net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2023 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 static int validate_he_capa(const struct nlattr *attr,
 289                             struct netlink_ext_ack *extack)
 290 {
 291         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 292                 return -EINVAL;
 293
 294         return 0;
 295 }
 296
 297 /* policy for the attributes */
 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 299
 300 static const struct nla_policy
 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 302         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 303         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 304                                         .len = U8_MAX },
 305         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 306                                              .len = U8_MAX },
 307 };
 308
 309 static const struct nla_policy
 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 311         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 312         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 313         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 314                 NLA_POLICY_MAX(NLA_U8, 15),
 315         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 316         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 317                 NLA_POLICY_MAX(NLA_U8, 15),
 318         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 319                 NLA_POLICY_MAX(NLA_U8, 31),
 320         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 321         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 322         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 323         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 324         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 325         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 326 };
 327
 328 static const struct nla_policy
 329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 330         [NL80211_PMSR_TYPE_FTM] =
 331                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 332 };
 333
 334 static const struct nla_policy
 335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 336         [NL80211_PMSR_REQ_ATTR_DATA] =
 337                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 338         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 339 };
 340
 341 static const struct nla_policy
 342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 343         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 344         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 345         [NL80211_PMSR_PEER_ATTR_REQ] =
 346                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 347         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 348 };
 349
 350 static const struct nla_policy
 351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 352         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 353         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 354         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 355         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 356         [NL80211_PMSR_ATTR_PEERS] =
 357                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 358 };
 359
 360 static const struct nla_policy
 361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 362         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 363                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 364         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 365                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 366         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 367                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 368         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 369                 NLA_POLICY_EXACT_LEN(8),
 370         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 371                 NLA_POLICY_EXACT_LEN(8),
 372         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 373 };
 374
 375 static const struct nla_policy
 376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 377         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 378         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 379         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 380 };
 381
 382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 383         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 384                                     .len = NL80211_MAX_SUPP_RATES },
 385         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 386                                 .len = NL80211_MAX_SUPP_HT_RATES },
 387         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 388         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 389         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 390         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 391                                                    NL80211_RATE_INFO_HE_GI_0_8,
 392                                                    NL80211_RATE_INFO_HE_GI_3_2),
 393         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 394                                                    NL80211_RATE_INFO_HE_1XLTF,
 395                                                    NL80211_RATE_INFO_HE_4XLTF),
 396 };
 397
 398 static const struct nla_policy
 399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 400         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 401         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 402         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 403         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 404         [NL80211_TID_CONFIG_ATTR_NOACK] =
 405                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 406         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 407         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 408         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 409                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 410         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 411                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 412         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 413                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 414         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 415                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 416         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 417                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 418 };
 419
 420 static const struct nla_policy
 421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 422         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 423         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 424         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 425                         NLA_POLICY_RANGE(NLA_BINARY,
 426                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 427                                          IEEE80211_MAX_DATA_LEN),
 428 };
 429
 430 static const struct nla_policy
 431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 432         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 433         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 434                                                        .len = IEEE80211_MAX_DATA_LEN }
 435 };
 436
 437 static const struct nla_policy
 438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 439         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 440         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 441 };
 442
 443 static const struct nla_policy
 444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 445         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 446         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 447 };
 448
 449 static const struct nla_policy
 450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 451         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 452         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 453                                                 NLA_POLICY_MIN(NLA_U8, 1),
 454         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 455         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 456         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 457 };
 458
 459 static const struct nla_policy
 460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 461         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 462         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 463 };
 464
 465 static struct netlink_range_validation nl80211_punct_bitmap_range = {
 466         .min = 0,
 467         .max = 0xffff,
 468 };
 469
 470 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 471         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 472         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 473         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 474                                       .len = 20-1 },
 475         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 476
 477         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 478         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 479         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 480                                                 NL80211_EDMG_CHANNELS_MIN,
 481                                                 NL80211_EDMG_CHANNELS_MAX),
 482         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 483                                                 NL80211_EDMG_BW_CONFIG_MIN,
 484                                                 NL80211_EDMG_BW_CONFIG_MAX),
 485
 486         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 487         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 488         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 489         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 490
 491         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 492         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 493         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 494         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 496         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 497
 498         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 499         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 500         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 501
 502         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 503         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 504
 505         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 506         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 507                                     .len = WLAN_MAX_KEY_LEN },
 508         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 509         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 510         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 511         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 512         [NL80211_ATTR_KEY_TYPE] =
 513                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 514
 515         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 516         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 517         [NL80211_ATTR_BEACON_HEAD] =
 518                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 519                                        IEEE80211_MAX_DATA_LEN),
 520         [NL80211_ATTR_BEACON_TAIL] =
 521                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 522                                        IEEE80211_MAX_DATA_LEN),
 523         [NL80211_ATTR_STA_AID] =
 524                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 525         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 526         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 527         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 528                                                .len = NL80211_MAX_SUPP_RATES },
 529         [NL80211_ATTR_STA_PLINK_ACTION] =
 530                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 531         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 532                 NLA_POLICY_RANGE(NLA_U8,
 533                                  NL80211_TX_POWER_AUTOMATIC,
 534                                  NL80211_TX_POWER_FIXED),
 535         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 536         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 537         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 538         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 539                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 540         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 541
 542         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 543         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 544         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 545
 546         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 547         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 548         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 549         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 550                                            .len = NL80211_MAX_SUPP_RATES },
 551         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 552
 553         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 554         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 555
 556         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 557
 558         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 559         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 560                                                    validate_ie_attr,
 561                                                    IEEE80211_MAX_DATA_LEN),
 562         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 563         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 564
 565         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 566                                 .len = IEEE80211_MAX_SSID_LEN },
 567         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 568         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 569         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 570         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 571         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 572                                                   NL80211_MFP_NO,
 573                                                   NL80211_MFP_OPTIONAL),
 574         [NL80211_ATTR_STA_FLAGS2] =
 575                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 576         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 577         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 578         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 579         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 581         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 582         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 583         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 584         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 585         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 586         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 587         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 588         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 589         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 590         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 591                                  .len = IEEE80211_MAX_DATA_LEN },
 592         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 593         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 594                                                    NL80211_PS_DISABLED,
 595                                                    NL80211_PS_ENABLED),
 596         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 597         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 598         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 599         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 600         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 601         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 602         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 603         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 604         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 605         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 606         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 607         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 608         [NL80211_ATTR_STA_PLINK_STATE] =
 609                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 610         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 611         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 612         [NL80211_ATTR_MESH_PEER_AID] =
 613                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 614         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 615         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 616         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 617         [NL80211_ATTR_HIDDEN_SSID] =
 618                 NLA_POLICY_RANGE(NLA_U32,
 619                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 620                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 621         [NL80211_ATTR_IE_PROBE_RESP] =
 622                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 623                                        IEEE80211_MAX_DATA_LEN),
 624         [NL80211_ATTR_IE_ASSOC_RESP] =
 625                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 626                                        IEEE80211_MAX_DATA_LEN),
 627         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 628         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 629         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 630         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 631         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 632         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 633         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 634         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 635         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 636         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 637         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 638         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 639                                       .len = IEEE80211_MAX_DATA_LEN },
 640         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 641         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 642         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 643                 .len = NL80211_HT_CAPABILITY_LEN
 644         },
 645         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 646         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 647         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 648         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 649         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 650
 651         /* need to include at least Auth Transaction and Status Code */
 652         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 653
 654         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 655         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 656         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 657         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 658         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 659                 NLA_POLICY_RANGE(NLA_U32,
 660                                  NL80211_MESH_POWER_UNKNOWN + 1,
 661                                  NL80211_MESH_POWER_MAX),
 662         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 663         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 664         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 665         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 666         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 667         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 668         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 669                 .len = NL80211_VHT_CAPABILITY_LEN,
 670         },
 671         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 672         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 673                                   .len = IEEE80211_MAX_DATA_LEN },
 674         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 675         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 676                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 677         [NL80211_ATTR_PEER_AID] =
 678                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 679         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 680         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 681         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 682         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 683         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 684         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 685         /*
 686          * The value of the Length field of the Supported Operating
 687          * Classes element is between 2 and 253.
 688          */
 689         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 690                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 691         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 692         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 693         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 694         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 695         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 696         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 697                                                   IEEE80211_QOS_MAP_LEN_MIN,
 698                                                   IEEE80211_QOS_MAP_LEN_MAX),
 699         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 700         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 701         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 702         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 703         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 704         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 705         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 706         [NL80211_ATTR_USER_PRIO] =
 707                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 708         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 709         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 710         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 711         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 712         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 713         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 714         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 715         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 716         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 717         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 718         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 719                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 720         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 721                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 722         },
 723         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 724         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 725         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 726         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 727         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 728                                     .len = FILS_MAX_KEK_LEN },
 729         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 730         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 731         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 732         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 733         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 734                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 735         },
 736         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 737         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 738                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 739         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 740                                           .len = FILS_ERP_MAX_REALM_LEN },
 741         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 742         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 743                                         .len = FILS_ERP_MAX_RRK_LEN },
 744         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 745         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 746         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 747         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 748         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 749
 750         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 751         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 752         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 753         [NL80211_ATTR_HE_CAPABILITY] =
 754                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 755                                        NL80211_HE_MAX_CAPABILITY_LEN),
 756         [NL80211_ATTR_FTM_RESPONDER] =
 757                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 758         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 759         [NL80211_ATTR_PEER_MEASUREMENTS] =
 760                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 761         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 762         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 763                                         .len = SAE_PASSWORD_MAX_LEN },
 764         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 765         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 766         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 767         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 768         [NL80211_ATTR_TID_CONFIG] =
 769                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 770         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 771         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 772         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 773         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 774         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 775         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 776         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 777                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 778         [NL80211_ATTR_FILS_DISCOVERY] =
 779                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 780         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 781                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 782         [NL80211_ATTR_S1G_CAPABILITY] =
 783                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 784         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 785                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 786         [NL80211_ATTR_SAE_PWE] =
 787                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 788                                  NL80211_SAE_PWE_BOTH),
 789         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 790         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 791         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 792         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 793         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 794         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 795         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 796         [NL80211_ATTR_MBSSID_CONFIG] =
 797                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 798         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 799         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 800         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 801         [NL80211_ATTR_EHT_CAPABILITY] =
 802                 NLA_POLICY_RANGE(NLA_BINARY,
 803                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 804                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 805         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 806         [NL80211_ATTR_MLO_LINKS] =
 807                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 808         [NL80211_ATTR_MLO_LINK_ID] =
 809                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
 810         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 811         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 812         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 813         [NL80211_ATTR_PUNCT_BITMAP] =
 814                 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
 815
 816         [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
 817         [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
 818         [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
 819         [NL80211_ATTR_MLO_LINK_DISABLED] = { .type = NLA_FLAG },
 820 };
 821
 822 /* policy for the key attributes */
 823 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 824         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 825         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 826         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 827         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 828         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 829         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 830         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 831         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 832         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 833 };
 834
 835 /* policy for the key default flags */
 836 static const struct nla_policy
 837 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 838         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 839         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 840 };
 841
 842 #ifdef CONFIG_PM
 843 /* policy for WoWLAN attributes */
 844 static const struct nla_policy
 845 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 846         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 847         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 848         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 849         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 850         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 851         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 852         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 853         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 854         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 855         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 856 };
 857
 858 static const struct nla_policy
 859 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 860         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 861         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 862         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 863         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 864         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 865         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 866         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 867                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 868         },
 869         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 870                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 871         },
 872         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 873         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 874         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 875 };
 876 #endif /* CONFIG_PM */
 877
 878 /* policy for coalesce rule attributes */
 879 static const struct nla_policy
 880 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 881         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 882         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 883                 NLA_POLICY_RANGE(NLA_U32,
 884                                  NL80211_COALESCE_CONDITION_MATCH,
 885                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 886         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 887 };
 888
 889 /* policy for GTK rekey offload attributes */
 890 static const struct nla_policy
 891 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 892         [NL80211_REKEY_DATA_KEK] = {
 893                 .type = NLA_BINARY,
 894                 .len = NL80211_KEK_EXT_LEN
 895         },
 896         [NL80211_REKEY_DATA_KCK] = {
 897                 .type = NLA_BINARY,
 898                 .len = NL80211_KCK_EXT_LEN_32
 899         },
 900         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 901         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 902 };
 903
 904 static const struct nla_policy
 905 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 906         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 907         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 908         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 909         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 910         [NL80211_BAND_LC]    = { .type = NLA_S32 },
 911 };
 912
 913 static const struct nla_policy
 914 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 915         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 916                                                  .len = IEEE80211_MAX_SSID_LEN },
 917         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 918         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 919         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 920                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 921 };
 922
 923 static const struct nla_policy
 924 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 925         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 926         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 927 };
 928
 929 static const struct nla_policy
 930 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 931         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 932         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 933         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 934                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 935         },
 936 };
 937
 938 /* policy for NAN function attributes */
 939 static const struct nla_policy
 940 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 941         [NL80211_NAN_FUNC_TYPE] =
 942                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 943         [NL80211_NAN_FUNC_SERVICE_ID] = {
 944                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 945         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 946         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 947         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 948         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 949         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 950         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 951         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 952         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 953         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 954                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 955         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 956         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 957         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 958         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 959         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 960 };
 961
 962 /* policy for Service Response Filter attributes */
 963 static const struct nla_policy
 964 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 965         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 966         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 967                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 968         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 969         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 970 };
 971
 972 /* policy for packet pattern attributes */
 973 static const struct nla_policy
 974 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 975         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 976         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 977         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 978 };
 979
 980 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 981                                      struct cfg80211_registered_device **rdev,
 982                                      struct wireless_dev **wdev,
 983                                      struct nlattr **attrbuf)
 984 {
 985         int err;
 986
 987         if (!cb->args[0]) {
 988                 struct nlattr **attrbuf_free = NULL;
 989
 990                 if (!attrbuf) {
 991                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 992                                           GFP_KERNEL);
 993                         if (!attrbuf)
 994                                 return -ENOMEM;
 995                         attrbuf_free = attrbuf;
 996                 }
 997
 998                 err = nlmsg_parse_deprecated(cb->nlh,
 999                                              GENL_HDRLEN + nl80211_fam.hdrsize,
1000                                              attrbuf, nl80211_fam.maxattr,
1001                                              nl80211_policy, NULL);
1002                 if (err) {
1003                         kfree(attrbuf_free);
1004                         return err;
1005                 }
1006
1007                 rtnl_lock();
1008                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1009                                                    attrbuf);
1010                 kfree(attrbuf_free);
1011                 if (IS_ERR(*wdev)) {
1012                         rtnl_unlock();
1013                         return PTR_ERR(*wdev);
1014                 }
1015                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1016                 mutex_lock(&(*rdev)->wiphy.mtx);
1017                 rtnl_unlock();
1018                 /* 0 is the first index - add 1 to parse only once */
1019                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1020                 cb->args[1] = (*wdev)->identifier;
1021         } else {
1022                 /* subtract the 1 again here */
1023                 struct wiphy *wiphy;
1024                 struct wireless_dev *tmp;
1025
1026                 rtnl_lock();
1027                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1028                 if (!wiphy) {
1029                         rtnl_unlock();
1030                         return -ENODEV;
1031                 }
1032                 *rdev = wiphy_to_rdev(wiphy);
1033                 *wdev = NULL;
1034
1035                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1036                         if (tmp->identifier == cb->args[1]) {
1037                                 *wdev = tmp;
1038                                 break;
1039                         }
1040                 }
1041
1042                 if (!*wdev) {
1043                         rtnl_unlock();
1044                         return -ENODEV;
1045                 }
1046                 mutex_lock(&(*rdev)->wiphy.mtx);
1047                 rtnl_unlock();
1048         }
1049
1050         return 0;
1051 }
1052
1053 /* message building helper */
1054 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1055                      int flags, u8 cmd)
1056 {
1057         /* since there is no private header just add the generic one */
1058         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1059 }
1060
1061 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1062                                      const struct ieee80211_reg_rule *rule)
1063 {
1064         int j;
1065         struct nlattr *nl_wmm_rules =
1066                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1067
1068         if (!nl_wmm_rules)
1069                 goto nla_put_failure;
1070
1071         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1072                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1073
1074                 if (!nl_wmm_rule)
1075                         goto nla_put_failure;
1076
1077                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1078                                 rule->wmm_rule.client[j].cw_min) ||
1079                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1080                                 rule->wmm_rule.client[j].cw_max) ||
1081                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1082                                rule->wmm_rule.client[j].aifsn) ||
1083                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1084                                 rule->wmm_rule.client[j].cot))
1085                         goto nla_put_failure;
1086
1087                 nla_nest_end(msg, nl_wmm_rule);
1088         }
1089         nla_nest_end(msg, nl_wmm_rules);
1090
1091         return 0;
1092
1093 nla_put_failure:
1094         return -ENOBUFS;
1095 }
1096
1097 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1098                                    struct ieee80211_channel *chan,
1099                                    bool large)
1100 {
1101         /* Some channels must be completely excluded from the
1102          * list to protect old user-space tools from breaking
1103          */
1104         if (!large && chan->flags &
1105             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1106                 return 0;
1107         if (!large && chan->freq_offset)
1108                 return 0;
1109
1110         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1111                         chan->center_freq))
1112                 goto nla_put_failure;
1113
1114         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1115                 goto nla_put_failure;
1116
1117         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1118             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1119                 goto nla_put_failure;
1120         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1121                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1122                         goto nla_put_failure;
1123                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1124                         goto nla_put_failure;
1125         }
1126         if (chan->flags & IEEE80211_CHAN_RADAR) {
1127                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1128                         goto nla_put_failure;
1129                 if (large) {
1130                         u32 time;
1131
1132                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1133
1134                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1135                                         chan->dfs_state))
1136                                 goto nla_put_failure;
1137                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1138                                         time))
1139                                 goto nla_put_failure;
1140                         if (nla_put_u32(msg,
1141                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1142                                         chan->dfs_cac_ms))
1143                                 goto nla_put_failure;
1144                 }
1145         }
1146
1147         if (large) {
1148                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1149                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1150                         goto nla_put_failure;
1151                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1152                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1153                         goto nla_put_failure;
1154                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1155                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1156                         goto nla_put_failure;
1157                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1158                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1159                         goto nla_put_failure;
1160                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1161                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1162                         goto nla_put_failure;
1163                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1164                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1165                         goto nla_put_failure;
1166                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1167                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1168                         goto nla_put_failure;
1169                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1170                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1171                         goto nla_put_failure;
1172                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1173                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1174                         goto nla_put_failure;
1175                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1176                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1177                         goto nla_put_failure;
1178                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1179                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1180                         goto nla_put_failure;
1181                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1182                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1183                         goto nla_put_failure;
1184                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1185                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1186                         goto nla_put_failure;
1187                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1188                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1189                         goto nla_put_failure;
1190                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1191                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1192                         goto nla_put_failure;
1193                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1194                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1195                         goto nla_put_failure;
1196         }
1197
1198         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1199                         DBM_TO_MBM(chan->max_power)))
1200                 goto nla_put_failure;
1201
1202         if (large) {
1203                 const struct ieee80211_reg_rule *rule =
1204                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1205
1206                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1207                         if (nl80211_msg_put_wmm_rules(msg, rule))
1208                                 goto nla_put_failure;
1209                 }
1210         }
1211
1212         return 0;
1213
1214  nla_put_failure:
1215         return -ENOBUFS;
1216 }
1217
1218 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1219                                   struct cfg80211_txq_stats *txqstats,
1220                                   int attrtype)
1221 {
1222         struct nlattr *txqattr;
1223
1224 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1225         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1226             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1227                 return false;                                             \
1228         } while (0)
1229
1230         txqattr = nla_nest_start_noflag(msg, attrtype);
1231         if (!txqattr)
1232                 return false;
1233
1234         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1235         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1236         PUT_TXQVAL_U32(FLOWS, flows);
1237         PUT_TXQVAL_U32(DROPS, drops);
1238         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1239         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1240         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1241         PUT_TXQVAL_U32(COLLISIONS, collisions);
1242         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1243         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1244         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1245         nla_nest_end(msg, txqattr);
1246
1247 #undef PUT_TXQVAL_U32
1248         return true;
1249 }
1250
1251 /* netlink command implementations */
1252
1253 /**
1254  * nl80211_link_id - return link ID
1255  * @attrs: attributes to look at
1256  *
1257  * Returns: the link ID or 0 if not given
1258  *
1259  * Note this function doesn't do any validation of the link
1260  * ID validity wrt. links that were actually added, so it must
1261  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1262  * or if additional validation is done.
