool found = false;
6530         int i;
6531
6532         /* only process one nested attribute */
6533         nest = nla_data(nla);
6534         if (!nla_ok(nest, nla_len(nest)))
6535                 return -EINVAL;
6536
6537         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6538                                nl80211_bss_select_policy, NULL);
6539         if (err)
6540                 return err;
6541
6542         /* only one attribute may be given */
6543         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6544                 if (attr[i]) {
6545                         if (found)
6546                                 return -EINVAL;
6547                         found = true;
6548                 }
6549         }
6550
6551         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6552
6553         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6554                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6555
6556         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6557                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6558                 bss_select->param.band_pref =
6559                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6560                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6561                         return -EINVAL;
6562         }
6563
6564         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6565                 struct nl80211_bss_select_rssi_adjust *adj_param;
6566
6567                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6568                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6569                 bss_select->param.adjust.band = adj_param->band;
6570                 bss_select->param.adjust.delta = adj_param->delta;
6571                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6572                         return -EINVAL;
6573         }
6574
6575         /* user-space did not provide behaviour attribute */
6576         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6577                 return -EINVAL;
6578
6579         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6580                 return -EINVAL;
6581
6582         return 0;
6583 }
6584
6585 static int nl80211_parse_random_mac(struct nlattr **attrs,
6586                                     u8 *mac_addr, u8 *mac_addr_mask)
6587 {
6588         int i;
6589
6590         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6591                 eth_zero_addr(mac_addr);
6592                 eth_zero_addr(mac_addr_mask);
6593                 mac_addr[0] = 0x2;
6594                 mac_addr_mask[0] = 0x3;
6595
6596                 return 0;
6597         }
6598
6599         /* need both or none */
6600         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6601                 return -EINVAL;
6602
6603         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6604         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6605
6606         /* don't allow or configure an mcast address */
6607         if (!is_multicast_ether_addr(mac_addr_mask) ||
6608             is_multicast_ether_addr(mac_addr))
6609                 return -EINVAL;
6610
6611         /*
6612          * allow users to pass a MAC address that has bits set outside
6613          * of the mask, but don't bother drivers with having to deal
6614          * with such bits
6615          */
6616         for (i = 0; i < ETH_ALEN; i++)
6617                 mac_addr[i] &= mac_addr_mask[i];
6618
6619         return 0;
6620 }
6621
6622 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6623 {
6624         ASSERT_WDEV_LOCK(wdev);
6625
6626         if (!cfg80211_beaconing_iface_active(wdev))
6627                 return true;
6628
6629         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6630                 return true;
6631
6632         return regulatory_pre_cac_allowed(wdev->wiphy);
6633 }
6634
6635 static int
6636 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6637                          void *request, struct nlattr **attrs,
6638                          bool is_sched_scan)
6639 {
6640         u8 *mac_addr, *mac_addr_mask;
6641         u32 *flags;
6642         enum nl80211_feature_flags randomness_flag;
6643
6644         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6645                 return 0;
6646
6647         if (is_sched_scan) {
6648                 struct cfg80211_sched_scan_request *req = request;
6649
6650                 randomness_flag = wdev ?
6651                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6652                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6653                 flags = &req->flags;
6654                 mac_addr = req->mac_addr;
6655                 mac_addr_mask = req->mac_addr_mask;
6656         } else {
6657                 struct cfg80211_scan_request *req = request;
6658
6659                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6660                 flags = &req->flags;
6661                 mac_addr = req->mac_addr;
6662                 mac_addr_mask = req->mac_addr_mask;
6663         }
6664
6665         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6666
6667         if ((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6668             !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN))
6669                 return -EOPNOTSUPP;
6670
6671         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6672                 int err;
6673
6674                 if (!(wiphy->features & randomness_flag) ||
6675                     (wdev && wdev->current_bss))
6676                         return -EOPNOTSUPP;
6677
6678                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6679                 if (err)
6680                         return err;
6681         }
6682
6683         if ((*flags & NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME) &&
6684             !wiphy_ext_feature_isset(wiphy,
6685                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME))
6686                 return -EOPNOTSUPP;
6687
6688         if ((*flags & NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP) &&
6689            !wiphy_ext_feature_isset(wiphy,
6690                                     NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP))
6691                 return -EOPNOTSUPP;
6692
6693         if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) &&
6694             !wiphy_ext_feature_isset(wiphy,
6695                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION))
6696                 return -EOPNOTSUPP;
6697
6698         if ((*flags & NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE) &&
6699             !wiphy_ext_feature_isset(wiphy,
6700                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE))
6701                 return -EOPNOTSUPP;
6702
6703         return 0;
6704 }
6705
6706 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6707 {
6708         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6709         struct wireless_dev *wdev = info->user_ptr[1];
6710         struct cfg80211_scan_request *request;
6711         struct nlattr *attr;
6712         struct wiphy *wiphy;
6713         int err, tmp, n_ssids = 0, n_channels, i;
6714         size_t ie_len;
6715
6716         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
6717                 return -EINVAL;
6718
6719         wiphy = &rdev->wiphy;
6720
6721         if (wdev->iftype == NL80211_IFTYPE_NAN)
6722                 return -EOPNOTSUPP;
6723
6724         if (!rdev->ops->scan)
6725                 return -EOPNOTSUPP;
6726
6727         if (rdev->scan_req || rdev->scan_msg) {
6728                 err = -EBUSY;
6729                 goto unlock;
6730         }
6731
6732         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6733                 n_channels = validate_scan_freqs(
6734                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
6735                 if (!n_channels) {
6736                         err = -EINVAL;
6737                         goto unlock;
6738                 }
6739         } else {
6740                 n_channels = ieee80211_get_num_supported_channels(wiphy);
6741         }
6742
6743         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
6744                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
6745                         n_ssids++;
6746
6747         if (n_ssids > wiphy->max_scan_ssids) {
6748                 err = -EINVAL;
6749                 goto unlock;
6750         }
6751
6752         if (info->attrs[NL80211_ATTR_IE])
6753                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6754         else
6755                 ie_len = 0;
6756
6757         if (ie_len > wiphy->max_scan_ie_len) {
6758                 err = -EINVAL;
6759                 goto unlock;
6760         }
6761
6762         request = kzalloc(sizeof(*request)
6763                         + sizeof(*request->ssids) * n_ssids
6764                         + sizeof(*request->channels) * n_channels
6765                         + ie_len, GFP_KERNEL);
6766         if (!request) {
6767                 err = -ENOMEM;
6768                 goto unlock;
6769         }
6770
6771         if (n_ssids)
6772                 request->ssids = (void *)&request->channels[n_channels];
6773         request->n_ssids = n_ssids;
6774         if (ie_len) {
6775                 if (n_ssids)
6776                         request->ie = (void *)(request->ssids + n_ssids);
6777                 else
6778                         request->ie = (void *)(request->channels + n_channels);
6779         }
6780
6781         i = 0;
6782         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
6783                 /* user specified, bail out if channel not found */
6784                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
6785                         struct ieee80211_channel *chan;
6786
6787                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
6788
6789                         if (!chan) {
6790                                 err = -EINVAL;
6791                                 goto out_free;
6792                         }
6793
6794                         /* ignore disabled channels */
6795                         if (chan->flags & IEEE80211_CHAN_DISABLED)
6796                                 continue;
6797
6798                         request->channels[i] = chan;
6799                         i++;
6800                 }
6801         } else {
6802                 enum nl80211_band band;
6803
6804                 /* all channels */
6805                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
6806                         int j;
6807
6808                         if (!wiphy->bands[band])
6809                                 continue;
6810                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
6811                                 struct ieee80211_channel *chan;
6812
6813                                 chan = &wiphy->bands[band]->channels[j];
6814
6815                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
6816                                         continue;
6817
6818                                 request->channels[i] = chan;
6819                                 i++;
6820                         }
6821                 }
6822         }
6823
6824         if (!i) {
6825                 err = -EINVAL;
6826                 goto out_free;
6827         }
6828
6829         request->n_channels = i;
6830
6831         wdev_lock(wdev);
6832         if (!cfg80211_off_channel_oper_allowed(wdev)) {
6833                 struct ieee80211_channel *chan;
6834
6835                 if (request->n_channels != 1) {
6836                         wdev_unlock(wdev);
6837                         err = -EBUSY;
6838                         goto out_free;
6839                 }
6840
6841                 chan = request->channels[0];
6842                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
6843                         wdev_unlock(wdev);
6844                         err = -EBUSY;
6845                         goto out_free;
6846                 }
6847         }
6848         wdev_unlock(wdev);
6849
6850         i = 0;
6851         if (n_ssids) {
6852                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
6853                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
6854                                 err = -EINVAL;
6855                                 goto out_free;
6856                         }
6857                         request->ssids[i].ssid_len = nla_len(attr);
6858                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
6859                         i++;
6860                 }
6861         }
6862
6863         if (info->attrs[NL80211_ATTR_IE]) {
6864                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
6865                 memcpy((void *)request->ie,
6866                        nla_data(info->attrs[NL80211_ATTR_IE]),
6867                        request->ie_len);
6868         }
6869
6870         for (i = 0; i < NUM_NL80211_BANDS; i++)
6871                 if (wiphy->bands[i])
6872                         request->rates[i] =
6873                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
6874
6875         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
6876                 nla_for_each_nested(attr,
6877                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
6878                                     tmp) {
6879                         enum nl80211_band band = nla_type(attr);
6880
6881                         if (band < 0 || band >= NUM_NL80211_BANDS) {
6882                                 err = -EINVAL;
6883                                 goto out_free;
6884                         }
6885
6886                         if (!wiphy->bands[band])
6887                                 continue;
6888
6889                         err = ieee80211_get_ratemask(wiphy->bands[band],
6890                                                      nla_data(attr),
6891                                                      nla_len(attr),
6892                                                      &request->rates[band]);
6893                         if (err)
6894                                 goto out_free;
6895                 }
6896         }
6897
6898         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
6899                 if (!wiphy_ext_feature_isset(wiphy,
6900                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
6901                         err = -EOPNOTSUPP;
6902                         goto out_free;
6903                 }
6904
6905                 request->duration =
6906                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
6907                 request->duration_mandatory =
6908                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
6909         }
6910
6911         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
6912                                        false);
6913         if (err)
6914                 goto out_free;
6915
6916         request->no_cck =
6917                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
6918
6919         /* Initial implementation used NL80211_ATTR_MAC to set the specific
6920          * BSSID to scan for. This was problematic because that same attribute
6921          * was already used for another purpose (local random MAC address). The
6922          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
6923          * compatibility with older userspace components, also use the
6924          * NL80211_ATTR_MAC value here if it can be determined to be used for
6925          * the specific BSSID use case instead of the random MAC address
6926          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
6927          */
6928         if (info->attrs[NL80211_ATTR_BSSID])
6929                 memcpy(request->bssid,
6930                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
6931         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
6932                  info->attrs[NL80211_ATTR_MAC])
6933                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
6934                        ETH_ALEN);
6935         else
6936                 eth_broadcast_addr(request->bssid);
6937
6938         request->wdev = wdev;
6939         request->wiphy = &rdev->wiphy;
6940         request->scan_start = jiffies;
6941
6942         rdev->scan_req = request;
6943         err = rdev_scan(rdev, request);
6944
6945         if (!err) {
6946                 nl80211_send_scan_start(rdev, wdev);
6947                 if (wdev->netdev)
6948                         dev_hold(wdev->netdev);
6949         } else {
6950  out_free:
6951                 rdev->scan_req = NULL;
6952                 kfree(request);
6953         }
6954
6955  unlock:
6956         return err;
6957 }
6958
6959 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
6960 {
6961         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6962         struct wireless_dev *wdev = info->user_ptr[1];
6963
6964         if (!rdev->ops->abort_scan)
6965                 return -EOPNOTSUPP;
6966
6967         if (rdev->scan_msg)
6968                 return 0;
6969
6970         if (!rdev->scan_req)
6971                 return -ENOENT;
6972
6973         rdev_abort_scan(rdev, wdev);
6974         return 0;
6975 }
6976
6977 static int
6978 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
6979                                struct cfg80211_sched_scan_request *request,
6980                                struct nlattr **attrs)
6981 {
6982         int tmp, err, i = 0;
6983         struct nlattr *attr;
6984
6985         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
6986                 u32 interval;
6987
6988                 /*
6989                  * If scan plans are not specified,
6990                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
6991                  * case one scan plan will be set with the specified scan
6992                  * interval and infinite number of iterations.
6993                  */
6994                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
6995                 if (!interval)
6996                         return -EINVAL;
6997
6998                 request->scan_plans[0].interval =
6999                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7000                 if (!request->scan_plans[0].interval)
7001                         return -EINVAL;
7002
7003                 if (request->scan_plans[0].interval >
7004                     wiphy->max_sched_scan_plan_interval)
7005                         request->scan_plans[0].interval =
7006                                 wiphy->max_sched_scan_plan_interval;
7007
7008                 return 0;
7009         }
7010
7011         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7012                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7013
7014                 if (WARN_ON(i >= n_plans))
7015                         return -EINVAL;
7016
7017                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7018                                        attr, nl80211_plan_policy, NULL);
7019                 if (err)
7020                         return err;
7021
7022                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7023                         return -EINVAL;
7024
7025                 request->scan_plans[i].interval =
7026                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7027                 if (!request->scan_plans[i].interval ||
7028                     request->scan_plans[i].interval >
7029                     wiphy->max_sched_scan_plan_interval)
7030                         return -EINVAL;
7031
7032                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7033                         request->scan_plans[i].iterations =
7034                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7035                         if (!request->scan_plans[i].iterations ||
7036                             (request->scan_plans[i].iterations >
7037                              wiphy->max_sched_scan_plan_iterations))
7038                                 return -EINVAL;
7039                 } else if (i < n_plans - 1) {
7040                         /*
7041                          * All scan plans but the last one must specify
7042                          * a finite number of iterations
7043                          */
7044                         return -EINVAL;
7045                 }
7046
7047                 i++;
7048         }
7049
7050         /*
7051          * The last scan plan must not specify the number of
7052          * iterations, it is supposed to run infinitely
7053          */
7054         if (request->scan_plans[n_plans - 1].iterations)
7055                 return  -EINVAL;
7056
7057         return 0;
7058 }
7059
7060 static struct cfg80211_sched_scan_request *
7061 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7062                          struct nlattr **attrs, int max_match_sets)
7063 {
7064         struct cfg80211_sched_scan_request *request;
7065         struct nlattr *attr;
7066         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7067         enum nl80211_band band;
7068         size_t ie_len;
7069         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7070         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7071
7072         if (!is_valid_ie_attr(attrs[NL80211_ATTR_IE]))
7073                 return ERR_PTR(-EINVAL);
7074
7075         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7076                 n_channels = validate_scan_freqs(
7077                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7078                 if (!n_channels)
7079                         return ERR_PTR(-EINVAL);
7080         } else {
7081                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7082         }
7083
7084         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7085                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7086                                     tmp)
7087                         n_ssids++;
7088
7089         if (n_ssids > wiphy->max_sched_scan_ssids)
7090                 return ERR_PTR(-EINVAL);
7091
7092         /*
7093          * First, count the number of 'real' matchsets. Due to an issue with
7094          * the old implementation, matchsets containing only the RSSI attribute
7095          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7096          * RSSI for all matchsets, rather than their own matchset for reporting
7097          * all APs with a strong RSSI. This is needed to be compatible with
7098          * older userspace that treated a matchset with only the RSSI as the
7099          * global RSSI for all other matchsets - if there are other matchsets.
7100          */
7101         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7102                 nla_for_each_nested(attr,
7103                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7104                                     tmp) {
7105                         struct nlattr *rssi;
7106
7107                         err = nla_parse_nested(tb,
7108                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7109                                                attr, nl80211_match_policy,
7110                                                NULL);
7111                         if (err)
7112                                 return ERR_PTR(err);
7113
7114                         /* SSID and BSSID are mutually exclusive */
7115                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7116                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7117                                 return ERR_PTR(-EINVAL);
7118
7119                         /* add other standalone attributes here */
7120                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7121                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7122                                 n_match_sets++;
7123                                 continue;
7124                         }
7125                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7126                         if (rssi)
7127                                 default_match_rssi = nla_get_s32(rssi);
7128                 }
7129         }
7130
7131         /* However, if there's no other matchset, add the RSSI one */
7132         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7133                 n_match_sets = 1;
7134
7135         if (n_match_sets > max_match_sets)
7136                 return ERR_PTR(-EINVAL);
7137
7138         if (attrs[NL80211_ATTR_IE])
7139                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7140         else
7141                 ie_len = 0;
7142
7143         if (ie_len > wiphy->max_sched_scan_ie_len)
7144                 return ERR_PTR(-EINVAL);
7145
7146         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7147                 /*
7148                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7149                  * each scan plan already specifies its own interval
7150                  */
7151                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7152                         return ERR_PTR(-EINVAL);
7153
7154                 nla_for_each_nested(attr,
7155                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7156                         n_plans++;
7157         } else {
7158                 /*
7159                  * The scan interval attribute is kept for backward
7160                  * compatibility. If no scan plans are specified and sched scan
7161                  * interval is specified, one scan plan will be set with this
7162                  * scan interval and infinite number of iterations.
7163                  */
7164                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7165                         return ERR_PTR(-EINVAL);
7166
7167                 n_plans = 1;
7168         }
7169
7170         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7171                 return ERR_PTR(-EINVAL);
7172
7173         if (!wiphy_ext_feature_isset(
7174                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7175             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7176              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7177                 return ERR_PTR(-EINVAL);
7178
7179         request = kzalloc(sizeof(*request)
7180                         + sizeof(*request->ssids) * n_ssids
7181                         + sizeof(*request->match_sets) * n_match_sets
7182                         + sizeof(*request->scan_plans) * n_plans
7183                         + sizeof(*request->channels) * n_channels
7184                         + ie_len, GFP_KERNEL);
7185         if (!request)
7186                 return ERR_PTR(-ENOMEM);
7187
7188         if (n_ssids)
7189                 request->ssids = (void *)&request->channels[n_channels];
7190         request->n_ssids = n_ssids;
7191         if (ie_len) {
7192                 if (n_ssids)
7193                         request->ie = (void *)(request->ssids + n_ssids);
7194                 else
7195                         request->ie = (void *)(request->channels + n_channels);
7196         }
7197
7198         if (n_match_sets) {
7199                 if (request->ie)
7200                         request->match_sets = (void *)(request->ie + ie_len);
7201                 else if (n_ssids)
7202                         request->match_sets =
7203                                 (void *)(request->ssids + n_ssids);
7204                 else
7205                         request->match_sets =
7206                                 (void *)(request->channels + n_channels);
7207         }
7208         request->n_match_sets = n_match_sets;
7209
7210         if (n_match_sets)
7211                 request->scan_plans = (void *)(request->match_sets +
7212                                                n_match_sets);
7213         else if (request->ie)
7214                 request->scan_plans = (void *)(request->ie + ie_len);
7215         else if (n_ssids)
7216                 request->scan_plans = (void *)(request->ssids + n_ssids);
7217         else
7218                 request->scan_plans = (void *)(request->channels + n_channels);
7219
7220         request->n_scan_plans = n_plans;
7221
7222         i = 0;
7223         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7224                 /* user specified, bail out if channel not found */
7225                 nla_for_each_nested(attr,
7226                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7227                                     tmp) {
7228                         struct ieee80211_channel *chan;
7229
7230                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7231
7232                         if (!chan) {
7233                                 err = -EINVAL;
7234                                 goto out_free;
7235                         }
7236
7237                         /* ignore disabled channels */
7238                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7239                                 continue;
7240
7241                         request->channels[i] = chan;
7242                         i++;
7243                 }
7244         } else {
7245                 /* all channels */
7246                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7247                         int j;
7248
7249                         if (!wiphy->bands[band])
7250                                 continue;
7251                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7252                                 struct ieee80211_channel *chan;
7253
7254                                 chan = &wiphy->bands[band]->channels[j];
7255
7256                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7257                                         continue;
7258
7259                                 request->channels[i] = chan;
7260                                 i++;
7261                         }
7262                 }
7263         }
7264
7265         if (!i) {
7266                 err = -EINVAL;
7267                 goto out_free;
7268         }
7269
7270         request->n_channels = i;
7271
7272         i = 0;
7273         if (n_ssids) {
7274                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7275                                     tmp) {
7276                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7277                                 err = -EINVAL;
7278                                 goto out_free;
7279                         }
7280                         request->ssids[i].ssid_len = nla_len(attr);
7281                         memcpy(request->ssids[i].ssid, nla_data(attr),
7282                                nla_len(attr));
7283                         i++;
7284                 }
7285         }
7286
7287         i = 0;
7288         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7289                 nla_for_each_nested(attr,
7290                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7291                                     tmp) {
7292                         struct nlattr *ssid, *bssid, *rssi;
7293
7294                         err = nla_parse_nested(tb,
7295                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7296                                                attr, nl80211_match_policy,
7297                                                NULL);
7298                         if (err)
7299                                 goto out_free;
7300                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7301                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7302                         if (ssid || bssid) {
7303                                 if (WARN_ON(i >= n_match_sets)) {
7304                                         /* this indicates a programming error,
7305                                          * the loop above should have verified
7306                                          * things properly
7307                                          */
7308                                         err = -EINVAL;
7309                                         goto out_free;
7310                                 }
7311
7312                                 if (ssid) {
7313                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7314                                                 err = -EINVAL;
7315                                                 goto out_free;
7316                                         }
7317                                         memcpy(request->match_sets[i].ssid.ssid,
7318                                                nla_data(ssid), nla_len(ssid));
7319                                         request->match_sets[i].ssid.ssid_len =
7320                                                 nla_len(ssid);
7321                                 }
7322                                 if (bssid) {
7323                                         if (nla_len(bssid) != ETH_ALEN) {
7324                                                 err = -EINVAL;
7325                                                 goto out_free;
7326                                         }
7327                                         memcpy(request->match_sets[i].bssid,
7328                                                nla_data(bssid), ETH_ALEN);
7329                                 }
7330
7331                                 /* special attribute - old implementation w/a */
7332                                 request->match_sets[i].rssi_thold =
7333                                         default_match_rssi;
7334                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7335                                 if (rssi)
7336                                         request->match_sets[i].rssi_thold =
7337                                                 nla_get_s32(rssi);
7338                         }
7339                         i++;
7340                 }
7341
7342                 /* there was no other matchset, so the RSSI one is alone */
7343                 if (i == 0 && n_match_sets)
7344                         request->match_sets[0].rssi_thold = default_match_rssi;
7345
7346                 request->min_rssi_thold = INT_MAX;
7347                 for (i = 0; i < n_match_sets; i++)
7348                         request->min_rssi_thold =
7349                                 min(request->match_sets[i].rssi_thold,
7350                                     request->min_rssi_thold);
7351         } else {
7352                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7353         }
7354
7355         if (ie_len) {
7356                 request->ie_len = ie_len;
7357                 memcpy((void *)request->ie,
7358                        nla_data(attrs[NL80211_ATTR_IE]),
7359                        request->ie_len);
7360         }
7361
7362         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7363         if (err)
7364                 goto out_free;
7365
7366         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7367                 request->delay =
7368                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7369
7370         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7371                 request->relative_rssi = nla_get_s8(
7372                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7373                 request->relative_rssi_set = true;
7374         }
7375
7376         if (request->relative_rssi_set &&
7377             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7378                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7379
7380                 rssi_adjust = nla_data(
7381                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7382                 request->rssi_adjust.band = rssi_adjust->band;
7383                 request->rssi_adjust.delta = rssi_adjust->delta;
7384                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7385                         err = -EINVAL;
7386                         goto out_free;
7387                 }
7388         }
7389
7390         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7391         if (err)
7392                 goto out_free;
7393
7394         request->scan_start = jiffies;
7395
7396         return request;
7397
7398 out_free:
7399         kfree(request);
7400         return ERR_PTR(err);
7401 }
7402
7403 static int nl80211_start_sched_scan(struct sk_buff *skb,
7404                                     struct genl_info *info)
7405 {
7406         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7407         struct net_device *dev = info->user_ptr[1];
7408         struct wireless_dev *wdev = dev->ieee80211_ptr;
7409         struct cfg80211_sched_scan_request *sched_scan_req;
7410         bool want_multi;
7411         int err;
7412
7413         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7414                 return -EOPNOTSUPP;
7415
7416         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7417         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7418         if (err)
7419                 return err;
7420
7421         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7422                                                   info->attrs,
7423                                                   rdev->wiphy.max_match_sets);
7424
7425         err = PTR_ERR_OR_ZERO(sched_scan_req);
7426         if (err)
7427                 goto out_err;
7428
7429         /* leave request id zero for legacy request
7430          * or if driver does not support multi-scheduled scan
7431          */
7432         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7433                 while (!sched_scan_req->reqid)
7434                         sched_scan_req->reqid = rdev->wiphy.cookie_counter++;
7435         }
7436
7437         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7438         if (err)
7439                 goto out_free;
7440
7441         sched_scan_req->dev = dev;
7442         sched_scan_req->wiphy = &rdev->wiphy;
7443
7444         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7445                 sched_scan_req->owner_nlportid = info->snd_portid;
7446
7447         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7448
7449         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7450         return 0;
7451
7452 out_free:
7453         kfree(sched_scan_req);
7454 out_err:
7455         return err;
7456 }
7457
7458 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7459                                    struct genl_info *info)
7460 {
7461         struct cfg80211_sched_scan_request *req;
7462         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7463         u64 cookie;
7464
7465         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7466                 return -EOPNOTSUPP;
7467
7468         if (info->attrs[NL80211_ATTR_COOKIE]) {
7469                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7470                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7471         }
7472
7473         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7474                                      struct cfg80211_sched_scan_request,
7475                                      list);
7476         if (!req || req->reqid ||
7477             (req->owner_nlportid &&
7478              req->owner_nlportid != info->snd_portid))
7479                 return -ENOENT;
7480
7481         return cfg80211_stop_sched_scan_req(rdev, req, false);
7482 }
7483
7484 static int nl80211_start_radar_detection(struct sk_buff *skb,
7485                                          struct genl_info *info)
7486 {
7487         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7488         struct net_device *dev = info->user_ptr[1];
7489         struct wireless_dev *wdev = dev->ieee80211_ptr;
7490         struct cfg80211_chan_def chandef;
7491         enum nl80211_dfs_regions dfs_region;
7492         unsigned int cac_time_ms;
7493         int err;
7494
7495         dfs_region = reg_get_dfs_region(wdev->wiphy);
7496         if (dfs_region == NL80211_DFS_UNSET)
7497                 return -EINVAL;
7498
7499         err = nl80211_parse_chandef(rdev, info, &chandef);
7500         if (err)
7501                 return err;
7502
7503         if (netif_carrier_ok(dev))
7504                 return -EBUSY;
7505
7506         if (wdev->cac_started)
7507                 return -EBUSY;
7508
7509         err = cfg80211_chandef_dfs_required(wdev->wiphy, &chandef,
7510                                             wdev->iftype);
7511         if (err < 0)
7512                 return err;
7513
7514         if (err == 0)
7515                 return -EINVAL;
7516
7517         if (!cfg80211_chandef_dfs_usable(wdev->wiphy, &chandef))
7518                 return -EINVAL;
7519
7520         if (!rdev->ops->start_radar_detection)
7521                 return -EOPNOTSUPP;
7522
7523         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7524         if (WARN_ON(!cac_time_ms))
7525                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7526
7527         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7528         if (!err) {
7529                 wdev->chandef = chandef;
7530                 wdev->cac_started = true;
7531                 wdev->cac_start_time = jiffies;
7532                 wdev->cac_time_ms = cac_time_ms;
7533         }
7534         return err;
7535 }
7536
7537 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7538 {
7539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7540         struct net_device *dev = info->user_ptr[1];
7541         struct wireless_dev *wdev = dev->ieee80211_ptr;
7542         struct cfg80211_csa_settings params;
7543         /* csa_attrs is defined static to avoid waste of stack size - this
7544          * function is called under RTNL lock, so this should not be a problem.
7545          */
7546         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7547         int err;
7548         bool need_new_beacon = false;
7549         bool need_handle_dfs_flag = true;
7550         int len, i;
7551         u32 cs_count;
7552
7553         if (!rdev->ops->channel_switch ||
7554             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7555                 return -EOPNOTSUPP;
7556
7557         switch (dev->ieee80211_ptr->iftype) {
7558         case NL80211_IFTYPE_AP:
7559         case NL80211_IFTYPE_P2P_GO:
7560                 need_new_beacon = true;
7561                 /* For all modes except AP the handle_dfs flag needs to be
7562                  * supplied to tell the kernel that userspace will handle radar
7563                  * events when they happen. Otherwise a switch to a channel
7564                  * requiring DFS will be rejected.
7565                  */
7566                 need_handle_dfs_flag = false;
7567
7568                 /* useless if AP is not running */
7569                 if (!wdev->beacon_interval)
7570                         return -ENOTCONN;
7571                 break;
7572         case NL80211_IFTYPE_ADHOC:
7573                 if (!wdev->ssid_len)
7574                         return -ENOTCONN;
7575                 break;
7576         case NL80211_IFTYPE_MESH_POINT:
7577                 if (!wdev->mesh_id_len)
7578                         return -ENOTCONN;
7579                 break;
7580         default:
7581                 return -EOPNOTSUPP;
7582         }
7583
7584         memset(&params, 0, sizeof(params));
7585
7586         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7587             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7588                 return -EINVAL;
7589
7590         /* only important for AP, IBSS and mesh create IEs internally */
7591         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7592                 return -EINVAL;
7593
7594         /* Even though the attribute is u32, the specification says
7595          * u8, so let's make sure we don't overflow.