1263  */
1264 static unsigned int nl80211_link_id(struct nlattr **attrs)
1265 {
1266         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1267
1268         if (!linkid)
1269                 return 0;
1270
1271         return nla_get_u8(linkid);
1272 }
1273
1274 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1275 {
1276         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1277
1278         if (!linkid)
1279                 return -1;
1280
1281         return nla_get_u8(linkid);
1282 }
1283
1284 struct key_parse {
1285         struct key_params p;
1286         int idx;
1287         int type;
1288         bool def, defmgmt, defbeacon;
1289         bool def_uni, def_multi;
1290 };
1291
1292 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1293                                  struct key_parse *k)
1294 {
1295         struct nlattr *tb[NL80211_KEY_MAX + 1];
1296         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1297                                               nl80211_key_policy,
1298                                               info->extack);
1299         if (err)
1300                 return err;
1301
1302         k->def = !!tb[NL80211_KEY_DEFAULT];
1303         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1304         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1305
1306         if (k->def) {
1307                 k->def_uni = true;
1308                 k->def_multi = true;
1309         }
1310         if (k->defmgmt || k->defbeacon)
1311                 k->def_multi = true;
1312
1313         if (tb[NL80211_KEY_IDX])
1314                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1315
1316         if (tb[NL80211_KEY_DATA]) {
1317                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1318                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1319         }
1320
1321         if (tb[NL80211_KEY_SEQ]) {
1322                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1323                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1324         }
1325
1326         if (tb[NL80211_KEY_CIPHER])
1327                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1328
1329         if (tb[NL80211_KEY_TYPE])
1330                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1331
1332         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1333                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1334
1335                 err = nla_parse_nested_deprecated(kdt,
1336                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1337                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1338                                                   nl80211_key_default_policy,
1339                                                   info->extack);
1340                 if (err)
1341                         return err;
1342
1343                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1344                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1345         }
1346
1347         if (tb[NL80211_KEY_MODE])
1348                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1349
1350         return 0;
1351 }
1352
1353 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1354 {
1355         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1356                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1357                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1358         }
1359
1360         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1361                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1362                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1363         }
1364
1365         if (info->attrs[NL80211_ATTR_KEY_IDX])
1366                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1367
1368         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1369                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1370
1371         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1372         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1373
1374         if (k->def) {
1375                 k->def_uni = true;
1376                 k->def_multi = true;
1377         }
1378         if (k->defmgmt)
1379                 k->def_multi = true;
1380
1381         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1382                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1383
1384         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1385                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1386                 int err = nla_parse_nested_deprecated(kdt,
1387                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1388                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1389                                                       nl80211_key_default_policy,
1390                                                       info->extack);
1391                 if (err)
1392                         return err;
1393
1394                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1395                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1396         }
1397
1398         return 0;
1399 }
1400
1401 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1402 {
1403         int err;
1404
1405         memset(k, 0, sizeof(*k));
1406         k->idx = -1;
1407         k->type = -1;
1408
1409         if (info->attrs[NL80211_ATTR_KEY])
1410                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1411         else
1412                 err = nl80211_parse_key_old(info, k);
1413
1414         if (err)
1415                 return err;
1416
1417         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1418             (k->defbeacon ? 1 : 0) > 1) {
1419                 GENL_SET_ERR_MSG(info,
1420                                  "key with multiple default flags is invalid");
1421                 return -EINVAL;
1422         }
1423
1424         if (k->defmgmt || k->defbeacon) {
1425                 if (k->def_uni || !k->def_multi) {
1426                         GENL_SET_ERR_MSG(info,
1427                                          "defmgmt/defbeacon key must be mcast");
1428                         return -EINVAL;
1429                 }
1430         }
1431
1432         if (k->idx != -1) {
1433                 if (k->defmgmt) {
1434                         if (k->idx < 4 || k->idx > 5) {
1435                                 GENL_SET_ERR_MSG(info,
1436                                                  "defmgmt key idx not 4 or 5");
1437                                 return -EINVAL;
1438                         }
1439                 } else if (k->defbeacon) {
1440                         if (k->idx < 6 || k->idx > 7) {
1441                                 GENL_SET_ERR_MSG(info,
1442                                                  "defbeacon key idx not 6 or 7");
1443                                 return -EINVAL;
1444                         }
1445                 } else if (k->def) {
1446                         if (k->idx < 0 || k->idx > 3) {
1447                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1448                                 return -EINVAL;
1449                         }
1450                 } else {
1451                         if (k->idx < 0 || k->idx > 7) {
1452                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1453                                 return -EINVAL;
1454                         }
1455                 }
1456         }
1457
1458         return 0;
1459 }
1460
1461 static struct cfg80211_cached_keys *
1462 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1463                        struct genl_info *info, bool *no_ht)
1464 {
1465         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1466         struct key_parse parse;
1467         struct nlattr *key;
1468         struct cfg80211_cached_keys *result;
1469         int rem, err, def = 0;
1470         bool have_key = false;
1471
1472         nla_for_each_nested(key, keys, rem) {
1473                 have_key = true;
1474                 break;
1475         }
1476
1477         if (!have_key)
1478                 return NULL;
1479
1480         result = kzalloc(sizeof(*result), GFP_KERNEL);
1481         if (!result)
1482                 return ERR_PTR(-ENOMEM);
1483
1484         result->def = -1;
1485
1486         nla_for_each_nested(key, keys, rem) {
1487                 memset(&parse, 0, sizeof(parse));
1488                 parse.idx = -1;
1489
1490                 err = nl80211_parse_key_new(info, key, &parse);
1491                 if (err)
1492                         goto error;
1493                 err = -EINVAL;
1494                 if (!parse.p.key)
1495                         goto error;
1496                 if (parse.idx < 0 || parse.idx > 3) {
1497                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1498                         goto error;
1499                 }
1500                 if (parse.def) {
1501                         if (def) {
1502                                 GENL_SET_ERR_MSG(info,
1503                                                  "only one key can be default");
1504                                 goto error;
1505                         }
1506                         def = 1;
1507                         result->def = parse.idx;
1508                         if (!parse.def_uni || !parse.def_multi)
1509                                 goto error;
1510                 } else if (parse.defmgmt)
1511                         goto error;
1512                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1513                                                      parse.idx, false, NULL);
1514                 if (err)
1515                         goto error;
1516                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1517                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1518                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1519                         err = -EINVAL;
1520                         goto error;
1521                 }
1522                 result->params[parse.idx].cipher = parse.p.cipher;
1523                 result->params[parse.idx].key_len = parse.p.key_len;
1524                 result->params[parse.idx].key = result->data[parse.idx];
1525                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1526
1527                 /* must be WEP key if we got here */
1528                 if (no_ht)
1529                         *no_ht = true;
1530         }
1531
1532         if (result->def < 0) {
1533                 err = -EINVAL;
1534                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1535                 goto error;
1536         }
1537
1538         return result;
1539  error:
1540         kfree(result);
1541         return ERR_PTR(err);
1542 }
1543
1544 static int nl80211_key_allowed(struct wireless_dev *wdev)
1545 {
1546         ASSERT_WDEV_LOCK(wdev);
1547
1548         switch (wdev->iftype) {
1549         case NL80211_IFTYPE_AP:
1550         case NL80211_IFTYPE_AP_VLAN:
1551         case NL80211_IFTYPE_P2P_GO:
1552         case NL80211_IFTYPE_MESH_POINT:
1553                 break;
1554         case NL80211_IFTYPE_ADHOC:
1555                 if (wdev->u.ibss.current_bss)
1556                         return 0;
1557                 return -ENOLINK;
1558         case NL80211_IFTYPE_STATION:
1559         case NL80211_IFTYPE_P2P_CLIENT:
1560                 if (wdev->connected)
1561                         return 0;
1562                 return -ENOLINK;
1563         case NL80211_IFTYPE_NAN:
1564                 if (wiphy_ext_feature_isset(wdev->wiphy,
1565                                             NL80211_EXT_FEATURE_SECURE_NAN))
1566                         return 0;
1567                 return -EINVAL;
1568         case NL80211_IFTYPE_UNSPECIFIED:
1569         case NL80211_IFTYPE_OCB:
1570         case NL80211_IFTYPE_MONITOR:
1571         case NL80211_IFTYPE_P2P_DEVICE:
1572         case NL80211_IFTYPE_WDS:
1573         case NUM_NL80211_IFTYPES:
1574                 return -EINVAL;
1575         }
1576
1577         return 0;
1578 }
1579
1580 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1581                                                         u32 freq)
1582 {
1583         struct ieee80211_channel *chan;
1584
1585         chan = ieee80211_get_channel_khz(wiphy, freq);
1586         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1587                 return NULL;
1588         return chan;
1589 }
1590
1591 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1592 {
1593         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1594         int i;
1595
1596         if (!nl_modes)
1597                 goto nla_put_failure;
1598
1599         i = 0;
1600         while (ifmodes) {
1601                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1602                         goto nla_put_failure;
1603                 ifmodes >>= 1;
1604                 i++;
1605         }
1606
1607         nla_nest_end(msg, nl_modes);
1608         return 0;
1609
1610 nla_put_failure:
1611         return -ENOBUFS;
1612 }
1613
1614 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1615                                           struct sk_buff *msg,
1616                                           bool large)
1617 {
1618         struct nlattr *nl_combis;
1619         int i, j;
1620
1621         nl_combis = nla_nest_start_noflag(msg,
1622                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1623         if (!nl_combis)
1624                 goto nla_put_failure;
1625
1626         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1627                 const struct ieee80211_iface_combination *c;
1628                 struct nlattr *nl_combi, *nl_limits;
1629
1630                 c = &wiphy->iface_combinations[i];
1631
1632                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1633                 if (!nl_combi)
1634                         goto nla_put_failure;
1635
1636                 nl_limits = nla_nest_start_noflag(msg,
1637                                                   NL80211_IFACE_COMB_LIMITS);
1638                 if (!nl_limits)
1639                         goto nla_put_failure;
1640
1641                 for (j = 0; j < c->n_limits; j++) {
1642                         struct nlattr *nl_limit;
1643
1644                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1645                         if (!nl_limit)
1646                                 goto nla_put_failure;
1647                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1648                                         c->limits[j].max))
1649                                 goto nla_put_failure;
1650                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1651                                                 c->limits[j].types))
1652                                 goto nla_put_failure;
1653                         nla_nest_end(msg, nl_limit);
1654                 }
1655
1656                 nla_nest_end(msg, nl_limits);
1657
1658                 if (c->beacon_int_infra_match &&
1659                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1660                         goto nla_put_failure;
1661                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1662                                 c->num_different_channels) ||
1663                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1664                                 c->max_interfaces))
1665                         goto nla_put_failure;
1666                 if (large &&
1667                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1668                                 c->radar_detect_widths) ||
1669                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1670                                 c->radar_detect_regions)))
1671                         goto nla_put_failure;
1672                 if (c->beacon_int_min_gcd &&
1673                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1674                                 c->beacon_int_min_gcd))
1675                         goto nla_put_failure;
1676
1677                 nla_nest_end(msg, nl_combi);
1678         }
1679
1680         nla_nest_end(msg, nl_combis);
1681
1682         return 0;
1683 nla_put_failure:
1684         return -ENOBUFS;
1685 }
1686
1687 #ifdef CONFIG_PM
1688 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1689                                         struct sk_buff *msg)
1690 {
1691         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1692         struct nlattr *nl_tcp;
1693
1694         if (!tcp)
1695                 return 0;
1696
1697         nl_tcp = nla_nest_start_noflag(msg,
1698                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1699         if (!nl_tcp)
1700                 return -ENOBUFS;
1701
1702         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1703                         tcp->data_payload_max))
1704                 return -ENOBUFS;
1705
1706         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1707                         tcp->data_payload_max))
1708                 return -ENOBUFS;
1709
1710         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1711                 return -ENOBUFS;
1712
1713         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1714                                 sizeof(*tcp->tok), tcp->tok))
1715                 return -ENOBUFS;
1716
1717         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1718                         tcp->data_interval_max))
1719                 return -ENOBUFS;
1720
1721         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1722                         tcp->wake_payload_max))
1723                 return -ENOBUFS;
1724
1725         nla_nest_end(msg, nl_tcp);
1726         return 0;
1727 }
1728
1729 static int nl80211_send_wowlan(struct sk_buff *msg,
1730                                struct cfg80211_registered_device *rdev,
1731                                bool large)
1732 {
1733         struct nlattr *nl_wowlan;
1734
1735         if (!rdev->wiphy.wowlan)
1736                 return 0;
1737
1738         nl_wowlan = nla_nest_start_noflag(msg,
1739                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1740         if (!nl_wowlan)
1741                 return -ENOBUFS;
1742
1743         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1744              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1745             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1746              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1747             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1748              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1749             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1750              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1751             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1752              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1753             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1754              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1755             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1756              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1757             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1758              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1759                 return -ENOBUFS;
1760
1761         if (rdev->wiphy.wowlan->n_patterns) {
1762                 struct nl80211_pattern_support pat = {
1763                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1764                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1765                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1766                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1767                 };
1768
1769                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1770                             sizeof(pat), &pat))
1771                         return -ENOBUFS;
1772         }
1773
1774         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1775             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1776                         rdev->wiphy.wowlan->max_nd_match_sets))
1777                 return -ENOBUFS;
1778
1779         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1780                 return -ENOBUFS;
1781
1782         nla_nest_end(msg, nl_wowlan);
1783
1784         return 0;
1785 }
1786 #endif
1787
1788 static int nl80211_send_coalesce(struct sk_buff *msg,
1789                                  struct cfg80211_registered_device *rdev)
1790 {
1791         struct nl80211_coalesce_rule_support rule;
1792
1793         if (!rdev->wiphy.coalesce)
1794                 return 0;
1795
1796         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1797         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1798         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1799         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1800         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1801         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1802
1803         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1804                 return -ENOBUFS;
1805
1806         return 0;
1807 }
1808
1809 static int
1810 nl80211_send_iftype_data(struct sk_buff *msg,
1811                          const struct ieee80211_supported_band *sband,
1812                          const struct ieee80211_sband_iftype_data *iftdata)
1813 {
1814         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1815         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1816
1817         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1818                                 iftdata->types_mask))
1819                 return -ENOBUFS;
1820
1821         if (he_cap->has_he) {
1822                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1823                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1824                             he_cap->he_cap_elem.mac_cap_info) ||
1825                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1826                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1827                             he_cap->he_cap_elem.phy_cap_info) ||
1828                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1829                             sizeof(he_cap->he_mcs_nss_supp),
1830                             &he_cap->he_mcs_nss_supp) ||
1831                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1832                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1833                         return -ENOBUFS;
1834         }
1835
1836         if (eht_cap->has_eht && he_cap->has_he) {
1837                 u8 mcs_nss_size, ppe_thresh_size;
1838                 u16 ppe_thres_hdr;
1839                 bool is_ap;
1840
1841                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1842                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1843
1844                 mcs_nss_size =
1845                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1846                                                    &eht_cap->eht_cap_elem,
1847                                                    is_ap);
1848
1849                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1850                 ppe_thresh_size =
1851                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1852                                                eht_cap->eht_cap_elem.phy_cap_info);
1853
1854                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1855                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1856                             eht_cap->eht_cap_elem.mac_cap_info) ||
1857                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1858                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1859                             eht_cap->eht_cap_elem.phy_cap_info) ||
1860                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1861                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1862                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1863                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1864                         return -ENOBUFS;
1865         }
1866
1867         if (sband->band == NL80211_BAND_6GHZ &&
1868             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1869                     sizeof(iftdata->he_6ghz_capa),
1870                     &iftdata->he_6ghz_capa))
1871                 return -ENOBUFS;
1872
1873         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1874             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1875                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1876                 return -ENOBUFS;
1877
1878         return 0;
1879 }
1880
1881 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1882                                       struct ieee80211_supported_band *sband,
1883                                       bool large)
1884 {
1885         struct nlattr *nl_rates, *nl_rate;
1886         struct ieee80211_rate *rate;
1887         int i;
1888
1889         /* add HT info */
1890         if (sband->ht_cap.ht_supported &&
1891             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1892                      sizeof(sband->ht_cap.mcs),
1893                      &sband->ht_cap.mcs) ||
1894              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1895                          sband->ht_cap.cap) ||
1896              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1897                         sband->ht_cap.ampdu_factor) ||
1898              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1899                         sband->ht_cap.ampdu_density)))
1900                 return -ENOBUFS;
1901
1902         /* add VHT info */
1903         if (sband->vht_cap.vht_supported &&
1904             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1905                      sizeof(sband->vht_cap.vht_mcs),
1906                      &sband->vht_cap.vht_mcs) ||
1907              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1908                          sband->vht_cap.cap)))
1909                 return -ENOBUFS;
1910
1911         if (large && sband->n_iftype_data) {
1912                 struct nlattr *nl_iftype_data =
1913                         nla_nest_start_noflag(msg,
1914                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1915                 int err;
1916
1917                 if (!nl_iftype_data)
1918                         return -ENOBUFS;
1919
1920                 for (i = 0; i < sband->n_iftype_data; i++) {
1921                         struct nlattr *iftdata;
1922
1923                         iftdata = nla_nest_start_noflag(msg, i + 1);
1924                         if (!iftdata)
1925                                 return -ENOBUFS;
1926
1927                         err = nl80211_send_iftype_data(msg, sband,
1928                                                        &sband->iftype_data[i]);
1929                         if (err)
1930                                 return err;
1931
1932                         nla_nest_end(msg, iftdata);
1933                 }
1934
1935                 nla_nest_end(msg, nl_iftype_data);
1936         }
1937
1938         /* add EDMG info */
1939         if (large && sband->edmg_cap.channels &&
1940             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1941                        sband->edmg_cap.channels) ||
1942             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1943                        sband->edmg_cap.bw_config)))
1944
1945                 return -ENOBUFS;
1946
1947         /* add bitrates */
1948         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1949         if (!nl_rates)
1950                 return -ENOBUFS;
1951
1952         for (i = 0; i < sband->n_bitrates; i++) {
1953                 nl_rate = nla_nest_start_noflag(msg, i);
1954                 if (!nl_rate)
1955                         return -ENOBUFS;
1956
1957                 rate = &sband->bitrates[i];
1958                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1959                                 rate->bitrate))
1960                         return -ENOBUFS;
1961                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1962                     nla_put_flag(msg,
1963                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1964                         return -ENOBUFS;
1965
1966                 nla_nest_end(msg, nl_rate);
1967         }
1968
1969         nla_nest_end(msg, nl_rates);
1970
1971         /* S1G capabilities */
1972         if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
1973             (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
1974                      sizeof(sband->s1g_cap.cap),
1975                      sband->s1g_cap.cap) ||
1976              nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
1977                      sizeof(sband->s1g_cap.nss_mcs),
1978                      sband->s1g_cap.nss_mcs)))
1979                 return -ENOBUFS;
1980
1981         return 0;
1982 }
1983
1984 static int
1985 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1986                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1987 {
1988         u16 stypes;
1989         struct nlattr *nl_ftypes, *nl_ifs;
1990         enum nl80211_iftype ift;
1991         int i;
1992
1993         if (!mgmt_stypes)
1994                 return 0;
1995
1996         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1997         if (!nl_ifs)
1998                 return -ENOBUFS;
1999
2000         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2001                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2002                 if (!nl_ftypes)
2003                         return -ENOBUFS;
2004                 i = 0;
2005                 stypes = mgmt_stypes[ift].tx;
2006                 while (stypes) {
2007                         if ((stypes & 1) &&
2008                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2009                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2010                                 return -ENOBUFS;
2011                         stypes >>= 1;
2012                         i++;
2013                 }
2014                 nla_nest_end(msg, nl_ftypes);
2015         }
2016
2017         nla_nest_end(msg, nl_ifs);
2018
2019         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2020         if (!nl_ifs)
2021                 return -ENOBUFS;
2022
2023         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2024                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2025                 if (!nl_ftypes)
2026                         return -ENOBUFS;
2027                 i = 0;
2028                 stypes = mgmt_stypes[ift].rx;
2029                 while (stypes) {
2030                         if ((stypes & 1) &&
2031                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2032                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2033                                 return -ENOBUFS;
2034                         stypes >>= 1;
2035                         i++;
2036                 }
2037                 nla_nest_end(msg, nl_ftypes);
2038         }
2039         nla_nest_end(msg, nl_ifs);
2040
2041         return 0;
2042 }
2043
2044 #define CMD(op, n)                                                      \
2045          do {                                                           \
2046                 if (rdev->ops->op) {                                    \
2047                         i++;                                            \
2048                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2049                                 goto nla_put_failure;                   \
2050                 }                                                       \
2051         } while (0)
2052
2053 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2054                                         struct sk_buff *msg)
2055 {
2056         int i = 0;
2057
2058         /*
2059          * do *NOT* add anything into this function, new things need to be
2060          * advertised only to new versions of userspace that can deal with
2061          * the split (and they can't possibly care about new features...
2062          */
2063         CMD(add_virtual_intf, NEW_INTERFACE);
2064         CMD(change_virtual_intf, SET_INTERFACE);
2065         CMD(add_key, NEW_KEY);
2066         CMD(start_ap, START_AP);
2067         CMD(add_station, NEW_STATION);
2068         CMD(add_mpath, NEW_MPATH);
2069         CMD(update_mesh_config, SET_MESH_CONFIG);
2070         CMD(change_bss, SET_BSS);
2071         CMD(auth, AUTHENTICATE);
2072         CMD(assoc, ASSOCIATE);
2073         CMD(deauth, DEAUTHENTICATE);
2074         CMD(disassoc, DISASSOCIATE);
2075         CMD(join_ibss, JOIN_IBSS);
2076         CMD(join_mesh, JOIN_MESH);
2077         CMD(set_pmksa, SET_PMKSA);
2078         CMD(del_pmksa, DEL_PMKSA);
2079         CMD(flush_pmksa, FLUSH_PMKSA);
2080         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2081                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2082         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2083         CMD(mgmt_tx, FRAME);
2084         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2085         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2086                 i++;
2087                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2088                         goto nla_put_failure;
2089         }
2090         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2091             rdev->ops->join_mesh) {
2092                 i++;
2093                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2094                         goto nla_put_failure;
2095         }
2096         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2097                 CMD(tdls_mgmt, TDLS_MGMT);
2098                 CMD(tdls_oper, TDLS_OPER);
2099         }
2100         if (rdev->wiphy.max_sched_scan_reqs)
2101                 CMD(sched_scan_start, START_SCHED_SCAN);
2102         CMD(probe_client, PROBE_CLIENT);
2103         CMD(set_noack_map, SET_NOACK_MAP);
2104         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2105                 i++;
2106                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2107                         goto nla_put_failure;
2108         }
2109         CMD(start_p2p_device, START_P2P_DEVICE);
2110         CMD(set_mcast_rate, SET_MCAST_RATE);
2111 #ifdef CONFIG_NL80211_TESTMODE
2112         CMD(testmode_cmd, TESTMODE);
2113 #endif
2114
2115         if (rdev->ops->connect || rdev->ops->auth) {
2116                 i++;
2117                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2118                         goto nla_put_failure;
2119         }
2120
2121         if (rdev->ops->disconnect || rdev->ops->deauth) {
2122                 i++;
2123                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2124                         goto nla_put_failure;
2125         }
2126
2127         return i;
2128  nla_put_failure:
2129         return -ENOBUFS;
2130 }
2131
2132 static int
2133 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2134                            struct sk_buff *msg)
2135 {
2136         struct nlattr *ftm;
2137
2138         if (!cap->ftm.supported)
2139                 return 0;
2140
2141         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2142         if (!ftm)
2143                 return -ENOBUFS;
2144
2145         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2146                 return -ENOBUFS;
2147         if (cap->ftm.non_asap &&
2148             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2149                 return -ENOBUFS;
2150         if (cap->ftm.request_lci &&
2151             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2152                 return -ENOBUFS;
2153         if (cap->ftm.request_civicloc &&
2154             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2155                 return -ENOBUFS;
2156         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2157                         cap->ftm.preambles))
2158                 return -ENOBUFS;
2159         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2160                         cap->ftm.bandwidths))
2161                 return -ENOBUFS;
2162         if (cap->ftm.max_bursts_exponent >= 0 &&
2163             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2164                         cap->ftm.max_bursts_exponent))
2165                 return -ENOBUFS;
2166         if (cap->ftm.max_ftms_per_burst &&
2167             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2168                         cap->ftm.max_ftms_per_burst))
2169                 return -ENOBUFS;
2170         if (cap->ftm.trigger_based &&
2171             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2172                 return -ENOBUFS;
2173         if (cap->ftm.non_trigger_based &&
2174             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2175                 return -ENOBUFS;
2176
2177         nla_nest_end(msg, ftm);
2178         return 0;
2179 }
2180
2181 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2182                                   struct sk_buff *msg)
2183 {
2184         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2185         struct nlattr *pmsr, *caps;
2186
2187         if (!cap)
2188                 return 0;
2189
2190         /*
2191          * we don't need to clean up anything here since the caller
2192          * will genlmsg_cancel() if we fail
2193          */
2194
2195         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2196         if (!pmsr)
2197                 return -ENOBUFS;
2198
2199         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2200                 return -ENOBUFS;
2201
2202         if (cap->report_ap_tsf &&
2203             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2204                 return -ENOBUFS;
2205
2206         if (cap->randomize_mac_addr &&
2207             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2208                 return -ENOBUFS;
2209
2210         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2211         if (!caps)
2212                 return -ENOBUFS;
2213
2214         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2215                 return -ENOBUFS;
2216
2217         nla_nest_end(msg, caps);
2218         nla_nest_end(msg, pmsr);
2219
2220         return 0;
2221 }
2222
2223 static int
2224 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2225                               struct sk_buff *msg)
2226 {
2227         int i;
2228         struct nlattr *nested, *nested_akms;
2229         const struct wiphy_iftype_akm_suites *iftype_akms;
2230
2231         if (!rdev->wiphy.num_iftype_akm_suites ||
2232             !rdev->wiphy.iftype_akm_suites)
2233                 return 0;
2234
2235         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2236         if (!nested)
2237                 return -ENOBUFS;
2238
2239         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2240                 nested_akms = nla_nest_start(msg, i + 1);
2241                 if (!nested_akms)
2242                         return -ENOBUFS;
2243
2244                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2245
2246                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2247                                         iftype_akms->iftypes_mask))
2248                         return -ENOBUFS;
2249
2250                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2251                             sizeof(u32) * iftype_akms->n_akm_suites,
2252                             iftype_akms->akm_suites)) {
2253                         return -ENOBUFS;
2254                 }
2255                 nla_nest_end(msg, nested_akms);
2256         }
2257
2258         nla_nest_end(msg, nested);
2259
2260         return 0;
2261 }
2262
2263 static int
2264 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2265                                struct sk_buff *msg)
2266 {
2267         struct nlattr *supp;
2268
2269         if (!rdev->wiphy.tid_config_support.vif &&
2270             !rdev->wiphy.tid_config_support.peer)
2271                 return 0;
2272
2273         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2274         if (!supp)
2275                 return -ENOSPC;
2276
2277         if (rdev->wiphy.tid_config_support.vif &&
2278             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2279                               rdev->wiphy.tid_config_support.vif,
2280                               NL80211_TID_CONFIG_ATTR_PAD))
2281                 goto fail;
2282
2283         if (rdev->wiphy.tid_config_support.peer &&
2284             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2285                               rdev->wiphy.tid_config_support.peer,
2286                               NL80211_TID_CONFIG_ATTR_PAD))
2287                 goto fail;
2288
2289         /* for now we just use the same value ... makes more sense */
2290         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2291                        rdev->wiphy.tid_config_support.max_retry))
2292                 goto fail;
2293         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2294                        rdev->wiphy.tid_config_support.max_retry))
2295                 goto fail;
2296
2297         nla_nest_end(msg, supp);
2298
2299         return 0;
2300 fail:
2301         nla_nest_cancel(msg, supp);
2302         return -ENOBUFS;
2303 }
2304
2305 static int
2306 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2307                       struct sk_buff *msg)
2308 {
2309         struct nlattr *sar_capa, *specs, *sub_freq_range;
2310         u8 num_freq_ranges;
2311         int i;
2312
2313         if (!rdev->wiphy.sar_capa)
2314                 return 0;
2315
2316         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2317
2318         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2319         if (!sar_capa)
2320                 return -ENOSPC;
2321
2322         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2323                 goto fail;
2324
2325         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2326         if (!specs)
2327                 goto fail;
2328
2329         /* report supported freq_ranges */
2330         for (i = 0; i < num_freq_ranges; i++) {
2331                 sub_freq_range = nla_nest_start(msg, i + 1);
2332                 if (!sub_freq_range)
2333                         goto fail;
2334
2335                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2336                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2337                         goto fail;
2338
2339                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2340                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2341                         goto fail;
2342
2343                 nla_nest_end(msg, sub_freq_range);
2344         }
2345
2346         nla_nest_end(msg, specs);
2347         nla_nest_end(msg, sar_capa);
2348
2349         return 0;
2350 fail:
2351         nla_nest_cancel(msg, sar_capa);
2352         return -ENOBUFS;
2353 }
2354
2355 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2356 {
2357         struct nlattr *config;
2358
2359         if (!wiphy->mbssid_max_interfaces)
2360                 return 0;
2361
2362         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2363         if (!config)
2364                 return -ENOBUFS;
2365
2366         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2367                        wiphy->mbssid_max_interfaces))
2368                 goto fail;
2369
2370         if (wiphy->ema_max_profile_periodicity &&
2371             nla_put_u8(msg,
2372                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2373                        wiphy->ema_max_profile_periodicity))
2374                 goto fail;
2375
2376         nla_nest_end(msg, config);
2377         return 0;
2378
2379 fail:
2380         nla_nest_cancel(msg, config);
2381         return -ENOBUFS;
2382 }
2383
2384 struct nl80211_dump_wiphy_state {
2385         s64 filter_wiphy;
2386         long start;
2387         long split_start, band_start, chan_start, capa_start;
2388         bool split;
2389 };
2390
2391 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2392                               enum nl80211_commands cmd,
2393                               struct sk_buff *msg, u32 portid, u32 seq,
2394                               int flags, struct nl80211_dump_wiphy_state *state)
2395 {
2396         void *hdr;
2397         struct nlattr *nl_bands, *nl_band;
2398         struct nlattr *nl_freqs, *nl_freq;
2399         struct nlattr *nl_cmds;
2400         enum nl80211_band band;
2401         struct ieee80211_channel *chan;
2402         int i;
2403         const struct ieee80211_txrx_stypes *mgmt_stypes =
2404                                 rdev->wiphy.mgmt_stypes;
2405         u32 features;
2406
2407         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2408         if (!hdr)
2409                 return -ENOBUFS;
2410
2411         if (WARN_ON(!state))
2412                 return -EINVAL;
2413
2414         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2415             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2416                            wiphy_name(&rdev->wiphy)) ||
2417             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2418                         cfg80211_rdev_list_generation))
2419                 goto nla_put_failure;
2420
2421         if (cmd != NL80211_CMD_NEW_WIPHY)
2422                 goto finish;
2423
2424         switch (state->split_start) {
2425         case 0:
2426                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2427                                rdev->wiphy.retry_short) ||
2428                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2429                                rdev->wiphy.retry_long) ||
2430                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2431                                 rdev->wiphy.frag_threshold) ||
2432                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2433                                 rdev->wiphy.rts_threshold) ||
2434                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2435                                rdev->wiphy.coverage_class) ||
2436                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2437                                rdev->wiphy.max_scan_ssids) ||
2438                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2439                                rdev->wiphy.max_sched_scan_ssids) ||
2440                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2441                                 rdev->wiphy.max_scan_ie_len) ||
2442                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2443                                 rdev->wiphy.max_sched_scan_ie_len) ||
2444                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2445                                rdev->wiphy.max_match_sets))
2446                         goto nla_put_failure;
2447
2448                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2449                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2450                         goto nla_put_failure;
2451                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2452                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2453                         goto nla_put_failure;
2454                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2455                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2456                         goto nla_put_failure;
2457                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2458                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2459                         goto nla_put_failure;
2460                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2461                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2462                         goto nla_put_failure;
2463                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2464                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2465                         goto nla_put_failure;
2466                 state->split_start++;
2467                 if (state->split)
2468                         break;
2469                 fallthrough;
2470         case 1:
2471                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2472                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2473                             rdev->wiphy.cipher_suites))
2474                         goto nla_put_failure;
2475
2476                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2477                                rdev->wiphy.max_num_pmkids))
2478                         goto nla_put_failure;
2479
2480                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2481                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2482                         goto nla_put_failure;
2483
2484                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2485                                 rdev->wiphy.available_antennas_tx) ||
2486                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2487                                 rdev->wiphy.available_antennas_rx))
2488                         goto nla_put_failure;
2489
2490                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2491                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2492                                 rdev->wiphy.probe_resp_offload))
2493                         goto nla_put_failure;
2494
2495                 if ((rdev->wiphy.available_antennas_tx ||
2496                      rdev->wiphy.available_antennas_rx) &&
2497                     rdev->ops->get_antenna) {
2498                         u32 tx_ant = 0, rx_ant = 0;
2499                         int res;
2500
2501                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2502                         if (!res) {
2503                                 if (nla_put_u32(msg,
2504                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2505                                                 tx_ant) ||
2506                                     nla_put_u32(msg,
2507                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2508                                                 rx_ant))
2509                                         goto nla_put_failure;
2510                         }
2511                 }
2512
2513                 state->split_start++;
2514                 if (state->split)
2515                         break;
2516                 fallthrough;
2517         case 2:
2518                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2519                                         rdev->wiphy.interface_modes))
2520                                 goto nla_put_failure;
2521                 state->split_start++;
2522                 if (state->split)
2523                         break;
2524                 fallthrough;
2525         case 3:
2526                 nl_bands = nla_nest_start_noflag(msg,
2527                                                  NL80211_ATTR_WIPHY_BANDS);
2528                 if (!nl_bands)
2529                         goto nla_put_failure;
2530
2531                 for (band = state->band_start;
2532                      band < (state->split ?