7596          */
7597         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7598         if (cs_count > 255)
7599                 return -EINVAL;
7600
7601         params.count = cs_count;
7602
7603         if (!need_new_beacon)
7604                 goto skip_beacons;
7605
7606         err = nl80211_parse_beacon(info->attrs, &params.beacon_after);
7607         if (err)
7608                 return err;
7609
7610         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7611                                info->attrs[NL80211_ATTR_CSA_IES],
7612                                nl80211_policy, info->extack);
7613         if (err)
7614                 return err;
7615
7616         err = nl80211_parse_beacon(csa_attrs, &params.beacon_csa);
7617         if (err)
7618                 return err;
7619
7620         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7621                 return -EINVAL;
7622
7623         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7624         if (!len || (len % sizeof(u16)))
7625                 return -EINVAL;
7626
7627         params.n_counter_offsets_beacon = len / sizeof(u16);
7628         if (rdev->wiphy.max_num_csa_counters &&
7629             (params.n_counter_offsets_beacon >
7630              rdev->wiphy.max_num_csa_counters))
7631                 return -EINVAL;
7632
7633         params.counter_offsets_beacon =
7634                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7635
7636         /* sanity checks - counters should fit and be the same */
7637         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7638                 u16 offset = params.counter_offsets_beacon[i];
7639
7640                 if (offset >= params.beacon_csa.tail_len)
7641                         return -EINVAL;
7642
7643                 if (params.beacon_csa.tail[offset] != params.count)
7644                         return -EINVAL;
7645         }
7646
7647         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7648                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7649                 if (!len || (len % sizeof(u16)))
7650                         return -EINVAL;
7651
7652                 params.n_counter_offsets_presp = len / sizeof(u16);
7653                 if (rdev->wiphy.max_num_csa_counters &&
7654                     (params.n_counter_offsets_presp >
7655                      rdev->wiphy.max_num_csa_counters))
7656                         return -EINVAL;
7657
7658                 params.counter_offsets_presp =
7659                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7660
7661                 /* sanity checks - counters should fit and be the same */
7662                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7663                         u16 offset = params.counter_offsets_presp[i];
7664
7665                         if (offset >= params.beacon_csa.probe_resp_len)
7666                                 return -EINVAL;
7667
7668                         if (params.beacon_csa.probe_resp[offset] !=
7669                             params.count)
7670                                 return -EINVAL;
7671                 }
7672         }
7673
7674 skip_beacons:
7675         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7676         if (err)
7677                 return err;
7678
7679         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7680                                            wdev->iftype))
7681                 return -EINVAL;
7682
7683         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7684                                             &params.chandef,
7685                                             wdev->iftype);
7686         if (err < 0)
7687                 return err;
7688
7689         if (err > 0) {
7690                 params.radar_required = true;
7691                 if (need_handle_dfs_flag &&
7692                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7693                         return -EINVAL;
7694                 }
7695         }
7696
7697         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7698                 params.block_tx = true;
7699
7700         wdev_lock(wdev);
7701         err = rdev_channel_switch(rdev, dev, &params);
7702         wdev_unlock(wdev);
7703
7704         return err;
7705 }
7706
7707 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7708                             u32 seq, int flags,
7709                             struct cfg80211_registered_device *rdev,
7710                             struct wireless_dev *wdev,
7711                             struct cfg80211_internal_bss *intbss)
7712 {
7713         struct cfg80211_bss *res = &intbss->pub;
7714         const struct cfg80211_bss_ies *ies;
7715         void *hdr;
7716         struct nlattr *bss;
7717
7718         ASSERT_WDEV_LOCK(wdev);
7719
7720         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
7721                              NL80211_CMD_NEW_SCAN_RESULTS);
7722         if (!hdr)
7723                 return -1;
7724
7725         genl_dump_check_consistent(cb, hdr, &nl80211_fam);
7726
7727         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
7728                 goto nla_put_failure;
7729         if (wdev->netdev &&
7730             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
7731                 goto nla_put_failure;
7732         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
7733                               NL80211_ATTR_PAD))
7734                 goto nla_put_failure;
7735
7736         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
7737         if (!bss)
7738                 goto nla_put_failure;
7739         if ((!is_zero_ether_addr(res->bssid) &&
7740              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
7741                 goto nla_put_failure;
7742
7743         rcu_read_lock();
7744         /* indicate whether we have probe response data or not */
7745         if (rcu_access_pointer(res->proberesp_ies) &&
7746             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
7747                 goto fail_unlock_rcu;
7748
7749         /* this pointer prefers to be pointed to probe response data
7750          * but is always valid
7751          */
7752         ies = rcu_dereference(res->ies);
7753         if (ies) {
7754                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
7755                                       NL80211_BSS_PAD))
7756                         goto fail_unlock_rcu;
7757                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
7758                                         ies->len, ies->data))
7759                         goto fail_unlock_rcu;
7760         }
7761
7762         /* and this pointer is always (unless driver didn't know) beacon data */
7763         ies = rcu_dereference(res->beacon_ies);
7764         if (ies && ies->from_beacon) {
7765                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
7766                                       NL80211_BSS_PAD))
7767                         goto fail_unlock_rcu;
7768                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
7769                                         ies->len, ies->data))
7770                         goto fail_unlock_rcu;
7771         }
7772         rcu_read_unlock();
7773
7774         if (res->beacon_interval &&
7775             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
7776                 goto nla_put_failure;
7777         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
7778             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
7779             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
7780             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
7781                         jiffies_to_msecs(jiffies - intbss->ts)))
7782                 goto nla_put_failure;
7783
7784         if (intbss->parent_tsf &&
7785             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
7786                                intbss->parent_tsf, NL80211_BSS_PAD) ||
7787              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
7788                      intbss->parent_bssid)))
7789                 goto nla_put_failure;
7790
7791         if (intbss->ts_boottime &&
7792             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
7793                               intbss->ts_boottime, NL80211_BSS_PAD))
7794                 goto nla_put_failure;
7795
7796         switch (rdev->wiphy.signal_type) {
7797         case CFG80211_SIGNAL_TYPE_MBM:
7798                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
7799                         goto nla_put_failure;
7800                 break;
7801         case CFG80211_SIGNAL_TYPE_UNSPEC:
7802                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
7803                         goto nla_put_failure;
7804                 break;
7805         default:
7806                 break;
7807         }
7808
7809         switch (wdev->iftype) {
7810         case NL80211_IFTYPE_P2P_CLIENT:
7811         case NL80211_IFTYPE_STATION:
7812                 if (intbss == wdev->current_bss &&
7813                     nla_put_u32(msg, NL80211_BSS_STATUS,
7814                                 NL80211_BSS_STATUS_ASSOCIATED))
7815                         goto nla_put_failure;
7816                 break;
7817         case NL80211_IFTYPE_ADHOC:
7818                 if (intbss == wdev->current_bss &&
7819                     nla_put_u32(msg, NL80211_BSS_STATUS,
7820                                 NL80211_BSS_STATUS_IBSS_JOINED))
7821                         goto nla_put_failure;
7822                 break;
7823         default:
7824                 break;
7825         }
7826
7827         nla_nest_end(msg, bss);
7828
7829         genlmsg_end(msg, hdr);
7830         return 0;
7831
7832  fail_unlock_rcu:
7833         rcu_read_unlock();
7834  nla_put_failure:
7835         genlmsg_cancel(msg, hdr);
7836         return -EMSGSIZE;
7837 }
7838
7839 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
7840 {
7841         struct cfg80211_registered_device *rdev;
7842         struct cfg80211_internal_bss *scan;
7843         struct wireless_dev *wdev;
7844         int start = cb->args[2], idx = 0;
7845         int err;
7846
7847         rtnl_lock();
7848         err = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7849         if (err) {
7850                 rtnl_unlock();
7851                 return err;
7852         }
7853
7854         wdev_lock(wdev);
7855         spin_lock_bh(&rdev->bss_lock);
7856         cfg80211_bss_expire(rdev);
7857
7858         cb->seq = rdev->bss_generation;
7859
7860         list_for_each_entry(scan, &rdev->bss_list, list) {
7861                 if (++idx <= start)
7862                         continue;
7863                 if (nl80211_send_bss(skb, cb,
7864                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7865                                 rdev, wdev, scan) < 0) {
7866                         idx--;
7867                         break;
7868                 }
7869         }
7870
7871         spin_unlock_bh(&rdev->bss_lock);
7872         wdev_unlock(wdev);
7873
7874         cb->args[2] = idx;
7875         rtnl_unlock();
7876
7877         return skb->len;
7878 }
7879
7880 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
7881                                int flags, struct net_device *dev,
7882                                bool allow_radio_stats,
7883                                struct survey_info *survey)
7884 {
7885         void *hdr;
7886         struct nlattr *infoattr;
7887
7888         /* skip radio stats if userspace didn't request them */
7889         if (!survey->channel && !allow_radio_stats)
7890                 return 0;
7891
7892         hdr = nl80211hdr_put(msg, portid, seq, flags,
7893                              NL80211_CMD_NEW_SURVEY_RESULTS);
7894         if (!hdr)
7895                 return -ENOMEM;
7896
7897         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
7898                 goto nla_put_failure;
7899
7900         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
7901         if (!infoattr)
7902                 goto nla_put_failure;
7903
7904         if (survey->channel &&
7905             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
7906                         survey->channel->center_freq))
7907                 goto nla_put_failure;
7908
7909         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
7910             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
7911                 goto nla_put_failure;
7912         if ((survey->filled & SURVEY_INFO_IN_USE) &&
7913             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
7914                 goto nla_put_failure;
7915         if ((survey->filled & SURVEY_INFO_TIME) &&
7916             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
7917                         survey->time, NL80211_SURVEY_INFO_PAD))
7918                 goto nla_put_failure;
7919         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
7920             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
7921                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
7922                 goto nla_put_failure;
7923         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
7924             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
7925                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
7926                 goto nla_put_failure;
7927         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
7928             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
7929                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
7930                 goto nla_put_failure;
7931         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
7932             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
7933                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
7934                 goto nla_put_failure;
7935         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
7936             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
7937                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
7938                 goto nla_put_failure;
7939
7940         nla_nest_end(msg, infoattr);
7941
7942         genlmsg_end(msg, hdr);
7943         return 0;
7944
7945  nla_put_failure:
7946         genlmsg_cancel(msg, hdr);
7947         return -EMSGSIZE;
7948 }
7949
7950 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
7951 {
7952         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
7953         struct survey_info survey;
7954         struct cfg80211_registered_device *rdev;
7955         struct wireless_dev *wdev;
7956         int survey_idx = cb->args[2];
7957         int res;
7958         bool radio_stats;
7959
7960         rtnl_lock();
7961         res = nl80211_prepare_wdev_dump(skb, cb, &rdev, &wdev);
7962         if (res)
7963                 goto out_err;
7964
7965         /* prepare_wdev_dump parsed the attributes */
7966         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
7967
7968         if (!wdev->netdev) {
7969                 res = -EINVAL;
7970                 goto out_err;
7971         }
7972
7973         if (!rdev->ops->dump_survey) {
7974                 res = -EOPNOTSUPP;
7975                 goto out_err;
7976         }
7977
7978         while (1) {
7979                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
7980                 if (res == -ENOENT)
7981                         break;
7982                 if (res)
7983                         goto out_err;
7984
7985                 /* don't send disabled channels, but do send non-channel data */
7986                 if (survey.channel &&
7987                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
7988                         survey_idx++;
7989                         continue;
7990                 }
7991
7992                 if (nl80211_send_survey(skb,
7993                                 NETLINK_CB(cb->skb).portid,
7994                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
7995                                 wdev->netdev, radio_stats, &survey) < 0)
7996                         goto out;
7997                 survey_idx++;
7998         }
7999
8000  out:
8001         cb->args[2] = survey_idx;
8002         res = skb->len;
8003  out_err:
8004         rtnl_unlock();
8005         return res;
8006 }
8007
8008 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8009 {
8010         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8011                                   NL80211_WPA_VERSION_2));
8012 }
8013
8014 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8015 {
8016         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8017         struct net_device *dev = info->user_ptr[1];
8018         struct ieee80211_channel *chan;
8019         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8020         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8021         enum nl80211_auth_type auth_type;
8022         struct key_parse key;
8023         bool local_state_change;
8024
8025         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8026                 return -EINVAL;
8027
8028         if (!info->attrs[NL80211_ATTR_MAC])
8029                 return -EINVAL;
8030
8031         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8032                 return -EINVAL;
8033
8034         if (!info->attrs[NL80211_ATTR_SSID])
8035                 return -EINVAL;
8036
8037         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8038                 return -EINVAL;
8039
8040         err = nl80211_parse_key(info, &key);
8041         if (err)
8042                 return err;
8043
8044         if (key.idx >= 0) {
8045                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8046                         return -EINVAL;
8047                 if (!key.p.key || !key.p.key_len)
8048                         return -EINVAL;
8049                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8050                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8051                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8052                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8053                         return -EINVAL;
8054                 if (key.idx > 3)
8055                         return -EINVAL;
8056         } else {
8057                 key.p.key_len = 0;
8058                 key.p.key = NULL;
8059         }
8060
8061         if (key.idx >= 0) {
8062                 int i;
8063                 bool ok = false;
8064
8065                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8066                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8067                                 ok = true;
8068                                 break;
8069                         }
8070                 }
8071                 if (!ok)
8072                         return -EINVAL;
8073         }
8074
8075         if (!rdev->ops->auth)
8076                 return -EOPNOTSUPP;
8077
8078         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8079             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8080                 return -EOPNOTSUPP;
8081
8082         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8083         chan = nl80211_get_valid_chan(&rdev->wiphy,
8084                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8085         if (!chan)
8086                 return -EINVAL;
8087
8088         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8089         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8090
8091         if (info->attrs[NL80211_ATTR_IE]) {
8092                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8093                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8094         }
8095
8096         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8097         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8098                 return -EINVAL;
8099
8100         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8101              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8102              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8103              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8104             !info->attrs[NL80211_ATTR_AUTH_DATA])
8105                 return -EINVAL;
8106
8107         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8108                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8109                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8110                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8111                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8112                         return -EINVAL;
8113                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8114                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8115                 /* need to include at least Auth Transaction and Status Code */
8116                 if (auth_data_len < 4)
8117                         return -EINVAL;
8118         }
8119
8120         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8121
8122         /*
8123          * Since we no longer track auth state, ignore
8124          * requests to only change local state.
8125          */
8126         if (local_state_change)
8127                 return 0;
8128
8129         wdev_lock(dev->ieee80211_ptr);
8130         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8131                                  ssid, ssid_len, ie, ie_len,
8132                                  key.p.key, key.p.key_len, key.idx,
8133                                  auth_data, auth_data_len);
8134         wdev_unlock(dev->ieee80211_ptr);
8135         return err;
8136 }
8137
8138 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8139                                    struct genl_info *info,
8140                                    struct cfg80211_crypto_settings *settings,
8141                                    int cipher_limit)
8142 {
8143         memset(settings, 0, sizeof(*settings));
8144
8145         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8146
8147         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8148                 u16 proto;
8149
8150                 proto = nla_get_u16(
8151                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8152                 settings->control_port_ethertype = cpu_to_be16(proto);
8153                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8154                     proto != ETH_P_PAE)
8155                         return -EINVAL;
8156                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8157                         settings->control_port_no_encrypt = true;
8158         } else
8159                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8160
8161         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8162                 void *data;
8163                 int len, i;
8164
8165                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8166                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8167                 settings->n_ciphers_pairwise = len / sizeof(u32);
8168
8169                 if (len % sizeof(u32))
8170                         return -EINVAL;
8171
8172                 if (settings->n_ciphers_pairwise > cipher_limit)
8173                         return -EINVAL;
8174
8175                 memcpy(settings->ciphers_pairwise, data, len);
8176
8177                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8178                         if (!cfg80211_supported_cipher_suite(
8179                                         &rdev->wiphy,
8180                                         settings->ciphers_pairwise[i]))
8181                                 return -EINVAL;
8182         }
8183
8184         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8185                 settings->cipher_group =
8186                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8187                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8188                                                      settings->cipher_group))
8189                         return -EINVAL;
8190         }
8191
8192         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8193                 settings->wpa_versions =
8194                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8195                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8196                         return -EINVAL;
8197         }
8198
8199         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8200                 void *data;
8201                 int len;
8202
8203                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8204                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8205                 settings->n_akm_suites = len / sizeof(u32);
8206
8207                 if (len % sizeof(u32))
8208                         return -EINVAL;
8209
8210                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8211                         return -EINVAL;
8212
8213                 memcpy(settings->akm_suites, data, len);
8214         }
8215
8216         if (info->attrs[NL80211_ATTR_PMK]) {
8217                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8218                         return -EINVAL;
8219                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8220                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8221                         return -EINVAL;
8222                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8223         }
8224
8225         return 0;
8226 }
8227
8228 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8229 {
8230         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8231         struct net_device *dev = info->user_ptr[1];
8232         struct ieee80211_channel *chan;
8233         struct cfg80211_assoc_request req = {};
8234         const u8 *bssid, *ssid;
8235         int err, ssid_len = 0;
8236
8237         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8238                 return -EINVAL;
8239
8240         if (!info->attrs[NL80211_ATTR_MAC] ||
8241             !info->attrs[NL80211_ATTR_SSID] ||
8242             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8243                 return -EINVAL;
8244
8245         if (!rdev->ops->assoc)
8246                 return -EOPNOTSUPP;
8247
8248         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8249             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8250                 return -EOPNOTSUPP;
8251
8252         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8253
8254         chan = nl80211_get_valid_chan(&rdev->wiphy,
8255                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8256         if (!chan)
8257                 return -EINVAL;
8258
8259         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8260         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8261
8262         if (info->attrs[NL80211_ATTR_IE]) {
8263                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8264                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8265         }
8266
8267         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8268                 enum nl80211_mfp mfp =
8269                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8270                 if (mfp == NL80211_MFP_REQUIRED)
8271                         req.use_mfp = true;
8272                 else if (mfp != NL80211_MFP_NO)
8273                         return -EINVAL;
8274         }
8275
8276         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8277                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8278
8279         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8280                 req.flags |= ASSOC_REQ_DISABLE_HT;
8281
8282         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8283                 memcpy(&req.ht_capa_mask,
8284                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8285                        sizeof(req.ht_capa_mask));
8286
8287         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8288                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8289                         return -EINVAL;
8290                 memcpy(&req.ht_capa,
8291                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8292                        sizeof(req.ht_capa));
8293         }
8294
8295         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8296                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8297
8298         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8299                 memcpy(&req.vht_capa_mask,
8300                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8301                        sizeof(req.vht_capa_mask));
8302
8303         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8304                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8305                         return -EINVAL;
8306                 memcpy(&req.vht_capa,
8307                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8308                        sizeof(req.vht_capa));
8309         }
8310
8311         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8312                 if (!((rdev->wiphy.features &
8313                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8314                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8315                     !wiphy_ext_feature_isset(&rdev->wiphy,
8316                                              NL80211_EXT_FEATURE_RRM))
8317                         return -EINVAL;
8318                 req.flags |= ASSOC_REQ_USE_RRM;
8319         }
8320
8321         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8322                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8323                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8324                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8325                         return -EINVAL;
8326                 req.fils_nonces =
8327                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8328         }
8329
8330         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8331         if (!err) {
8332                 wdev_lock(dev->ieee80211_ptr);
8333
8334                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8335                                           ssid, ssid_len, &req);
8336
8337                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8338                         dev->ieee80211_ptr->conn_owner_nlportid =
8339                                 info->snd_portid;
8340                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8341                                bssid, ETH_ALEN);
8342                 }
8343
8344                 wdev_unlock(dev->ieee80211_ptr);
8345         }
8346
8347         return err;
8348 }
8349
8350 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8351 {
8352         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8353         struct net_device *dev = info->user_ptr[1];
8354         const u8 *ie = NULL, *bssid;
8355         int ie_len = 0, err;
8356         u16 reason_code;
8357         bool local_state_change;
8358
8359         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8360                 return -EINVAL;
8361
8362         if (!info->attrs[NL80211_ATTR_MAC])
8363                 return -EINVAL;
8364
8365         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8366                 return -EINVAL;
8367
8368         if (!rdev->ops->deauth)
8369                 return -EOPNOTSUPP;
8370
8371         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8372             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8373                 return -EOPNOTSUPP;
8374
8375         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8376
8377         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8378         if (reason_code == 0) {
8379                 /* Reason Code 0 is reserved */
8380                 return -EINVAL;
8381         }
8382
8383         if (info->attrs[NL80211_ATTR_IE]) {
8384                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8385                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8386         }
8387
8388         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8389
8390         wdev_lock(dev->ieee80211_ptr);
8391         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8392                                    local_state_change);
8393         wdev_unlock(dev->ieee80211_ptr);
8394         return err;
8395 }
8396
8397 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8398 {
8399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8400         struct net_device *dev = info->user_ptr[1];
8401         const u8 *ie = NULL, *bssid;
8402         int ie_len = 0, err;
8403         u16 reason_code;
8404         bool local_state_change;
8405
8406         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8407                 return -EINVAL;
8408
8409         if (!info->attrs[NL80211_ATTR_MAC])
8410                 return -EINVAL;
8411
8412         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8413                 return -EINVAL;
8414
8415         if (!rdev->ops->disassoc)
8416                 return -EOPNOTSUPP;
8417
8418         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8419             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8420                 return -EOPNOTSUPP;
8421
8422         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8423
8424         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8425         if (reason_code == 0) {
8426                 /* Reason Code 0 is reserved */
8427                 return -EINVAL;
8428         }
8429
8430         if (info->attrs[NL80211_ATTR_IE]) {
8431                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8432                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8433         }
8434
8435         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8436
8437         wdev_lock(dev->ieee80211_ptr);
8438         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8439                                      local_state_change);
8440         wdev_unlock(dev->ieee80211_ptr);
8441         return err;
8442 }
8443
8444 static bool
8445 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8446                          int mcast_rate[NUM_NL80211_BANDS],
8447                          int rateval)
8448 {
8449         struct wiphy *wiphy = &rdev->wiphy;
8450         bool found = false;
8451         int band, i;
8452
8453         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8454                 struct ieee80211_supported_band *sband;
8455
8456                 sband = wiphy->bands[band];
8457                 if (!sband)
8458                         continue;
8459
8460                 for (i = 0; i < sband->n_bitrates; i++) {
8461                         if (sband->bitrates[i].bitrate == rateval) {
8462                                 mcast_rate[band] = i + 1;
8463                                 found = true;
8464                                 break;
8465                         }
8466                 }
8467         }
8468
8469         return found;
8470 }
8471
8472 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8473 {
8474         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8475         struct net_device *dev = info->user_ptr[1];
8476         struct cfg80211_ibss_params ibss;
8477         struct wiphy *wiphy;
8478         struct cfg80211_cached_keys *connkeys = NULL;
8479         int err;
8480
8481         memset(&ibss, 0, sizeof(ibss));
8482
8483         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8484                 return -EINVAL;
8485
8486         if (!info->attrs[NL80211_ATTR_SSID] ||
8487             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8488                 return -EINVAL;
8489
8490         ibss.beacon_interval = 100;
8491
8492         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8493                 ibss.beacon_interval =
8494                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8495
8496         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8497                                            ibss.beacon_interval);
8498         if (err)
8499                 return err;
8500
8501         if (!rdev->ops->join_ibss)
8502                 return -EOPNOTSUPP;
8503
8504         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8505                 return -EOPNOTSUPP;
8506
8507         wiphy = &rdev->wiphy;
8508
8509         if (info->attrs[NL80211_ATTR_MAC]) {
8510                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8511
8512                 if (!is_valid_ether_addr(ibss.bssid))
8513                         return -EINVAL;
8514         }
8515         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8516         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8517
8518         if (info->attrs[NL80211_ATTR_IE]) {
8519                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8520                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8521         }
8522
8523         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8524         if (err)
8525                 return err;
8526
8527         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8528                                      NL80211_IFTYPE_ADHOC))
8529                 return -EINVAL;
8530
8531         switch (ibss.chandef.width) {
8532         case NL80211_CHAN_WIDTH_5:
8533         case NL80211_CHAN_WIDTH_10:
8534         case NL80211_CHAN_WIDTH_20_NOHT:
8535                 break;
8536         case NL80211_CHAN_WIDTH_20:
8537         case NL80211_CHAN_WIDTH_40:
8538                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8539                         return -EINVAL;
8540                 break;
8541         case NL80211_CHAN_WIDTH_80:
8542         case NL80211_CHAN_WIDTH_80P80:
8543         case NL80211_CHAN_WIDTH_160:
8544                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8545                         return -EINVAL;
8546                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8547                                              NL80211_EXT_FEATURE_VHT_IBSS))
8548                         return -EINVAL;
8549                 break;
8550         default:
8551                 return -EINVAL;
8552         }
8553
8554         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8555         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8556
8557         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8558                 u8 *rates =
8559                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8560                 int n_rates =
8561                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8562                 struct ieee80211_supported_band *sband =
8563                         wiphy->bands[ibss.chandef.chan->band];
8564
8565                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8566                                              &ibss.basic_rates);
8567                 if (err)
8568                         return err;
8569         }
8570
8571         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8572                 memcpy(&ibss.ht_capa_mask,
8573                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8574                        sizeof(ibss.ht_capa_mask));
8575
8576         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8577                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8578                         return -EINVAL;
8579                 memcpy(&ibss.ht_capa,
8580                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8581                        sizeof(ibss.ht_capa));
8582         }
8583
8584         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8585             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8586                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8587                 return -EINVAL;
8588
8589         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8590                 bool no_ht = false;
8591
8592                 connkeys = nl80211_parse_connkeys(rdev,
8593                                           info->attrs[NL80211_ATTR_KEYS],
8594                                           &no_ht);
8595                 if (IS_ERR(connkeys))
8596                         return PTR_ERR(connkeys);
8597
8598                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8599                     no_ht) {
8600                         kzfree(connkeys);
8601                         return -EINVAL;
8602                 }
8603         }
8604
8605         ibss.control_port =
8606                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8607
8608         ibss.userspace_handles_dfs =
8609                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8610
8611         err = cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8612         if (err)
8613                 kzfree(connkeys);
8614         return err;
8615 }
8616
8617 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8618 {
8619         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8620         struct net_device *dev = info->user_ptr[1];
8621
8622         if (!rdev->ops->leave_ibss)
8623                 return -EOPNOTSUPP;
8624
8625         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8626                 return -EOPNOTSUPP;
8627
8628         return cfg80211_leave_ibss(rdev, dev, false);
8629 }
8630
8631 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8632 {
8633         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8634         struct net_device *dev = info->user_ptr[1];
8635         int mcast_rate[NUM_NL80211_BANDS];
8636         u32 nla_rate;
8637         int err;
8638
8639         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8640             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8641             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8642                 return -EOPNOTSUPP;
8643
8644         if (!rdev->ops->set_mcast_rate)
8645                 return -EOPNOTSUPP;
8646
8647         memset(mcast_rate, 0, sizeof(mcast_rate));
8648
8649         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8650                 return -EINVAL;
8651
8652         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8653         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8654                 return -EINVAL;
8655
8656         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8657
8658         return err;
8659 }
8660
8661 static struct sk_buff *
8662 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
8663                             struct wireless_dev *wdev, int approxlen,
8664                             u32 portid, u32 seq, enum nl80211_commands cmd,
8665                             enum nl80211_attrs attr,
8666                             const struct nl80211_vendor_cmd_info *info,
8667                             gfp_t gfp)
8668 {
8669         struct sk_buff *skb;
8670         void *hdr;
8671         struct nlattr *data;
8672
8673         skb = nlmsg_new(approxlen + 100, gfp);
8674         if (!skb)
8675                 return NULL;
8676
8677         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
8678         if (!hdr) {
8679                 kfree_skb(skb);
8680                 return NULL;
8681         }
8682
8683         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
8684                 goto nla_put_failure;
8685
8686         if (info) {
8687                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
8688                                 info->vendor_id))
8689                         goto nla_put_failure;
8690                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
8691                                 info->subcmd))
8692                         goto nla_put_failure;
8693         }
8694
8695         if (wdev) {
8696                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
8697                                       wdev_id(wdev), NL80211_ATTR_PAD))
8698                         goto nla_put_failure;
8699                 if (wdev->netdev &&
8700                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
8701                                 wdev->netdev->ifindex))
8702                         goto nla_put_failure;
8703         }
8704
8705         data = nla_nest_start(skb, attr);
8706         if (!data)
8707                 goto nla_put_failure;
8708
8709         ((void **)skb->cb)[0] = rdev;
8710         ((void **)skb->cb)[1] = hdr;
8711         ((void **)skb->cb)[2] = data;
8712
8713         return skb;
8714
8715  nla_put_failure:
8716         kfree_skb(skb);
8717         return NULL;
8718 }
8719
8720 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
8721                                            struct wireless_dev *wdev,
8722                                            enum nl80211_commands cmd,
8723                                            enum nl80211_attrs attr,
8724                                            int vendor_event_idx,
8725                                            int approxlen, gfp_t gfp)
8726 {
8727         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
8728         const struct nl80211_vendor_cmd_info *info;
8729
8730         switch (cmd) {
8731         case NL80211_CMD_TESTMODE:
8732                 if (WARN_ON(vendor_event_idx != -1))
8733                         return NULL;
8734                 info = NULL;
8735                 break;
8736         case NL80211_CMD_VENDOR:
8737                 if (WARN_ON(vendor_event_idx < 0 ||
8738                             vendor_event_idx >= wiphy->n_vendor_events))
8739                         return NULL;
8740                 info = &wiphy->vendor_events[vendor_event_idx];
8741                 break;
8742         default:
8743                 WARN_ON(1);
8744                 return NULL;
8745         }
8746
8747         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
8748                                            cmd, attr, info, gfp);
8749 }
8750 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
8751
8752 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
8753 {
8754         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
8755         void *hdr = ((void **)skb->cb)[1];
8756         struct nlattr *data = ((void **)skb->cb)[2];
8757         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
8758
8759         /* clear CB data for netlink core to own from now on */
8760         memset(skb->cb, 0, sizeof(skb->cb));
8761
8762         nla_nest_end(skb, data);
8763         genlmsg_end(skb, hdr);
8764
8765         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
8766                 mcgrp = NL80211_MCGRP_VENDOR;
8767
8768         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
8769                                 mcgrp, gfp);
8770 }
8771 EXPORT_SYMBOL(__cfg80211_send_event_skb);
8772
8773 #ifdef CONFIG_NL80211_TESTMODE
8774 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
8775 {
8776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8777         struct wireless_dev *wdev =
8778                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
8779         int err;
8780
8781         if (!rdev->ops->testmode_cmd)
8782                 return -EOPNOTSUPP;
8783
8784         if (IS_ERR(wdev)) {
8785                 err = PTR_ERR(wdev);
8786                 if (err != -EINVAL)
8787                         return err;
8788                 wdev = NULL;
8789         } else if (wdev->wiphy != &rdev->wiphy) {
8790                 return -EINVAL;
8791         }
8792
8793         if (!info->attrs[NL80211_ATTR_TESTDATA])
8794                 return -EINVAL;
8795
8796         rdev->cur_cmd_info = info;
8797         err = rdev_testmode_cmd(rdev, wdev,
8798                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
8799                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
8800         rdev->cur_cmd_info = NULL;
8801
8802         return err;
8803 }
8804
8805 static int nl80211_testmode_dump(struct sk_buff *skb,
8806                                  struct netlink_callback *cb)
8807 {
8808         struct cfg80211_registered_device *rdev;
8809         int err;
8810         long phy_idx;
8811         void *data = NULL;
8812         int data_len = 0;
8813
8814         rtnl_lock();
8815
8816         if (cb->args[0]) {
8817                 /*
8818                  * 0 is a valid index, but not valid for args[0],
8819                  * so we need to offset by 1.
8820                  */
8821                 phy_idx = cb->args[0] - 1;
8822
8823                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
8824                 if (!rdev) {
8825                         err = -ENOENT;
8826                         goto out_err;
8827                 }
8828         } else {
8829                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8830
8831                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
8832                                   attrbuf, nl80211_fam.maxattr,
8833                                   nl80211_policy, NULL);
8834                 if (err)
8835                         goto out_err;
8836
8837                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
8838                 if (IS_ERR(rdev)) {
8839                         err = PTR_ERR(rdev);
8840                         goto out_err;
8841                 }
8842                 phy_idx = rdev->wiphy_idx;
8843
8844                 if (attrbuf[NL80211_ATTR_TESTDATA])
8845                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
8846         }
8847
8848         if (cb->args[1]) {
8849                 data = nla_data((void *)cb->args[1]);
8850                 data_len = nla_len((void *)cb->args[1]);
8851         }
8852
8853         if (!rdev->ops->testmode_dump) {
8854                 err = -EOPNOTSUPP;
8855                 goto out_err;
8856         }
8857
8858         while (1) {
8859                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
8860                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
8861                                            NL80211_CMD_TESTMODE);
8862                 struct nlattr *tmdata;
8863
8864                 if (!hdr)
8865                         break;
8866
8867                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
8868                         genlmsg_cancel(skb, hdr);
8869                         break;
8870                 }
8871
8872                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
8873                 if (!tmdata) {
8874                         genlmsg_cancel(skb, hdr);
8875                         break;
8876                 }
8877                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
8878                 nla_nest_end(skb, tmdata);
8879
8880                 if (err == -ENOBUFS || err == -ENOENT) {
8881                         genlmsg_cancel(skb, hdr);
8882                         break;
8883                 } else if (err) {
8884                         genlmsg_cancel(skb, hdr);
8885                         goto out_err;
8886                 }
8887
8888                 genlmsg_end(skb, hdr);
8889         }
8890
8891         err = skb->len;
8892         /* see above */
8893         cb->args[0] = phy_idx + 1;
8894  out_err:
8895         rtnl_unlock();
8896         return err;
8897 }
8898 #endif
8899
8900 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
8901 {
8902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8903         struct net_device *dev = info->user_ptr[1];
8904         struct cfg80211_connect_params connect;
8905         struct wiphy *wiphy;
8906         struct cfg80211_cached_keys *connkeys = NULL;
8907         int err;
8908
8909         memset(&connect, 0, sizeof(connect));
8910
8911         if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
8912                 return -EINVAL;
8913
8914         if (!info->attrs[NL80211_ATTR_SSID] ||
8915             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8916                 return -EINVAL;
8917
8918         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
8919                 connect.auth_type =
8920                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8921                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
8922                                              NL80211_CMD_CONNECT))
8923                         return -EINVAL;
8924         } else
8925                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
8926
8927         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
8928
8929         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
8930             !wiphy_ext_feature_isset(&rdev->wiphy,
8931                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
8932                 return -EINVAL;
8933         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
8934
8935         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
8936                                       NL80211_MAX_NR_CIPHER_SUITES);
8937         if (err)
8938                 return err;
8939
8940         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8941             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8942                 return -EOPNOTSUPP;
8943
8944         wiphy = &rdev->wiphy;
8945
8946         connect.bg_scan_period = -1;
8947         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
8948                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
8949                 connect.bg_scan_period =
8950                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
8951         }
8952
8953         if (info->attrs[NL80211_ATTR_MAC])
8954                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8955         else if (info->attrs[NL80211_ATTR_MAC_HINT])
8956                 connect.bssid_hint =
8957                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
8958         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8959         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8960
8961         if (info->attrs[NL80211_ATTR_IE]) {
8962                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8963                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8964         }
8965
8966         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8967                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8968                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
8969                     !wiphy_ext_feature_isset(&rdev->wiphy,
8970                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
8971                         return -EOPNOTSUPP;
8972
8973                 if (connect.mfp != NL80211_MFP_REQUIRED &&
8974                     connect.mfp != NL80211_MFP_NO &&
8975                     connect.mfp != NL80211_MFP_OPTIONAL)
8976                         return -EINVAL;
8977         } else {
8978                 connect.mfp = NL80211_MFP_NO;
8979         }
8980
8981         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8982                 connect.prev_bssid =
8983                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8984
8985         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
8986                 connect.channel = nl80211_get_valid_chan(
8987                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8988                 if (!connect.channel)
8989                         return -EINVAL;
8990         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
8991                 connect.channel_hint = nl80211_get_valid_chan(
8992                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
8993                 if (!connect.channel_hint)
8994                         return -EINVAL;
8995         }
8996
8997         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8998                 connkeys = nl80211_parse_connkeys(rdev,
8999                                           info->attrs[NL80211_ATTR_KEYS], NULL);
9000                 if (IS_ERR(connkeys))
9001                         return PTR_ERR(connkeys);
9002         }
9003
9004         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9005                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9006
9007         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9008                 memcpy(&connect.ht_capa_mask,
9009                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9010                        sizeof(connect.ht_capa_mask));
9011
9012         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9013                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9014                         kzfree(connkeys);
9015                         return -EINVAL;
9016                 }
9017                 memcpy(&connect.ht_capa,
9018                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9019                        sizeof(connect.ht_capa));
9020         }
9021
9022         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9023                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9024
9025         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9026                 memcpy(&connect.vht_capa_mask,
9027                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9028                        sizeof(connect.vht_capa_mask));
9029
9030         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9031                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9032                         kzfree(connkeys);
9033                         return -EINVAL;
9034                 }
9035                 memcpy(&connect.vht_capa,
9036                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9037                        sizeof(connect.vht_capa));
9038         }
9039
9040         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9041                 if (!((rdev->wiphy.features &
9042                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9043                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9044                     !wiphy_ext_feature_isset(&rdev->wiphy,
9045                                              NL80211_EXT_FEATURE_RRM)) {
9046                         kzfree(connkeys);
9047                         return -EINVAL;
9048                 }
9049                 connect.flags |= ASSOC_REQ_USE_RRM;
9050         }
9051
9052         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9053         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9054                 kzfree(connkeys);
9055                 return -EOPNOTSUPP;
9056         }
9057
9058         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9059                 /* bss selection makes no sense if bssid is set */
9060                 if (connect.bssid) {
9061                         kzfree(connkeys);
9062                         return -EINVAL;
9063                 }
9064
9065                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9066                                        wiphy, &connect.bss_select);
9067                 if (err) {
9068                         kzfree(connkeys);
9069                         return err;
9070                 }
9071         }
9072
9073         if (wiphy_ext_feature_isset(&rdev->wiphy,
9074                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9075             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9076             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9077             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9078             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9079                 connect.fils_erp_username =
9080                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9081                 connect.fils_erp_username_len =
9082                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9083                 connect.fils_erp_realm =
9084                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9085                 connect.fils_erp_realm_len =
9086                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9087                 connect.fils_erp_next_seq_num =
9088                         nla_get_u16(
9089                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9090                 connect.fils_erp_rrk =
9091                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9092                 connect.fils_erp_rrk_len =
9093                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9094         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9095                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9096                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9097                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9098                 kzfree(connkeys);
9099                 return -EINVAL;
9100         }
9101
9102         wdev_lock(dev->ieee80211_ptr);
9103
9104         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9105                                connect.prev_bssid);
9106         if (err)
9107                 kzfree(connkeys);
9108
9109         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9110                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9111                 if (connect.bssid)
9112                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9113                                connect.bssid, ETH_ALEN);
9114                 else
9115                         memset(dev->ieee80211_ptr->disconnect_bssid,
9116                                0, ETH_ALEN);
9117         }
9118
9119         wdev_unlock(dev->ieee80211_ptr);
9120
9121         return err;
9122 }
9123
9124 static int nl80211_update_connect_params(struct sk_buff *skb,
9125                                          struct genl_info *info)
9126 {
9127         struct cfg80211_connect_params connect = {};
9128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9129         struct net_device *dev = info->user_ptr[1];
9130         struct wireless_dev *wdev = dev->ieee80211_ptr;
9131         u32 changed = 0;
9132         int ret;
9133
9134         if (!rdev->ops->update_connect_params)
9135                 return -EOPNOTSUPP;
9136
9137         if (info->attrs[NL80211_ATTR_IE]) {
9138                 if (!is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
9139                         return -EINVAL;
9140                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9141                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9142                 changed |= UPDATE_ASSOC_IES;
9143         }
9144
9145         wdev_lock(dev->ieee80211_ptr);
9146         if (!wdev->current_bss)
9147                 ret = -ENOLINK;
9148         else
9149                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9150         wdev_unlock(dev->ieee80211_ptr);
9151
9152         return ret;
9153 }
9154
9155 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9156 {
9157         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9158         struct net_device *dev = info->user_ptr[1];
9159         u16 reason;
9160         int ret;
9161
9162         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9163                 reason = WLAN_REASON_DEAUTH_LEAVING;
9164         else
9165                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9166
9167         if (reason == 0)
9168                 return -EINVAL;
9169
9170         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9171             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9172                 return -EOPNOTSUPP;
9173
9174         wdev_lock(dev->ieee80211_ptr);
9175         ret = cfg80211_disconnect(rdev, dev, reason, true);
9176         wdev_unlock(dev->ieee80211_ptr);
9177         return ret;
9178 }
9179
9180 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9181 {
9182         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9183         struct net *net;
9184         int err;
9185
9186         if (info->attrs[NL80211_ATTR_PID]) {
9187                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9188
9189                 net = get_net_ns_by_pid(pid);
9190         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9191                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9192
9193                 net = get_net_ns_by_fd(fd);
9194         } else {
9195                 return -EINVAL;
9196         }
9197
9198         if (IS_ERR(net))
9199                 return PTR_ERR(net);
9200
9201         err = 0;
9202
9203         /* check if anything to do */
9204         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9205                 err = cfg80211_switch_netns(rdev, net);
9206
9207         put_net(net);
9208         return err;
9209 }
9210
9211 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9212 {
9213         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9214         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9215                         struct cfg80211_pmksa *pmksa) = NULL;
9216         struct net_device *dev = info->user_ptr[1];
9217         struct cfg80211_pmksa pmksa;
9218
9219         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9220
9221         if (!info->attrs[NL80211_ATTR_PMKID])
9222                 return -EINVAL;
9223
9224         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9225
9226         if (info->attrs[NL80211_ATTR_MAC]) {
9227                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9228         } else if (info->attrs[NL80211_ATTR_SSID] &&
9229                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9230                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9231                     info->attrs[NL80211_ATTR_PMK])) {
9232                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9233                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9234                 pmksa.cache_id =
9235                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9236         } else {
9237                 return -EINVAL;
9238         }
9239         if (info->attrs[NL80211_ATTR_PMK]) {
9240                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9241                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9242         }
9243
9244         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9245             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9246                 return -EOPNOTSUPP;
9247
9248         switch (info->genlhdr->cmd) {
9249         case NL80211_CMD_SET_PMKSA:
9250                 rdev_ops = rdev->ops->set_pmksa;
9251                 break;
9252         case NL80211_CMD_DEL_PMKSA:
9253                 rdev_ops = rdev->ops->del_pmksa;
9254                 break;
9255         default:
9256                 WARN_ON(1);
9257                 break;
9258         }
9259
9260         if (!rdev_ops)
9261                 return -EOPNOTSUPP;
9262
9263         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9264 }
9265
9266 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9267 {
9268         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9269         struct net_device *dev = info->user_ptr[1];
9270
9271         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9272             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9273                 return -EOPNOTSUPP;
9274
9275         if (!rdev->ops->flush_pmksa)
9276                 return -EOPNOTSUPP;
9277
9278         return rdev_flush_pmksa(rdev, dev);
9279 }
9280
9281 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9282 {
9283         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9284         struct net_device *dev = info->user_ptr[1];
9285         u8 action_code, dialog_token;
9286         u32 peer_capability = 0;
9287         u16 status_code;
9288         u8 *peer;
9289         bool initiator;
9290
9291         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9292             !rdev->ops->tdls_mgmt)
9293                 return -EOPNOTSUPP;
9294
9295         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9296             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9297             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9298             !info->attrs[NL80211_ATTR_IE] ||
9299             !info->attrs[NL80211_ATTR_MAC])
9300                 return -EINVAL;
9301
9302         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9303         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9304         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9305         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9306         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9307         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9308                 peer_capability =
9309                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9310
9311         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9312                               dialog_token, status_code, peer_capability,
9313                               initiator,
9314                               nla_data(info->attrs[NL80211_ATTR_IE]),
9315                               nla_len(info->attrs[NL80211_ATTR_IE]));
9316 }
9317
9318 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9319 {
9320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9321         struct net_device *dev = info->user_ptr[1];
9322         enum nl80211_tdls_operation operation;
9323         u8 *peer;
9324
9325         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9326             !rdev->ops->tdls_oper)
9327                 return -EOPNOTSUPP;
9328
9329         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9330             !info->attrs[NL80211_ATTR_MAC])
9331                 return -EINVAL;
9332
9333         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9334         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9335
9336         return rdev_tdls_oper(rdev, dev, peer, operation);
9337 }
9338
9339 static int nl80211_remain_on_channel(struct sk_buff *skb,
9340                                      struct genl_info *info)
9341 {
9342         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9343         struct wireless_dev *wdev = info->user_ptr[1];
9344         struct cfg80211_chan_def chandef;
9345         const struct cfg80211_chan_def *compat_chandef;
9346         struct sk_buff *msg;
9347         void *hdr;
9348         u64 cookie;
9349         u32 duration;
9350         int err;
9351
9352         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9353             !info->attrs[NL80211_ATTR_DURATION])
9354                 return -EINVAL;
9355
9356         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9357
9358         if (!rdev->ops->remain_on_channel ||
9359             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9360                 return -EOPNOTSUPP;
9361
9362         /*
9363          * We should be on that channel for at least a minimum amount of
9364          * time (10ms) but no longer than the driver supports.
9365          */
9366         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9367             duration > rdev->wiphy.max_remain_on_channel_duration)
9368                 return -EINVAL;
9369
9370         err = nl80211_parse_chandef(rdev, info, &chandef);
9371         if (err)
9372                 return err;
9373
9374         wdev_lock(wdev);
9375         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9376             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9377                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9378                                                              &chandef);
9379                 if (compat_chandef != &chandef) {
9380                         wdev_unlock(wdev);
9381                         return -EBUSY;
9382                 }
9383         }
9384         wdev_unlock(wdev);
9385
9386         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9387         if (!msg)
9388                 return -ENOMEM;
9389
9390         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9391                              NL80211_CMD_REMAIN_ON_CHANNEL);
9392         if (!hdr) {
9393                 err = -ENOBUFS;
9394                 goto free_msg;
9395         }
9396
9397         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9398                                      duration, &cookie);
9399
9400         if (err)
9401                 goto free_msg;
9402
9403         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9404                               NL80211_ATTR_PAD))
9405                 goto nla_put_failure;
9406
9407         genlmsg_end(msg, hdr);
9408
9409         return genlmsg_reply(msg, info);
9410
9411  nla_put_failure:
9412         err = -ENOBUFS;
9413  free_msg:
9414         nlmsg_free(msg);
9415         return err;
9416 }
9417
9418 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9419                                             struct genl_info *info)
9420 {
9421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9422         struct wireless_dev *wdev = info->user_ptr[1];
9423         u64 cookie;
9424
9425         if (!info->attrs[NL80211_ATTR_COOKIE])
9426                 return -EINVAL;
9427
9428         if (!rdev->ops->cancel_remain_on_channel)
9429                 return -EOPNOTSUPP;
9430
9431         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9432
9433         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9434 }
9435
9436 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9437                                        struct genl_info *info)
9438 {
9439         struct cfg80211_bitrate_mask mask;
9440         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9441         struct net_device *dev = info->user_ptr[1];
9442         int err;
9443
9444         if (!rdev->ops->set_bitrate_mask)
9445                 return -EOPNOTSUPP;
9446
9447         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9448         if (err)
9449                 return err;
9450
9451         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9452 }
9453
9454 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9455 {
9456         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9457         struct wireless_dev *wdev = info->user_ptr[1];
9458         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9459
9460         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9461                 return -EINVAL;
9462
9463         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9464                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9465
9466         switch (wdev->iftype) {
9467         case NL80211_IFTYPE_STATION:
9468         case NL80211_IFTYPE_ADHOC:
9469         case NL80211_IFTYPE_P2P_CLIENT:
9470         case NL80211_IFTYPE_AP:
9471         case NL80211_IFTYPE_AP_VLAN:
9472         case NL80211_IFTYPE_MESH_POINT:
9473         case NL80211_IFTYPE_P2P_GO:
9474         case NL80211_IFTYPE_P2P_DEVICE:
9475                 break;
9476         case NL80211_IFTYPE_NAN:
9477         default:
9478                 return -EOPNOTSUPP;
9479         }
9480
9481         /* not much point in registering if we can't reply */
9482         if (!rdev->ops->mgmt_tx)
9483                 return -EOPNOTSUPP;
9484
9485         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9486                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9487                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9488 }
9489
9490 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9491 {
9492         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9493         struct wireless_dev *wdev = info->user_ptr[1];
9494         struct cfg80211_chan_def chandef;
9495         int err;
9496         void *hdr = NULL;
9497         u64 cookie;
9498         struct sk_buff *msg = NULL;
9499         struct cfg80211_mgmt_tx_params params = {
9500                 .dont_wait_for_ack =
9501                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9502         };
9503
9504         if (!info->attrs[NL80211_ATTR_FRAME])
9505                 return -EINVAL;
9506
9507         if (!rdev->ops->mgmt_tx)
9508                 return -EOPNOTSUPP;
9509
9510         switch (wdev->iftype) {
9511         case NL80211_IFTYPE_P2P_DEVICE:
9512                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9513                         return -EINVAL;
9514         case NL80211_IFTYPE_STATION:
9515         case NL80211_IFTYPE_ADHOC:
9516         case NL80211_IFTYPE_P2P_CLIENT:
9517         case NL80211_IFTYPE_AP:
9518         case NL80211_IFTYPE_AP_VLAN:
9519         case NL80211_IFTYPE_MESH_POINT:
9520         case NL80211_IFTYPE_P2P_GO:
9521                 break;
9522         case NL80211_IFTYPE_NAN:
9523         default:
9524                 return -EOPNOTSUPP;
9525         }
9526
9527         if (info->attrs[NL80211_ATTR_DURATION]) {
9528                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9529                         return -EINVAL;
9530                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9531
9532                 /*
9533                  * We should wait on the channel for at least a minimum amount
9534                  * of time (10ms) but no longer than the driver supports.
9535                  */
9536                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9537                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9538                         return -EINVAL;
9539         }
9540
9541         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9542
9543         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9544                 return -EINVAL;
9545
9546         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9547
9548         /* get the channel if any has been specified, otherwise pass NULL to
9549          * the driver. The latter will use the current one
9550          */
9551         chandef.chan = NULL;
9552         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9553                 err = nl80211_parse_chandef(rdev, info, &chandef);
9554                 if (err)
9555                         return err;
9556         }
9557
9558         if (!chandef.chan && params.offchan)
9559                 return -EINVAL;
9560
9561         wdev_lock(wdev);
9562         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9563                 wdev_unlock(wdev);
9564                 return -EBUSY;
9565         }
9566         wdev_unlock(wdev);
9567
9568         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9569         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9570
9571         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9572                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9573                 int i;
9574
9575                 if (len % sizeof(u16))
9576                         return -EINVAL;
9577
9578                 params.n_csa_offsets = len / sizeof(u16);
9579                 params.csa_offsets =
9580                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9581
9582                 /* check that all the offsets fit the frame */
9583                 for (i = 0; i < params.n_csa_offsets; i++) {
9584                         if (params.csa_offsets[i] >= params.len)
9585                                 return -EINVAL;
9586                 }
9587         }
9588
9589         if (!params.dont_wait_for_ack) {
9590                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9591                 if (!msg)
9592                         return -ENOMEM;
9593
9594                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9595                                      NL80211_CMD_FRAME);
9596                 if (!hdr) {
9597                         err = -ENOBUFS;
9598                         goto free_msg;
9599                 }
9600         }
9601
9602         params.chan = chandef.chan;
9603         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9604         if (err)
9605                 goto free_msg;
9606
9607         if (msg) {
9608                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9609                                       NL80211_ATTR_PAD))
9610                         goto nla_put_failure;
9611
9612                 genlmsg_end(msg, hdr);
9613                 return genlmsg_reply(msg, info);
9614         }
9615
9616         return 0;
9617
9618  nla_put_failure:
9619         err = -ENOBUFS;
9620  free_msg:
9621         nlmsg_free(msg);
9622         return err;
9623 }
9624
9625 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
9626 {
9627         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9628         struct wireless_dev *wdev = info->user_ptr[1];
9629         u64 cookie;
9630
9631         if (!info->attrs[NL80211_ATTR_COOKIE])
9632                 return -EINVAL;
9633
9634         if (!rdev->ops->mgmt_tx_cancel_wait)
9635                 return -EOPNOTSUPP;
9636
9637         switch (wdev->iftype) {
9638         case NL80211_IFTYPE_STATION:
9639         case NL80211_IFTYPE_ADHOC:
9640         case NL80211_IFTYPE_P2P_CLIENT:
9641         case NL80211_IFTYPE_AP:
9642         case NL80211_IFTYPE_AP_VLAN:
9643         case NL80211_IFTYPE_P2P_GO:
9644         case NL80211_IFTYPE_P2P_DEVICE:
9645                 break;
9646         case NL80211_IFTYPE_NAN:
9647         default:
9648                 return -EOPNOTSUPP;
9649         }
9650
9651         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9652
9653         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
9654 }
9655
9656 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
9657 {
9658         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9659         struct wireless_dev *wdev;
9660         struct net_device *dev = info->user_ptr[1];
9661         u8 ps_state;
9662         bool state;
9663         int err;
9664
9665         if (!info->attrs[NL80211_ATTR_PS_STATE])
9666                 return -EINVAL;
9667
9668         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
9669
9670         if (ps_state != NL80211_PS_DISABLED && ps_state != NL80211_PS_ENABLED)
9671                 return -EINVAL;
9672
9673         wdev = dev->ieee80211_ptr;
9674
9675         if (!rdev->ops->set_power_mgmt)
9676                 return -EOPNOTSUPP;
9677
9678         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
9679
9680         if (state == wdev->ps)
9681                 return 0;
9682
9683         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
9684         if (!err)
9685                 wdev->ps = state;
9686         return err;
9687 }
9688
9689 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
9690 {
9691         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9692         enum nl80211_ps_state ps_state;
9693         struct wireless_dev *wdev;
9694         struct net_device *dev = info->user_ptr[1];
9695         struct sk_buff *msg;
9696         void *hdr;
9697         int err;
9698
9699         wdev = dev->ieee80211_ptr;
9700
9701         if (!rdev->ops->set_power_mgmt)
9702                 return -EOPNOTSUPP;
9703
9704         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9705         if (!msg)
9706                 return -ENOMEM;
9707
9708         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9709                              NL80211_CMD_GET_POWER_SAVE);
9710         if (!hdr) {
9711                 err = -ENOBUFS;
9712                 goto free_msg;
9713         }
9714
9715         if (wdev->ps)
9716                 ps_state = NL80211_PS_ENABLED;
9717         else
9718                 ps_state = NL80211_PS_DISABLED;
9719
9720         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
9721                 goto nla_put_failure;
9722
9723         genlmsg_end(msg, hdr);
9724         return genlmsg_reply(msg, info);
9725
9726  nla_put_failure:
9727         err = -ENOBUFS;
9728  free_msg:
9729         nlmsg_free(msg);
9730         return err;
9731 }
9732
9733 static const struct nla_policy
9734 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
9735         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
9736         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
9737         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
9738         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
9739         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
9740         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
9741         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
9742 };
9743
9744 static int nl80211_set_cqm_txe(struct genl_info *info,
9745                                u32 rate, u32 pkts, u32 intvl)
9746 {
9747         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9748         struct net_device *dev = info->user_ptr[1];
9749         struct wireless_dev *wdev = dev->ieee80211_ptr;
9750
9751         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
9752                 return -EINVAL;
9753
9754         if (!rdev->ops->set_cqm_txe_config)
9755                 return -EOPNOTSUPP;
9756
9757         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9758             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9759                 return -EOPNOTSUPP;
9760
9761         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
9762 }
9763
9764 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
9765                                     struct net_device *dev)
9766 {
9767         struct wireless_dev *wdev = dev->ieee80211_ptr;
9768         s32 last, low, high;
9769         u32 hyst;
9770         int i, n;
9771         int err;
9772
9773         /* RSSI reporting disabled? */
9774         if (!wdev->cqm_config)
9775                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
9776
9777         /*
9778          * Obtain current RSSI value if possible, if not and no RSSI threshold
9779          * event has been received yet, we should receive an event after a
9780          * connection is established and enough beacons received to calculate
9781          * the average.
9782          */
9783         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
9784             rdev->ops->get_station) {
9785                 struct station_info sinfo;
9786                 u8 *mac_addr;
9787
9788                 mac_addr = wdev->current_bss->pub.bssid;
9789
9790                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
9791                 if (err)
9792                         return err;
9793
9794                 if (sinfo.filled & BIT(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
9795                         wdev->cqm_config->last_rssi_event_value =
9796                                 (s8) sinfo.rx_beacon_signal_avg;
9797         }
9798
9799         last = wdev->cqm_config->last_rssi_event_value;
9800         hyst = wdev->cqm_config->rssi_hyst;
9801         n = wdev->cqm_config->n_rssi_thresholds;
9802
9803         for (i = 0; i < n; i++)
9804                 if (last < wdev->cqm_config->rssi_thresholds[i])
9805                         break;
9806
9807         low = i > 0 ?
9808                 (wdev->cqm_config->rssi_thresholds[i - 1] - hyst) : S32_MIN;
9809         high = i < n ?