2533                                 NUM_NL80211_BANDS :
2534                                 NL80211_BAND_60GHZ + 1);
2535                      band++) {
2536                         struct ieee80211_supported_band *sband;
2537
2538                         /* omit higher bands for ancient software */
2539                         if (band > NL80211_BAND_5GHZ && !state->split)
2540                                 break;
2541
2542                         sband = rdev->wiphy.bands[band];
2543
2544                         if (!sband)
2545                                 continue;
2546
2547                         nl_band = nla_nest_start_noflag(msg, band);
2548                         if (!nl_band)
2549                                 goto nla_put_failure;
2550
2551                         switch (state->chan_start) {
2552                         case 0:
2553                                 if (nl80211_send_band_rateinfo(msg, sband,
2554                                                                state->split))
2555                                         goto nla_put_failure;
2556                                 state->chan_start++;
2557                                 if (state->split)
2558                                         break;
2559                                 fallthrough;
2560                         default:
2561                                 /* add frequencies */
2562                                 nl_freqs = nla_nest_start_noflag(msg,
2563                                                                  NL80211_BAND_ATTR_FREQS);
2564                                 if (!nl_freqs)
2565                                         goto nla_put_failure;
2566
2567                                 for (i = state->chan_start - 1;
2568                                      i < sband->n_channels;
2569                                      i++) {
2570                                         nl_freq = nla_nest_start_noflag(msg,
2571                                                                         i);
2572                                         if (!nl_freq)
2573                                                 goto nla_put_failure;
2574
2575                                         chan = &sband->channels[i];
2576
2577                                         if (nl80211_msg_put_channel(
2578                                                         msg, &rdev->wiphy, chan,
2579                                                         state->split))
2580                                                 goto nla_put_failure;
2581
2582                                         nla_nest_end(msg, nl_freq);
2583                                         if (state->split)
2584                                                 break;
2585                                 }
2586                                 if (i < sband->n_channels)
2587                                         state->chan_start = i + 2;
2588                                 else
2589                                         state->chan_start = 0;
2590                                 nla_nest_end(msg, nl_freqs);
2591                         }
2592
2593                         nla_nest_end(msg, nl_band);
2594
2595                         if (state->split) {
2596                                 /* start again here */
2597                                 if (state->chan_start)
2598                                         band--;
2599                                 break;
2600                         }
2601                 }
2602                 nla_nest_end(msg, nl_bands);
2603
2604                 if (band < NUM_NL80211_BANDS)
2605                         state->band_start = band + 1;
2606                 else
2607                         state->band_start = 0;
2608
2609                 /* if bands & channels are done, continue outside */
2610                 if (state->band_start == 0 && state->chan_start == 0)
2611                         state->split_start++;
2612                 if (state->split)
2613                         break;
2614                 fallthrough;
2615         case 4:
2616                 nl_cmds = nla_nest_start_noflag(msg,
2617                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2618                 if (!nl_cmds)
2619                         goto nla_put_failure;
2620
2621                 i = nl80211_add_commands_unsplit(rdev, msg);
2622                 if (i < 0)
2623                         goto nla_put_failure;
2624                 if (state->split) {
2625                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2626                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2627                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2628                                 CMD(channel_switch, CHANNEL_SWITCH);
2629                         CMD(set_qos_map, SET_QOS_MAP);
2630                         if (rdev->wiphy.features &
2631                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2632                                 CMD(add_tx_ts, ADD_TX_TS);
2633                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2634                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2635                         CMD(update_ft_ies, UPDATE_FT_IES);
2636                         if (rdev->wiphy.sar_capa)
2637                                 CMD(set_sar_specs, SET_SAR_SPECS);
2638                 }
2639 #undef CMD
2640
2641                 nla_nest_end(msg, nl_cmds);
2642                 state->split_start++;
2643                 if (state->split)
2644                         break;
2645                 fallthrough;
2646         case 5:
2647                 if (rdev->ops->remain_on_channel &&
2648                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2649                     nla_put_u32(msg,
2650                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2651                                 rdev->wiphy.max_remain_on_channel_duration))
2652                         goto nla_put_failure;
2653
2654                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2655                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2656                         goto nla_put_failure;
2657
2658                 state->split_start++;
2659                 if (state->split)
2660                         break;
2661                 fallthrough;
2662         case 6:
2663 #ifdef CONFIG_PM
2664                 if (nl80211_send_wowlan(msg, rdev, state->split))
2665                         goto nla_put_failure;
2666                 state->split_start++;
2667                 if (state->split)
2668                         break;
2669 #else
2670                 state->split_start++;
2671 #endif
2672                 fallthrough;
2673         case 7:
2674                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2675                                         rdev->wiphy.software_iftypes))
2676                         goto nla_put_failure;
2677
2678                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2679                                                    state->split))
2680                         goto nla_put_failure;
2681
2682                 state->split_start++;
2683                 if (state->split)
2684                         break;
2685                 fallthrough;
2686         case 8:
2687                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2688                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2689                                 rdev->wiphy.ap_sme_capa))
2690                         goto nla_put_failure;
2691
2692                 features = rdev->wiphy.features;
2693                 /*
2694                  * We can only add the per-channel limit information if the
2695                  * dump is split, otherwise it makes it too big. Therefore
2696                  * only advertise it in that case.
2697                  */
2698                 if (state->split)
2699                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2700                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2701                         goto nla_put_failure;
2702
2703                 if (rdev->wiphy.ht_capa_mod_mask &&
2704                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2705                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2706                             rdev->wiphy.ht_capa_mod_mask))
2707                         goto nla_put_failure;
2708
2709                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2710                     rdev->wiphy.max_acl_mac_addrs &&
2711                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2712                                 rdev->wiphy.max_acl_mac_addrs))
2713                         goto nla_put_failure;
2714
2715                 /*
2716                  * Any information below this point is only available to
2717                  * applications that can deal with it being split. This
2718                  * helps ensure that newly added capabilities don't break
2719                  * older tools by overrunning their buffers.
2720                  *
2721                  * We still increment split_start so that in the split
2722                  * case we'll continue with more data in the next round,
2723                  * but break unconditionally so unsplit data stops here.
2724                  */
2725                 if (state->split)
2726                         state->split_start++;
2727                 else
2728                         state->split_start = 0;
2729                 break;
2730         case 9:
2731                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2732                         goto nla_put_failure;
2733
2734                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2735                                 rdev->wiphy.max_sched_scan_plans) ||
2736                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2737                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2738                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2739                                 rdev->wiphy.max_sched_scan_plan_iterations))
2740                         goto nla_put_failure;
2741
2742                 if (rdev->wiphy.extended_capabilities &&
2743                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2744                              rdev->wiphy.extended_capabilities_len,
2745                              rdev->wiphy.extended_capabilities) ||
2746                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2747                              rdev->wiphy.extended_capabilities_len,
2748                              rdev->wiphy.extended_capabilities_mask)))
2749                         goto nla_put_failure;
2750
2751                 if (rdev->wiphy.vht_capa_mod_mask &&
2752                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2753                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2754                             rdev->wiphy.vht_capa_mod_mask))
2755                         goto nla_put_failure;
2756
2757                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2758                             rdev->wiphy.perm_addr))
2759                         goto nla_put_failure;
2760
2761                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2762                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2763                             rdev->wiphy.addr_mask))
2764                         goto nla_put_failure;
2765
2766                 if (rdev->wiphy.n_addresses > 1) {
2767                         void *attr;
2768
2769                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2770                         if (!attr)
2771                                 goto nla_put_failure;
2772
2773                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2774                                 if (nla_put(msg, i + 1, ETH_ALEN,
2775                                             rdev->wiphy.addresses[i].addr))
2776                                         goto nla_put_failure;
2777
2778                         nla_nest_end(msg, attr);
2779                 }
2780
2781                 state->split_start++;
2782                 break;
2783         case 10:
2784                 if (nl80211_send_coalesce(msg, rdev))
2785                         goto nla_put_failure;
2786
2787                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2788                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2789                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2790                         goto nla_put_failure;
2791
2792                 if (rdev->wiphy.max_ap_assoc_sta &&
2793                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2794                                 rdev->wiphy.max_ap_assoc_sta))
2795                         goto nla_put_failure;
2796
2797                 state->split_start++;
2798                 break;
2799         case 11:
2800                 if (rdev->wiphy.n_vendor_commands) {
2801                         const struct nl80211_vendor_cmd_info *info;
2802                         struct nlattr *nested;
2803
2804                         nested = nla_nest_start_noflag(msg,
2805                                                        NL80211_ATTR_VENDOR_DATA);
2806                         if (!nested)
2807                                 goto nla_put_failure;
2808
2809                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2810                                 info = &rdev->wiphy.vendor_commands[i].info;
2811                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2812                                         goto nla_put_failure;
2813                         }
2814                         nla_nest_end(msg, nested);
2815                 }
2816
2817                 if (rdev->wiphy.n_vendor_events) {
2818                         const struct nl80211_vendor_cmd_info *info;
2819                         struct nlattr *nested;
2820
2821                         nested = nla_nest_start_noflag(msg,
2822                                                        NL80211_ATTR_VENDOR_EVENTS);
2823                         if (!nested)
2824                                 goto nla_put_failure;
2825
2826                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2827                                 info = &rdev->wiphy.vendor_events[i];
2828                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2829                                         goto nla_put_failure;
2830                         }
2831                         nla_nest_end(msg, nested);
2832                 }
2833                 state->split_start++;
2834                 break;
2835         case 12:
2836                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2837                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2838                                rdev->wiphy.max_num_csa_counters))
2839                         goto nla_put_failure;
2840
2841                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2842                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2843                         goto nla_put_failure;
2844
2845                 if (rdev->wiphy.max_sched_scan_reqs &&
2846                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2847                                 rdev->wiphy.max_sched_scan_reqs))
2848                         goto nla_put_failure;
2849
2850                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2851                             sizeof(rdev->wiphy.ext_features),
2852                             rdev->wiphy.ext_features))
2853                         goto nla_put_failure;
2854
2855                 if (rdev->wiphy.bss_select_support) {
2856                         struct nlattr *nested;
2857                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2858
2859                         nested = nla_nest_start_noflag(msg,
2860                                                        NL80211_ATTR_BSS_SELECT);
2861                         if (!nested)
2862                                 goto nla_put_failure;
2863
2864                         i = 0;
2865                         while (bss_select_support) {
2866                                 if ((bss_select_support & 1) &&
2867                                     nla_put_flag(msg, i))
2868                                         goto nla_put_failure;
2869                                 i++;
2870                                 bss_select_support >>= 1;
2871                         }
2872                         nla_nest_end(msg, nested);
2873                 }
2874
2875                 state->split_start++;
2876                 break;
2877         case 13:
2878                 if (rdev->wiphy.num_iftype_ext_capab &&
2879                     rdev->wiphy.iftype_ext_capab) {
2880                         struct nlattr *nested_ext_capab, *nested;
2881
2882                         nested = nla_nest_start_noflag(msg,
2883                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2884                         if (!nested)
2885                                 goto nla_put_failure;
2886
2887                         for (i = state->capa_start;
2888                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2889                                 const struct wiphy_iftype_ext_capab *capab;
2890
2891                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2892
2893                                 nested_ext_capab = nla_nest_start_noflag(msg,
2894                                                                          i);
2895                                 if (!nested_ext_capab ||
2896                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2897                                                 capab->iftype) ||
2898                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2899                                             capab->extended_capabilities_len,
2900                                             capab->extended_capabilities) ||
2901                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2902                                             capab->extended_capabilities_len,
2903                                             capab->extended_capabilities_mask))
2904                                         goto nla_put_failure;
2905
2906                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2907                                     (nla_put_u16(msg,
2908                                                  NL80211_ATTR_EML_CAPABILITY,
2909                                                  capab->eml_capabilities) ||
2910                                      nla_put_u16(msg,
2911                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
2912                                                  capab->mld_capa_and_ops)))
2913                                         goto nla_put_failure;
2914
2915                                 nla_nest_end(msg, nested_ext_capab);
2916                                 if (state->split)
2917                                         break;
2918                         }
2919                         nla_nest_end(msg, nested);
2920                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2921                                 state->capa_start = i + 1;
2922                                 break;
2923                         }
2924                 }
2925
2926                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2927                                 rdev->wiphy.nan_supported_bands))
2928                         goto nla_put_failure;
2929
2930                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2931                                             NL80211_EXT_FEATURE_TXQS)) {
2932                         struct cfg80211_txq_stats txqstats = {};
2933                         int res;
2934
2935                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2936                         if (!res &&
2937                             !nl80211_put_txq_stats(msg, &txqstats,
2938                                                    NL80211_ATTR_TXQ_STATS))
2939                                 goto nla_put_failure;
2940
2941                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2942                                         rdev->wiphy.txq_limit))
2943                                 goto nla_put_failure;
2944                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2945                                         rdev->wiphy.txq_memory_limit))
2946                                 goto nla_put_failure;
2947                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2948                                         rdev->wiphy.txq_quantum))
2949                                 goto nla_put_failure;
2950                 }
2951
2952                 state->split_start++;
2953                 break;
2954         case 14:
2955                 if (nl80211_send_pmsr_capa(rdev, msg))
2956                         goto nla_put_failure;
2957
2958                 state->split_start++;
2959                 break;
2960         case 15:
2961                 if (rdev->wiphy.akm_suites &&
2962                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2963                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2964                             rdev->wiphy.akm_suites))
2965                         goto nla_put_failure;
2966
2967                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2968                         goto nla_put_failure;
2969
2970                 if (nl80211_put_tid_config_support(rdev, msg))
2971                         goto nla_put_failure;
2972                 state->split_start++;
2973                 break;
2974         case 16:
2975                 if (nl80211_put_sar_specs(rdev, msg))
2976                         goto nla_put_failure;
2977
2978                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2979                         goto nla_put_failure;
2980