9810                 (wdev->cqm_config->rssi_thresholds[i] + hyst - 1) : S32_MAX;
9811
9812         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
9813 }
9814
9815 static int nl80211_set_cqm_rssi(struct genl_info *info,
9816                                 const s32 *thresholds, int n_thresholds,
9817                                 u32 hysteresis)
9818 {
9819         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9820         struct net_device *dev = info->user_ptr[1];
9821         struct wireless_dev *wdev = dev->ieee80211_ptr;
9822         int i, err;
9823         s32 prev = S32_MIN;
9824
9825         /* Check all values negative and sorted */
9826         for (i = 0; i < n_thresholds; i++) {
9827                 if (thresholds[i] > 0 || thresholds[i] <= prev)
9828                         return -EINVAL;
9829
9830                 prev = thresholds[i];
9831         }
9832
9833         if (wdev->iftype != NL80211_IFTYPE_STATION &&
9834             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
9835                 return -EOPNOTSUPP;
9836
9837         wdev_lock(wdev);
9838         cfg80211_cqm_config_free(wdev);
9839         wdev_unlock(wdev);
9840
9841         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
9842                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
9843                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
9844
9845                 return rdev_set_cqm_rssi_config(rdev, dev,
9846                                                 thresholds[0], hysteresis);
9847         }
9848
9849         if (!wiphy_ext_feature_isset(&rdev->wiphy,
9850                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
9851                 return -EOPNOTSUPP;
9852
9853         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
9854                 n_thresholds = 0;
9855
9856         wdev_lock(wdev);
9857         if (n_thresholds) {
9858                 struct cfg80211_cqm_config *cqm_config;
9859
9860                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
9861                                      n_thresholds * sizeof(s32), GFP_KERNEL);
9862                 if (!cqm_config) {
9863                         err = -ENOMEM;
9864                         goto unlock;
9865                 }
9866
9867                 cqm_config->rssi_hyst = hysteresis;
9868                 cqm_config->n_rssi_thresholds = n_thresholds;
9869                 memcpy(cqm_config->rssi_thresholds, thresholds,
9870                        n_thresholds * sizeof(s32));
9871
9872                 wdev->cqm_config = cqm_config;
9873         }
9874
9875         err = cfg80211_cqm_rssi_update(rdev, dev);
9876
9877 unlock:
9878         wdev_unlock(wdev);
9879
9880         return err;
9881 }
9882
9883 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
9884 {
9885         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
9886         struct nlattr *cqm;
9887         int err;
9888
9889         cqm = info->attrs[NL80211_ATTR_CQM];
9890         if (!cqm)
9891                 return -EINVAL;
9892
9893         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
9894                                nl80211_attr_cqm_policy, info->extack);
9895         if (err)
9896                 return err;
9897
9898         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
9899             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
9900                 const s32 *thresholds =
9901                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9902                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
9903                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
9904
9905                 if (len % 4)
9906                         return -EINVAL;
9907
9908                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
9909                                             hysteresis);
9910         }
9911
9912         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
9913             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
9914             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
9915                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
9916                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
9917                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
9918
9919                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
9920         }
9921
9922         return -EINVAL;
9923 }
9924
9925 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
9926 {
9927         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9928         struct net_device *dev = info->user_ptr[1];
9929         struct ocb_setup setup = {};
9930         int err;
9931
9932         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
9933         if (err)
9934                 return err;
9935
9936         return cfg80211_join_ocb(rdev, dev, &setup);
9937 }
9938
9939 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
9940 {
9941         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9942         struct net_device *dev = info->user_ptr[1];
9943
9944         return cfg80211_leave_ocb(rdev, dev);
9945 }
9946
9947 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
9948 {
9949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9950         struct net_device *dev = info->user_ptr[1];
9951         struct mesh_config cfg;
9952         struct mesh_setup setup;
9953         int err;
9954
9955         /* start with default */
9956         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
9957         memcpy(&setup, &default_mesh_setup, sizeof(setup));
9958
9959         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
9960                 /* and parse parameters if given */
9961                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
9962                 if (err)
9963                         return err;
9964         }
9965
9966         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
9967             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
9968                 return -EINVAL;
9969
9970         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
9971         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
9972
9973         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
9974             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
9975                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
9976                         return -EINVAL;
9977
9978         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
9979                 setup.beacon_interval =
9980                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
9981
9982                 err = cfg80211_validate_beacon_int(rdev,
9983                                                    NL80211_IFTYPE_MESH_POINT,
9984                                                    setup.beacon_interval);
9985                 if (err)
9986                         return err;
9987         }
9988
9989         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
9990                 setup.dtim_period =
9991                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
9992                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
9993                         return -EINVAL;
9994         }
9995
9996         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
9997                 /* parse additional setup parameters if given */
9998                 err = nl80211_parse_mesh_setup(info, &setup);
9999                 if (err)
10000                         return err;
10001         }
10002
10003         if (setup.user_mpm)
10004                 cfg.auto_open_plinks = false;
10005
10006         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10007                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10008                 if (err)
10009                         return err;
10010         } else {
10011                 /* cfg80211_join_mesh() will sort it out */
10012                 setup.chandef.chan = NULL;
10013         }
10014
10015         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10016                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10017                 int n_rates =
10018                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10019                 struct ieee80211_supported_band *sband;
10020
10021                 if (!setup.chandef.chan)
10022                         return -EINVAL;
10023
10024                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10025
10026                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10027                                              &setup.basic_rates);
10028                 if (err)
10029                         return err;
10030         }
10031
10032         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10033                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10034                 if (err)
10035                         return err;
10036
10037                 if (!setup.chandef.chan)
10038                         return -EINVAL;
10039
10040                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10041                                               &setup.beacon_rate);
10042                 if (err)
10043                         return err;
10044         }
10045
10046         setup.userspace_handles_dfs =
10047                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10048
10049         return cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10050 }
10051
10052 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10053 {
10054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10055         struct net_device *dev = info->user_ptr[1];
10056
10057         return cfg80211_leave_mesh(rdev, dev);
10058 }
10059
10060 #ifdef CONFIG_PM
10061 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10062                                         struct cfg80211_registered_device *rdev)
10063 {
10064         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10065         struct nlattr *nl_pats, *nl_pat;
10066         int i, pat_len;
10067
10068         if (!wowlan->n_patterns)
10069                 return 0;
10070
10071         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10072         if (!nl_pats)
10073                 return -ENOBUFS;
10074
10075         for (i = 0; i < wowlan->n_patterns; i++) {
10076                 nl_pat = nla_nest_start(msg, i + 1);
10077                 if (!nl_pat)
10078                         return -ENOBUFS;
10079                 pat_len = wowlan->patterns[i].pattern_len;
10080                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10081                             wowlan->patterns[i].mask) ||
10082                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10083                             wowlan->patterns[i].pattern) ||
10084                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10085                                 wowlan->patterns[i].pkt_offset))
10086                         return -ENOBUFS;
10087                 nla_nest_end(msg, nl_pat);
10088         }
10089         nla_nest_end(msg, nl_pats);
10090
10091         return 0;
10092 }
10093
10094 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10095                                    struct cfg80211_wowlan_tcp *tcp)
10096 {
10097         struct nlattr *nl_tcp;
10098
10099         if (!tcp)
10100                 return 0;
10101
10102         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10103         if (!nl_tcp)
10104                 return -ENOBUFS;
10105
10106         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10107             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10108             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10109             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10110             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10111             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10112                     tcp->payload_len, tcp->payload) ||
10113             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10114                         tcp->data_interval) ||
10115             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10116                     tcp->wake_len, tcp->wake_data) ||
10117             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10118                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10119                 return -ENOBUFS;
10120
10121         if (tcp->payload_seq.len &&
10122             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10123                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10124                 return -ENOBUFS;
10125
10126         if (tcp->payload_tok.len &&
10127             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10128                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10129                     &tcp->payload_tok))
10130                 return -ENOBUFS;
10131
10132         nla_nest_end(msg, nl_tcp);
10133
10134         return 0;
10135 }
10136
10137 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10138                                   struct cfg80211_sched_scan_request *req)
10139 {
10140         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10141         int i;
10142
10143         if (!req)
10144                 return 0;
10145
10146         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10147         if (!nd)
10148                 return -ENOBUFS;
10149
10150         if (req->n_scan_plans == 1 &&
10151             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10152                         req->scan_plans[0].interval * 1000))
10153                 return -ENOBUFS;
10154
10155         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10156                 return -ENOBUFS;
10157
10158         if (req->relative_rssi_set) {
10159                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10160
10161                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10162                                req->relative_rssi))
10163                         return -ENOBUFS;
10164
10165                 rssi_adjust.band = req->rssi_adjust.band;
10166                 rssi_adjust.delta = req->rssi_adjust.delta;
10167                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10168                             sizeof(rssi_adjust), &rssi_adjust))
10169                         return -ENOBUFS;
10170         }
10171
10172         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10173         if (!freqs)
10174                 return -ENOBUFS;
10175
10176         for (i = 0; i < req->n_channels; i++) {
10177                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10178                         return -ENOBUFS;
10179         }
10180
10181         nla_nest_end(msg, freqs);
10182
10183         if (req->n_match_sets) {
10184                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10185                 if (!matches)
10186                         return -ENOBUFS;
10187
10188                 for (i = 0; i < req->n_match_sets; i++) {
10189                         match = nla_nest_start(msg, i);
10190                         if (!match)
10191                                 return -ENOBUFS;
10192
10193                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10194                                     req->match_sets[i].ssid.ssid_len,
10195                                     req->match_sets[i].ssid.ssid))
10196                                 return -ENOBUFS;
10197                         nla_nest_end(msg, match);
10198                 }
10199                 nla_nest_end(msg, matches);
10200         }
10201
10202         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10203         if (!scan_plans)
10204                 return -ENOBUFS;
10205
10206         for (i = 0; i < req->n_scan_plans; i++) {
10207                 scan_plan = nla_nest_start(msg, i + 1);
10208                 if (!scan_plan)
10209                         return -ENOBUFS;
10210
10211                 if (!scan_plan ||
10212                     nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10213                                 req->scan_plans[i].interval) ||
10214                     (req->scan_plans[i].iterations &&
10215                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10216                                  req->scan_plans[i].iterations)))
10217                         return -ENOBUFS;
10218                 nla_nest_end(msg, scan_plan);
10219         }
10220         nla_nest_end(msg, scan_plans);
10221
10222         nla_nest_end(msg, nd);
10223
10224         return 0;
10225 }
10226
10227 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10228 {
10229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10230         struct sk_buff *msg;
10231         void *hdr;
10232         u32 size = NLMSG_DEFAULT_SIZE;
10233
10234         if (!rdev->wiphy.wowlan)
10235                 return -EOPNOTSUPP;
10236
10237         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10238                 /* adjust size to have room for all the data */
10239                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10240                         rdev->wiphy.wowlan_config->tcp->payload_len +
10241                         rdev->wiphy.wowlan_config->tcp->wake_len +
10242                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10243         }
10244
10245         msg = nlmsg_new(size, GFP_KERNEL);
10246         if (!msg)
10247                 return -ENOMEM;
10248
10249         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10250                              NL80211_CMD_GET_WOWLAN);
10251         if (!hdr)
10252                 goto nla_put_failure;
10253
10254         if (rdev->wiphy.wowlan_config) {
10255                 struct nlattr *nl_wowlan;
10256
10257                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10258                 if (!nl_wowlan)
10259                         goto nla_put_failure;
10260
10261                 if ((rdev->wiphy.wowlan_config->any &&
10262                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10263                     (rdev->wiphy.wowlan_config->disconnect &&
10264                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10265                     (rdev->wiphy.wowlan_config->magic_pkt &&
10266                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10267                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10268                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10269                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10270                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10271                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10272                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10273                     (rdev->wiphy.wowlan_config->rfkill_release &&
10274                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10275                         goto nla_put_failure;
10276
10277                 if (nl80211_send_wowlan_patterns(msg, rdev))
10278                         goto nla_put_failure;
10279
10280                 if (nl80211_send_wowlan_tcp(msg,
10281                                             rdev->wiphy.wowlan_config->tcp))
10282                         goto nla_put_failure;
10283
10284                 if (nl80211_send_wowlan_nd(
10285                             msg,
10286                             rdev->wiphy.wowlan_config->nd_config))
10287                         goto nla_put_failure;
10288
10289                 nla_nest_end(msg, nl_wowlan);
10290         }
10291
10292         genlmsg_end(msg, hdr);
10293         return genlmsg_reply(msg, info);
10294
10295 nla_put_failure:
10296         nlmsg_free(msg);
10297         return -ENOBUFS;
10298 }
10299
10300 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10301                                     struct nlattr *attr,
10302                                     struct cfg80211_wowlan *trig)
10303 {
10304         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10305         struct cfg80211_wowlan_tcp *cfg;
10306         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10307         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10308         u32 size;
10309         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10310         int err, port;
10311
10312         if (!rdev->wiphy.wowlan->tcp)
10313                 return -EINVAL;
10314
10315         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10316                                nl80211_wowlan_tcp_policy, NULL);
10317         if (err)
10318                 return err;
10319
10320         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10321             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10322             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10323             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10324             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10325             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10326             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10327             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10328                 return -EINVAL;
10329
10330         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10331         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10332                 return -EINVAL;
10333
10334         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10335                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10336             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10337                 return -EINVAL;
10338
10339         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10340         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10341                 return -EINVAL;
10342
10343         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10344         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10345                 return -EINVAL;
10346
10347         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10348                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10349
10350                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10351                 tokens_size = tokln - sizeof(*tok);
10352
10353                 if (!tok->len || tokens_size % tok->len)
10354                         return -EINVAL;
10355                 if (!rdev->wiphy.wowlan->tcp->tok)
10356                         return -EINVAL;
10357                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10358                         return -EINVAL;
10359                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10360                         return -EINVAL;
10361                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10362                         return -EINVAL;
10363                 if (tok->offset + tok->len > data_size)
10364                         return -EINVAL;
10365         }
10366
10367         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10368                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10369                 if (!rdev->wiphy.wowlan->tcp->seq)
10370                         return -EINVAL;
10371                 if (seq->len == 0 || seq->len > 4)
10372                         return -EINVAL;
10373                 if (seq->len + seq->offset > data_size)
10374                         return -EINVAL;
10375         }
10376
10377         size = sizeof(*cfg);
10378         size += data_size;
10379         size += wake_size + wake_mask_size;
10380         size += tokens_size;
10381
10382         cfg = kzalloc(size, GFP_KERNEL);
10383         if (!cfg)
10384                 return -ENOMEM;
10385         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10386         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10387         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10388                ETH_ALEN);
10389         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10390                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10391         else
10392                 port = 0;
10393 #ifdef CONFIG_INET
10394         /* allocate a socket and port for it and use it */
10395         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10396                             IPPROTO_TCP, &cfg->sock, 1);
10397         if (err) {
10398                 kfree(cfg);
10399                 return err;
10400         }
10401         if (inet_csk_get_port(cfg->sock->sk, port)) {
10402                 sock_release(cfg->sock);
10403                 kfree(cfg);
10404                 return -EADDRINUSE;
10405         }
10406         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10407 #else
10408         if (!port) {
10409                 kfree(cfg);
10410                 return -EINVAL;
10411         }
10412         cfg->src_port = port;
10413 #endif
10414
10415         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10416         cfg->payload_len = data_size;
10417         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10418         memcpy((void *)cfg->payload,
10419                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10420                data_size);
10421         if (seq)
10422                 cfg->payload_seq = *seq;
10423         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10424         cfg->wake_len = wake_size;
10425         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10426         memcpy((void *)cfg->wake_data,
10427                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10428                wake_size);
10429         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10430                          data_size + wake_size;
10431         memcpy((void *)cfg->wake_mask,
10432                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10433                wake_mask_size);
10434         if (tok) {
10435                 cfg->tokens_size = tokens_size;
10436                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10437         }
10438
10439         trig->tcp = cfg;
10440
10441         return 0;
10442 }
10443
10444 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10445                                    const struct wiphy_wowlan_support *wowlan,
10446                                    struct nlattr *attr,
10447                                    struct cfg80211_wowlan *trig)
10448 {
10449         struct nlattr **tb;
10450         int err;
10451
10452         tb = kzalloc(NUM_NL80211_ATTR * sizeof(*tb), GFP_KERNEL);
10453         if (!tb)
10454                 return -ENOMEM;
10455
10456         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10457                 err = -EOPNOTSUPP;
10458                 goto out;
10459         }
10460
10461         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10462                                NULL);
10463         if (err)
10464                 goto out;
10465
10466         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10467                                                    wowlan->max_nd_match_sets);
10468         err = PTR_ERR_OR_ZERO(trig->nd_config);
10469         if (err)
10470                 trig->nd_config = NULL;
10471
10472 out:
10473         kfree(tb);
10474         return err;
10475 }
10476
10477 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10478 {
10479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10480         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10481         struct cfg80211_wowlan new_triggers = {};
10482         struct cfg80211_wowlan *ntrig;
10483         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10484         int err, i;
10485         bool prev_enabled = rdev->wiphy.wowlan_config;
10486         bool regular = false;
10487
10488         if (!wowlan)
10489                 return -EOPNOTSUPP;
10490
10491         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10492                 cfg80211_rdev_free_wowlan(rdev);
10493                 rdev->wiphy.wowlan_config = NULL;
10494                 goto set_wakeup;
10495         }
10496
10497         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10498                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10499                                nl80211_wowlan_policy, info->extack);
10500         if (err)
10501                 return err;
10502
10503         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10504                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10505                         return -EINVAL;
10506                 new_triggers.any = true;
10507         }
10508
10509         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10510                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10511                         return -EINVAL;
10512                 new_triggers.disconnect = true;
10513                 regular = true;
10514         }
10515
10516         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10517                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10518                         return -EINVAL;
10519                 new_triggers.magic_pkt = true;
10520                 regular = true;
10521         }
10522
10523         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10524                 return -EINVAL;
10525
10526         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10527                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10528                         return -EINVAL;
10529                 new_triggers.gtk_rekey_failure = true;
10530                 regular = true;
10531         }
10532
10533         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10534                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10535                         return -EINVAL;
10536                 new_triggers.eap_identity_req = true;
10537                 regular = true;
10538         }
10539
10540         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10541                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10542                         return -EINVAL;
10543                 new_triggers.four_way_handshake = true;
10544                 regular = true;
10545         }
10546
10547         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10548                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10549                         return -EINVAL;
10550                 new_triggers.rfkill_release = true;
10551                 regular = true;
10552         }
10553
10554         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10555                 struct nlattr *pat;
10556                 int n_patterns = 0;
10557                 int rem, pat_len, mask_len, pkt_offset;
10558                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10559
10560                 regular = true;
10561
10562                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10563                                     rem)
10564                         n_patterns++;
10565                 if (n_patterns > wowlan->n_patterns)
10566                         return -EINVAL;
10567
10568                 new_triggers.patterns = kcalloc(n_patterns,
10569                                                 sizeof(new_triggers.patterns[0]),
10570                                                 GFP_KERNEL);
10571                 if (!new_triggers.patterns)
10572                         return -ENOMEM;
10573
10574                 new_triggers.n_patterns = n_patterns;
10575                 i = 0;
10576
10577                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10578                                     rem) {
10579                         u8 *mask_pat;
10580
10581                         nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10582                                          nl80211_packet_pattern_policy,
10583                                          info->extack);
10584                         err = -EINVAL;
10585                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
10586                             !pat_tb[NL80211_PKTPAT_PATTERN])
10587                                 goto error;
10588                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10589                         mask_len = DIV_ROUND_UP(pat_len, 8);
10590                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10591                                 goto error;
10592                         if (pat_len > wowlan->pattern_max_len ||
10593                             pat_len < wowlan->pattern_min_len)
10594                                 goto error;
10595
10596                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
10597                                 pkt_offset = 0;
10598                         else
10599                                 pkt_offset = nla_get_u32(
10600                                         pat_tb[NL80211_PKTPAT_OFFSET]);
10601                         if (pkt_offset > wowlan->max_pkt_offset)
10602                                 goto error;
10603                         new_triggers.patterns[i].pkt_offset = pkt_offset;
10604
10605                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10606                         if (!mask_pat) {
10607                                 err = -ENOMEM;
10608                                 goto error;
10609                         }
10610                         new_triggers.patterns[i].mask = mask_pat;
10611                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10612                                mask_len);
10613                         mask_pat += mask_len;
10614                         new_triggers.patterns[i].pattern = mask_pat;
10615                         new_triggers.patterns[i].pattern_len = pat_len;
10616                         memcpy(mask_pat,
10617                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10618                                pat_len);
10619                         i++;
10620                 }
10621         }
10622
10623         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
10624                 regular = true;
10625                 err = nl80211_parse_wowlan_tcp(
10626                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
10627                         &new_triggers);
10628                 if (err)
10629                         goto error;
10630         }
10631
10632         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
10633                 regular = true;
10634                 err = nl80211_parse_wowlan_nd(
10635                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
10636                         &new_triggers);
10637                 if (err)
10638                         goto error;
10639         }
10640
10641         /* The 'any' trigger means the device continues operating more or less
10642          * as in its normal operation mode and wakes up the host on most of the
10643          * normal interrupts (like packet RX, ...)
10644          * It therefore makes little sense to combine with the more constrained
10645          * wakeup trigger modes.
10646          */
10647         if (new_triggers.any && regular) {
10648                 err = -EINVAL;
10649                 goto error;
10650         }
10651
10652         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
10653         if (!ntrig) {
10654                 err = -ENOMEM;
10655                 goto error;
10656         }
10657         cfg80211_rdev_free_wowlan(rdev);
10658         rdev->wiphy.wowlan_config = ntrig;
10659
10660  set_wakeup:
10661         if (rdev->ops->set_wakeup &&
10662             prev_enabled != !!rdev->wiphy.wowlan_config)
10663                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
10664
10665         return 0;
10666  error:
10667         for (i = 0; i < new_triggers.n_patterns; i++)
10668                 kfree(new_triggers.patterns[i].mask);
10669         kfree(new_triggers.patterns);
10670         if (new_triggers.tcp && new_triggers.tcp->sock)
10671                 sock_release(new_triggers.tcp->sock);
10672         kfree(new_triggers.tcp);
10673         kfree(new_triggers.nd_config);
10674         return err;
10675 }
10676 #endif
10677
10678 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
10679                                        struct cfg80211_registered_device *rdev)
10680 {
10681         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
10682         int i, j, pat_len;
10683         struct cfg80211_coalesce_rules *rule;
10684
10685         if (!rdev->coalesce->n_rules)
10686                 return 0;
10687
10688         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
10689         if (!nl_rules)
10690                 return -ENOBUFS;
10691
10692         for (i = 0; i < rdev->coalesce->n_rules; i++) {
10693                 nl_rule = nla_nest_start(msg, i + 1);
10694                 if (!nl_rule)
10695                         return -ENOBUFS;
10696
10697                 rule = &rdev->coalesce->rules[i];
10698                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
10699                                 rule->delay))
10700                         return -ENOBUFS;
10701
10702                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
10703                                 rule->condition))
10704                         return -ENOBUFS;
10705
10706                 nl_pats = nla_nest_start(msg,
10707                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
10708                 if (!nl_pats)
10709                         return -ENOBUFS;
10710
10711                 for (j = 0; j < rule->n_patterns; j++) {
10712                         nl_pat = nla_nest_start(msg, j + 1);
10713                         if (!nl_pat)
10714                                 return -ENOBUFS;
10715                         pat_len = rule->patterns[j].pattern_len;
10716                         if (nla_put(msg, NL80211_PKTPAT_MASK,
10717                                     DIV_ROUND_UP(pat_len, 8),
10718                                     rule->patterns[j].mask) ||
10719                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10720                                     rule->patterns[j].pattern) ||
10721                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10722                                         rule->patterns[j].pkt_offset))
10723                                 return -ENOBUFS;
10724                         nla_nest_end(msg, nl_pat);
10725                 }
10726                 nla_nest_end(msg, nl_pats);
10727                 nla_nest_end(msg, nl_rule);
10728         }
10729         nla_nest_end(msg, nl_rules);
10730
10731         return 0;
10732 }
10733
10734 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
10735 {
10736         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10737         struct sk_buff *msg;
10738         void *hdr;
10739
10740         if (!rdev->wiphy.coalesce)
10741                 return -EOPNOTSUPP;
10742
10743         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10744         if (!msg)
10745                 return -ENOMEM;
10746
10747         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10748                              NL80211_CMD_GET_COALESCE);
10749         if (!hdr)
10750                 goto nla_put_failure;
10751
10752         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
10753                 goto nla_put_failure;
10754
10755         genlmsg_end(msg, hdr);
10756         return genlmsg_reply(msg, info);
10757
10758 nla_put_failure:
10759         nlmsg_free(msg);
10760         return -ENOBUFS;
10761 }
10762
10763 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
10764 {
10765         struct cfg80211_coalesce *coalesce = rdev->coalesce;
10766         int i, j;
10767         struct cfg80211_coalesce_rules *rule;
10768
10769         if (!coalesce)
10770                 return;
10771
10772         for (i = 0; i < coalesce->n_rules; i++) {
10773                 rule = &coalesce->rules[i];
10774                 for (j = 0; j < rule->n_patterns; j++)
10775                         kfree(rule->patterns[j].mask);
10776                 kfree(rule->patterns);
10777         }
10778         kfree(coalesce->rules);
10779         kfree(coalesce);
10780         rdev->coalesce = NULL;
10781 }
10782
10783 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
10784                                        struct nlattr *rule,
10785                                        struct cfg80211_coalesce_rules *new_rule)
10786 {
10787         int err, i;
10788         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10789         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
10790         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
10791         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10792
10793         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
10794                                nl80211_coalesce_policy, NULL);
10795         if (err)
10796                 return err;
10797
10798         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
10799                 new_rule->delay =
10800                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
10801         if (new_rule->delay > coalesce->max_delay)
10802                 return -EINVAL;
10803
10804         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
10805                 new_rule->condition =
10806                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
10807         if (new_rule->condition != NL80211_COALESCE_CONDITION_MATCH &&
10808             new_rule->condition != NL80211_COALESCE_CONDITION_NO_MATCH)
10809                 return -EINVAL;
10810
10811         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
10812                 return -EINVAL;
10813
10814         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10815                             rem)
10816                 n_patterns++;
10817         if (n_patterns > coalesce->n_patterns)
10818                 return -EINVAL;
10819
10820         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
10821                                      GFP_KERNEL);
10822         if (!new_rule->patterns)
10823                 return -ENOMEM;
10824
10825         new_rule->n_patterns = n_patterns;
10826         i = 0;
10827
10828         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
10829                             rem) {
10830                 u8 *mask_pat;
10831
10832                 nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10833                                  nl80211_packet_pattern_policy, NULL);
10834                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
10835                     !pat_tb[NL80211_PKTPAT_PATTERN])
10836                         return -EINVAL;
10837                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
10838                 mask_len = DIV_ROUND_UP(pat_len, 8);
10839                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
10840                         return -EINVAL;
10841                 if (pat_len > coalesce->pattern_max_len ||
10842                     pat_len < coalesce->pattern_min_len)
10843                         return -EINVAL;
10844
10845                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
10846                         pkt_offset = 0;
10847                 else
10848                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
10849                 if (pkt_offset > coalesce->max_pkt_offset)
10850                         return -EINVAL;
10851                 new_rule->patterns[i].pkt_offset = pkt_offset;
10852
10853                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
10854                 if (!mask_pat)
10855                         return -ENOMEM;
10856
10857                 new_rule->patterns[i].mask = mask_pat;
10858                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
10859                        mask_len);
10860
10861                 mask_pat += mask_len;
10862                 new_rule->patterns[i].pattern = mask_pat;
10863                 new_rule->patterns[i].pattern_len = pat_len;
10864                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
10865                        pat_len);
10866                 i++;
10867         }
10868
10869         return 0;
10870 }
10871
10872 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
10873 {
10874         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10875         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
10876         struct cfg80211_coalesce new_coalesce = {};
10877         struct cfg80211_coalesce *n_coalesce;
10878         int err, rem_rule, n_rules = 0, i, j;
10879         struct nlattr *rule;
10880         struct cfg80211_coalesce_rules *tmp_rule;
10881
10882         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
10883                 return -EOPNOTSUPP;
10884
10885         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
10886                 cfg80211_rdev_free_coalesce(rdev);
10887                 rdev_set_coalesce(rdev, NULL);
10888                 return 0;
10889         }
10890
10891         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10892                             rem_rule)
10893                 n_rules++;
10894         if (n_rules > coalesce->n_rules)
10895                 return -EINVAL;
10896
10897         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
10898                                      GFP_KERNEL);
10899         if (!new_coalesce.rules)
10900                 return -ENOMEM;
10901
10902         new_coalesce.n_rules = n_rules;
10903         i = 0;
10904
10905         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
10906                             rem_rule) {
10907                 err = nl80211_parse_coalesce_rule(rdev, rule,
10908                                                   &new_coalesce.rules[i]);
10909                 if (err)
10910                         goto error;
10911
10912                 i++;
10913         }
10914
10915         err = rdev_set_coalesce(rdev, &new_coalesce);
10916         if (err)
10917                 goto error;
10918
10919         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
10920         if (!n_coalesce) {
10921                 err = -ENOMEM;
10922                 goto error;
10923         }
10924         cfg80211_rdev_free_coalesce(rdev);
10925         rdev->coalesce = n_coalesce;
10926
10927         return 0;
10928 error:
10929         for (i = 0; i < new_coalesce.n_rules; i++) {
10930                 tmp_rule = &new_coalesce.rules[i];
10931                 for (j = 0; j < tmp_rule->n_patterns; j++)
10932                         kfree(tmp_rule->patterns[j].mask);
10933                 kfree(tmp_rule->patterns);
10934         }
10935         kfree(new_coalesce.rules);
10936
10937         return err;
10938 }
10939
10940 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
10941 {
10942         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10943         struct net_device *dev = info->user_ptr[1];
10944         struct wireless_dev *wdev = dev->ieee80211_ptr;
10945         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
10946         struct cfg80211_gtk_rekey_data rekey_data;
10947         int err;
10948
10949         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
10950                 return -EINVAL;
10951
10952         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
10953                                info->attrs[NL80211_ATTR_REKEY_DATA],
10954                                nl80211_rekey_policy, info->extack);
10955         if (err)
10956                 return err;
10957
10958         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
10959             !tb[NL80211_REKEY_DATA_KCK])
10960                 return -EINVAL;
10961         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
10962                 return -ERANGE;
10963         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
10964                 return -ERANGE;
10965         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
10966                 return -ERANGE;
10967
10968         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
10969         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
10970         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
10971
10972         wdev_lock(wdev);
10973         if (!wdev->current_bss) {
10974                 err = -ENOTCONN;
10975                 goto out;
10976         }
10977
10978         if (!rdev->ops->set_rekey_data) {
10979                 err = -EOPNOTSUPP;
10980                 goto out;
10981         }
10982
10983         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
10984  out:
10985         wdev_unlock(wdev);
10986         return err;
10987 }
10988
10989 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
10990                                              struct genl_info *info)
10991 {
10992         struct net_device *dev = info->user_ptr[1];
10993         struct wireless_dev *wdev = dev->ieee80211_ptr;
10994
10995         if (wdev->iftype != NL80211_IFTYPE_AP &&
10996             wdev->iftype != NL80211_IFTYPE_P2P_GO)
10997                 return -EINVAL;
10998
10999         if (wdev->ap_unexpected_nlportid)
11000                 return -EBUSY;
11001
11002         wdev->ap_unexpected_nlportid = info->snd_portid;
11003         return 0;
11004 }
11005
11006 static int nl80211_probe_client(struct sk_buff *skb,
11007                                 struct genl_info *info)
11008 {
11009         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11010         struct net_device *dev = info->user_ptr[1];
11011         struct wireless_dev *wdev = dev->ieee80211_ptr;
11012         struct sk_buff *msg;
11013         void *hdr;
11014         const u8 *addr;
11015         u64 cookie;
11016         int err;
11017
11018         if (wdev->iftype != NL80211_IFTYPE_AP &&
11019             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11020                 return -EOPNOTSUPP;
11021
11022         if (!info->attrs[NL80211_ATTR_MAC])
11023                 return -EINVAL;
11024
11025         if (!rdev->ops->probe_client)
11026                 return -EOPNOTSUPP;
11027
11028         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11029         if (!msg)
11030                 return -ENOMEM;
11031
11032         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11033                              NL80211_CMD_PROBE_CLIENT);
11034         if (!hdr) {
11035                 err = -ENOBUFS;
11036                 goto free_msg;
11037         }
11038
11039         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11040
11041         err = rdev_probe_client(rdev, dev, addr, &cookie);
11042         if (err)
11043                 goto free_msg;
11044
11045         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11046                               NL80211_ATTR_PAD))
11047                 goto nla_put_failure;
11048
11049         genlmsg_end(msg, hdr);
11050
11051         return genlmsg_reply(msg, info);
11052
11053  nla_put_failure:
11054         err = -ENOBUFS;
11055  free_msg:
11056         nlmsg_free(msg);
11057         return err;
11058 }
11059
11060 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11061 {
11062         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11063         struct cfg80211_beacon_registration *reg, *nreg;
11064         int rv;
11065
11066         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11067                 return -EOPNOTSUPP;
11068
11069         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11070         if (!nreg)
11071                 return -ENOMEM;
11072
11073         /* First, check if already registered. */
11074         spin_lock_bh(&rdev->beacon_registrations_lock);
11075         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11076                 if (reg->nlportid == info->snd_portid) {
11077                         rv = -EALREADY;
11078                         goto out_err;
11079                 }
11080         }
11081         /* Add it to the list */
11082         nreg->nlportid = info->snd_portid;
11083         list_add(&nreg->list, &rdev->beacon_registrations);
11084
11085         spin_unlock_bh(&rdev->beacon_registrations_lock);
11086
11087         return 0;
11088 out_err:
11089         spin_unlock_bh(&rdev->beacon_registrations_lock);
11090         kfree(nreg);
11091         return rv;
11092 }
11093
11094 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11095 {
11096         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11097         struct wireless_dev *wdev = info->user_ptr[1];
11098         int err;
11099
11100         if (!rdev->ops->start_p2p_device)
11101                 return -EOPNOTSUPP;
11102
11103         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11104                 return -EOPNOTSUPP;
11105
11106         if (wdev_running(wdev))
11107                 return 0;
11108
11109         if (rfkill_blocked(rdev->rfkill))
11110                 return -ERFKILL;
11111
11112         err = rdev_start_p2p_device(rdev, wdev);
11113         if (err)
11114                 return err;
11115
11116         wdev->is_running = true;
11117         rdev->opencount++;
11118
11119         return 0;
11120 }
11121
11122 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11123 {
11124         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11125         struct wireless_dev *wdev = info->user_ptr[1];
11126
11127         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11128                 return -EOPNOTSUPP;
11129
11130         if (!rdev->ops->stop_p2p_device)
11131                 return -EOPNOTSUPP;
11132
11133         cfg80211_stop_p2p_device(rdev, wdev);
11134
11135         return 0;
11136 }
11137
11138 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11139 {
11140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11141         struct wireless_dev *wdev = info->user_ptr[1];
11142         struct cfg80211_nan_conf conf = {};
11143         int err;
11144
11145         if (wdev->iftype != NL80211_IFTYPE_NAN)
11146                 return -EOPNOTSUPP;
11147
11148         if (wdev_running(wdev))
11149                 return -EEXIST;
11150
11151         if (rfkill_blocked(rdev->rfkill))
11152                 return -ERFKILL;
11153
11154         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11155                 return -EINVAL;
11156
11157         conf.master_pref =
11158                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11159         if (!conf.master_pref)
11160                 return -EINVAL;
11161
11162         if (info->attrs[NL80211_ATTR_BANDS]) {
11163                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11164
11165                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11166                         return -EOPNOTSUPP;
11167
11168                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11169                         return -EINVAL;
11170
11171                 conf.bands = bands;
11172         }
11173
11174         err = rdev_start_nan(rdev, wdev, &conf);
11175         if (err)
11176                 return err;
11177
11178         wdev->is_running = true;
11179         rdev->opencount++;
11180
11181         return 0;
11182 }
11183
11184 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11185 {
11186         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11187         struct wireless_dev *wdev = info->user_ptr[1];
11188
11189         if (wdev->iftype != NL80211_IFTYPE_NAN)
11190                 return -EOPNOTSUPP;
11191
11192         cfg80211_stop_nan(rdev, wdev);
11193
11194         return 0;
11195 }
11196
11197 static int validate_nan_filter(struct nlattr *filter_attr)
11198 {
11199         struct nlattr *attr;
11200         int len = 0, n_entries = 0, rem;
11201
11202         nla_for_each_nested(attr, filter_attr, rem) {
11203                 len += nla_len(attr);
11204                 n_entries++;
11205         }
11206
11207         if (len >= U8_MAX)
11208                 return -EINVAL;
11209
11210         return n_entries;
11211 }
11212
11213 static int handle_nan_filter(struct nlattr *attr_filter,
11214                              struct cfg80211_nan_func *func,
11215                              bool tx)
11216 {
11217         struct nlattr *attr;
11218         int n_entries, rem, i;
11219         struct cfg80211_nan_func_filter *filter;
11220
11221         n_entries = validate_nan_filter(attr_filter);
11222         if (n_entries < 0)
11223                 return n_entries;
11224
11225         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11226
11227         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11228         if (!filter)
11229                 return -ENOMEM;
11230
11231         i = 0;
11232         nla_for_each_nested(attr, attr_filter, rem) {
11233                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11234                 filter[i].len = nla_len(attr);
11235                 i++;
11236         }
11237         if (tx) {
11238                 func->num_tx_filters = n_entries;
11239                 func->tx_filters = filter;
11240         } else {
11241                 func->num_rx_filters = n_entries;
11242                 func->rx_filters = filter;
11243         }
11244
11245         return 0;
11246 }
11247
11248 static int nl80211_nan_add_func(struct sk_buff *skb,
11249                                 struct genl_info *info)
11250 {
11251         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11252         struct wireless_dev *wdev = info->user_ptr[1];
11253         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11254         struct cfg80211_nan_func *func;
11255         struct sk_buff *msg = NULL;
11256         void *hdr = NULL;
11257         int err = 0;
11258
11259         if (wdev->iftype != NL80211_IFTYPE_NAN)
11260                 return -EOPNOTSUPP;
11261
11262         if (!wdev_running(wdev))
11263                 return -ENOTCONN;
11264
11265         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11266                 return -EINVAL;
11267
11268         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11269                                info->attrs[NL80211_ATTR_NAN_FUNC],
11270                                nl80211_nan_func_policy, info->extack);
11271         if (err)
11272                 return err;
11273
11274         func = kzalloc(sizeof(*func), GFP_KERNEL);
11275         if (!func)
11276                 return -ENOMEM;
11277
11278         func->cookie = wdev->wiphy->cookie_counter++;
11279
11280         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11281             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11282                 err = -EINVAL;
11283                 goto out;
11284         }
11285
11286
11287         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11288
11289         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11290                 err = -EINVAL;
11291                 goto out;
11292         }
11293
11294         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11295                sizeof(func->service_id));
11296
11297         func->close_range =
11298                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11299
11300         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11301                 func->serv_spec_info_len =
11302                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11303                 func->serv_spec_info =
11304                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11305                                 func->serv_spec_info_len,
11306                                 GFP_KERNEL);
11307                 if (!func->serv_spec_info) {
11308                         err = -ENOMEM;
11309                         goto out;
11310                 }
11311         }
11312
11313         if (tb[NL80211_NAN_FUNC_TTL])
11314                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11315
11316         switch (func->type) {
11317         case NL80211_NAN_FUNC_PUBLISH:
11318                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11319                         err = -EINVAL;
11320                         goto out;
11321                 }
11322
11323                 func->publish_type =
11324                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11325                 func->publish_bcast =
11326                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11327
11328                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11329                         func->publish_bcast) {
11330                         err = -EINVAL;
11331                         goto out;
11332                 }
11333                 break;
11334         case NL80211_NAN_FUNC_SUBSCRIBE:
11335                 func->subscribe_active =
11336                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11337                 break;
11338         case NL80211_NAN_FUNC_FOLLOW_UP:
11339                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11340                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]) {
11341                         err = -EINVAL;
11342                         goto out;
11343                 }
11344
11345                 func->followup_id =
11346                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11347                 func->followup_reqid =
11348                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11349                 memcpy(func->followup_dest.addr,
11350                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11351                        sizeof(func->followup_dest.addr));
11352                 if (func->ttl) {
11353                         err = -EINVAL;
11354                         goto out;
11355                 }
11356                 break;
11357         default:
11358                 err = -EINVAL;
11359                 goto out;
11360         }
11361
11362         if (tb[NL80211_NAN_FUNC_SRF]) {
11363                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11364
11365                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11366                                        tb[NL80211_NAN_FUNC_SRF],
11367                                        nl80211_nan_srf_policy, info->extack);
11368                 if (err)
11369                         goto out;
11370
11371                 func->srf_include =
11372                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11373
11374                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11375                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11376                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11377                                 err = -EINVAL;
11378                                 goto out;
11379                         }
11380
11381                         func->srf_bf_len =
11382                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11383                         func->srf_bf =
11384                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11385                                         func->srf_bf_len, GFP_KERNEL);
11386                         if (!func->srf_bf) {
11387                                 err = -ENOMEM;
11388                                 goto out;
11389                         }
11390
11391                         func->srf_bf_idx =
11392                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11393                 } else {
11394                         struct nlattr *attr, *mac_attr =
11395                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11396                         int n_entries, rem, i = 0;
11397
11398                         if (!mac_attr) {
11399                                 err = -EINVAL;
11400                                 goto out;
11401                         }
11402
11403                         n_entries = validate_acl_mac_addrs(mac_attr);
11404                         if (n_entries <= 0) {
11405                                 err = -EINVAL;
11406                                 goto out;
11407                         }
11408
11409                         func->srf_num_macs = n_entries;
11410                         func->srf_macs =
11411                                 kzalloc(sizeof(*func->srf_macs) * n_entries,
11412                                         GFP_KERNEL);
11413                         if (!func->srf_macs) {
11414                                 err = -ENOMEM;
11415                                 goto out;
11416                         }
11417
11418                         nla_for_each_nested(attr, mac_attr, rem)
11419                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11420                                        sizeof(*func->srf_macs));
11421                 }
11422         }
11423
11424         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11425                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11426                                         func, true);
11427                 if (err)
11428                         goto out;
11429         }
11430
11431         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11432                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11433                                         func, false);
11434                 if (err)
11435                         goto out;
11436         }
11437
11438         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11439         if (!msg) {
11440                 err = -ENOMEM;
11441                 goto out;
11442         }
11443
11444         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11445                              NL80211_CMD_ADD_NAN_FUNCTION);
11446         /* This can't really happen - we just allocated 4KB */
11447         if (WARN_ON(!hdr)) {
11448                 err = -ENOMEM;
11449                 goto out;
11450         }
11451
11452         err = rdev_add_nan_func(rdev, wdev, func);
11453 out:
11454         if (err < 0) {
11455                 cfg80211_free_nan_func(func);
11456                 nlmsg_free(msg);
11457                 return err;
11458         }
11459
11460         /* propagate the instance id and cookie to userspace  */
11461         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11462                               NL80211_ATTR_PAD))
11463                 goto nla_put_failure;
11464
11465         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11466         if (!func_attr)
11467                 goto nla_put_failure;
11468
11469         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11470                        func->instance_id))
11471                 goto nla_put_failure;
11472
11473         nla_nest_end(msg, func_attr);
11474
11475         genlmsg_end(msg, hdr);
11476         return genlmsg_reply(msg, info);
11477
11478 nla_put_failure:
11479         nlmsg_free(msg);
11480         return -ENOBUFS;
11481 }
11482
11483 static int nl80211_nan_del_func(struct sk_buff *skb,
11484                                struct genl_info *info)
11485 {
11486         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11487         struct wireless_dev *wdev = info->user_ptr[1];
11488         u64 cookie;
11489
11490         if (wdev->iftype != NL80211_IFTYPE_NAN)
11491                 return -EOPNOTSUPP;
11492
11493         if (!wdev_running(wdev))
11494                 return -ENOTCONN;
11495
11496         if (!info->attrs[NL80211_ATTR_COOKIE])
11497                 return -EINVAL;
11498
11499         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11500
11501         rdev_del_nan_func(rdev, wdev, cookie);
11502
11503         return 0;
11504 }
11505
11506 static int nl80211_nan_change_config(struct sk_buff *skb,
11507                                      struct genl_info *info)
11508 {
11509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11510         struct wireless_dev *wdev = info->user_ptr[1];
11511         struct cfg80211_nan_conf conf = {};
11512         u32 changed = 0;
11513
11514         if (wdev->iftype != NL80211_IFTYPE_NAN)
11515                 return -EOPNOTSUPP;
11516
11517         if (!wdev_running(wdev))
11518                 return -ENOTCONN;
11519
11520         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11521                 conf.master_pref =
11522                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11523                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11524                         return -EINVAL;
11525
11526                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11527         }
11528
11529         if (info->attrs[NL80211_ATTR_BANDS]) {
11530                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11531
11532                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11533                         return -EOPNOTSUPP;
11534
11535                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11536                         return -EINVAL;
11537
11538                 conf.bands = bands;
11539                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11540         }
11541
11542         if (!changed)
11543                 return -EINVAL;
11544
11545         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11546 }
11547
11548 void cfg80211_nan_match(struct wireless_dev *wdev,
11549                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11550 {
11551         struct wiphy *wiphy = wdev->wiphy;
11552         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11553         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11554         struct sk_buff *msg;
11555         void *hdr;
11556
11557         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11558                 return;
11559
11560         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11561         if (!msg)
11562                 return;
11563
11564         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11565         if (!hdr) {
11566                 nlmsg_free(msg);
11567                 return;
11568         }
11569
11570         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11571             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11572                                          wdev->netdev->ifindex)) ||
11573             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11574                               NL80211_ATTR_PAD))
11575                 goto nla_put_failure;
11576
11577         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11578                               NL80211_ATTR_PAD) ||
11579             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11580                 goto nla_put_failure;
11581
11582         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11583         if (!match_attr)
11584                 goto nla_put_failure;
11585
11586         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
11587         if (!local_func_attr)
11588                 goto nla_put_failure;
11589
11590         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
11591                 goto nla_put_failure;
11592
11593         nla_nest_end(msg, local_func_attr);
11594
11595         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
11596         if (!peer_func_attr)
11597                 goto nla_put_failure;
11598
11599         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
11600             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
11601                 goto nla_put_failure;
11602
11603         if (match->info && match->info_len &&
11604             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
11605                     match->info))
11606                 goto nla_put_failure;
11607
11608         nla_nest_end(msg, peer_func_attr);
11609         nla_nest_end(msg, match_attr);
11610         genlmsg_end(msg, hdr);
11611
11612         if (!wdev->owner_nlportid)
11613                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11614                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11615         else
11616                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11617                                 wdev->owner_nlportid);
11618
11619         return;
11620
11621 nla_put_failure:
11622         nlmsg_free(msg);
11623 }
11624 EXPORT_SYMBOL(cfg80211_nan_match);
11625
11626 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
11627                                   u8 inst_id,
11628                                   enum nl80211_nan_func_term_reason reason,
11629                                   u64 cookie, gfp_t gfp)
11630 {
11631         struct wiphy *wiphy = wdev->wiphy;
11632         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11633         struct sk_buff *msg;
11634         struct nlattr *func_attr;
11635         void *hdr;
11636
11637         if (WARN_ON(!inst_id))
11638                 return;
11639
11640         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11641         if (!msg)
11642                 return;
11643
11644         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
11645         if (!hdr) {
11646                 nlmsg_free(msg);
11647                 return;
11648         }
11649
11650         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11651             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11652                                          wdev->netdev->ifindex)) ||
11653             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11654                               NL80211_ATTR_PAD))
11655                 goto nla_put_failure;
11656
11657         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11658                               NL80211_ATTR_PAD))
11659                 goto nla_put_failure;
11660
11661         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11662         if (!func_attr)
11663                 goto nla_put_failure;
11664
11665         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
11666             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
11667                 goto nla_put_failure;
11668
11669         nla_nest_end(msg, func_attr);
11670         genlmsg_end(msg, hdr);
11671
11672         if (!wdev->owner_nlportid)
11673                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11674                                         msg, 0, NL80211_MCGRP_NAN, gfp);
11675         else
11676                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
11677                                 wdev->owner_nlportid);
11678
11679         return;
11680
11681 nla_put_failure:
11682         nlmsg_free(msg);
11683 }
11684 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
11685
11686 static int nl80211_get_protocol_features(struct sk_buff *skb,
11687                                          struct genl_info *info)
11688 {
11689         void *hdr;
11690         struct sk_buff *msg;
11691
11692         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11693         if (!msg)
11694                 return -ENOMEM;
11695
11696         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11697                              NL80211_CMD_GET_PROTOCOL_FEATURES);
11698         if (!hdr)
11699                 goto nla_put_failure;
11700
11701         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
11702                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
11703                 goto nla_put_failure;
11704
11705         genlmsg_end(msg, hdr);
11706         return genlmsg_reply(msg, info);
11707
11708  nla_put_failure:
11709         kfree_skb(msg);
11710         return -ENOBUFS;
11711 }
11712
11713 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
11714 {
11715         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11716         struct cfg80211_update_ft_ies_params ft_params;
11717         struct net_device *dev = info->user_ptr[1];
11718
11719         if (!rdev->ops->update_ft_ies)
11720                 return -EOPNOTSUPP;
11721
11722         if (!info->attrs[NL80211_ATTR_MDID] ||
11723             !is_valid_ie_attr(info->attrs[NL80211_ATTR_IE]))
11724                 return -EINVAL;
11725
11726         memset(&ft_params, 0, sizeof(ft_params));
11727         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
11728         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11729         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11730
11731         return rdev_update_ft_ies(rdev, dev, &ft_params);
11732 }
11733
11734 static int nl80211_crit_protocol_start(struct sk_buff *skb,
11735                                        struct genl_info *info)
11736 {
11737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11738         struct wireless_dev *wdev = info->user_ptr[1];
11739         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
11740         u16 duration;
11741         int ret;
11742
11743         if (!rdev->ops->crit_proto_start)
11744                 return -EOPNOTSUPP;
11745
11746         if (WARN_ON(!rdev->ops->crit_proto_stop))
11747                 return -EINVAL;
11748
11749         if (rdev->crit_proto_nlportid)
11750                 return -EBUSY;
11751
11752         /* determine protocol if provided */
11753         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
11754                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
11755
11756         if (proto >= NUM_NL80211_CRIT_PROTO)
11757                 return -EINVAL;
11758
11759         /* timeout must be provided */
11760         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
11761                 return -EINVAL;
11762
11763         duration =
11764                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
11765
11766         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
11767                 return -ERANGE;
11768
11769         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
11770         if (!ret)
11771                 rdev->crit_proto_nlportid = info->snd_portid;
11772
11773         return ret;
11774 }
11775
11776 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
11777                                       struct genl_info *info)
11778 {
11779         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11780         struct wireless_dev *wdev = info->user_ptr[1];
11781
11782         if (!rdev->ops->crit_proto_stop)
11783                 return -EOPNOTSUPP;
11784
11785         if (rdev->crit_proto_nlportid) {
11786                 rdev->crit_proto_nlportid = 0;
11787                 rdev_crit_proto_stop(rdev, wdev);
11788         }
11789         return 0;
11790 }
11791
11792 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
11793 {
11794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11795         struct wireless_dev *wdev =
11796                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
11797         int i, err;
11798         u32 vid, subcmd;
11799
11800         if (!rdev->wiphy.vendor_commands)
11801                 return -EOPNOTSUPP;
11802
11803         if (IS_ERR(wdev)) {
11804                 err = PTR_ERR(wdev);
11805                 if (err != -EINVAL)
11806                         return err;
11807                 wdev = NULL;
11808         } else if (wdev->wiphy != &rdev->wiphy) {
11809                 return -EINVAL;
11810         }
11811
11812         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
11813             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
11814                 return -EINVAL;
11815
11816         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
11817         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
11818         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
11819                 const struct wiphy_vendor_command *vcmd;
11820                 void *data = NULL;
11821                 int len = 0;
11822
11823                 vcmd = &rdev->wiphy.vendor_commands[i];
11824
11825                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11826                         continue;
11827
11828                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11829                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11830                         if (!wdev)
11831                                 return -EINVAL;
11832                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11833                             !wdev->netdev)
11834                                 return -EINVAL;
11835
11836                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11837                                 if (!wdev_running(wdev))
11838                                         return -ENETDOWN;
11839                         }
11840
11841                         if (!vcmd->doit)
11842                                 return -EOPNOTSUPP;
11843                 } else {
11844                         wdev = NULL;
11845                 }
11846
11847                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
11848                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11849                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
11850                 }
11851
11852                 rdev->cur_cmd_info = info;
11853                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
11854                                                           data, len);
11855                 rdev->cur_cmd_info = NULL;
11856                 return err;
11857         }
11858
11859         return -EOPNOTSUPP;
11860 }
11861
11862 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
11863                                        struct netlink_callback *cb,
11864                                        struct cfg80211_registered_device **rdev,
11865                                        struct wireless_dev **wdev)
11866 {
11867         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
11868         u32 vid, subcmd;
11869         unsigned int i;
11870         int vcmd_idx = -1;
11871         int err;
11872         void *data = NULL;
11873         unsigned int data_len = 0;
11874
11875         if (cb->args[0]) {
11876                 /* subtract the 1 again here */
11877                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
11878                 struct wireless_dev *tmp;
11879
11880                 if (!wiphy)
11881                         return -ENODEV;
11882                 *rdev = wiphy_to_rdev(wiphy);
11883                 *wdev = NULL;
11884
11885                 if (cb->args[1]) {
11886                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
11887                                 if (tmp->identifier == cb->args[1] - 1) {
11888                                         *wdev = tmp;
11889                                         break;
11890                                 }
11891                         }
11892                 }
11893
11894                 /* keep rtnl locked in successful case */
11895                 return 0;
11896         }
11897
11898         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
11899                           nl80211_fam.maxattr, nl80211_policy, NULL);
11900         if (err)
11901                 return err;
11902
11903         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
11904             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
11905                 return -EINVAL;
11906
11907         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
11908         if (IS_ERR(*wdev))
11909                 *wdev = NULL;
11910
11911         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11912         if (IS_ERR(*rdev))
11913                 return PTR_ERR(*rdev);
11914
11915         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
11916         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
11917
11918         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
11919                 const struct wiphy_vendor_command *vcmd;
11920
11921                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
11922
11923                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
11924                         continue;
11925
11926                 if (!vcmd->dumpit)
11927                         return -EOPNOTSUPP;
11928
11929                 vcmd_idx = i;
11930                 break;
11931         }
11932
11933         if (vcmd_idx < 0)
11934                 return -EOPNOTSUPP;
11935
11936         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
11937                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11938                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
11939         }
11940
11941         /* 0 is the first index - add 1 to parse only once */
11942         cb->args[0] = (*rdev)->wiphy_idx + 1;
11943         /* add 1 to know if it was NULL */
11944         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
11945         cb->args[2] = vcmd_idx;
11946         cb->args[3] = (unsigned long)data;
11947         cb->args[4] = data_len;
11948
11949         /* keep rtnl locked in successful case */
11950         return 0;
11951 }
11952
11953 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
11954                                    struct netlink_callback *cb)
11955 {
11956         struct cfg80211_registered_device *rdev;
11957         struct wireless_dev *wdev;
11958         unsigned int vcmd_idx;
11959         const struct wiphy_vendor_command *vcmd;
11960         void *data;
11961         int data_len;
11962         int err;
11963         struct nlattr *vendor_data;
11964
11965         rtnl_lock();
11966         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
11967         if (err)
11968                 goto out;
11969
11970         vcmd_idx = cb->args[2];
11971         data = (void *)cb->args[3];
11972         data_len = cb->args[4];
11973         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
11974
11975         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
11976                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
11977                 if (!wdev) {
11978                         err = -EINVAL;
11979                         goto out;
11980                 }
11981                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
11982                     !wdev->netdev) {
11983                         err = -EINVAL;
11984                         goto out;
11985                 }
11986
11987                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
11988                         if (!wdev_running(wdev)) {
11989                                 err = -ENETDOWN;
11990                                 goto out;
11991                         }
11992                 }
11993         }
11994
11995         while (1) {
11996                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11997                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11998                                            NL80211_CMD_VENDOR);
11999                 if (!hdr)
12000                         break;
12001
12002                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12003                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12004                                                wdev_id(wdev),
12005                                                NL80211_ATTR_PAD))) {
12006                         genlmsg_cancel(skb, hdr);
12007                         break;
12008                 }
12009
12010                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12011                 if (!vendor_data) {
12012                         genlmsg_cancel(skb, hdr);
12013                         break;
12014                 }
12015
12016                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12017                                    (unsigned long *)&cb->args[5]);
12018                 nla_nest_end(skb, vendor_data);
12019
12020                 if (err == -ENOBUFS || err == -ENOENT) {
12021                         genlmsg_cancel(skb, hdr);
12022                         break;
12023                 } else if (err) {
12024                         genlmsg_cancel(skb, hdr);
12025                         goto out;
12026                 }
12027
12028                 genlmsg_end(skb, hdr);
12029         }
12030
12031         err = skb->len;
12032  out:
12033         rtnl_unlock();
12034         return err;
12035 }
12036
12037 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12038                                            enum nl80211_commands cmd,
12039                                            enum nl80211_attrs attr,
12040                                            int approxlen)
12041 {
12042         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12043
12044         if (WARN_ON(!rdev->cur_cmd_info))
12045                 return NULL;
12046
12047         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12048                                            rdev->cur_cmd_info->snd_portid,
12049                                            rdev->cur_cmd_info->snd_seq,
12050                                            cmd, attr, NULL, GFP_KERNEL);
12051 }
12052 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12053
12054 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12055 {
12056         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12057         void *hdr = ((void **)skb->cb)[1];
12058         struct nlattr *data = ((void **)skb->cb)[2];
12059
12060         /* clear CB data for netlink core to own from now on */
12061         memset(skb->cb, 0, sizeof(skb->cb));
12062
12063         if (WARN_ON(!rdev->cur_cmd_info)) {
12064                 kfree_skb(skb);
12065                 return -EINVAL;
12066         }
12067
12068         nla_nest_end(skb, data);
12069         genlmsg_end(skb, hdr);
12070         return genlmsg_reply(skb, rdev->cur_cmd_info);
12071 }
12072 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12073
12074 static int nl80211_set_qos_map(struct sk_buff *skb,
12075                                struct genl_info *info)
12076 {
12077         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12078         struct cfg80211_qos_map *qos_map = NULL;
12079         struct net_device *dev = info->user_ptr[1];
12080         u8 *pos, len, num_des, des_len, des;
12081         int ret;
12082
12083         if (!rdev->ops->set_qos_map)
12084                 return -EOPNOTSUPP;
12085
12086         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12087                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12088                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12089
12090                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12091                     len > IEEE80211_QOS_MAP_LEN_MAX)
12092                         return -EINVAL;
12093
12094                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12095                 if (!qos_map)
12096                         return -ENOMEM;
12097
12098                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12099                 if (num_des) {
12100                         des_len = num_des *
12101                                 sizeof(struct cfg80211_dscp_exception);
12102                         memcpy(qos_map->dscp_exception, pos, des_len);
12103                         qos_map->num_des = num_des;
12104                         for (des = 0; des < num_des; des++) {
12105                                 if (qos_map->dscp_exception[des].up > 7) {
12106                                         kfree(qos_map);
12107                                         return -EINVAL;
12108                                 }
12109                         }
12110                         pos += des_len;
12111                 }
12112                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12113         }
12114
12115         wdev_lock(dev->ieee80211_ptr);
12116         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12117         if (!ret)
12118                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12119         wdev_unlock(dev->ieee80211_ptr);
12120
12121         kfree(qos_map);
12122         return ret;
12123 }
12124
12125 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12126 {
12127         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12128         struct net_device *dev = info->user_ptr[1];
12129         struct wireless_dev *wdev = dev->ieee80211_ptr;
12130         const u8 *peer;
12131         u8 tsid, up;
12132         u16 admitted_time = 0;
12133         int err;
12134
12135         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12136                 return -EOPNOTSUPP;
12137
12138         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12139             !info->attrs[NL80211_ATTR_USER_PRIO])
12140                 return -EINVAL;
12141
12142         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12143         if (tsid >= IEEE80211_NUM_TIDS)
12144                 return -EINVAL;
12145
12146         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12147         if (up >= IEEE80211_NUM_UPS)
12148                 return -EINVAL;
12149
12150         /* WMM uses TIDs 0-7 even for TSPEC */
12151         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12152                 /* TODO: handle 802.11 TSPEC/admission control
12153                  * need more attributes for that (e.g. BA session requirement);
12154                  * change the WMM adminssion test above to allow both then
12155                  */
12156                 return -EINVAL;
12157         }
12158
12159         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12160
12161         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12162                 admitted_time =
12163                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12164                 if (!admitted_time)
12165                         return -EINVAL;
12166         }
12167
12168         wdev_lock(wdev);
12169         switch (wdev->iftype) {
12170         case NL80211_IFTYPE_STATION:
12171         case NL80211_IFTYPE_P2P_CLIENT:
12172                 if (wdev->current_bss)
12173                         break;
12174                 err = -ENOTCONN;
12175                 goto out;
12176         default:
12177                 err = -EOPNOTSUPP;
12178                 goto out;
12179         }
12180
12181         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12182
12183  out:
12184         wdev_unlock(wdev);
12185         return err;
12186 }
12187
12188 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12189 {
12190         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12191         struct net_device *dev = info->user_ptr[1];
12192         struct wireless_dev *wdev = dev->ieee80211_ptr;
12193         const u8 *peer;
12194         u8 tsid;
12195         int err;
12196
12197         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12198                 return -EINVAL;
12199
12200         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12201         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12202
12203         wdev_lock(wdev);
12204         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12205         wdev_unlock(wdev);
12206
12207         return err;
12208 }
12209
12210 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12211                                        struct genl_info *info)
12212 {
12213         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12214         struct net_device *dev = info->user_ptr[1];
12215         struct wireless_dev *wdev = dev->ieee80211_ptr;
12216         struct cfg80211_chan_def chandef = {};
12217         const u8 *addr;
12218         u8 oper_class;
12219         int err;
12220
12221         if (!rdev->ops->tdls_channel_switch ||
12222             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12223                 return -EOPNOTSUPP;
12224
12225         switch (dev->ieee80211_ptr->iftype) {
12226         case NL80211_IFTYPE_STATION:
12227         case NL80211_IFTYPE_P2P_CLIENT:
12228                 break;
12229         default:
12230                 return -EOPNOTSUPP;
12231         }
12232
12233         if (!info->attrs[NL80211_ATTR_MAC] ||
12234             !info->attrs[NL80211_ATTR_OPER_CLASS])
12235                 return -EINVAL;
12236
12237         err = nl80211_parse_chandef(rdev, info, &chandef);
12238         if (err)
12239                 return err;
12240
12241         /*
12242          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12243          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12244          * specification is not defined for them.