2981                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2982                                 rdev->wiphy.max_num_akm_suites))
2983                         goto nla_put_failure;
2984
2985                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2986                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2987
2988                 if (rdev->wiphy.hw_timestamp_max_peers &&
2989                     nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
2990                                 rdev->wiphy.hw_timestamp_max_peers))
2991                         goto nla_put_failure;
2992
2993                 /* done */
2994                 state->split_start = 0;
2995                 break;
2996         }
2997  finish:
2998         genlmsg_end(msg, hdr);
2999         return 0;
3000
3001  nla_put_failure:
3002         genlmsg_cancel(msg, hdr);
3003         return -EMSGSIZE;
3004 }
3005
3006 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3007                                     struct netlink_callback *cb,
3008                                     struct nl80211_dump_wiphy_state *state)
3009 {
3010         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3011         int ret;
3012
3013         if (!tb)
3014                 return -ENOMEM;
3015
3016         ret = nlmsg_parse_deprecated(cb->nlh,
3017                                      GENL_HDRLEN + nl80211_fam.hdrsize,
3018                                      tb, nl80211_fam.maxattr,
3019                                      nl80211_policy, NULL);
3020         /* ignore parse errors for backward compatibility */
3021         if (ret) {
3022                 ret = 0;
3023                 goto out;
3024         }
3025
3026         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3027         if (tb[NL80211_ATTR_WIPHY])
3028                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3029         if (tb[NL80211_ATTR_WDEV])
3030                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3031         if (tb[NL80211_ATTR_IFINDEX]) {
3032                 struct net_device *netdev;
3033                 struct cfg80211_registered_device *rdev;
3034                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3035
3036                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3037                 if (!netdev) {
3038                         ret = -ENODEV;
3039                         goto out;
3040                 }
3041                 if (netdev->ieee80211_ptr) {
3042                         rdev = wiphy_to_rdev(
3043                                 netdev->ieee80211_ptr->wiphy);
3044                         state->filter_wiphy = rdev->wiphy_idx;
3045                 }
3046         }
3047
3048         ret = 0;
3049 out:
3050         kfree(tb);
3051         return ret;
3052 }
3053
3054 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3055 {
3056         int idx = 0, ret;
3057         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3058         struct cfg80211_registered_device *rdev;
3059
3060         rtnl_lock();
3061         if (!state) {
3062                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3063                 if (!state) {
3064                         rtnl_unlock();
3065                         return -ENOMEM;
3066                 }
3067                 state->filter_wiphy = -1;
3068                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3069                 if (ret) {
3070                         kfree(state);
3071                         rtnl_unlock();
3072                         return ret;
3073                 }
3074                 cb->args[0] = (long)state;
3075         }
3076
3077         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3078                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3079                         continue;
3080                 if (++idx <= state->start)
3081                         continue;
3082                 if (state->filter_wiphy != -1 &&
3083                     state->filter_wiphy != rdev->wiphy_idx)
3084                         continue;
3085                 wiphy_lock(&rdev->wiphy);
3086                 /* attempt to fit multiple wiphy data chunks into the skb */
3087                 do {
3088                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3089                                                  skb,
3090                                                  NETLINK_CB(cb->skb).portid,
3091                                                  cb->nlh->nlmsg_seq,
3092                                                  NLM_F_MULTI, state);
3093                         if (ret < 0) {
3094                                 /*
3095                                  * If sending the wiphy data didn't fit (ENOBUFS
3096                                  * or EMSGSIZE returned), this SKB is still
3097                                  * empty (so it's not too big because another
3098                                  * wiphy dataset is already in the skb) and
3099                                  * we've not tried to adjust the dump allocation
3100                                  * yet ... then adjust the alloc size to be
3101                                  * bigger, and return 1 but with the empty skb.
3102                                  * This results in an empty message being RX'ed
3103                                  * in userspace, but that is ignored.
3104                                  *
3105                                  * We can then retry with the larger buffer.
3106                                  */
3107                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3108                                     !skb->len && !state->split &&
3109                                     cb->min_dump_alloc < 4096) {
3110                                         cb->min_dump_alloc = 4096;
3111                                         state->split_start = 0;
3112                                         wiphy_unlock(&rdev->wiphy);
3113                                         rtnl_unlock();
3114                                         return 1;
3115                                 }
3116                                 idx--;
3117                                 break;
3118                         }
3119                 } while (state->split_start > 0);
3120                 wiphy_unlock(&rdev->wiphy);
3121                 break;
3122         }
3123         rtnl_unlock();
3124
3125         state->start = idx;
3126
3127         return skb->len;
3128 }
3129
3130 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3131 {
3132         kfree((void *)cb->args[0]);
3133         return 0;
3134 }
3135
3136 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3137 {
3138         struct sk_buff *msg;
3139         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3140         struct nl80211_dump_wiphy_state state = {};
3141
3142         msg = nlmsg_new(4096, GFP_KERNEL);
3143         if (!msg)
3144                 return -ENOMEM;
3145
3146         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3147                                info->snd_portid, info->snd_seq, 0,
3148                                &state) < 0) {
3149                 nlmsg_free(msg);
3150                 return -ENOBUFS;
3151         }
3152
3153         return genlmsg_reply(msg, info);
3154 }
3155
3156 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3157         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3158         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3159         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3160         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3161         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3162 };
3163
3164 static int parse_txq_params(struct nlattr *tb[],
3165                             struct ieee80211_txq_params *txq_params)
3166 {
3167         u8 ac;
3168
3169         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3170             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3171             !tb[NL80211_TXQ_ATTR_AIFS])
3172                 return -EINVAL;
3173
3174         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3175         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3176         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3177         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3178         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3179
3180         if (ac >= NL80211_NUM_ACS)
3181                 return -EINVAL;
3182         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3183         return 0;
3184 }
3185
3186 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3187 {
3188         /*
3189          * You can only set the channel explicitly for some interfaces,
3190          * most have their channel managed via their respective
3191          * "establish a connection" command (connect, join, ...)
3192          *
3193          * For AP/GO and mesh mode, the channel can be set with the
3194          * channel userspace API, but is only stored and passed to the
3195          * low-level driver when the AP starts or the mesh is joined.
3196          * This is for backward compatibility, userspace can also give
3197          * the channel in the start-ap or join-mesh commands instead.
3198          *
3199          * Monitors are special as they are normally slaved to
3200          * whatever else is going on, so they have their own special
3201          * operation to set the monitor channel if possible.
3202          */
3203         return !wdev ||
3204                 wdev->iftype == NL80211_IFTYPE_AP ||
3205                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3206                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3207                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3208 }
3209
3210 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3211                                       struct genl_info *info,
3212                                       const struct cfg80211_chan_def *chandef,
3213                                       u16 *punct_bitmap)
3214 {
3215         if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3216                 return -EINVAL;
3217
3218         *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3219         if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3220                 return -EINVAL;
3221
3222         return 0;
3223 }
3224
3225 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3226                           struct genl_info *info,
3227                           struct cfg80211_chan_def *chandef)
3228 {
3229         struct netlink_ext_ack *extack = info->extack;
3230         struct nlattr **attrs = info->attrs;
3231         u32 control_freq;
3232
3233         if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3234                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3235                                     "Frequency is missing");
3236                 return -EINVAL;
3237         }
3238
3239         control_freq = MHZ_TO_KHZ(
3240                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3241         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3242                 control_freq +=
3243                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3244
3245         memset(chandef, 0, sizeof(*chandef));
3246         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3247         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3248         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3249         chandef->freq1_offset = control_freq % 1000;
3250         chandef->center_freq2 = 0;
3251
3252         /* Primary channel not allowed */
3253         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3254                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3255                                     "Channel is disabled");
3256                 return -EINVAL;
3257         }
3258
3259         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3260                 enum nl80211_channel_type chantype;
3261
3262                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3263
3264                 switch (chantype) {
3265                 case NL80211_CHAN_NO_HT:
3266                 case NL80211_CHAN_HT20:
3267                 case NL80211_CHAN_HT40PLUS:
3268                 case NL80211_CHAN_HT40MINUS:
3269                         cfg80211_chandef_create(chandef, chandef->chan,
3270                                                 chantype);
3271                         /* user input for center_freq is incorrect */
3272                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3273                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3274                                 NL_SET_ERR_MSG_ATTR(extack,
3275                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3276                                                     "bad center frequency 1");
3277                                 return -EINVAL;
3278                         }
3279                         /* center_freq2 must be zero */
3280                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3281                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3282                                 NL_SET_ERR_MSG_ATTR(extack,
3283                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3284                                                     "center frequency 2 can't be used");
3285                                 return -EINVAL;
3286                         }
3287                         break;
3288                 default:
3289                         NL_SET_ERR_MSG_ATTR(extack,
3290                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3291                                             "invalid channel type");
3292                         return -EINVAL;
3293                 }
3294         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3295                 chandef->width =
3296                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3297                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3298                         /* User input error for channel width doesn't match channel  */
3299                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3300                                 NL_SET_ERR_MSG_ATTR(extack,
3301                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3302                                                     "bad channel width");
3303                                 return -EINVAL;
3304                         }
3305                 }
3306                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3307                         chandef->center_freq1 =
3308                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3309                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3310                                 chandef->freq1_offset = nla_get_u32(
3311                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3312                         else
3313                                 chandef->freq1_offset = 0;
3314                 }
3315                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3316                         chandef->center_freq2 =
3317                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3318         }
3319
3320         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3321                 chandef->edmg.channels =
3322                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3323
3324                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3325                         chandef->edmg.bw_config =
3326                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3327         } else {
3328                 chandef->edmg.bw_config = 0;
3329                 chandef->edmg.channels = 0;
3330         }
3331
3332         if (!cfg80211_chandef_valid(chandef)) {
3333                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3334                 return -EINVAL;
3335         }
3336
3337         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3338                                      IEEE80211_CHAN_DISABLED)) {
3339                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3340                 return -EINVAL;
3341         }
3342
3343         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3344              chandef->width == NL80211_CHAN_WIDTH_10) &&
3345             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3346                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3347                 return -EINVAL;
3348         }
3349
3350         return 0;
3351 }
3352
3353 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3354                                  struct net_device *dev,
3355                                  struct genl_info *info,
3356                                  int _link_id)
3357 {
3358         struct cfg80211_chan_def chandef;
3359         int result;
3360         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3361         struct wireless_dev *wdev = NULL;
3362         int link_id = _link_id;
3363
3364         if (dev)
3365                 wdev = dev->ieee80211_ptr;
3366         if (!nl80211_can_set_dev_channel(wdev))
3367                 return -EOPNOTSUPP;
3368         if (wdev)
3369                 iftype = wdev->iftype;
3370
3371         if (link_id < 0) {
3372                 if (wdev && wdev->valid_links)
3373                         return -EINVAL;
3374                 link_id = 0;
3375         }
3376
3377         result = nl80211_parse_chandef(rdev, info, &chandef);
3378         if (result)
3379                 return result;
3380
3381         switch (iftype) {
3382         case NL80211_IFTYPE_AP:
3383         case NL80211_IFTYPE_P2P_GO:
3384                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3385                                                    iftype))
3386                         return -EINVAL;
3387                 if (wdev->links[link_id].ap.beacon_interval) {
3388                         struct ieee80211_channel *cur_chan;
3389
3390                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3391                             !(rdev->wiphy.features &
3392                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3393                                 return -EBUSY;
3394
3395                         /* Only allow dynamic channel width changes */
3396                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3397                         if (chandef.chan != cur_chan)
3398                                 return -EBUSY;
3399
3400                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3401                                                        &chandef);
3402                         if (result)
3403                                 return result;
3404                         wdev->links[link_id].ap.chandef = chandef;
3405                 } else {
3406                         wdev->u.ap.preset_chandef = chandef;
3407                 }
3408                 return 0;
3409         case NL80211_IFTYPE_MESH_POINT:
3410                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3411         case NL80211_IFTYPE_MONITOR:
3412                 return cfg80211_set_monitor_channel(rdev, &chandef);
3413         default:
3414                 break;
3415         }
3416
3417         return -EINVAL;
3418 }
3419
3420 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3421 {
3422         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3423         int link_id = nl80211_link_id_or_invalid(info->attrs);
3424         struct net_device *netdev = info->user_ptr[1];
3425         int ret;
3426
3427         wdev_lock(netdev->ieee80211_ptr);
3428         ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3429         wdev_unlock(netdev->ieee80211_ptr);
3430
3431         return ret;
3432 }
3433
3434 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3435 {
3436         struct cfg80211_registered_device *rdev = NULL;
3437         struct net_device *netdev = NULL;
3438         struct wireless_dev *wdev;
3439         int result = 0, rem_txq_params = 0;
3440         struct nlattr *nl_txq_params;
3441         u32 changed;
3442         u8 retry_short = 0, retry_long = 0;
3443         u32 frag_threshold = 0, rts_threshold = 0;
3444         u8 coverage_class = 0;
3445         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3446
3447         rtnl_lock();
3448         /*
3449          * Try to find the wiphy and netdev. Normally this
3450          * function shouldn't need the netdev, but this is
3451          * done for backward compatibility -- previously
3452          * setting the channel was done per wiphy, but now
3453          * it is per netdev. Previous userland like hostapd
3454          * also passed a netdev to set_wiphy, so that it is
3455          * possible to let that go to the right netdev!
3456          */
3457
3458         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3459                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3460
3461                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3462                 if (netdev && netdev->ieee80211_ptr)
3463                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3464                 else
3465                         netdev = NULL;
3466         }
3467
3468         if (!netdev) {
3469                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3470                                                   info->attrs);
3471                 if (IS_ERR(rdev)) {
3472                         rtnl_unlock();
3473                         return PTR_ERR(rdev);
3474                 }
3475                 wdev = NULL;
3476                 netdev = NULL;
3477                 result = 0;
3478         } else
3479                 wdev = netdev->ieee80211_ptr;
3480
3481         wiphy_lock(&rdev->wiphy);
3482
3483         /*
3484          * end workaround code, by now the rdev is available
3485          * and locked, and wdev may or may not be NULL.