12245          */
12246         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12247             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12248             chandef.width != NL80211_CHAN_WIDTH_20)
12249                 return -EINVAL;
12250
12251         /* we will be active on the TDLS link */
12252         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12253                                            wdev->iftype))
12254                 return -EINVAL;
12255
12256         /* don't allow switching to DFS channels */
12257         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12258                 return -EINVAL;
12259
12260         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12261         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12262
12263         wdev_lock(wdev);
12264         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12265         wdev_unlock(wdev);
12266
12267         return err;
12268 }
12269
12270 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12271                                               struct genl_info *info)
12272 {
12273         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12274         struct net_device *dev = info->user_ptr[1];
12275         struct wireless_dev *wdev = dev->ieee80211_ptr;
12276         const u8 *addr;
12277
12278         if (!rdev->ops->tdls_channel_switch ||
12279             !rdev->ops->tdls_cancel_channel_switch ||
12280             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12281                 return -EOPNOTSUPP;
12282
12283         switch (dev->ieee80211_ptr->iftype) {
12284         case NL80211_IFTYPE_STATION:
12285         case NL80211_IFTYPE_P2P_CLIENT:
12286                 break;
12287         default:
12288                 return -EOPNOTSUPP;
12289         }
12290
12291         if (!info->attrs[NL80211_ATTR_MAC])
12292                 return -EINVAL;
12293
12294         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12295
12296         wdev_lock(wdev);
12297         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12298         wdev_unlock(wdev);
12299
12300         return 0;
12301 }
12302
12303 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12304                                             struct genl_info *info)
12305 {
12306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12307         struct net_device *dev = info->user_ptr[1];
12308         struct wireless_dev *wdev = dev->ieee80211_ptr;
12309         const struct nlattr *nla;
12310         bool enabled;
12311
12312         if (!rdev->ops->set_multicast_to_unicast)
12313                 return -EOPNOTSUPP;
12314
12315         if (wdev->iftype != NL80211_IFTYPE_AP &&
12316             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12317                 return -EOPNOTSUPP;
12318
12319         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12320         enabled = nla_get_flag(nla);
12321
12322         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12323 }
12324
12325 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12326 {
12327         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12328         struct net_device *dev = info->user_ptr[1];
12329         struct wireless_dev *wdev = dev->ieee80211_ptr;
12330         struct cfg80211_pmk_conf pmk_conf = {};
12331         int ret;
12332
12333         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12334             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12335                 return -EOPNOTSUPP;
12336
12337         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12338                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12339                 return -EOPNOTSUPP;
12340
12341         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12342                 return -EINVAL;
12343
12344         wdev_lock(wdev);
12345         if (!wdev->current_bss) {
12346                 ret = -ENOTCONN;
12347                 goto out;
12348         }
12349
12350         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12351         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12352                 ret = -EINVAL;
12353                 goto out;
12354         }
12355
12356         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12357         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12358         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12359             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12360                 ret = -EINVAL;
12361                 goto out;
12362         }
12363
12364         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12365                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12366
12367                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12368                         ret = -EINVAL;
12369                         goto out;
12370                 }
12371
12372                 pmk_conf.pmk_r0_name =
12373                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12374         }
12375
12376         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12377 out:
12378         wdev_unlock(wdev);
12379         return ret;
12380 }
12381
12382 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12383 {
12384         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12385         struct net_device *dev = info->user_ptr[1];
12386         struct wireless_dev *wdev = dev->ieee80211_ptr;
12387         const u8 *aa;
12388         int ret;
12389
12390         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12391             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12392                 return -EOPNOTSUPP;
12393
12394         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12395                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12396                 return -EOPNOTSUPP;
12397
12398         if (!info->attrs[NL80211_ATTR_MAC])
12399                 return -EINVAL;
12400
12401         wdev_lock(wdev);
12402         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12403         ret = rdev_del_pmk(rdev, dev, aa);
12404         wdev_unlock(wdev);
12405
12406         return ret;
12407 }
12408
12409 #define NL80211_FLAG_NEED_WIPHY         0x01
12410 #define NL80211_FLAG_NEED_NETDEV        0x02
12411 #define NL80211_FLAG_NEED_RTNL          0x04
12412 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
12413 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
12414                                          NL80211_FLAG_CHECK_NETDEV_UP)
12415 #define NL80211_FLAG_NEED_WDEV          0x10
12416 /* If a netdev is associated, it must be UP, P2P must be started */
12417 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
12418                                          NL80211_FLAG_CHECK_NETDEV_UP)
12419 #define NL80211_FLAG_CLEAR_SKB          0x20
12420
12421 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12422                             struct genl_info *info)
12423 {
12424         struct cfg80211_registered_device *rdev;
12425         struct wireless_dev *wdev;
12426         struct net_device *dev;
12427         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
12428
12429         if (rtnl)
12430                 rtnl_lock();
12431
12432         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
12433                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
12434                 if (IS_ERR(rdev)) {
12435                         if (rtnl)
12436                                 rtnl_unlock();
12437                         return PTR_ERR(rdev);
12438                 }
12439                 info->user_ptr[0] = rdev;
12440         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
12441                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12442                 ASSERT_RTNL();
12443
12444                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
12445                                                   info->attrs);
12446                 if (IS_ERR(wdev)) {
12447                         if (rtnl)
12448                                 rtnl_unlock();
12449                         return PTR_ERR(wdev);
12450                 }
12451
12452                 dev = wdev->netdev;
12453                 rdev = wiphy_to_rdev(wdev->wiphy);
12454
12455                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
12456                         if (!dev) {
12457                                 if (rtnl)
12458                                         rtnl_unlock();
12459                                 return -EINVAL;
12460                         }
12461
12462                         info->user_ptr[1] = dev;
12463                 } else {
12464                         info->user_ptr[1] = wdev;
12465                 }
12466
12467                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
12468                     !wdev_running(wdev)) {
12469                         if (rtnl)
12470                                 rtnl_unlock();
12471                         return -ENETDOWN;
12472                 }
12473
12474                 if (dev)
12475                         dev_hold(dev);
12476
12477                 info->user_ptr[0] = rdev;
12478         }
12479
12480         return 0;
12481 }
12482
12483 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
12484                               struct genl_info *info)
12485 {
12486         if (info->user_ptr[1]) {
12487                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
12488                         struct wireless_dev *wdev = info->user_ptr[1];
12489
12490                         if (wdev->netdev)
12491                                 dev_put(wdev->netdev);
12492                 } else {
12493                         dev_put(info->user_ptr[1]);
12494                 }
12495         }
12496
12497         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
12498                 rtnl_unlock();
12499
12500         /* If needed, clear the netlink message payload from the SKB
12501          * as it might contain key data that shouldn't stick around on
12502          * the heap after the SKB is freed. The netlink message header
12503          * is still needed for further processing, so leave it intact.
12504          */
12505         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
12506                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
12507
12508                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
12509         }
12510 }
12511
12512 static const struct genl_ops nl80211_ops[] = {
12513         {
12514                 .cmd = NL80211_CMD_GET_WIPHY,
12515                 .doit = nl80211_get_wiphy,
12516                 .dumpit = nl80211_dump_wiphy,
12517                 .done = nl80211_dump_wiphy_done,
12518                 .policy = nl80211_policy,
12519                 /* can be retrieved by unprivileged users */
12520                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12521                                   NL80211_FLAG_NEED_RTNL,
12522         },
12523         {
12524                 .cmd = NL80211_CMD_SET_WIPHY,
12525                 .doit = nl80211_set_wiphy,
12526                 .policy = nl80211_policy,
12527                 .flags = GENL_UNS_ADMIN_PERM,
12528                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12529         },
12530         {
12531                 .cmd = NL80211_CMD_GET_INTERFACE,
12532                 .doit = nl80211_get_interface,
12533                 .dumpit = nl80211_dump_interface,
12534                 .policy = nl80211_policy,
12535                 /* can be retrieved by unprivileged users */
12536                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12537                                   NL80211_FLAG_NEED_RTNL,
12538         },
12539         {
12540                 .cmd = NL80211_CMD_SET_INTERFACE,
12541                 .doit = nl80211_set_interface,
12542                 .policy = nl80211_policy,
12543                 .flags = GENL_UNS_ADMIN_PERM,
12544                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12545                                   NL80211_FLAG_NEED_RTNL,
12546         },
12547         {
12548                 .cmd = NL80211_CMD_NEW_INTERFACE,
12549                 .doit = nl80211_new_interface,
12550                 .policy = nl80211_policy,
12551                 .flags = GENL_UNS_ADMIN_PERM,
12552                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12553                                   NL80211_FLAG_NEED_RTNL,
12554         },
12555         {
12556                 .cmd = NL80211_CMD_DEL_INTERFACE,
12557                 .doit = nl80211_del_interface,
12558                 .policy = nl80211_policy,
12559                 .flags = GENL_UNS_ADMIN_PERM,
12560                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12561                                   NL80211_FLAG_NEED_RTNL,
12562         },
12563         {
12564                 .cmd = NL80211_CMD_GET_KEY,
12565                 .doit = nl80211_get_key,
12566                 .policy = nl80211_policy,
12567                 .flags = GENL_UNS_ADMIN_PERM,
12568                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12569                                   NL80211_FLAG_NEED_RTNL,
12570         },
12571         {
12572                 .cmd = NL80211_CMD_SET_KEY,
12573                 .doit = nl80211_set_key,
12574                 .policy = nl80211_policy,
12575                 .flags = GENL_UNS_ADMIN_PERM,
12576                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12577                                   NL80211_FLAG_NEED_RTNL |
12578                                   NL80211_FLAG_CLEAR_SKB,
12579         },
12580         {
12581                 .cmd = NL80211_CMD_NEW_KEY,
12582                 .doit = nl80211_new_key,
12583                 .policy = nl80211_policy,
12584                 .flags = GENL_UNS_ADMIN_PERM,
12585                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12586                                   NL80211_FLAG_NEED_RTNL |
12587                                   NL80211_FLAG_CLEAR_SKB,
12588         },
12589         {
12590                 .cmd = NL80211_CMD_DEL_KEY,
12591                 .doit = nl80211_del_key,
12592                 .policy = nl80211_policy,
12593                 .flags = GENL_UNS_ADMIN_PERM,
12594                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12595                                   NL80211_FLAG_NEED_RTNL,
12596         },
12597         {
12598                 .cmd = NL80211_CMD_SET_BEACON,
12599                 .policy = nl80211_policy,
12600                 .flags = GENL_UNS_ADMIN_PERM,
12601                 .doit = nl80211_set_beacon,
12602                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12603                                   NL80211_FLAG_NEED_RTNL,
12604         },
12605         {
12606                 .cmd = NL80211_CMD_START_AP,
12607                 .policy = nl80211_policy,
12608                 .flags = GENL_UNS_ADMIN_PERM,
12609                 .doit = nl80211_start_ap,
12610                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12611                                   NL80211_FLAG_NEED_RTNL,
12612         },
12613         {
12614                 .cmd = NL80211_CMD_STOP_AP,
12615                 .policy = nl80211_policy,
12616                 .flags = GENL_UNS_ADMIN_PERM,
12617                 .doit = nl80211_stop_ap,
12618                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12619                                   NL80211_FLAG_NEED_RTNL,
12620         },
12621         {
12622                 .cmd = NL80211_CMD_GET_STATION,
12623                 .doit = nl80211_get_station,
12624                 .dumpit = nl80211_dump_station,
12625                 .policy = nl80211_policy,
12626                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12627                                   NL80211_FLAG_NEED_RTNL,
12628         },
12629         {
12630                 .cmd = NL80211_CMD_SET_STATION,
12631                 .doit = nl80211_set_station,
12632                 .policy = nl80211_policy,
12633                 .flags = GENL_UNS_ADMIN_PERM,
12634                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12635                                   NL80211_FLAG_NEED_RTNL,
12636         },
12637         {
12638                 .cmd = NL80211_CMD_NEW_STATION,
12639                 .doit = nl80211_new_station,
12640                 .policy = nl80211_policy,
12641                 .flags = GENL_UNS_ADMIN_PERM,
12642                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12643                                   NL80211_FLAG_NEED_RTNL,
12644         },
12645         {
12646                 .cmd = NL80211_CMD_DEL_STATION,
12647                 .doit = nl80211_del_station,
12648                 .policy = nl80211_policy,
12649                 .flags = GENL_UNS_ADMIN_PERM,
12650                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12651                                   NL80211_FLAG_NEED_RTNL,
12652         },
12653         {
12654                 .cmd = NL80211_CMD_GET_MPATH,
12655                 .doit = nl80211_get_mpath,
12656                 .dumpit = nl80211_dump_mpath,
12657                 .policy = nl80211_policy,
12658                 .flags = GENL_UNS_ADMIN_PERM,
12659                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12660                                   NL80211_FLAG_NEED_RTNL,
12661         },
12662         {
12663                 .cmd = NL80211_CMD_GET_MPP,
12664                 .doit = nl80211_get_mpp,
12665                 .dumpit = nl80211_dump_mpp,
12666                 .policy = nl80211_policy,
12667                 .flags = GENL_UNS_ADMIN_PERM,
12668                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12669                                   NL80211_FLAG_NEED_RTNL,
12670         },
12671         {
12672                 .cmd = NL80211_CMD_SET_MPATH,
12673                 .doit = nl80211_set_mpath,
12674                 .policy = nl80211_policy,
12675                 .flags = GENL_UNS_ADMIN_PERM,
12676                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12677                                   NL80211_FLAG_NEED_RTNL,
12678         },
12679         {
12680                 .cmd = NL80211_CMD_NEW_MPATH,
12681                 .doit = nl80211_new_mpath,
12682                 .policy = nl80211_policy,
12683                 .flags = GENL_UNS_ADMIN_PERM,
12684                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12685                                   NL80211_FLAG_NEED_RTNL,
12686         },
12687         {
12688                 .cmd = NL80211_CMD_DEL_MPATH,
12689                 .doit = nl80211_del_mpath,
12690                 .policy = nl80211_policy,
12691                 .flags = GENL_UNS_ADMIN_PERM,
12692                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12693                                   NL80211_FLAG_NEED_RTNL,
12694         },
12695         {
12696                 .cmd = NL80211_CMD_SET_BSS,
12697                 .doit = nl80211_set_bss,
12698                 .policy = nl80211_policy,
12699                 .flags = GENL_UNS_ADMIN_PERM,
12700                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12701                                   NL80211_FLAG_NEED_RTNL,
12702         },
12703         {
12704                 .cmd = NL80211_CMD_GET_REG,
12705                 .doit = nl80211_get_reg_do,
12706                 .dumpit = nl80211_get_reg_dump,
12707                 .policy = nl80211_policy,
12708                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12709                 /* can be retrieved by unprivileged users */
12710         },
12711 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
12712         {
12713                 .cmd = NL80211_CMD_SET_REG,
12714                 .doit = nl80211_set_reg,
12715                 .policy = nl80211_policy,
12716                 .flags = GENL_ADMIN_PERM,
12717                 .internal_flags = NL80211_FLAG_NEED_RTNL,
12718         },
12719 #endif
12720         {
12721                 .cmd = NL80211_CMD_REQ_SET_REG,
12722                 .doit = nl80211_req_set_reg,
12723                 .policy = nl80211_policy,
12724                 .flags = GENL_ADMIN_PERM,
12725         },
12726         {
12727                 .cmd = NL80211_CMD_RELOAD_REGDB,
12728                 .doit = nl80211_reload_regdb,
12729                 .policy = nl80211_policy,
12730                 .flags = GENL_ADMIN_PERM,
12731         },
12732         {
12733                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
12734                 .doit = nl80211_get_mesh_config,
12735                 .policy = nl80211_policy,
12736                 /* can be retrieved by unprivileged users */
12737                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12738                                   NL80211_FLAG_NEED_RTNL,
12739         },
12740         {
12741                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
12742                 .doit = nl80211_update_mesh_config,
12743                 .policy = nl80211_policy,
12744                 .flags = GENL_UNS_ADMIN_PERM,
12745                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12746                                   NL80211_FLAG_NEED_RTNL,
12747         },
12748         {
12749                 .cmd = NL80211_CMD_TRIGGER_SCAN,
12750                 .doit = nl80211_trigger_scan,
12751                 .policy = nl80211_policy,
12752                 .flags = GENL_UNS_ADMIN_PERM,
12753                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12754                                   NL80211_FLAG_NEED_RTNL,
12755         },
12756         {
12757                 .cmd = NL80211_CMD_ABORT_SCAN,
12758                 .doit = nl80211_abort_scan,
12759                 .policy = nl80211_policy,
12760                 .flags = GENL_UNS_ADMIN_PERM,
12761                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12762                                   NL80211_FLAG_NEED_RTNL,
12763         },
12764         {
12765                 .cmd = NL80211_CMD_GET_SCAN,
12766                 .policy = nl80211_policy,
12767                 .dumpit = nl80211_dump_scan,
12768         },
12769         {
12770                 .cmd = NL80211_CMD_START_SCHED_SCAN,
12771                 .doit = nl80211_start_sched_scan,
12772                 .policy = nl80211_policy,
12773                 .flags = GENL_UNS_ADMIN_PERM,
12774                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12775                                   NL80211_FLAG_NEED_RTNL,
12776         },
12777         {
12778                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
12779                 .doit = nl80211_stop_sched_scan,
12780                 .policy = nl80211_policy,
12781                 .flags = GENL_UNS_ADMIN_PERM,
12782                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12783                                   NL80211_FLAG_NEED_RTNL,
12784         },
12785         {
12786                 .cmd = NL80211_CMD_AUTHENTICATE,
12787                 .doit = nl80211_authenticate,
12788                 .policy = nl80211_policy,
12789                 .flags = GENL_UNS_ADMIN_PERM,
12790                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12791                                   NL80211_FLAG_NEED_RTNL |
12792                                   NL80211_FLAG_CLEAR_SKB,
12793         },
12794         {
12795                 .cmd = NL80211_CMD_ASSOCIATE,
12796                 .doit = nl80211_associate,
12797                 .policy = nl80211_policy,
12798                 .flags = GENL_UNS_ADMIN_PERM,
12799                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12800                                   NL80211_FLAG_NEED_RTNL,
12801         },
12802         {
12803                 .cmd = NL80211_CMD_DEAUTHENTICATE,
12804                 .doit = nl80211_deauthenticate,
12805                 .policy = nl80211_policy,
12806                 .flags = GENL_UNS_ADMIN_PERM,
12807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12808                                   NL80211_FLAG_NEED_RTNL,
12809         },
12810         {
12811                 .cmd = NL80211_CMD_DISASSOCIATE,
12812                 .doit = nl80211_disassociate,
12813                 .policy = nl80211_policy,
12814                 .flags = GENL_UNS_ADMIN_PERM,
12815                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12816                                   NL80211_FLAG_NEED_RTNL,
12817         },
12818         {
12819                 .cmd = NL80211_CMD_JOIN_IBSS,
12820                 .doit = nl80211_join_ibss,
12821                 .policy = nl80211_policy,
12822                 .flags = GENL_UNS_ADMIN_PERM,
12823                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12824                                   NL80211_FLAG_NEED_RTNL,
12825         },
12826         {
12827                 .cmd = NL80211_CMD_LEAVE_IBSS,
12828                 .doit = nl80211_leave_ibss,
12829                 .policy = nl80211_policy,
12830                 .flags = GENL_UNS_ADMIN_PERM,
12831                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12832                                   NL80211_FLAG_NEED_RTNL,
12833         },
12834 #ifdef CONFIG_NL80211_TESTMODE
12835         {
12836                 .cmd = NL80211_CMD_TESTMODE,
12837                 .doit = nl80211_testmode_do,
12838                 .dumpit = nl80211_testmode_dump,
12839                 .policy = nl80211_policy,
12840                 .flags = GENL_UNS_ADMIN_PERM,
12841                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12842                                   NL80211_FLAG_NEED_RTNL,
12843         },
12844 #endif
12845         {
12846                 .cmd = NL80211_CMD_CONNECT,
12847                 .doit = nl80211_connect,
12848                 .policy = nl80211_policy,
12849                 .flags = GENL_UNS_ADMIN_PERM,
12850                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12851                                   NL80211_FLAG_NEED_RTNL,
12852         },
12853         {
12854                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
12855                 .doit = nl80211_update_connect_params,
12856                 .policy = nl80211_policy,
12857                 .flags = GENL_ADMIN_PERM,
12858                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12859                                   NL80211_FLAG_NEED_RTNL,
12860         },
12861         {
12862                 .cmd = NL80211_CMD_DISCONNECT,
12863                 .doit = nl80211_disconnect,
12864                 .policy = nl80211_policy,
12865                 .flags = GENL_UNS_ADMIN_PERM,
12866                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12867                                   NL80211_FLAG_NEED_RTNL,
12868         },
12869         {
12870                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
12871                 .doit = nl80211_wiphy_netns,
12872                 .policy = nl80211_policy,
12873                 .flags = GENL_UNS_ADMIN_PERM,
12874                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
12875                                   NL80211_FLAG_NEED_RTNL,
12876         },
12877         {
12878                 .cmd = NL80211_CMD_GET_SURVEY,
12879                 .policy = nl80211_policy,
12880                 .dumpit = nl80211_dump_survey,
12881         },
12882         {
12883                 .cmd = NL80211_CMD_SET_PMKSA,
12884                 .doit = nl80211_setdel_pmksa,
12885                 .policy = nl80211_policy,
12886                 .flags = GENL_UNS_ADMIN_PERM,
12887                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12888                                   NL80211_FLAG_NEED_RTNL,
12889         },
12890         {
12891                 .cmd = NL80211_CMD_DEL_PMKSA,
12892                 .doit = nl80211_setdel_pmksa,
12893                 .policy = nl80211_policy,
12894                 .flags = GENL_UNS_ADMIN_PERM,
12895                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12896                                   NL80211_FLAG_NEED_RTNL,
12897         },
12898         {
12899                 .cmd = NL80211_CMD_FLUSH_PMKSA,
12900                 .doit = nl80211_flush_pmksa,
12901                 .policy = nl80211_policy,
12902                 .flags = GENL_UNS_ADMIN_PERM,
12903                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
12904                                   NL80211_FLAG_NEED_RTNL,
12905         },
12906         {
12907                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
12908                 .doit = nl80211_remain_on_channel,
12909                 .policy = nl80211_policy,
12910                 .flags = GENL_UNS_ADMIN_PERM,
12911                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12912                                   NL80211_FLAG_NEED_RTNL,
12913         },
12914         {
12915                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
12916                 .doit = nl80211_cancel_remain_on_channel,
12917                 .policy = nl80211_policy,
12918                 .flags = GENL_UNS_ADMIN_PERM,
12919                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12920                                   NL80211_FLAG_NEED_RTNL,
12921         },
12922         {
12923                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
12924                 .doit = nl80211_set_tx_bitrate_mask,
12925                 .policy = nl80211_policy,
12926                 .flags = GENL_UNS_ADMIN_PERM,
12927                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12928                                   NL80211_FLAG_NEED_RTNL,
12929         },
12930         {
12931                 .cmd = NL80211_CMD_REGISTER_FRAME,
12932                 .doit = nl80211_register_mgmt,
12933                 .policy = nl80211_policy,
12934                 .flags = GENL_UNS_ADMIN_PERM,
12935                 .internal_flags = NL80211_FLAG_NEED_WDEV |
12936                                   NL80211_FLAG_NEED_RTNL,
12937         },
12938         {
12939                 .cmd = NL80211_CMD_FRAME,
12940                 .doit = nl80211_tx_mgmt,
12941                 .policy = nl80211_policy,
12942                 .flags = GENL_UNS_ADMIN_PERM,
12943                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12944                                   NL80211_FLAG_NEED_RTNL,
12945         },
12946         {
12947                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
12948                 .doit = nl80211_tx_mgmt_cancel_wait,
12949                 .policy = nl80211_policy,
12950                 .flags = GENL_UNS_ADMIN_PERM,
12951                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
12952                                   NL80211_FLAG_NEED_RTNL,
12953         },
12954         {
12955                 .cmd = NL80211_CMD_SET_POWER_SAVE,
12956                 .doit = nl80211_set_power_save,
12957                 .policy = nl80211_policy,
12958                 .flags = GENL_UNS_ADMIN_PERM,
12959                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12960                                   NL80211_FLAG_NEED_RTNL,
12961         },
12962         {
12963                 .cmd = NL80211_CMD_GET_POWER_SAVE,
12964                 .doit = nl80211_get_power_save,
12965                 .policy = nl80211_policy,
12966                 /* can be retrieved by unprivileged users */
12967                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12968                                   NL80211_FLAG_NEED_RTNL,
12969         },
12970         {
12971                 .cmd = NL80211_CMD_SET_CQM,
12972                 .doit = nl80211_set_cqm,
12973                 .policy = nl80211_policy,
12974                 .flags = GENL_UNS_ADMIN_PERM,
12975                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12976                                   NL80211_FLAG_NEED_RTNL,
12977         },
12978         {
12979                 .cmd = NL80211_CMD_SET_CHANNEL,
12980                 .doit = nl80211_set_channel,
12981                 .policy = nl80211_policy,
12982                 .flags = GENL_UNS_ADMIN_PERM,
12983                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12984                                   NL80211_FLAG_NEED_RTNL,
12985         },
12986         {
12987                 .cmd = NL80211_CMD_SET_WDS_PEER,
12988                 .doit = nl80211_set_wds_peer,
12989                 .policy = nl80211_policy,
12990                 .flags = GENL_UNS_ADMIN_PERM,
12991                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
12992                                   NL80211_FLAG_NEED_RTNL,
12993         },
12994         {
12995                 .cmd = NL80211_CMD_JOIN_MESH,
12996                 .doit = nl80211_join_mesh,
12997                 .policy = nl80211_policy,
12998                 .flags = GENL_UNS_ADMIN_PERM,
12999                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13000                                   NL80211_FLAG_NEED_RTNL,
13001         },
13002         {
13003                 .cmd = NL80211_CMD_LEAVE_MESH,
13004                 .doit = nl80211_leave_mesh,
13005                 .policy = nl80211_policy,
13006                 .flags = GENL_UNS_ADMIN_PERM,
13007                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13008                                   NL80211_FLAG_NEED_RTNL,
13009         },
13010         {
13011                 .cmd = NL80211_CMD_JOIN_OCB,
13012                 .doit = nl80211_join_ocb,
13013                 .policy = nl80211_policy,
13014                 .flags = GENL_UNS_ADMIN_PERM,
13015                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13016                                   NL80211_FLAG_NEED_RTNL,
13017         },
13018         {
13019                 .cmd = NL80211_CMD_LEAVE_OCB,
13020                 .doit = nl80211_leave_ocb,
13021                 .policy = nl80211_policy,
13022                 .flags = GENL_UNS_ADMIN_PERM,
13023                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13024                                   NL80211_FLAG_NEED_RTNL,
13025         },
13026 #ifdef CONFIG_PM
13027         {
13028                 .cmd = NL80211_CMD_GET_WOWLAN,
13029                 .doit = nl80211_get_wowlan,
13030                 .policy = nl80211_policy,
13031                 /* can be retrieved by unprivileged users */
13032                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13033                                   NL80211_FLAG_NEED_RTNL,
13034         },
13035         {
13036                 .cmd = NL80211_CMD_SET_WOWLAN,
13037                 .doit = nl80211_set_wowlan,
13038                 .policy = nl80211_policy,
13039                 .flags = GENL_UNS_ADMIN_PERM,
13040                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13041                                   NL80211_FLAG_NEED_RTNL,
13042         },
13043 #endif
13044         {
13045                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13046                 .doit = nl80211_set_rekey_data,
13047                 .policy = nl80211_policy,
13048                 .flags = GENL_UNS_ADMIN_PERM,
13049                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13050                                   NL80211_FLAG_NEED_RTNL |
13051                                   NL80211_FLAG_CLEAR_SKB,
13052         },
13053         {
13054                 .cmd = NL80211_CMD_TDLS_MGMT,
13055                 .doit = nl80211_tdls_mgmt,
13056                 .policy = nl80211_policy,
13057                 .flags = GENL_UNS_ADMIN_PERM,
13058                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13059                                   NL80211_FLAG_NEED_RTNL,
13060         },
13061         {
13062                 .cmd = NL80211_CMD_TDLS_OPER,
13063                 .doit = nl80211_tdls_oper,
13064                 .policy = nl80211_policy,
13065                 .flags = GENL_UNS_ADMIN_PERM,
13066                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13067                                   NL80211_FLAG_NEED_RTNL,
13068         },
13069         {
13070                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13071                 .doit = nl80211_register_unexpected_frame,
13072                 .policy = nl80211_policy,
13073                 .flags = GENL_UNS_ADMIN_PERM,
13074                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13075                                   NL80211_FLAG_NEED_RTNL,
13076         },
13077         {
13078                 .cmd = NL80211_CMD_PROBE_CLIENT,
13079                 .doit = nl80211_probe_client,
13080                 .policy = nl80211_policy,
13081                 .flags = GENL_UNS_ADMIN_PERM,
13082                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13083                                   NL80211_FLAG_NEED_RTNL,
13084         },
13085         {
13086                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13087                 .doit = nl80211_register_beacons,
13088                 .policy = nl80211_policy,
13089                 .flags = GENL_UNS_ADMIN_PERM,
13090                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13091                                   NL80211_FLAG_NEED_RTNL,
13092         },
13093         {
13094                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13095                 .doit = nl80211_set_noack_map,
13096                 .policy = nl80211_policy,
13097                 .flags = GENL_UNS_ADMIN_PERM,
13098                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13099                                   NL80211_FLAG_NEED_RTNL,
13100         },
13101         {
13102                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13103                 .doit = nl80211_start_p2p_device,
13104                 .policy = nl80211_policy,
13105                 .flags = GENL_UNS_ADMIN_PERM,
13106                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13107                                   NL80211_FLAG_NEED_RTNL,
13108         },
13109         {
13110                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13111                 .doit = nl80211_stop_p2p_device,
13112                 .policy = nl80211_policy,
13113                 .flags = GENL_UNS_ADMIN_PERM,
13114                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13115                                   NL80211_FLAG_NEED_RTNL,
13116         },
13117         {
13118                 .cmd = NL80211_CMD_START_NAN,
13119                 .doit = nl80211_start_nan,
13120                 .policy = nl80211_policy,
13121                 .flags = GENL_ADMIN_PERM,
13122                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13123                                   NL80211_FLAG_NEED_RTNL,
13124         },
13125         {
13126                 .cmd = NL80211_CMD_STOP_NAN,
13127                 .doit = nl80211_stop_nan,
13128                 .policy = nl80211_policy,
13129                 .flags = GENL_ADMIN_PERM,
13130                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13131                                   NL80211_FLAG_NEED_RTNL,
13132         },
13133         {
13134                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13135                 .doit = nl80211_nan_add_func,
13136                 .policy = nl80211_policy,
13137                 .flags = GENL_ADMIN_PERM,
13138                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13139                                   NL80211_FLAG_NEED_RTNL,
13140         },
13141         {
13142                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13143                 .doit = nl80211_nan_del_func,
13144                 .policy = nl80211_policy,
13145                 .flags = GENL_ADMIN_PERM,
13146                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13147                                   NL80211_FLAG_NEED_RTNL,
13148         },
13149         {
13150                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13151                 .doit = nl80211_nan_change_config,
13152                 .policy = nl80211_policy,
13153                 .flags = GENL_ADMIN_PERM,
13154                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13155                                   NL80211_FLAG_NEED_RTNL,
13156         },
13157         {
13158                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13159                 .doit = nl80211_set_mcast_rate,
13160                 .policy = nl80211_policy,
13161                 .flags = GENL_UNS_ADMIN_PERM,
13162                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13163                                   NL80211_FLAG_NEED_RTNL,
13164         },
13165         {
13166                 .cmd = NL80211_CMD_SET_MAC_ACL,
13167                 .doit = nl80211_set_mac_acl,
13168                 .policy = nl80211_policy,
13169                 .flags = GENL_UNS_ADMIN_PERM,
13170                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13171                                   NL80211_FLAG_NEED_RTNL,
13172         },
13173         {
13174                 .cmd = NL80211_CMD_RADAR_DETECT,
13175                 .doit = nl80211_start_radar_detection,
13176                 .policy = nl80211_policy,
13177                 .flags = GENL_UNS_ADMIN_PERM,
13178                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13179                                   NL80211_FLAG_NEED_RTNL,
13180         },
13181         {
13182                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13183                 .doit = nl80211_get_protocol_features,
13184                 .policy = nl80211_policy,
13185         },
13186         {
13187                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13188                 .doit = nl80211_update_ft_ies,
13189                 .policy = nl80211_policy,
13190                 .flags = GENL_UNS_ADMIN_PERM,
13191                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13192                                   NL80211_FLAG_NEED_RTNL,
13193         },
13194         {
13195                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13196                 .doit = nl80211_crit_protocol_start,
13197                 .policy = nl80211_policy,
13198                 .flags = GENL_UNS_ADMIN_PERM,
13199                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13200                                   NL80211_FLAG_NEED_RTNL,
13201         },
13202         {
13203                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13204                 .doit = nl80211_crit_protocol_stop,
13205                 .policy = nl80211_policy,
13206                 .flags = GENL_UNS_ADMIN_PERM,
13207                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13208                                   NL80211_FLAG_NEED_RTNL,
13209         },
13210         {
13211                 .cmd = NL80211_CMD_GET_COALESCE,
13212                 .doit = nl80211_get_coalesce,
13213                 .policy = nl80211_policy,
13214                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13215                                   NL80211_FLAG_NEED_RTNL,
13216         },
13217         {
13218                 .cmd = NL80211_CMD_SET_COALESCE,
13219                 .doit = nl80211_set_coalesce,
13220                 .policy = nl80211_policy,
13221                 .flags = GENL_UNS_ADMIN_PERM,
13222                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13223                                   NL80211_FLAG_NEED_RTNL,
13224         },
13225         {
13226                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13227                 .doit = nl80211_channel_switch,
13228                 .policy = nl80211_policy,
13229                 .flags = GENL_UNS_ADMIN_PERM,
13230                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13231                                   NL80211_FLAG_NEED_RTNL,
13232         },
13233         {
13234                 .cmd = NL80211_CMD_VENDOR,
13235                 .doit = nl80211_vendor_cmd,
13236                 .dumpit = nl80211_vendor_cmd_dump,
13237                 .policy = nl80211_policy,
13238                 .flags = GENL_UNS_ADMIN_PERM,
13239                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13240                                   NL80211_FLAG_NEED_RTNL,
13241         },
13242         {
13243                 .cmd = NL80211_CMD_SET_QOS_MAP,
13244                 .doit = nl80211_set_qos_map,
13245                 .policy = nl80211_policy,
13246                 .flags = GENL_UNS_ADMIN_PERM,
13247                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13248                                   NL80211_FLAG_NEED_RTNL,
13249         },
13250         {
13251                 .cmd = NL80211_CMD_ADD_TX_TS,
13252                 .doit = nl80211_add_tx_ts,
13253                 .policy = nl80211_policy,
13254                 .flags = GENL_UNS_ADMIN_PERM,
13255                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13256                                   NL80211_FLAG_NEED_RTNL,
13257         },
13258         {
13259                 .cmd = NL80211_CMD_DEL_TX_TS,
13260                 .doit = nl80211_del_tx_ts,
13261                 .policy = nl80211_policy,
13262                 .flags = GENL_UNS_ADMIN_PERM,
13263                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13264                                   NL80211_FLAG_NEED_RTNL,
13265         },
13266         {
13267                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13268                 .doit = nl80211_tdls_channel_switch,
13269                 .policy = nl80211_policy,
13270                 .flags = GENL_UNS_ADMIN_PERM,
13271                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13272                                   NL80211_FLAG_NEED_RTNL,
13273         },
13274         {
13275                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13276                 .doit = nl80211_tdls_cancel_channel_switch,
13277                 .policy = nl80211_policy,
13278                 .flags = GENL_UNS_ADMIN_PERM,
13279                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13280                                   NL80211_FLAG_NEED_RTNL,
13281         },
13282         {
13283                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13284                 .doit = nl80211_set_multicast_to_unicast,
13285                 .policy = nl80211_policy,
13286                 .flags = GENL_UNS_ADMIN_PERM,
13287                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13288                                   NL80211_FLAG_NEED_RTNL,
13289         },
13290         {
13291                 .cmd = NL80211_CMD_SET_PMK,
13292                 .doit = nl80211_set_pmk,
13293                 .policy = nl80211_policy,
13294                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13295                                   NL80211_FLAG_NEED_RTNL,
13296         },
13297         {
13298                 .cmd = NL80211_CMD_DEL_PMK,
13299                 .doit = nl80211_del_pmk,
13300                 .policy = nl80211_policy,
13301                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13302                                   NL80211_FLAG_NEED_RTNL,
13303         },
13304
13305 };
13306
13307 static struct genl_family nl80211_fam __ro_after_init = {
13308         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13309         .hdrsize = 0,                   /* no private header */
13310         .version = 1,                   /* no particular meaning now */
13311         .maxattr = NL80211_ATTR_MAX,
13312         .netnsok = true,
13313         .pre_doit = nl80211_pre_doit,
13314         .post_doit = nl80211_post_doit,
13315         .module = THIS_MODULE,
13316         .ops = nl80211_ops,
13317         .n_ops = ARRAY_SIZE(nl80211_ops),
13318         .mcgrps = nl80211_mcgrps,
13319         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13320 };
13321
13322 /* notification functions */
13323
13324 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13325                           enum nl80211_commands cmd)
13326 {
13327         struct sk_buff *msg;
13328         struct nl80211_dump_wiphy_state state = {};
13329
13330         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13331                 cmd != NL80211_CMD_DEL_WIPHY);
13332
13333         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13334         if (!msg)
13335                 return;
13336
13337         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13338                 nlmsg_free(msg);
13339                 return;
13340         }
13341
13342         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13343                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13344 }
13345
13346 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13347                                 struct wireless_dev *wdev,
13348                                 enum nl80211_commands cmd)
13349 {
13350         struct sk_buff *msg;
13351
13352         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13353                 cmd != NL80211_CMD_DEL_INTERFACE);
13354
13355         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13356         if (!msg)
13357                 return;
13358
13359         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13360                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13361                 nlmsg_free(msg);
13362                 return;
13363         }
13364
13365         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13366                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13367 }
13368
13369 static int nl80211_add_scan_req(struct sk_buff *msg,
13370                                 struct cfg80211_registered_device *rdev)
13371 {
13372         struct cfg80211_scan_request *req = rdev->scan_req;
13373         struct nlattr *nest;
13374         int i;
13375
13376         if (WARN_ON(!req))
13377                 return 0;
13378
13379         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13380         if (!nest)
13381                 goto nla_put_failure;
13382         for (i = 0; i < req->n_ssids; i++) {
13383                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13384                         goto nla_put_failure;
13385         }
13386         nla_nest_end(msg, nest);
13387
13388         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13389         if (!nest)
13390                 goto nla_put_failure;
13391         for (i = 0; i < req->n_channels; i++) {
13392                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13393                         goto nla_put_failure;
13394         }
13395         nla_nest_end(msg, nest);
13396
13397         if (req->ie &&
13398             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13399                 goto nla_put_failure;
13400
13401         if (req->flags &&
13402             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
13403                 goto nla_put_failure;
13404
13405         if (req->info.scan_start_tsf &&
13406             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
13407                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
13408              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
13409                      req->info.tsf_bssid)))
13410                 goto nla_put_failure;
13411
13412         return 0;
13413  nla_put_failure:
13414         return -ENOBUFS;
13415 }
13416
13417 static int nl80211_prep_scan_msg(struct sk_buff *msg,
13418                                  struct cfg80211_registered_device *rdev,
13419                                  struct wireless_dev *wdev,
13420                                  u32 portid, u32 seq, int flags,
13421                                  u32 cmd)
13422 {
13423         void *hdr;
13424
13425         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
13426         if (!hdr)
13427                 return -1;
13428
13429         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13430             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
13431                                          wdev->netdev->ifindex)) ||
13432             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
13433                               NL80211_ATTR_PAD))
13434                 goto nla_put_failure;
13435
13436         /* ignore errors and send incomplete event anyway */
13437         nl80211_add_scan_req(msg, rdev);
13438
13439         genlmsg_end(msg, hdr);
13440         return 0;
13441
13442  nla_put_failure:
13443         genlmsg_cancel(msg, hdr);
13444         return -EMSGSIZE;
13445 }
13446
13447 static int
13448 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
13449                             struct cfg80211_sched_scan_request *req, u32 cmd)
13450 {
13451         void *hdr;
13452
13453         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13454         if (!hdr)
13455                 return -1;
13456
13457         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
13458                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
13459             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
13460             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
13461                               NL80211_ATTR_PAD))
13462                 goto nla_put_failure;
13463
13464         genlmsg_end(msg, hdr);
13465         return 0;
13466
13467  nla_put_failure:
13468         genlmsg_cancel(msg, hdr);
13469         return -EMSGSIZE;
13470 }
13471
13472 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
13473                              struct wireless_dev *wdev)
13474 {
13475         struct sk_buff *msg;
13476
13477         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13478         if (!msg)
13479                 return;
13480
13481         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13482                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
13483                 nlmsg_free(msg);
13484                 return;
13485         }
13486
13487         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13488                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13489 }
13490
13491 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
13492                                        struct wireless_dev *wdev, bool aborted)
13493 {
13494         struct sk_buff *msg;
13495
13496         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13497         if (!msg)
13498                 return NULL;
13499
13500         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
13501                                   aborted ? NL80211_CMD_SCAN_ABORTED :
13502                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
13503                 nlmsg_free(msg);
13504                 return NULL;
13505         }
13506
13507         return msg;
13508 }
13509
13510 /* send message created by nl80211_build_scan_msg() */
13511 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
13512                            struct sk_buff *msg)
13513 {
13514         if (!msg)
13515                 return;
13516
13517         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13518                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13519 }
13520
13521 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
13522 {
13523         struct sk_buff *msg;
13524
13525         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13526         if (!msg)
13527                 return;
13528
13529         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
13530                 nlmsg_free(msg);
13531                 return;
13532         }
13533
13534         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
13535                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
13536 }
13537
13538 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
13539                                           struct regulatory_request *request)
13540 {
13541         /* Userspace can always count this one always being set */
13542         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
13543                 goto nla_put_failure;
13544
13545         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
13546                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13547                                NL80211_REGDOM_TYPE_WORLD))
13548                         goto nla_put_failure;
13549         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
13550                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13551                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
13552                         goto nla_put_failure;
13553         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
13554                    request->intersect) {
13555                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13556                                NL80211_REGDOM_TYPE_INTERSECTION))
13557                         goto nla_put_failure;
13558         } else {
13559                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
13560                                NL80211_REGDOM_TYPE_COUNTRY) ||
13561                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
13562                                    request->alpha2))
13563                         goto nla_put_failure;
13564         }
13565
13566         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
13567                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
13568
13569                 if (wiphy &&
13570                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
13571                         goto nla_put_failure;
13572
13573                 if (wiphy &&
13574                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
13575                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
13576                         goto nla_put_failure;
13577         }
13578
13579         return true;
13580
13581 nla_put_failure:
13582         return false;
13583 }
13584
13585 /*
13586  * This can happen on global regulatory changes or device specific settings
13587  * based on custom regulatory domains.
13588  */
13589 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
13590                                      struct regulatory_request *request)
13591 {
13592         struct sk_buff *msg;
13593         void *hdr;
13594
13595         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13596         if (!msg)
13597                 return;
13598
13599         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
13600         if (!hdr) {
13601                 nlmsg_free(msg);
13602                 return;
13603         }
13604
13605         if (nl80211_reg_change_event_fill(msg, request) == false)
13606                 goto nla_put_failure;
13607
13608         genlmsg_end(msg, hdr);
13609
13610         rcu_read_lock();
13611         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
13612                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
13613         rcu_read_unlock();
13614
13615         return;
13616
13617 nla_put_failure:
13618         genlmsg_cancel(msg, hdr);
13619         nlmsg_free(msg);
13620 }
13621
13622 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
13623                                     struct net_device *netdev,
13624                                     const u8 *buf, size_t len,
13625                                     enum nl80211_commands cmd, gfp_t gfp,
13626                                     int uapsd_queues)
13627 {
13628         struct sk_buff *msg;
13629         void *hdr;
13630
13631         msg = nlmsg_new(100 + len, gfp);
13632         if (!msg)
13633                 return;
13634
13635         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13636         if (!hdr) {
13637                 nlmsg_free(msg);
13638                 return;
13639         }
13640
13641         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13642             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13643             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
13644                 goto nla_put_failure;
13645
13646         if (uapsd_queues >= 0) {
13647                 struct nlattr *nla_wmm =
13648                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
13649                 if (!nla_wmm)
13650                         goto nla_put_failure;
13651
13652                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
13653                                uapsd_queues))
13654                         goto nla_put_failure;
13655
13656                 nla_nest_end(msg, nla_wmm);
13657         }
13658
13659         genlmsg_end(msg, hdr);
13660
13661         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13662                                 NL80211_MCGRP_MLME, gfp);
13663         return;
13664
13665  nla_put_failure:
13666         genlmsg_cancel(msg, hdr);
13667         nlmsg_free(msg);
13668 }
13669
13670 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
13671                           struct net_device *netdev, const u8 *buf,
13672                           size_t len, gfp_t gfp)
13673 {
13674         nl80211_send_mlme_event(rdev, netdev, buf, len,
13675                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
13676 }
13677
13678 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
13679                            struct net_device *netdev, const u8 *buf,
13680                            size_t len, gfp_t gfp, int uapsd_queues)
13681 {
13682         nl80211_send_mlme_event(rdev, netdev, buf, len,
13683                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
13684 }
13685
13686 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
13687                          struct net_device *netdev, const u8 *buf,
13688                          size_t len, gfp_t gfp)
13689 {
13690         nl80211_send_mlme_event(rdev, netdev, buf, len,
13691                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
13692 }
13693
13694 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
13695                            struct net_device *netdev, const u8 *buf,
13696                            size_t len, gfp_t gfp)
13697 {
13698         nl80211_send_mlme_event(rdev, netdev, buf, len,
13699                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
13700 }
13701
13702 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
13703                                   size_t len)
13704 {
13705         struct wireless_dev *wdev = dev->ieee80211_ptr;
13706         struct wiphy *wiphy = wdev->wiphy;
13707         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
13708         const struct ieee80211_mgmt *mgmt = (void *)buf;
13709         u32 cmd;
13710
13711         if (WARN_ON(len < 2))
13712                 return;
13713
13714         if (ieee80211_is_deauth(mgmt->frame_control))
13715                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
13716         else
13717                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
13718
13719         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
13720         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
13721 }
13722 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
13723
13724 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
13725                                       struct net_device *netdev, int cmd,
13726                                       const u8 *addr, gfp_t gfp)
13727 {
13728         struct sk_buff *msg;
13729         void *hdr;
13730
13731         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13732         if (!msg)
13733                 return;
13734
13735         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
13736         if (!hdr) {
13737                 nlmsg_free(msg);
13738                 return;
13739         }
13740
13741         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13742             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13743             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13744             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
13745                 goto nla_put_failure;
13746
13747         genlmsg_end(msg, hdr);
13748
13749         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13750                                 NL80211_MCGRP_MLME, gfp);
13751         return;
13752
13753  nla_put_failure:
13754         genlmsg_cancel(msg, hdr);
13755         nlmsg_free(msg);
13756 }
13757
13758 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
13759                                struct net_device *netdev, const u8 *addr,
13760                                gfp_t gfp)
13761 {
13762         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
13763                                   addr, gfp);
13764 }
13765
13766 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
13767                                 struct net_device *netdev, const u8 *addr,
13768                                 gfp_t gfp)
13769 {
13770         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
13771                                   addr, gfp);
13772 }
13773
13774 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
13775                                  struct net_device *netdev,
13776                                  struct cfg80211_connect_resp_params *cr,
13777                                  gfp_t gfp)
13778 {
13779         struct sk_buff *msg;
13780         void *hdr;
13781
13782         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
13783                         cr->fils_kek_len + cr->pmk_len +
13784                         (cr->pmkid ? WLAN_PMKID_LEN : 0), gfp);
13785         if (!msg)
13786                 return;
13787
13788         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
13789         if (!hdr) {
13790                 nlmsg_free(msg);
13791                 return;
13792         }
13793
13794         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13795             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13796             (cr->bssid &&
13797              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
13798             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
13799                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
13800                         cr->status) ||
13801             (cr->status < 0 &&
13802              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
13803               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
13804                           cr->timeout_reason))) ||
13805             (cr->req_ie &&
13806              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
13807             (cr->resp_ie &&
13808              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
13809                      cr->resp_ie)) ||
13810             (cr->update_erp_next_seq_num &&
13811              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
13812                          cr->fils_erp_next_seq_num)) ||
13813             (cr->status == WLAN_STATUS_SUCCESS &&
13814              ((cr->fils_kek &&
13815                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils_kek_len,
13816                        cr->fils_kek)) ||
13817               (cr->pmk &&
13818                nla_put(msg, NL80211_ATTR_PMK, cr->pmk_len, cr->pmk)) ||
13819               (cr->pmkid &&
13820                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->pmkid)))))
13821                 goto nla_put_failure;
13822
13823         genlmsg_end(msg, hdr);
13824
13825         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13826                                 NL80211_MCGRP_MLME, gfp);
13827         return;
13828
13829  nla_put_failure:
13830         genlmsg_cancel(msg, hdr);
13831         nlmsg_free(msg);
13832 }
13833
13834 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
13835                          struct net_device *netdev,
13836                          struct cfg80211_roam_info *info, gfp_t gfp)
13837 {
13838         struct sk_buff *msg;
13839         void *hdr;
13840         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
13841
13842         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len, gfp);
13843         if (!msg)
13844                 return;
13845
13846         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
13847         if (!hdr) {
13848                 nlmsg_free(msg);
13849                 return;
13850         }
13851
13852         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13853             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13854             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
13855             (info->req_ie &&
13856              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
13857                      info->req_ie)) ||
13858             (info->resp_ie &&
13859              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
13860                      info->resp_ie)))
13861                 goto nla_put_failure;
13862
13863         genlmsg_end(msg, hdr);
13864
13865         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13866                                 NL80211_MCGRP_MLME, gfp);
13867         return;
13868
13869  nla_put_failure:
13870         genlmsg_cancel(msg, hdr);
13871         nlmsg_free(msg);
13872 }
13873
13874 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
13875                                   struct net_device *netdev, const u8 *bssid)
13876 {
13877         struct sk_buff *msg;
13878         void *hdr;
13879
13880         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13881         if (!msg)
13882                 return;
13883
13884         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
13885         if (!hdr) {
13886                 nlmsg_free(msg);
13887                 return;
13888         }
13889
13890         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13891                 goto nla_put_failure;
13892
13893         genlmsg_end(msg, hdr);
13894
13895         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13896                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13897         return;
13898
13899  nla_put_failure:
13900         genlmsg_cancel(msg, hdr);
13901         nlmsg_free(msg);
13902 }
13903
13904 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
13905                                struct net_device *netdev, u16 reason,
13906                                const u8 *ie, size_t ie_len, bool from_ap)
13907 {
13908         struct sk_buff *msg;
13909         void *hdr;
13910
13911         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
13912         if (!msg)
13913                 return;
13914
13915         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
13916         if (!hdr) {
13917                 nlmsg_free(msg);
13918                 return;
13919         }
13920
13921         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13922             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13923             (from_ap && reason &&
13924              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
13925             (from_ap &&
13926              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
13927             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
13928                 goto nla_put_failure;
13929
13930         genlmsg_end(msg, hdr);
13931
13932         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13933                                 NL80211_MCGRP_MLME, GFP_KERNEL);
13934         return;
13935
13936  nla_put_failure:
13937         genlmsg_cancel(msg, hdr);
13938         nlmsg_free(msg);
13939 }
13940
13941 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
13942                              struct net_device *netdev, const u8 *bssid,
13943                              gfp_t gfp)
13944 {
13945         struct sk_buff *msg;
13946         void *hdr;
13947
13948         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
13949         if (!msg)
13950                 return;
13951
13952         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
13953         if (!hdr) {
13954                 nlmsg_free(msg);
13955                 return;
13956         }
13957
13958         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13959             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
13960             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
13961                 goto nla_put_failure;
13962
13963         genlmsg_end(msg, hdr);
13964
13965         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13966                                 NL80211_MCGRP_MLME, gfp);
13967         return;
13968
13969  nla_put_failure:
13970         genlmsg_cancel(msg, hdr);
13971         nlmsg_free(msg);
13972 }
13973
13974 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
13975                                         const u8* ie, u8 ie_len, gfp_t gfp)
13976 {
13977         struct wireless_dev *wdev = dev->ieee80211_ptr;
13978         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
13979         struct sk_buff *msg;
13980         void *hdr;
13981
13982         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
13983                 return;
13984
13985         trace_cfg80211_notify_new_peer_candidate(dev, addr);
13986
13987         msg = nlmsg_new(100 + ie_len, gfp);
13988         if (!msg)
13989                 return;
13990
13991         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
13992         if (!hdr) {
13993                 nlmsg_free(msg);
13994                 return;
13995         }
13996
13997         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
13998             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
13999             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14000             (ie_len && ie &&
14001              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14002                 goto nla_put_failure;
14003
14004         genlmsg_end(msg, hdr);
14005
14006         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14007                                 NL80211_MCGRP_MLME, gfp);
14008         return;
14009
14010  nla_put_failure:
14011         genlmsg_cancel(msg, hdr);
14012         nlmsg_free(msg);
14013 }
14014 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14015
14016 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14017                                  struct net_device *netdev, const u8 *addr,
14018                                  enum nl80211_key_type key_type, int key_id,
14019                                  const u8 *tsc, gfp_t gfp)
14020 {
14021         struct sk_buff *msg;
14022         void *hdr;
14023
14024         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14025         if (!msg)
14026                 return;
14027
14028         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14029         if (!hdr) {
14030                 nlmsg_free(msg);
14031                 return;
14032         }
14033
14034         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14035             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14036             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14037             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14038             (key_id != -1 &&
14039              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14040             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14041                 goto nla_put_failure;
14042
14043         genlmsg_end(msg, hdr);
14044
14045         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14046                                 NL80211_MCGRP_MLME, gfp);
14047         return;
14048
14049  nla_put_failure:
14050         genlmsg_cancel(msg, hdr);
14051         nlmsg_free(msg);
14052 }
14053
14054 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14055                                     struct ieee80211_channel *channel_before,
14056                                     struct ieee80211_channel *channel_after)
14057 {
14058         struct sk_buff *msg;
14059         void *hdr;
14060         struct nlattr *nl_freq;
14061
14062         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14063         if (!msg)
14064                 return;
14065
14066         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14067         if (!hdr) {
14068                 nlmsg_free(msg);
14069                 return;
14070         }
14071
14072         /*
14073          * Since we are applying the beacon hint to a wiphy we know its
14074          * wiphy_idx is valid
14075          */
14076         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14077                 goto nla_put_failure;
14078
14079         /* Before */
14080         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14081         if (!nl_freq)
14082                 goto nla_put_failure;
14083         if (nl80211_msg_put_channel(msg, channel_before, false))
14084                 goto nla_put_failure;
14085         nla_nest_end(msg, nl_freq);
14086
14087         /* After */
14088         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14089         if (!nl_freq)
14090                 goto nla_put_failure;
14091         if (nl80211_msg_put_channel(msg, channel_after, false))
14092                 goto nla_put_failure;
14093         nla_nest_end(msg, nl_freq);
14094
14095         genlmsg_end(msg, hdr);
14096
14097         rcu_read_lock();
14098         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14099                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14100         rcu_read_unlock();
14101
14102         return;
14103
14104 nla_put_failure:
14105         genlmsg_cancel(msg, hdr);
14106         nlmsg_free(msg);
14107 }
14108
14109 static void nl80211_send_remain_on_chan_event(
14110         int cmd, struct cfg80211_registered_device *rdev,
14111         struct wireless_dev *wdev, u64 cookie,
14112         struct ieee80211_channel *chan,
14113         unsigned int duration, gfp_t gfp)
14114 {
14115         struct sk_buff *msg;
14116         void *hdr;
14117
14118         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14119         if (!msg)
14120                 return;
14121
14122         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14123         if (!hdr) {
14124                 nlmsg_free(msg);
14125                 return;
14126         }
14127
14128         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14129             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14130                                          wdev->netdev->ifindex)) ||
14131             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14132                               NL80211_ATTR_PAD) ||
14133             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14134             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14135                         NL80211_CHAN_NO_HT) ||
14136             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14137                               NL80211_ATTR_PAD))
14138                 goto nla_put_failure;
14139
14140         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14141             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14142                 goto nla_put_failure;
14143
14144         genlmsg_end(msg, hdr);
14145
14146         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14147                                 NL80211_MCGRP_MLME, gfp);
14148         return;
14149
14150  nla_put_failure:
14151         genlmsg_cancel(msg, hdr);
14152         nlmsg_free(msg);
14153 }
14154
14155 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14156                                struct ieee80211_channel *chan,
14157                                unsigned int duration, gfp_t gfp)
14158 {
14159         struct wiphy *wiphy = wdev->wiphy;
14160         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14161
14162         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14163         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14164                                           rdev, wdev, cookie, chan,
14165                                           duration, gfp);
14166 }
14167 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14168
14169 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14170                                         struct ieee80211_channel *chan,
14171                                         gfp_t gfp)
14172 {
14173         struct wiphy *wiphy = wdev->wiphy;
14174         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14175
14176         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14177         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14178                                           rdev, wdev, cookie, chan, 0, gfp);
14179 }
14180 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14181
14182 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14183                       struct station_info *sinfo, gfp_t gfp)
14184 {
14185         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14186         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14187         struct sk_buff *msg;
14188
14189         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14190
14191         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14192         if (!msg)
14193                 return;
14194
14195         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14196                                  rdev, dev, mac_addr, sinfo) < 0) {
14197                 nlmsg_free(msg);
14198                 return;
14199         }
14200
14201         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14202                                 NL80211_MCGRP_MLME, gfp);
14203 }
14204 EXPORT_SYMBOL(cfg80211_new_sta);
14205
14206 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14207                             struct station_info *sinfo, gfp_t gfp)
14208 {
14209         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14210         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14211         struct sk_buff *msg;
14212         struct station_info empty_sinfo = {};
14213
14214         if (!sinfo)
14215                 sinfo = &empty_sinfo;
14216
14217         trace_cfg80211_del_sta(dev, mac_addr);
14218
14219         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14220         if (!msg)
14221                 return;
14222
14223         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14224                                  rdev, dev, mac_addr, sinfo) < 0) {
14225                 nlmsg_free(msg);
14226                 return;
14227         }
14228
14229         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14230                                 NL80211_MCGRP_MLME, gfp);
14231 }
14232 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14233
14234 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14235                           enum nl80211_connect_failed_reason reason,
14236                           gfp_t gfp)
14237 {