3486          */
3487
3488         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3489                 result = cfg80211_dev_rename(
3490                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3491         rtnl_unlock();
3492
3493         if (result)
3494                 goto out;
3495
3496         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3497                 struct ieee80211_txq_params txq_params;
3498                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3499
3500                 if (!rdev->ops->set_txq_params) {
3501                         result = -EOPNOTSUPP;
3502                         goto out;
3503                 }
3504
3505                 if (!netdev) {
3506                         result = -EINVAL;
3507                         goto out;
3508                 }
3509
3510                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3511                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3512                         result = -EINVAL;
3513                         goto out;
3514                 }
3515
3516                 if (!netif_running(netdev)) {
3517                         result = -ENETDOWN;
3518                         goto out;
3519                 }
3520
3521                 nla_for_each_nested(nl_txq_params,
3522                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3523                                     rem_txq_params) {
3524                         result = nla_parse_nested_deprecated(tb,
3525                                                              NL80211_TXQ_ATTR_MAX,
3526                                                              nl_txq_params,
3527                                                              txq_params_policy,
3528                                                              info->extack);
3529                         if (result)
3530                                 goto out;
3531                         result = parse_txq_params(tb, &txq_params);
3532                         if (result)
3533                                 goto out;
3534
3535                         txq_params.link_id =
3536                                 nl80211_link_id_or_invalid(info->attrs);
3537
3538                         wdev_lock(netdev->ieee80211_ptr);
3539                         if (txq_params.link_id >= 0 &&
3540                             !(netdev->ieee80211_ptr->valid_links &
3541                               BIT(txq_params.link_id)))
3542                                 result = -ENOLINK;
3543                         else if (txq_params.link_id >= 0 &&
3544                                  !netdev->ieee80211_ptr->valid_links)
3545                                 result = -EINVAL;
3546                         else
3547                                 result = rdev_set_txq_params(rdev, netdev,
3548                                                              &txq_params);
3549                         wdev_unlock(netdev->ieee80211_ptr);
3550                         if (result)
3551                                 goto out;
3552                 }
3553         }
3554
3555         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3556                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3557
3558                 if (wdev) {
3559                         wdev_lock(wdev);
3560                         result = __nl80211_set_channel(
3561                                 rdev,
3562                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3563                                 info, link_id);
3564                         wdev_unlock(wdev);
3565                 } else {
3566                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3567                 }
3568
3569                 if (result)
3570                         goto out;
3571         }
3572
3573         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3574                 struct wireless_dev *txp_wdev = wdev;
3575                 enum nl80211_tx_power_setting type;
3576                 int idx, mbm = 0;
3577
3578                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3579                         txp_wdev = NULL;
3580
3581                 if (!rdev->ops->set_tx_power) {
3582                         result = -EOPNOTSUPP;
3583                         goto out;
3584                 }
3585
3586                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3587                 type = nla_get_u32(info->attrs[idx]);
3588
3589                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3590                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3591                         result = -EINVAL;
3592                         goto out;
3593                 }
3594
3595                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3596                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3597                         mbm = nla_get_u32(info->attrs[idx]);
3598                 }
3599
3600                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3601                 if (result)
3602                         goto out;
3603         }
3604
3605         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3606             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3607                 u32 tx_ant, rx_ant;
3608
3609                 if ((!rdev->wiphy.available_antennas_tx &&
3610                      !rdev->wiphy.available_antennas_rx) ||
3611                     !rdev->ops->set_antenna) {
3612                         result = -EOPNOTSUPP;
3613                         goto out;
3614                 }
3615
3616                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3617                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3618
3619                 /* reject antenna configurations which don't match the
3620                  * available antenna masks, except for the "all" mask */
3621                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3622                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3623                         result = -EINVAL;
3624                         goto out;
3625                 }
3626
3627                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3628                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3629
3630                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3631                 if (result)
3632                         goto out;
3633         }
3634
3635         changed = 0;
3636
3637         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3638                 retry_short = nla_get_u8(
3639                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3640
3641                 changed |= WIPHY_PARAM_RETRY_SHORT;
3642         }
3643
3644         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3645                 retry_long = nla_get_u8(
3646                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3647
3648                 changed |= WIPHY_PARAM_RETRY_LONG;
3649         }
3650
3651         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3652                 frag_threshold = nla_get_u32(
3653                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3654                 if (frag_threshold < 256) {
3655                         result = -EINVAL;
3656                         goto out;
3657                 }
3658
3659                 if (frag_threshold != (u32) -1) {
3660                         /*
3661                          * Fragments (apart from the last one) are required to
3662                          * have even length. Make the fragmentation code
3663                          * simpler by stripping LSB should someone try to use
3664                          * odd threshold value.
3665                          */
3666                         frag_threshold &= ~0x1;
3667                 }
3668                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3669         }
3670
3671         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3672                 rts_threshold = nla_get_u32(
3673                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3674                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3675         }
3676
3677         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3678                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3679                         result = -EINVAL;
3680                         goto out;
3681                 }
3682
3683                 coverage_class = nla_get_u8(
3684                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3685                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3686         }
3687
3688         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3689                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3690                         result = -EOPNOTSUPP;
3691                         goto out;
3692                 }
3693
3694                 changed |= WIPHY_PARAM_DYN_ACK;
3695         }
3696
3697         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3698                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3699                                              NL80211_EXT_FEATURE_TXQS)) {
3700                         result = -EOPNOTSUPP;
3701                         goto out;
3702                 }
3703                 txq_limit = nla_get_u32(
3704                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3705                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3706         }
3707
3708         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3709                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3710                                              NL80211_EXT_FEATURE_TXQS)) {
3711                         result = -EOPNOTSUPP;
3712                         goto out;
3713                 }
3714                 txq_memory_limit = nla_get_u32(
3715                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3716                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3717         }
3718
3719         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3720                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3721                                              NL80211_EXT_FEATURE_TXQS)) {
3722                         result = -EOPNOTSUPP;
3723                         goto out;
3724                 }
3725                 txq_quantum = nla_get_u32(
3726                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3727                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3728         }
3729
3730         if (changed) {
3731                 u8 old_retry_short, old_retry_long;
3732                 u32 old_frag_threshold, old_rts_threshold;
3733                 u8 old_coverage_class;
3734                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3735
3736                 if (!rdev->ops->set_wiphy_params) {
3737                         result = -EOPNOTSUPP;
3738                         goto out;
3739                 }
3740
3741                 old_retry_short = rdev->wiphy.retry_short;
3742                 old_retry_long = rdev->wiphy.retry_long;
3743                 old_frag_threshold = rdev->wiphy.frag_threshold;
3744                 old_rts_threshold = rdev->wiphy.rts_threshold;
3745                 old_coverage_class = rdev->wiphy.coverage_class;
3746                 old_txq_limit = rdev->wiphy.txq_limit;
3747                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3748                 old_txq_quantum = rdev->wiphy.txq_quantum;
3749
3750                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3751                         rdev->wiphy.retry_short = retry_short;
3752                 if (changed & WIPHY_PARAM_RETRY_LONG)
3753                         rdev->wiphy.retry_long = retry_long;
3754                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3755                         rdev->wiphy.frag_threshold = frag_threshold;
3756                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3757                         rdev->wiphy.rts_threshold = rts_threshold;
3758                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3759                         rdev->wiphy.coverage_class = coverage_class;
3760                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3761                         rdev->wiphy.txq_limit = txq_limit;
3762                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3763                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3764                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3765                         rdev->wiphy.txq_quantum = txq_quantum;
3766
3767                 result = rdev_set_wiphy_params(rdev, changed);
3768                 if (result) {
3769                         rdev->wiphy.retry_short = old_retry_short;
3770                         rdev->wiphy.retry_long = old_retry_long;
3771                         rdev->wiphy.frag_threshold = old_frag_threshold;
3772                         rdev->wiphy.rts_threshold = old_rts_threshold;
3773                         rdev->wiphy.coverage_class = old_coverage_class;
3774                         rdev->wiphy.txq_limit = old_txq_limit;
3775                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3776                         rdev->wiphy.txq_quantum = old_txq_quantum;
3777                         goto out;
3778                 }
3779         }
3780
3781         result = 0;
3782
3783 out:
3784         wiphy_unlock(&rdev->wiphy);
3785         return result;
3786 }
3787
3788 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3789 {
3790         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3791                 return -EINVAL;
3792
3793         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3794                         chandef->chan->center_freq))
3795                 return -ENOBUFS;
3796         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3797                         chandef->chan->freq_offset))
3798                 return -ENOBUFS;
3799         switch (chandef->width) {
3800         case NL80211_CHAN_WIDTH_20_NOHT:
3801         case NL80211_CHAN_WIDTH_20:
3802         case NL80211_CHAN_WIDTH_40:
3803                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3804                                 cfg80211_get_chandef_type(chandef)))
3805                         return -ENOBUFS;
3806                 break;
3807         default:
3808                 break;
3809         }
3810         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3811                 return -ENOBUFS;
3812         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3813                 return -ENOBUFS;
3814         if (chandef->center_freq2 &&
3815             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3816                 return -ENOBUFS;
3817         return 0;
3818 }
3819 EXPORT_SYMBOL(nl80211_send_chandef);
3820
3821 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3822                               struct cfg80211_registered_device *rdev,
3823                               struct wireless_dev *wdev,
3824                               enum nl80211_commands cmd)
3825 {
3826         struct net_device *dev = wdev->netdev;
3827         void *hdr;
3828
3829         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3830                 cmd != NL80211_CMD_DEL_INTERFACE &&
3831                 cmd != NL80211_CMD_SET_INTERFACE);
3832
3833         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3834         if (!hdr)
3835                 return -1;
3836
3837         if (dev &&
3838             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3839              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3840                 goto nla_put_failure;
3841
3842         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3843             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3844             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3845                               NL80211_ATTR_PAD) ||
3846             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3847             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3848                         rdev->devlist_generation ^
3849                         (cfg80211_rdev_list_generation << 2)) ||
3850             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3851                 goto nla_put_failure;
3852
3853         if (rdev->ops->get_channel && !wdev->valid_links) {
3854                 struct cfg80211_chan_def chandef = {};
3855                 int ret;
3856
3857                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3858                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3859                         goto nla_put_failure;
3860         }
3861
3862         if (rdev->ops->get_tx_power) {
3863                 int dbm, ret;
3864
3865                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3866                 if (ret == 0 &&
3867                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3868                                 DBM_TO_MBM(dbm)))
3869                         goto nla_put_failure;
3870         }
3871
3872         wdev_lock(wdev);
3873         switch (wdev->iftype) {
3874         case NL80211_IFTYPE_AP:
3875         case NL80211_IFTYPE_P2P_GO:
3876                 if (wdev->u.ap.ssid_len &&
3877                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3878                             wdev->u.ap.ssid))
3879                         goto nla_put_failure_locked;
3880                 break;
3881         case NL80211_IFTYPE_STATION:
3882         case NL80211_IFTYPE_P2P_CLIENT:
3883                 if (wdev->u.client.ssid_len &&
3884                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3885                             wdev->u.client.ssid))
3886                         goto nla_put_failure_locked;
3887                 break;
3888         case NL80211_IFTYPE_ADHOC:
3889                 if (wdev->u.ibss.ssid_len &&
3890                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3891                             wdev->u.ibss.ssid))
3892                         goto nla_put_failure_locked;
3893                 break;
3894         default:
3895                 /* nothing */
3896                 break;
3897         }
3898         wdev_unlock(wdev);
3899
3900         if (rdev->ops->get_txq_stats) {
3901                 struct cfg80211_txq_stats txqstats = {};
3902                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3903
3904                 if (ret == 0 &&
3905                     !nl80211_put_txq_stats(msg, &txqstats,
3906                                            NL80211_ATTR_TXQ_STATS))
3907                         goto nla_put_failure;
3908         }
3909
3910         if (wdev->valid_links) {
3911                 unsigned int link_id;
3912                 struct nlattr *links = nla_nest_start(msg,
3913                                                       NL80211_ATTR_MLO_LINKS);
3914
3915                 if (!links)
3916                         goto nla_put_failure;
3917
3918                 for_each_valid_link(wdev, link_id) {
3919                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
3920                         struct cfg80211_chan_def chandef = {};
3921                         int ret;
3922
3923                         if (!link)
3924                                 goto nla_put_failure;
3925
3926                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3927                                 goto nla_put_failure;
3928                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3929                                     wdev->links[link_id].addr))
3930                                 goto nla_put_failure;
3931
3932                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3933                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3934                                 goto nla_put_failure;
3935
3936                         nla_nest_end(msg, link);
3937                 }
3938
3939                 nla_nest_end(msg, links);
3940         }
3941
3942         genlmsg_end(msg, hdr);
3943         return 0;
3944
3945  nla_put_failure_locked:
3946         wdev_unlock(wdev);
3947  nla_put_failure:
3948         genlmsg_cancel(msg, hdr);
3949         return -EMSGSIZE;
3950 }
3951
3952 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3953 {
3954         int wp_idx = 0;
3955         int if_idx = 0;
3956         int wp_start = cb->args[0];
3957         int if_start = cb->args[1];
3958         int filter_wiphy = -1;
3959         struct cfg80211_registered_device *rdev;
3960         struct wireless_dev *wdev;
3961         int ret;
3962
3963         rtnl_lock();
3964         if (!cb->args[2]) {
3965                 struct nl80211_dump_wiphy_state state = {
3966                         .filter_wiphy = -1,
3967                 };
3968
3969                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3970                 if (ret)
3971                         goto out_unlock;
3972
3973                 filter_wiphy = state.filter_wiphy;
3974
3975                 /*
3976                  * if filtering, set cb->args[2] to +1 since 0 is the default
3977                  * value needed to determine that parsing is necessary.