14238         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14239         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14240         struct sk_buff *msg;
14241         void *hdr;
14242
14243         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14244         if (!msg)
14245                 return;
14246
14247         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14248         if (!hdr) {
14249                 nlmsg_free(msg);
14250                 return;
14251         }
14252
14253         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14254             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14255             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14256                 goto nla_put_failure;
14257
14258         genlmsg_end(msg, hdr);
14259
14260         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14261                                 NL80211_MCGRP_MLME, gfp);
14262         return;
14263
14264  nla_put_failure:
14265         genlmsg_cancel(msg, hdr);
14266         nlmsg_free(msg);
14267 }
14268 EXPORT_SYMBOL(cfg80211_conn_failed);
14269
14270 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14271                                        const u8 *addr, gfp_t gfp)
14272 {
14273         struct wireless_dev *wdev = dev->ieee80211_ptr;
14274         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14275         struct sk_buff *msg;
14276         void *hdr;
14277         u32 nlportid = ACCESS_ONCE(wdev->ap_unexpected_nlportid);
14278
14279         if (!nlportid)
14280                 return false;
14281
14282         msg = nlmsg_new(100, gfp);
14283         if (!msg)
14284                 return true;
14285
14286         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14287         if (!hdr) {
14288                 nlmsg_free(msg);
14289                 return true;
14290         }
14291
14292         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14293             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14294             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14295                 goto nla_put_failure;
14296
14297         genlmsg_end(msg, hdr);
14298         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14299         return true;
14300
14301  nla_put_failure:
14302         genlmsg_cancel(msg, hdr);
14303         nlmsg_free(msg);
14304         return true;
14305 }
14306
14307 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14308                                 const u8 *addr, gfp_t gfp)
14309 {
14310         struct wireless_dev *wdev = dev->ieee80211_ptr;
14311         bool ret;
14312
14313         trace_cfg80211_rx_spurious_frame(dev, addr);
14314
14315         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14316                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14317                 trace_cfg80211_return_bool(false);
14318                 return false;
14319         }
14320         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14321                                          addr, gfp);
14322         trace_cfg80211_return_bool(ret);
14323         return ret;
14324 }
14325 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14326
14327 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14328                                         const u8 *addr, gfp_t gfp)
14329 {
14330         struct wireless_dev *wdev = dev->ieee80211_ptr;
14331         bool ret;
14332
14333         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14334
14335         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14336                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14337                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14338                 trace_cfg80211_return_bool(false);
14339                 return false;
14340         }
14341         ret = __nl80211_unexpected_frame(dev,
14342                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14343                                          addr, gfp);
14344         trace_cfg80211_return_bool(ret);
14345         return ret;
14346 }
14347 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14348
14349 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14350                       struct wireless_dev *wdev, u32 nlportid,
14351                       int freq, int sig_dbm,
14352                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14353 {
14354         struct net_device *netdev = wdev->netdev;
14355         struct sk_buff *msg;
14356         void *hdr;
14357
14358         msg = nlmsg_new(100 + len, gfp);
14359         if (!msg)
14360                 return -ENOMEM;
14361
14362         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14363         if (!hdr) {
14364                 nlmsg_free(msg);
14365                 return -ENOMEM;
14366         }
14367
14368         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14369             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14370                                         netdev->ifindex)) ||
14371             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14372                               NL80211_ATTR_PAD) ||
14373             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14374             (sig_dbm &&
14375              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14376             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14377             (flags &&
14378              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14379                 goto nla_put_failure;
14380
14381         genlmsg_end(msg, hdr);
14382
14383         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14384
14385  nla_put_failure:
14386         genlmsg_cancel(msg, hdr);
14387         nlmsg_free(msg);
14388         return -ENOBUFS;
14389 }
14390
14391 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14392                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
14393 {
14394         struct wiphy *wiphy = wdev->wiphy;
14395         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14396         struct net_device *netdev = wdev->netdev;
14397         struct sk_buff *msg;
14398         void *hdr;
14399
14400         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
14401
14402         msg = nlmsg_new(100 + len, gfp);
14403         if (!msg)
14404                 return;
14405
14406         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
14407         if (!hdr) {
14408                 nlmsg_free(msg);
14409                 return;
14410         }
14411
14412         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14413             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14414                                    netdev->ifindex)) ||
14415             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14416                               NL80211_ATTR_PAD) ||
14417             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14418             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14419                               NL80211_ATTR_PAD) ||
14420             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
14421                 goto nla_put_failure;
14422
14423         genlmsg_end(msg, hdr);
14424
14425         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14426                                 NL80211_MCGRP_MLME, gfp);
14427         return;
14428
14429  nla_put_failure:
14430         genlmsg_cancel(msg, hdr);
14431         nlmsg_free(msg);
14432 }
14433 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
14434
14435 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
14436                                             const char *mac, gfp_t gfp)
14437 {
14438         struct wireless_dev *wdev = dev->ieee80211_ptr;
14439         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14440         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14441         void **cb;
14442
14443         if (!msg)
14444                 return NULL;
14445
14446         cb = (void **)msg->cb;
14447
14448         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
14449         if (!cb[0]) {
14450                 nlmsg_free(msg);
14451                 return NULL;
14452         }
14453
14454         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14455             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
14456                 goto nla_put_failure;
14457
14458         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
14459                 goto nla_put_failure;
14460
14461         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
14462         if (!cb[1])
14463                 goto nla_put_failure;
14464
14465         cb[2] = rdev;
14466
14467         return msg;
14468  nla_put_failure:
14469         nlmsg_free(msg);
14470         return NULL;
14471 }
14472
14473 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
14474 {
14475         void **cb = (void **)msg->cb;
14476         struct cfg80211_registered_device *rdev = cb[2];
14477
14478         nla_nest_end(msg, cb[1]);
14479         genlmsg_end(msg, cb[0]);
14480
14481         memset(msg->cb, 0, sizeof(msg->cb));
14482
14483         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14484                                 NL80211_MCGRP_MLME, gfp);
14485 }
14486
14487 void cfg80211_cqm_rssi_notify(struct net_device *dev,
14488                               enum nl80211_cqm_rssi_threshold_event rssi_event,
14489                               s32 rssi_level, gfp_t gfp)
14490 {
14491         struct sk_buff *msg;
14492         struct wireless_dev *wdev = dev->ieee80211_ptr;
14493         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14494
14495         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
14496
14497         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
14498                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
14499                 return;
14500
14501         if (wdev->cqm_config) {
14502                 wdev->cqm_config->last_rssi_event_value = rssi_level;
14503
14504                 cfg80211_cqm_rssi_update(rdev, dev);
14505
14506                 if (rssi_level == 0)
14507                         rssi_level = wdev->cqm_config->last_rssi_event_value;
14508         }
14509
14510         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14511         if (!msg)
14512                 return;
14513
14514         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
14515                         rssi_event))
14516                 goto nla_put_failure;
14517
14518         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
14519                                       rssi_level))
14520                 goto nla_put_failure;
14521
14522         cfg80211_send_cqm(msg, gfp);
14523
14524         return;
14525
14526  nla_put_failure:
14527         nlmsg_free(msg);
14528 }
14529 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
14530
14531 void cfg80211_cqm_txe_notify(struct net_device *dev,
14532                              const u8 *peer, u32 num_packets,
14533                              u32 rate, u32 intvl, gfp_t gfp)
14534 {
14535         struct sk_buff *msg;
14536
14537         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14538         if (!msg)
14539                 return;
14540
14541         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
14542                 goto nla_put_failure;
14543
14544         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
14545                 goto nla_put_failure;
14546
14547         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
14548                 goto nla_put_failure;
14549
14550         cfg80211_send_cqm(msg, gfp);
14551         return;
14552
14553  nla_put_failure:
14554         nlmsg_free(msg);
14555 }
14556 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
14557
14558 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
14559                                  const u8 *peer, u32 num_packets, gfp_t gfp)
14560 {
14561         struct sk_buff *msg;
14562
14563         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
14564
14565         msg = cfg80211_prepare_cqm(dev, peer, gfp);
14566         if (!msg)
14567                 return;
14568
14569         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
14570                 goto nla_put_failure;
14571
14572         cfg80211_send_cqm(msg, gfp);
14573         return;
14574
14575  nla_put_failure:
14576         nlmsg_free(msg);
14577 }
14578 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
14579
14580 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
14581 {
14582         struct sk_buff *msg;
14583
14584         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
14585         if (!msg)
14586                 return;
14587
14588         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
14589                 goto nla_put_failure;
14590
14591         cfg80211_send_cqm(msg, gfp);
14592         return;
14593
14594  nla_put_failure:
14595         nlmsg_free(msg);
14596 }
14597 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
14598
14599 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
14600                                      struct net_device *netdev, const u8 *bssid,
14601                                      const u8 *replay_ctr, gfp_t gfp)
14602 {
14603         struct sk_buff *msg;
14604         struct nlattr *rekey_attr;
14605         void *hdr;
14606
14607         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14608         if (!msg)
14609                 return;
14610
14611         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
14612         if (!hdr) {
14613                 nlmsg_free(msg);
14614                 return;
14615         }
14616
14617         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14618             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14619             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14620                 goto nla_put_failure;
14621
14622         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
14623         if (!rekey_attr)
14624                 goto nla_put_failure;
14625
14626         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
14627                     NL80211_REPLAY_CTR_LEN, replay_ctr))
14628                 goto nla_put_failure;
14629
14630         nla_nest_end(msg, rekey_attr);
14631
14632         genlmsg_end(msg, hdr);
14633
14634         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14635                                 NL80211_MCGRP_MLME, gfp);
14636         return;
14637
14638  nla_put_failure:
14639         genlmsg_cancel(msg, hdr);
14640         nlmsg_free(msg);
14641 }
14642
14643 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
14644                                const u8 *replay_ctr, gfp_t gfp)
14645 {
14646         struct wireless_dev *wdev = dev->ieee80211_ptr;
14647         struct wiphy *wiphy = wdev->wiphy;
14648         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14649
14650         trace_cfg80211_gtk_rekey_notify(dev, bssid);
14651         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
14652 }
14653 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
14654
14655 static void
14656 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
14657                                struct net_device *netdev, int index,
14658                                const u8 *bssid, bool preauth, gfp_t gfp)
14659 {
14660         struct sk_buff *msg;
14661         struct nlattr *attr;
14662         void *hdr;
14663
14664         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14665         if (!msg)
14666                 return;
14667
14668         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
14669         if (!hdr) {
14670                 nlmsg_free(msg);
14671                 return;
14672         }
14673
14674         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14675             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14676                 goto nla_put_failure;
14677
14678         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
14679         if (!attr)
14680                 goto nla_put_failure;
14681
14682         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
14683             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
14684             (preauth &&
14685              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
14686                 goto nla_put_failure;
14687
14688         nla_nest_end(msg, attr);
14689
14690         genlmsg_end(msg, hdr);
14691
14692         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14693                                 NL80211_MCGRP_MLME, gfp);
14694         return;
14695
14696  nla_put_failure:
14697         genlmsg_cancel(msg, hdr);
14698         nlmsg_free(msg);
14699 }
14700
14701 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
14702                                      const u8 *bssid, bool preauth, gfp_t gfp)
14703 {
14704         struct wireless_dev *wdev = dev->ieee80211_ptr;
14705         struct wiphy *wiphy = wdev->wiphy;
14706         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14707
14708         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
14709         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
14710 }
14711 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
14712
14713 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
14714                                      struct net_device *netdev,
14715                                      struct cfg80211_chan_def *chandef,
14716                                      gfp_t gfp,
14717                                      enum nl80211_commands notif,
14718                                      u8 count)
14719 {
14720         struct sk_buff *msg;
14721         void *hdr;
14722
14723         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14724         if (!msg)
14725                 return;
14726
14727         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
14728         if (!hdr) {
14729                 nlmsg_free(msg);
14730                 return;
14731         }
14732
14733         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
14734                 goto nla_put_failure;
14735
14736         if (nl80211_send_chandef(msg, chandef))
14737                 goto nla_put_failure;
14738
14739         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
14740             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
14741                         goto nla_put_failure;
14742
14743         genlmsg_end(msg, hdr);
14744
14745         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14746                                 NL80211_MCGRP_MLME, gfp);
14747         return;
14748
14749  nla_put_failure:
14750         genlmsg_cancel(msg, hdr);
14751         nlmsg_free(msg);
14752 }
14753
14754 void cfg80211_ch_switch_notify(struct net_device *dev,
14755                                struct cfg80211_chan_def *chandef)
14756 {
14757         struct wireless_dev *wdev = dev->ieee80211_ptr;
14758         struct wiphy *wiphy = wdev->wiphy;
14759         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14760
14761         ASSERT_WDEV_LOCK(wdev);
14762
14763         trace_cfg80211_ch_switch_notify(dev, chandef);
14764
14765         wdev->chandef = *chandef;
14766         wdev->preset_chandef = *chandef;
14767         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14768                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
14769 }
14770 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
14771
14772 void cfg80211_ch_switch_started_notify(struct net_device *dev,
14773                                        struct cfg80211_chan_def *chandef,
14774                                        u8 count)
14775 {
14776         struct wireless_dev *wdev = dev->ieee80211_ptr;
14777         struct wiphy *wiphy = wdev->wiphy;
14778         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14779
14780         trace_cfg80211_ch_switch_started_notify(dev, chandef);
14781
14782         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
14783                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
14784 }
14785 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
14786
14787 void
14788 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
14789                      const struct cfg80211_chan_def *chandef,
14790                      enum nl80211_radar_event event,
14791                      struct net_device *netdev, gfp_t gfp)
14792 {
14793         struct sk_buff *msg;
14794         void *hdr;
14795
14796         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14797         if (!msg)
14798                 return;
14799
14800         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
14801         if (!hdr) {
14802                 nlmsg_free(msg);
14803                 return;
14804         }
14805
14806         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
14807                 goto nla_put_failure;
14808
14809         /* NOP and radar events don't need a netdev parameter */
14810         if (netdev) {
14811                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
14812
14813                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14814                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14815                                       NL80211_ATTR_PAD))
14816                         goto nla_put_failure;
14817         }
14818
14819         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
14820                 goto nla_put_failure;
14821
14822         if (nl80211_send_chandef(msg, chandef))
14823                 goto nla_put_failure;
14824
14825         genlmsg_end(msg, hdr);
14826
14827         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14828                                 NL80211_MCGRP_MLME, gfp);
14829         return;
14830
14831  nla_put_failure:
14832         genlmsg_cancel(msg, hdr);
14833         nlmsg_free(msg);
14834 }
14835
14836 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
14837                            u64 cookie, bool acked, gfp_t gfp)
14838 {
14839         struct wireless_dev *wdev = dev->ieee80211_ptr;
14840         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14841         struct sk_buff *msg;
14842         void *hdr;
14843
14844         trace_cfg80211_probe_status(dev, addr, cookie, acked);
14845
14846         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14847
14848         if (!msg)
14849                 return;
14850
14851         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
14852         if (!hdr) {
14853                 nlmsg_free(msg);
14854                 return;
14855         }
14856
14857         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14858             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14859             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14860             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14861                               NL80211_ATTR_PAD) ||
14862             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)))
14863                 goto nla_put_failure;
14864
14865         genlmsg_end(msg, hdr);
14866
14867         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14868                                 NL80211_MCGRP_MLME, gfp);
14869         return;
14870
14871  nla_put_failure:
14872         genlmsg_cancel(msg, hdr);
14873         nlmsg_free(msg);
14874 }
14875 EXPORT_SYMBOL(cfg80211_probe_status);
14876
14877 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
14878                                  const u8 *frame, size_t len,
14879                                  int freq, int sig_dbm)
14880 {
14881         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14882         struct sk_buff *msg;
14883         void *hdr;
14884         struct cfg80211_beacon_registration *reg;
14885
14886         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
14887
14888         spin_lock_bh(&rdev->beacon_registrations_lock);
14889         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14890                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
14891                 if (!msg) {
14892                         spin_unlock_bh(&rdev->beacon_registrations_lock);
14893                         return;
14894                 }
14895
14896                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14897                 if (!hdr)
14898                         goto nla_put_failure;
14899
14900                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14901                     (freq &&
14902                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
14903                     (sig_dbm &&
14904                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14905                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
14906                         goto nla_put_failure;
14907
14908                 genlmsg_end(msg, hdr);
14909
14910                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
14911         }
14912         spin_unlock_bh(&rdev->beacon_registrations_lock);
14913         return;
14914
14915  nla_put_failure:
14916         spin_unlock_bh(&rdev->beacon_registrations_lock);
14917         if (hdr)
14918                 genlmsg_cancel(msg, hdr);
14919         nlmsg_free(msg);
14920 }
14921 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
14922
14923 #ifdef CONFIG_PM
14924 static int cfg80211_net_detect_results(struct sk_buff *msg,
14925                                        struct cfg80211_wowlan_wakeup *wakeup)
14926 {
14927         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
14928         struct nlattr *nl_results, *nl_match, *nl_freqs;
14929         int i, j;
14930
14931         nl_results = nla_nest_start(
14932                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
14933         if (!nl_results)
14934                 return -EMSGSIZE;
14935
14936         for (i = 0; i < nd->n_matches; i++) {
14937                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
14938
14939                 nl_match = nla_nest_start(msg, i);
14940                 if (!nl_match)
14941                         break;
14942
14943                 /* The SSID attribute is optional in nl80211, but for
14944                  * simplicity reasons it's always present in the
14945                  * cfg80211 structure.  If a driver can't pass the
14946                  * SSID, that needs to be changed.  A zero length SSID
14947                  * is still a valid SSID (wildcard), so it cannot be
14948                  * used for this purpose.
14949                  */
14950                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
14951                             match->ssid.ssid)) {
14952                         nla_nest_cancel(msg, nl_match);
14953                         goto out;
14954                 }
14955
14956                 if (match->n_channels) {
14957                         nl_freqs = nla_nest_start(
14958                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
14959                         if (!nl_freqs) {
14960                                 nla_nest_cancel(msg, nl_match);
14961                                 goto out;
14962                         }
14963
14964                         for (j = 0; j < match->n_channels; j++) {
14965                                 if (nla_put_u32(msg, j, match->channels[j])) {
14966                                         nla_nest_cancel(msg, nl_freqs);
14967                                         nla_nest_cancel(msg, nl_match);
14968                                         goto out;
14969                                 }
14970                         }
14971
14972                         nla_nest_end(msg, nl_freqs);
14973                 }
14974
14975                 nla_nest_end(msg, nl_match);
14976         }
14977
14978 out:
14979         nla_nest_end(msg, nl_results);
14980         return 0;
14981 }
14982
14983 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
14984                                    struct cfg80211_wowlan_wakeup *wakeup,
14985                                    gfp_t gfp)
14986 {
14987         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14988         struct sk_buff *msg;
14989         void *hdr;
14990         int size = 200;
14991
14992         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
14993
14994         if (wakeup)
14995                 size += wakeup->packet_present_len;
14996
14997         msg = nlmsg_new(size, gfp);
14998         if (!msg)
14999                 return;
15000
15001         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15002         if (!hdr)
15003                 goto free_msg;
15004
15005         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15006             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15007                               NL80211_ATTR_PAD))
15008                 goto free_msg;
15009
15010         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15011                                         wdev->netdev->ifindex))
15012                 goto free_msg;
15013
15014         if (wakeup) {
15015                 struct nlattr *reasons;
15016
15017                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15018                 if (!reasons)
15019                         goto free_msg;
15020
15021                 if (wakeup->disconnect &&
15022                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15023                         goto free_msg;
15024                 if (wakeup->magic_pkt &&
15025                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15026                         goto free_msg;
15027                 if (wakeup->gtk_rekey_failure &&
15028                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15029                         goto free_msg;
15030                 if (wakeup->eap_identity_req &&
15031                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15032                         goto free_msg;
15033                 if (wakeup->four_way_handshake &&
15034                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15035                         goto free_msg;
15036                 if (wakeup->rfkill_release &&
15037                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15038                         goto free_msg;
15039
15040                 if (wakeup->pattern_idx >= 0 &&
15041                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15042                                 wakeup->pattern_idx))
15043                         goto free_msg;
15044
15045                 if (wakeup->tcp_match &&
15046                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15047                         goto free_msg;
15048
15049                 if (wakeup->tcp_connlost &&
15050                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15051                         goto free_msg;
15052
15053                 if (wakeup->tcp_nomoretokens &&
15054                     nla_put_flag(msg,
15055                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15056                         goto free_msg;
15057
15058                 if (wakeup->packet) {
15059                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15060                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15061
15062                         if (!wakeup->packet_80211) {
15063                                 pkt_attr =
15064                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15065                                 len_attr =
15066                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15067                         }
15068
15069                         if (wakeup->packet_len &&
15070                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15071                                 goto free_msg;
15072
15073                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15074                                     wakeup->packet))
15075                                 goto free_msg;
15076                 }
15077
15078                 if (wakeup->net_detect &&
15079                     cfg80211_net_detect_results(msg, wakeup))
15080                                 goto free_msg;
15081
15082                 nla_nest_end(msg, reasons);
15083         }
15084
15085         genlmsg_end(msg, hdr);
15086
15087         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15088                                 NL80211_MCGRP_MLME, gfp);
15089         return;
15090
15091  free_msg:
15092         nlmsg_free(msg);
15093 }
15094 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15095 #endif
15096
15097 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15098                                 enum nl80211_tdls_operation oper,
15099                                 u16 reason_code, gfp_t gfp)
15100 {
15101         struct wireless_dev *wdev = dev->ieee80211_ptr;
15102         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15103         struct sk_buff *msg;
15104         void *hdr;
15105
15106         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15107                                          reason_code);
15108
15109         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15110         if (!msg)
15111                 return;
15112
15113         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15114         if (!hdr) {
15115                 nlmsg_free(msg);
15116                 return;
15117         }
15118
15119         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15120             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15121             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15122             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15123             (reason_code > 0 &&
15124              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15125                 goto nla_put_failure;
15126
15127         genlmsg_end(msg, hdr);
15128
15129         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15130                                 NL80211_MCGRP_MLME, gfp);
15131         return;
15132
15133  nla_put_failure:
15134         genlmsg_cancel(msg, hdr);
15135         nlmsg_free(msg);
15136 }
15137 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15138
15139 static int nl80211_netlink_notify(struct notifier_block * nb,
15140                                   unsigned long state,
15141                                   void *_notify)
15142 {
15143         struct netlink_notify *notify = _notify;
15144         struct cfg80211_registered_device *rdev;
15145         struct wireless_dev *wdev;
15146         struct cfg80211_beacon_registration *reg, *tmp;
15147
15148         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15149                 return NOTIFY_DONE;
15150
15151         rcu_read_lock();
15152
15153         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15154                 struct cfg80211_sched_scan_request *sched_scan_req;
15155
15156                 list_for_each_entry_rcu(sched_scan_req,
15157                                         &rdev->sched_scan_req_list,
15158                                         list) {
15159                         if (sched_scan_req->owner_nlportid == notify->portid) {
15160                                 sched_scan_req->nl_owner_dead = true;
15161                                 schedule_work(&rdev->sched_scan_stop_wk);
15162                         }
15163                 }
15164
15165                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15166                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15167
15168                         if (wdev->owner_nlportid == notify->portid) {
15169                                 wdev->nl_owner_dead = true;
15170                                 schedule_work(&rdev->destroy_work);
15171                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15172                                 schedule_work(&wdev->disconnect_wk);
15173                         }
15174                 }
15175
15176                 spin_lock_bh(&rdev->beacon_registrations_lock);
15177                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15178                                          list) {
15179                         if (reg->nlportid == notify->portid) {
15180                                 list_del(&reg->list);
15181                                 kfree(reg);
15182                                 break;
15183                         }
15184                 }
15185                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15186         }
15187
15188         rcu_read_unlock();
15189
15190         /*
15191          * It is possible that the user space process that is controlling the
15192          * indoor setting disappeared, so notify the regulatory core.
15193          */
15194         regulatory_netlink_notify(notify->portid);
15195         return NOTIFY_OK;
15196 }
15197
15198 static struct notifier_block nl80211_netlink_notifier = {
15199         .notifier_call = nl80211_netlink_notify,
15200 };
15201
15202 void cfg80211_ft_event(struct net_device *netdev,
15203                        struct cfg80211_ft_event_params *ft_event)
15204 {
15205         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15206         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15207         struct sk_buff *msg;
15208         void *hdr;
15209
15210         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15211
15212         if (!ft_event->target_ap)
15213                 return;
15214
15215         msg = nlmsg_new(100 + ft_event->ric_ies_len, GFP_KERNEL);
15216         if (!msg)
15217                 return;
15218
15219         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15220         if (!hdr)
15221                 goto out;
15222
15223         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15224             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15225             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15226                 goto out;
15227
15228         if (ft_event->ies &&
15229             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15230                 goto out;
15231         if (ft_event->ric_ies &&
15232             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15233                     ft_event->ric_ies))
15234                 goto out;
15235
15236         genlmsg_end(msg, hdr);
15237
15238         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15239                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15240         return;
15241  out:
15242         nlmsg_free(msg);
15243 }
15244 EXPORT_SYMBOL(cfg80211_ft_event);
15245
15246 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15247 {
15248         struct cfg80211_registered_device *rdev;
15249         struct sk_buff *msg;
15250         void *hdr;
15251         u32 nlportid;
15252
15253         rdev = wiphy_to_rdev(wdev->wiphy);
15254         if (!rdev->crit_proto_nlportid)
15255                 return;
15256
15257         nlportid = rdev->crit_proto_nlportid;
15258         rdev->crit_proto_nlportid = 0;
15259
15260         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15261         if (!msg)
15262                 return;
15263
15264         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15265         if (!hdr)
15266                 goto nla_put_failure;
15267
15268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15269             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15270                               NL80211_ATTR_PAD))
15271                 goto nla_put_failure;
15272
15273         genlmsg_end(msg, hdr);
15274
15275         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15276         return;
15277
15278  nla_put_failure:
15279         if (hdr)
15280                 genlmsg_cancel(msg, hdr);
15281         nlmsg_free(msg);
15282 }
15283 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15284
15285 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15286 {
15287         struct wiphy *wiphy = wdev->wiphy;
15288         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15289         struct sk_buff *msg;
15290         void *hdr;
15291
15292         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15293         if (!msg)
15294                 return;
15295
15296         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
15297         if (!hdr)
15298                 goto out;
15299
15300         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15301             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
15302             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15303                               NL80211_ATTR_PAD))
15304                 goto out;
15305
15306         genlmsg_end(msg, hdr);
15307
15308         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
15309                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15310         return;
15311  out:
15312         nlmsg_free(msg);
15313 }
15314
15315 /* initialisation/exit functions */
15316
15317 int __init nl80211_init(void)
15318 {
15319         int err;
15320
15321         err = genl_register_family(&nl80211_fam);
15322         if (err)
15323                 return err;
15324
15325         err = netlink_register_notifier(&nl80211_netlink_notifier);
15326         if (err)
15327                 goto err_out;
15328
15329         return 0;
15330  err_out:
15331         genl_unregister_family(&nl80211_fam);
15332         return err;
15333 }
15334
15335 void nl80211_exit(void)
15336 {
15337         netlink_unregister_notifier(&nl80211_netlink_notifier);
15338         genl_unregister_family(&nl80211_fam);
15339 }