3978                  */
3979                 if (filter_wiphy >= 0)
3980                         cb->args[2] = filter_wiphy + 1;
3981                 else
3982                         cb->args[2] = -1;
3983         } else if (cb->args[2] > 0) {
3984                 filter_wiphy = cb->args[2] - 1;
3985         }
3986
3987         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3988                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3989                         continue;
3990                 if (wp_idx < wp_start) {
3991                         wp_idx++;
3992                         continue;
3993                 }
3994
3995                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3996                         continue;
3997
3998                 if_idx = 0;
3999
4000                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4001                         if (if_idx < if_start) {
4002                                 if_idx++;
4003                                 continue;
4004                         }
4005                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4006                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
4007                                                rdev, wdev,
4008                                                NL80211_CMD_NEW_INTERFACE) < 0) {
4009                                 goto out;
4010                         }
4011                         if_idx++;
4012                 }
4013
4014                 wp_idx++;
4015         }
4016  out:
4017         cb->args[0] = wp_idx;
4018         cb->args[1] = if_idx;
4019
4020         ret = skb->len;
4021  out_unlock:
4022         rtnl_unlock();
4023
4024         return ret;
4025 }
4026
4027 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4028 {
4029         struct sk_buff *msg;
4030         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4031         struct wireless_dev *wdev = info->user_ptr[1];
4032
4033         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4034         if (!msg)
4035                 return -ENOMEM;
4036
4037         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4038                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4039                 nlmsg_free(msg);
4040                 return -ENOBUFS;
4041         }
4042
4043         return genlmsg_reply(msg, info);
4044 }
4045
4046 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4047         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4048         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4049         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4050         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4051         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4052         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4053 };
4054
4055 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4056 {
4057         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4058         int flag;
4059
4060         *mntrflags = 0;
4061
4062         if (!nla)
4063                 return -EINVAL;
4064
4065         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4066                 return -EINVAL;
4067
4068         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4069                 if (flags[flag])
4070                         *mntrflags |= (1<<flag);
4071
4072         *mntrflags |= MONITOR_FLAG_CHANGED;
4073
4074         return 0;
4075 }
4076
4077 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4078                                      enum nl80211_iftype type,
4079                                      struct genl_info *info,
4080                                      struct vif_params *params)
4081 {
4082         bool change = false;
4083         int err;
4084
4085         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4086                 if (type != NL80211_IFTYPE_MONITOR)
4087                         return -EINVAL;
4088
4089                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4090                                           &params->flags);
4091                 if (err)
4092                         return err;
4093
4094                 change = true;
4095         }
4096
4097         if (params->flags & MONITOR_FLAG_ACTIVE &&
4098             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4099                 return -EOPNOTSUPP;
4100
4101         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4102                 const u8 *mumimo_groups;
4103                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4104
4105                 if (type != NL80211_IFTYPE_MONITOR)
4106                         return -EINVAL;
4107
4108                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4109                         return -EOPNOTSUPP;
4110
4111                 mumimo_groups =
4112                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4113
4114                 /* bits 0 and 63 are reserved and must be zero */
4115                 if ((mumimo_groups[0] & BIT(0)) ||
4116                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4117                         return -EINVAL;
4118
4119                 params->vht_mumimo_groups = mumimo_groups;
4120                 change = true;
4121         }
4122
4123         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4124                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4125
4126                 if (type != NL80211_IFTYPE_MONITOR)
4127                         return -EINVAL;
4128
4129                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4130                         return -EOPNOTSUPP;
4131
4132                 params->vht_mumimo_follow_addr =
4133                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4134                 change = true;
4135         }
4136
4137         return change ? 1 : 0;
4138 }
4139
4140 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4141                                struct net_device *netdev, u8 use_4addr,
4142                                enum nl80211_iftype iftype)
4143 {
4144         if (!use_4addr) {
4145                 if (netdev && netif_is_bridge_port(netdev))
4146                         return -EBUSY;
4147                 return 0;
4148         }
4149
4150         switch (iftype) {
4151         case NL80211_IFTYPE_AP_VLAN:
4152                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4153                         return 0;
4154                 break;
4155         case NL80211_IFTYPE_STATION:
4156                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4157                         return 0;
4158                 break;
4159         default:
4160                 break;
4161         }
4162
4163         return -EOPNOTSUPP;
4164 }
4165
4166 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4167 {
4168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4169         struct vif_params params;
4170         int err;
4171         enum nl80211_iftype otype, ntype;
4172         struct net_device *dev = info->user_ptr[1];
4173         bool change = false;
4174
4175         memset(&params, 0, sizeof(params));
4176
4177         otype = ntype = dev->ieee80211_ptr->iftype;
4178
4179         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4180                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4181                 if (otype != ntype)
4182                         change = true;
4183         }
4184
4185         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4186                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4187
4188                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4189                         return -EINVAL;
4190                 if (netif_running(dev))
4191                         return -EBUSY;
4192
4193                 wdev_lock(wdev);
4194                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4195                              IEEE80211_MAX_MESH_ID_LEN);
4196                 wdev->u.mesh.id_up_len =
4197                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4198                 memcpy(wdev->u.mesh.id,
4199                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4200                        wdev->u.mesh.id_up_len);
4201                 wdev_unlock(wdev);
4202         }
4203
4204         if (info->attrs[NL80211_ATTR_4ADDR]) {
4205                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4206                 change = true;
4207                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4208                 if (err)
4209                         return err;
4210         } else {
4211                 params.use_4addr = -1;
4212         }
4213
4214         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4215         if (err < 0)
4216                 return err;
4217         if (err > 0)
4218                 change = true;
4219
4220         if (change)
4221                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4222         else
4223                 err = 0;
4224
4225         if (!err && params.use_4addr != -1)
4226                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4227
4228         if (change && !err) {
4229                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4230
4231                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4232         }
4233
4234         return err;
4235 }
4236
4237 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4238 {
4239         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4240         struct vif_params params;
4241         struct wireless_dev *wdev;
4242         struct sk_buff *msg;
4243         int err;
4244         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4245
4246         memset(&params, 0, sizeof(params));
4247
4248         if (!info->attrs[NL80211_ATTR_IFNAME])
4249                 return -EINVAL;
4250
4251         if (info->attrs[NL80211_ATTR_IFTYPE])
4252                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4253
4254         if (!rdev->ops->add_virtual_intf)
4255                 return -EOPNOTSUPP;
4256
4257         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4258              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4259             info->attrs[NL80211_ATTR_MAC]) {
4260                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4261                            ETH_ALEN);
4262                 if (!is_valid_ether_addr(params.macaddr))
4263                         return -EADDRNOTAVAIL;
4264         }
4265
4266         if (info->attrs[NL80211_ATTR_4ADDR]) {
4267                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4268                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4269                 if (err)
4270                         return err;
4271         }
4272
4273         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4274                 return -EOPNOTSUPP;
4275
4276         err = nl80211_parse_mon_options(rdev, type, info, &params);
4277         if (err < 0)
4278                 return err;
4279
4280         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4281         if (!msg)
4282                 return -ENOMEM;
4283
4284         wdev = rdev_add_virtual_intf(rdev,
4285                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4286                                 NET_NAME_USER, type, &params);
4287         if (WARN_ON(!wdev)) {
4288                 nlmsg_free(msg);
4289                 return -EPROTO;
4290         } else if (IS_ERR(wdev)) {
4291                 nlmsg_free(msg);
4292                 return PTR_ERR(wdev);
4293         }
4294
4295         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4296                 wdev->owner_nlportid = info->snd_portid;
4297
4298         switch (type) {
4299         case NL80211_IFTYPE_MESH_POINT:
4300                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4301                         break;
4302                 wdev_lock(wdev);
4303                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4304                              IEEE80211_MAX_MESH_ID_LEN);
4305                 wdev->u.mesh.id_up_len =
4306                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4307                 memcpy(wdev->u.mesh.id,
4308                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4309                        wdev->u.mesh.id_up_len);
4310                 wdev_unlock(wdev);
4311                 break;
4312         case NL80211_IFTYPE_NAN:
4313         case NL80211_IFTYPE_P2P_DEVICE:
4314                 /*
4315                  * P2P Device and NAN do not have a netdev, so don't go
4316                  * through the netdev notifier and must be added here
4317                  */
4318                 cfg80211_init_wdev(wdev);
4319                 cfg80211_register_wdev(rdev, wdev);
4320                 break;
4321         default:
4322                 break;
4323         }
4324
4325         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4326                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4327                 nlmsg_free(msg);
4328                 return -ENOBUFS;
4329         }
4330
4331         return genlmsg_reply(msg, info);
4332 }
4333
4334 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4335 {
4336         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4337         int ret;
4338
4339         /* to avoid failing a new interface creation due to pending removal */
4340         cfg80211_destroy_ifaces(rdev);
4341
4342         wiphy_lock(&rdev->wiphy);
4343         ret = _nl80211_new_interface(skb, info);
4344         wiphy_unlock(&rdev->wiphy);
4345
4346         return ret;
4347 }
4348
4349 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4350 {
4351         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4352         struct wireless_dev *wdev = info->user_ptr[1];
4353
4354         if (!rdev->ops->del_virtual_intf)
4355                 return -EOPNOTSUPP;
4356
4357         /*
4358          * We hold RTNL, so this is safe, without RTNL opencount cannot
4359          * reach 0, and thus the rdev cannot be deleted.
4360          *
4361          * We need to do it for the dev_close(), since that will call
4362          * the netdev notifiers, and we need to acquire the mutex there
4363          * but don't know if we get there from here or from some other
4364          * place (e.g. "ip link set ... down").
4365          */
4366         mutex_unlock(&rdev->wiphy.mtx);
4367
4368         /*
4369          * If we remove a wireless device without a netdev then clear
4370          * user_ptr[1] so that nl80211_post_doit won't dereference it
4371          * to check if it needs to do dev_put(). Otherwise it crashes
4372          * since the wdev has been freed, unlike with a netdev where
4373          * we need the dev_put() for the netdev to really be freed.
4374          */
4375         if (!wdev->netdev)
4376                 info->user_ptr[1] = NULL;
4377         else
4378                 dev_close(wdev->netdev);
4379
4380         mutex_lock(&rdev->wiphy.mtx);
4381
4382         return cfg80211_remove_virtual_intf(rdev, wdev);
4383 }
4384
4385 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4386 {
4387         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4388         struct net_device *dev = info->user_ptr[1];
4389         u16 noack_map;
4390
4391         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4392                 return -EINVAL;
4393
4394         if (!rdev->ops->set_noack_map)
4395                 return -EOPNOTSUPP;
4396
4397         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4398
4399         return rdev_set_noack_map(rdev, dev, noack_map);
4400 }
4401
4402 static int nl80211_validate_key_link_id(struct genl_info *info,
4403                                         struct wireless_dev *wdev,
4404                                         int link_id, bool pairwise)
4405 {
4406         if (pairwise) {
4407                 if (link_id != -1) {
4408                         GENL_SET_ERR_MSG(info,
4409                                          "link ID not allowed for pairwise key");
4410                         return -EINVAL;
4411                 }
4412
4413                 return 0;
4414         }
4415
4416         if (wdev->valid_links) {
4417                 if (link_id == -1) {
4418                         GENL_SET_ERR_MSG(info,
4419                                          "link ID must for MLO group key");
4420                         return -EINVAL;
4421                 }
4422                 if (!(wdev->valid_links & BIT(link_id))) {
4423                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4424                         return -EINVAL;
4425                 }
4426         } else if (link_id != -1) {
4427                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4428                 return -EINVAL;
4429         }
4430
4431         return 0;
4432 }
4433
4434 struct get_key_cookie {
4435         struct sk_buff *msg;
4436         int error;
4437         int idx;
4438 };
4439
4440 static void get_key_callback(void *c, struct key_params *params)
4441 {
4442         struct nlattr *key;
4443         struct get_key_cookie *cookie = c;
4444
4445         if ((params->key &&
4446              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4447                      params->key_len, params->key)) ||
4448             (params->seq &&
4449              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4450                      params->seq_len, params->seq)) ||
4451             (params->cipher &&
4452              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4453                          params->cipher)))
4454                 goto nla_put_failure;
4455
4456         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4457         if (!key)
4458                 goto nla_put_failure;
4459
4460         if ((params->key &&
4461              nla_put(cookie->msg, NL80211_KEY_DATA,
4462                      params->key_len, params->key)) ||
4463             (params->seq &&
4464              nla_put(cookie->msg, NL80211_KEY_SEQ,
4465                      params->seq_len, params->seq)) ||
4466             (params->cipher &&
4467              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4468                          params->cipher)))
4469                 goto nla_put_failure;
4470
4471         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4472                 goto nla_put_failure;
4473
4474         nla_nest_end(cookie->msg, key);
4475
4476         return;
4477  nla_put_failure:
4478         cookie->error = 1;
4479 }
4480
4481 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4482 {
4483         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4484         int err;
4485         struct net_device *dev = info->user_ptr[1];
4486         u8 key_idx = 0;
4487         const u8 *mac_addr = NULL;
4488         bool pairwise;
4489         struct get_key_cookie cookie = {
4490                 .error = 0,
4491         };
4492         void *hdr;
4493         struct sk_buff *msg;
4494         bool bigtk_support = false;
4495         int link_id = nl80211_link_id_or_invalid(info->attrs);
4496         struct wireless_dev *wdev = dev->ieee80211_ptr;
4497
4498         if (wiphy_ext_feature_isset(&rdev->wiphy,
4499                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4500                 bigtk_support = true;
4501
4502         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4503              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4504             wiphy_ext_feature_isset(&rdev->wiphy,
4505                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4506                 bigtk_support = true;
4507
4508         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4509                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4510
4511                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4512                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4513                         return -EINVAL;
4514                 }
4515         }
4516
4517         if (info->attrs[NL80211_ATTR_MAC])
4518                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4519
4520         pairwise = !!mac_addr;
4521         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4522                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4523
4524                 if (kt != NL80211_KEYTYPE_GROUP &&
4525                     kt != NL80211_KEYTYPE_PAIRWISE)
4526                         return -EINVAL;
4527                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4528         }
4529
4530         if (!rdev->ops->get_key)
4531                 return -EOPNOTSUPP;
4532
4533         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4534                 return -ENOENT;
4535
4536         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4537         if (!msg)
4538                 return -ENOMEM;
4539
4540         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4541                              NL80211_CMD_NEW_KEY);
4542         if (!hdr)
4543                 goto nla_put_failure;
4544
4545         cookie.msg = msg;
4546         cookie.idx = key_idx;
4547
4548         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4549             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4550                 goto nla_put_failure;
4551         if (mac_addr &&
4552             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4553                 goto nla_put_failure;
4554
4555         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4556         if (err)
4557                 goto free_msg;
4558
4559         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4560                            &cookie, get_key_callback);
4561
4562         if (err)
4563                 goto free_msg;
4564
4565         if (cookie.error)
4566                 goto nla_put_failure;
4567
4568         genlmsg_end(msg, hdr);
4569         return genlmsg_reply(msg, info);
4570
4571  nla_put_failure:
4572         err = -ENOBUFS;
4573  free_msg:
4574         nlmsg_free(msg);
4575         return err;
4576 }
4577
4578 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4579 {
4580         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4581         struct key_parse key;
4582         int err;
4583         struct net_device *dev = info->user_ptr[1];
4584         int link_id = nl80211_link_id_or_invalid(info->attrs);
4585         struct wireless_dev *wdev = dev->ieee80211_ptr;
4586
4587         err = nl80211_parse_key(info, &key);
4588         if (err)
4589                 return err;
4590
4591         if (key.idx < 0)
4592                 return -EINVAL;
4593
4594         /* Only support setting default key and
4595          * Extended Key ID action NL80211_KEY_SET_TX.
4596          */
4597         if (!key.def && !key.defmgmt && !key.defbeacon &&
4598             !(key.p.mode == NL80211_KEY_SET_TX))
4599                 return -EINVAL;
4600
4601         wdev_lock(wdev);
4602
4603         if (key.def) {
4604                 if (!rdev->ops->set_default_key) {
4605                         err = -EOPNOTSUPP;
4606                         goto out;
4607                 }
4608
4609                 err = nl80211_key_allowed(wdev);
4610                 if (err)
4611                         goto out;
4612
4613                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4614                 if (err)
4615                         goto out;
4616
4617                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4618                                            key.def_uni, key.def_multi);
4619
4620                 if (err)
4621                         goto out;
4622
4623 #ifdef CONFIG_CFG80211_WEXT
4624                 wdev->wext.default_key = key.idx;
4625 #endif
4626         } else if (key.defmgmt) {
4627                 if (key.def_uni || !key.def_multi) {
4628                         err = -EINVAL;
4629                         goto out;
4630                 }
4631
4632                 if (!rdev->ops->set_default_mgmt_key) {
4633                         err = -EOPNOTSUPP;
4634                         goto out;
4635                 }
4636
4637                 err = nl80211_key_allowed(wdev);
4638                 if (err)
4639                         goto out;
4640
4641                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4642                 if (err)
4643                         goto out;
4644
4645                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4646                 if (err)
4647                         goto out;
4648
4649 #ifdef CONFIG_CFG80211_WEXT
4650                 wdev->wext.default_mgmt_key = key.idx;
4651 #endif
4652         } else if (key.defbeacon) {
4653                 if (key.def_uni || !key.def_multi) {
4654                         err = -EINVAL;
4655                         goto out;
4656                 }
4657
4658                 if (!rdev->ops->set_default_beacon_key) {
4659                         err = -EOPNOTSUPP;
4660                         goto out;
4661                 }
4662
4663                 err = nl80211_key_allowed(wdev);
4664                 if (err)
4665                         goto out;
4666
4667                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4668                 if (err)
4669                         goto out;
4670
4671                 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4672                 if (err)
4673                         goto out;
4674         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4675                    wiphy_ext_feature_isset(&rdev->wiphy,
4676                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4677                 u8 *mac_addr = NULL;
4678
4679                 if (info->attrs[NL80211_ATTR_MAC])
4680                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4681
4682                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4683                         err = -EINVAL;
4684                         goto out;
4685                 }
4686
4687                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4688                 if (err)
4689                         goto out;
4690
4691                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4692                                    NL80211_KEYTYPE_PAIRWISE,
4693                                    mac_addr, &key.p);
4694         } else {
4695                 err = -EINVAL;
4696         }
4697  out:
4698         wdev_unlock(wdev);
4699
4700         return err;
4701 }
4702
4703 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4704 {
4705         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4706         int err;
4707         struct net_device *dev = info->user_ptr[1];
4708         struct key_parse key;
4709         const u8 *mac_addr = NULL;
4710         int link_id = nl80211_link_id_or_invalid(info->attrs);
4711         struct wireless_dev *wdev = dev->ieee80211_ptr;
4712
4713         err = nl80211_parse_key(info, &key);
4714         if (err)
4715                 return err;
4716
4717         if (!key.p.key) {
4718                 GENL_SET_ERR_MSG(info, "no key");
4719                 return -EINVAL;
4720         }
4721
4722         if (info->attrs[NL80211_ATTR_MAC])
4723                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4724
4725         if (key.type == -1) {
4726                 if (mac_addr)
4727                         key.type = NL80211_KEYTYPE_PAIRWISE;
4728                 else
4729                         key.type = NL80211_KEYTYPE_GROUP;
4730         }
4731
4732         /* for now */
4733         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4734             key.type != NL80211_KEYTYPE_GROUP) {
4735                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4736                 return -EINVAL;
4737         }
4738
4739         if (key.type == NL80211_KEYTYPE_GROUP &&
4740             info->attrs[NL80211_ATTR_VLAN_ID])
4741                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4742
4743         if (!rdev->ops->add_key)
4744                 return -EOPNOTSUPP;
4745
4746         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4747                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4748                                            mac_addr)) {
4749                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4750                 return -EINVAL;
4751         }
4752
4753         wdev_lock(wdev);
4754         err = nl80211_key_allowed(wdev);
4755         if (err)
4756                 GENL_SET_ERR_MSG(info, "key not allowed");
4757
4758         if (!err)
4759                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4760                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4761
4762         if (!err) {
4763                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4764                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4765                                     mac_addr, &key.p);
4766                 if (err)
4767                         GENL_SET_ERR_MSG(info, "key addition failed");
4768         }
4769         wdev_unlock(wdev);
4770
4771         return err;
4772 }
4773
4774 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4775 {
4776         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4777         int err;
4778         struct net_device *dev = info->user_ptr[1];
4779         u8 *mac_addr = NULL;
4780         struct key_parse key;
4781         int link_id = nl80211_link_id_or_invalid(info->attrs);
4782         struct wireless_dev *wdev = dev->ieee80211_ptr;
4783
4784         err = nl80211_parse_key(info, &key);
4785         if (err)
4786                 return err;
4787
4788         if (info->attrs[NL80211_ATTR_MAC])
4789                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4790
4791         if (key.type == -1) {
4792                 if (mac_addr)
4793                         key.type = NL80211_KEYTYPE_PAIRWISE;
4794                 else
4795                         key.type = NL80211_KEYTYPE_GROUP;
4796         }
4797
4798         /* for now */
4799         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4800             key.type != NL80211_KEYTYPE_GROUP)
4801                 return -EINVAL;
4802
4803         if (!cfg80211_valid_key_idx(rdev, key.idx,
4804                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4805                 return -EINVAL;
4806
4807         if (!rdev->ops->del_key)
4808                 return -EOPNOTSUPP;
4809
4810         wdev_lock(wdev);
4811         err = nl80211_key_allowed(wdev);
4812
4813         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4814             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4815                 err = -ENOENT;
4816
4817         if (!err)
4818                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4819                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4820
4821         if (!err)
4822                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4823                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4824                                    mac_addr);
4825
4826 #ifdef CONFIG_CFG80211_WEXT
4827         if (!err) {
4828                 if (key.idx == wdev->wext.default_key)
4829                         wdev->wext.default_key = -1;
4830                 else if (key.idx == wdev->wext.default_mgmt_key)
4831                         wdev->wext.default_mgmt_key = -1;
4832         }
4833 #endif
4834         wdev_unlock(wdev);
4835
4836         return err;
4837 }
4838
4839 /* This function returns an error or the number of nested attributes */
4840 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4841 {
4842         struct nlattr *attr;
4843         int n_entries = 0, tmp;
4844
4845         nla_for_each_nested(attr, nl_attr, tmp) {
4846                 if (nla_len(attr) != ETH_ALEN)
4847                         return -EINVAL;
4848
4849                 n_entries++;
4850         }
4851
4852         return n_entries;
4853 }
4854
4855 /*
4856  * This function parses ACL information and allocates memory for ACL data.
4857  * On successful return, the calling function is responsible to free the
4858  * ACL buffer returned by this function.
4859  */
4860 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4861                                                 struct genl_info *info)
4862 {
4863         enum nl80211_acl_policy acl_policy;
4864         struct nlattr *attr;
4865         struct cfg80211_acl_data *acl;
4866         int i = 0, n_entries, tmp;
4867
4868         if (!wiphy->max_acl_mac_addrs)
4869                 return ERR_PTR(-EOPNOTSUPP);
4870
4871         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4872                 return ERR_PTR(-EINVAL);
4873
4874         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4875         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4876             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4877                 return ERR_PTR(-EINVAL);
4878
4879         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4880                 return ERR_PTR(-EINVAL);
4881
4882         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4883         if (n_entries < 0)
4884                 return ERR_PTR(n_entries);
4885
4886         if (n_entries > wiphy->max_acl_mac_addrs)
4887                 return ERR_PTR(-ENOTSUPP);
4888
4889         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4890         if (!acl)
4891                 return ERR_PTR(-ENOMEM);
4892
4893         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4894                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4895                 i++;
4896         }
4897
4898         acl->n_acl_entries = n_entries;
4899         acl->acl_policy = acl_policy;
4900
4901         return acl;
4902 }
4903
4904 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4905 {
4906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4907         struct net_device *dev = info->user_ptr[1];
4908         struct cfg80211_acl_data *acl;
4909         int err;
4910
4911         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4912             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4913                 return -EOPNOTSUPP;
4914
4915         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4916                 return -EINVAL;
4917
4918         acl = parse_acl_data(&rdev->wiphy, info);
4919         if (IS_ERR(acl))
4920                 return PTR_ERR(acl);
4921
4922         err = rdev_set_mac_acl(rdev, dev, acl);
4923
4924         kfree(acl);
4925
4926         return err;
4927 }
4928
4929 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4930                            u8 *rates, u8 rates_len)
4931 {
4932         u8 i;
4933         u32 mask = 0;
4934
4935         for (i = 0; i < rates_len; i++) {
4936                 int rate = (rates[i] & 0x7f) * 5;
4937                 int ridx;
4938
4939                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4940                         struct ieee80211_rate *srate =
4941                                 &sband->bitrates[ridx];
4942                         if (rate == srate->bitrate) {
4943                                 mask |= 1 << ridx;
4944                                 break;
4945                         }
4946                 }
4947                 if (ridx == sband->n_bitrates)
4948                         return 0; /* rate not found */
4949         }
4950
4951         return mask;
4952 }
4953
4954 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4955                                u8 *rates, u8 rates_len,
4956                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4957 {
4958         u8 i;
4959
4960         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4961
4962         for (i = 0; i < rates_len; i++) {
4963                 int ridx, rbit;
4964
4965                 ridx = rates[i] / 8;
4966                 rbit = BIT(rates[i] % 8);
4967
4968                 /* check validity */
4969                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4970                         return false;
4971
4972                 /* check availability */
4973                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4974                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4975                         mcs[ridx] |= rbit;
4976                 else
4977                         return false;
4978         }
4979
4980         return true;
4981 }
4982
4983 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4984 {
4985         u16 mcs_mask = 0;
4986
4987         switch (vht_mcs_map) {
4988         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4989                 break;
4990         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4991                 mcs_mask = 0x00FF;
4992                 break;
4993         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4994                 mcs_mask = 0x01FF;
4995                 break;
4996         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4997                 mcs_mask = 0x03FF;
4998                 break;
4999         default:
5000                 break;
5001         }
5002
5003         return mcs_mask;
5004 }
5005
5006 static void vht_build_mcs_mask(u16 vht_mcs_map,
5007                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5008 {
5009         u8 nss;
5010
5011         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5012                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5013                 vht_mcs_map >>= 2;
5014         }
5015 }
5016
5017 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5018                              struct nl80211_txrate_vht *txrate,
5019                              u16 mcs[NL80211_VHT_NSS_MAX])
5020 {
5021         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5022         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5023         u8 i;
5024
5025         if (!sband->vht_cap.vht_supported)
5026                 return false;
5027
5028         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5029
5030         /* Build vht_mcs_mask from VHT capabilities */
5031         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5032
5033         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5034                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5035                         mcs[i] = txrate->mcs[i];
5036                 else
5037                         return false;
5038         }
5039
5040         return true;
5041 }
5042
5043 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5044 {
5045         switch (he_mcs_map) {
5046         case IEEE80211_HE_MCS_NOT_SUPPORTED:
5047                 return 0;
5048         case IEEE80211_HE_MCS_SUPPORT_0_7:
5049                 return 0x00FF;
5050         case IEEE80211_HE_MCS_SUPPORT_0_9:
5051                 return 0x03FF;
5052         case IEEE80211_HE_MCS_SUPPORT_0_11:
5053                 return 0xFFF;
5054         default:
5055                 break;
5056         }
5057         return 0;
5058 }
5059
5060 static void he_build_mcs_mask(u16 he_mcs_map,
5061                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5062 {
5063         u8 nss;
5064
5065         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5066                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5067                 he_mcs_map >>= 2;
5068         }
5069 }
5070
5071 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5072                            const struct ieee80211_sta_he_cap *he_cap)
5073 {
5074         struct net_device *dev = info->user_ptr[1];
5075         struct wireless_dev *wdev = dev->ieee80211_ptr;
5076         struct cfg80211_chan_def *chandef;
5077         __le16 tx_mcs;
5078
5079         chandef = wdev_chandef(wdev, link_id);
5080         if (!chandef) {
5081                 /*
5082                  * This is probably broken, but we never maintained
5083                  * a chandef in these cases, so it always was.
5084                  */
5085                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5086         }
5087
5088         switch (chandef->width) {
5089         case NL80211_CHAN_WIDTH_80P80:
5090                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5091                 break;
5092         case NL80211_CHAN_WIDTH_160:
5093                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5094                 break;
5095         default:
5096                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5097                 break;
5098         }
5099
5100         return le16_to_cpu(tx_mcs);
5101 }
5102
5103 static bool he_set_mcs_mask(struct genl_info *info,
5104                             struct wireless_dev *wdev,
5105                             struct ieee80211_supported_band *sband,
5106                             struct nl80211_txrate_he *txrate,
5107                             u16 mcs[NL80211_HE_NSS_MAX],
5108                             unsigned int link_id)
5109 {
5110         const struct ieee80211_sta_he_cap *he_cap;
5111         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5112         u16 tx_mcs_map = 0;
5113         u8 i;
5114
5115         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5116         if (!he_cap)
5117                 return false;
5118
5119         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5120
5121         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5122
5123         /* Build he_mcs_mask from HE capabilities */
5124         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5125
5126         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5127                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5128                         mcs[i] = txrate->mcs[i];
5129                 else
5130                         return false;
5131         }
5132
5133         return true;
5134 }
5135
5136 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5137                                          struct nlattr *attrs[],
5138                                          enum nl80211_attrs attr,
5139                                          struct cfg80211_bitrate_mask *mask,
5140                                          struct net_device *dev,
5141                                          bool default_all_enabled,
5142                                          unsigned int link_id)
5143 {
5144         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5145         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5146         struct wireless_dev *wdev = dev->ieee80211_ptr;
5147         int rem, i;
5148         struct nlattr *tx_rates;
5149         struct ieee80211_supported_band *sband;
5150         u16 vht_tx_mcs_map, he_tx_mcs_map;
5151
5152         memset(mask, 0, sizeof(*mask));
5153         /* Default to all rates enabled */
5154         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5155                 const struct ieee80211_sta_he_cap *he_cap;
5156
5157                 if (!default_all_enabled)
5158                         break;
5159
5160                 sband = rdev->wiphy.bands[i];
5161
5162                 if (!sband)
5163                         continue;
5164
5165                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5166                 memcpy(mask->control[i].ht_mcs,
5167                        sband->ht_cap.mcs.rx_mask,
5168                        sizeof(mask->control[i].ht_mcs));
5169
5170                 if (sband->vht_cap.vht_supported) {
5171                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5172                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5173                 }
5174
5175                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5176                 if (!he_cap)
5177                         continue;
5178
5179                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5180                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5181
5182                 mask->control[i].he_gi = 0xFF;
5183                 mask->control[i].he_ltf = 0xFF;
5184         }
5185
5186         /* if no rates are given set it back to the defaults */
5187         if (!attrs[attr])
5188                 goto out;
5189
5190         /* The nested attribute uses enum nl80211_band as the index. This maps
5191          * directly to the enum nl80211_band values used in cfg80211.
5192          */
5193         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5194         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5195                 enum nl80211_band band = nla_type(tx_rates);
5196                 int err;
5197
5198                 if (band < 0 || band >= NUM_NL80211_BANDS)
5199                         return -EINVAL;
5200                 sband = rdev->wiphy.bands[band];
5201                 if (sband == NULL)
5202                         return -EINVAL;
5203                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5204                                                   tx_rates,
5205                                                   nl80211_txattr_policy,
5206                                                   info->extack);
5207                 if (err)
5208                         return err;
5209                 if (tb[NL80211_TXRATE_LEGACY]) {
5210                         mask->control[band].legacy = rateset_to_mask(
5211                                 sband,
5212                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5213                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5214                         if ((mask->control[band].legacy == 0) &&
5215                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5216                                 return -EINVAL;
5217                 }
5218                 if (tb[NL80211_TXRATE_HT]) {
5219                         if (!ht_rateset_to_mask(
5220                                         sband,
5221                                         nla_data(tb[NL80211_TXRATE_HT]),
5222                                         nla_len(tb[NL80211_TXRATE_HT]),
5223                                         mask->control[band].ht_mcs))
5224                                 return -EINVAL;
5225                 }
5226
5227                 if (tb[NL80211_TXRATE_VHT]) {
5228                         if (!vht_set_mcs_mask(
5229                                         sband,
5230                                         nla_data(tb[NL80211_TXRATE_VHT]),
5231                                         mask->control[band].vht_mcs))
5232                                 return -EINVAL;
5233                 }
5234
5235                 if (tb[NL80211_TXRATE_GI]) {
5236                         mask->control[band].gi =
5237                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5238                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5239                                 return -EINVAL;
5240                 }
5241                 if (tb[NL80211_TXRATE_HE] &&
5242                     !he_set_mcs_mask(info, wdev, sband,
5243                                      nla_data(tb[NL80211_TXRATE_HE]),
5244                                      mask->control[band].he_mcs,
5245                                      link_id))
5246                         return -EINVAL;
5247
5248                 if (tb[NL80211_TXRATE_HE_GI])
5249                         mask->control[band].he_gi =
5250                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5251                 if (tb[NL80211_TXRATE_HE_LTF])
5252                         mask->control[band].he_ltf =
5253                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5254
5255                 if (mask->control[band].legacy == 0) {
5256                         /* don't allow empty legacy rates if HT, VHT or HE
5257                          * are not even supported.
5258                          */
5259                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5260                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5261                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5262                                 return -EINVAL;
5263
5264                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5265                                 if (mask->control[band].ht_mcs[i])
5266                                         goto out;
5267
5268                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5269                                 if (mask->control[band].vht_mcs[i])
5270                                         goto out;
5271
5272                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5273                                 if (mask->control[band].he_mcs[i])
5274                                         goto out;
5275
5276                         /* legacy and mcs rates may not be both empty */
5277                         return -EINVAL;
5278                 }
5279         }
5280
5281 out:
5282         return 0;
5283 }
5284
5285 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5286                                    enum nl80211_band band,
5287                                    struct cfg80211_bitrate_mask *beacon_rate)
5288 {
5289         u32 count_ht, count_vht, count_he, i;
5290         u32 rate = beacon_rate->control[band].legacy;
5291
5292         /* Allow only one rate */
5293         if (hweight32(rate) > 1)
5294                 return -EINVAL;
5295
5296         count_ht = 0;
5297         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5298                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5299                         return -EINVAL;
5300                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5301                         count_ht++;
5302                         if (count_ht > 1)
5303                                 return -EINVAL;
5304                 }
5305                 if (count_ht && rate)
5306                         return -EINVAL;
5307         }
5308
5309         count_vht = 0;
5310         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5311                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5312                         return -EINVAL;
5313                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5314                         count_vht++;
5315                         if (count_vht > 1)
5316                                 return -EINVAL;
5317                 }
5318                 if (count_vht && rate)
5319                         return -EINVAL;
5320         }
5321
5322         count_he = 0;
5323         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5324                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5325                         return -EINVAL;
5326                 } else if (beacon_rate->control[band].he_mcs[i]) {
5327                         count_he++;
5328                         if (count_he > 1)
5329                                 return -EINVAL;
5330                 }
5331                 if (count_he && rate)
5332                         return -EINVAL;
5333         }
5334
5335         if ((count_ht && count_vht && count_he) ||
5336             (!rate && !count_ht && !count_vht && !count_he))
5337                 return -EINVAL;
5338
5339         if (rate &&
5340             !wiphy_ext_feature_isset(&rdev->wiphy,
5341                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5342                 return -EINVAL;
5343         if (count_ht &&
5344             !wiphy_ext_feature_isset(&rdev->wiphy,
5345                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5346                 return -EINVAL;
5347         if (count_vht &&
5348             !wiphy_ext_feature_isset(&rdev->wiphy,
5349                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5350                 return -EINVAL;
5351         if (count_he &&
5352             !wiphy_ext_feature_isset(&rdev->wiphy,
5353                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5354                 return -EINVAL;
5355
5356         return 0;
5357 }
5358
5359 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5360                                        struct net_device *dev,
5361                                        struct nlattr *attrs,
5362                                        struct cfg80211_mbssid_config *config,
5363                                        u8 num_elems)
5364 {
5365         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5366
5367         if (!wiphy->mbssid_max_interfaces)
5368                 return -EOPNOTSUPP;
5369
5370         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5371                              NULL) ||
5372             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5373                 return -EINVAL;
5374
5375         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5376         if (config->ema) {
5377                 if (!wiphy->ema_max_profile_periodicity)
5378                         return -EOPNOTSUPP;
5379
5380                 if (num_elems > wiphy->ema_max_profile_periodicity)
5381                         return -EINVAL;
5382         }
5383
5384         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5385         if (config->index >= wiphy->mbssid_max_interfaces ||
5386             (!config->index && !num_elems))
5387                 return -EINVAL;
5388
5389         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5390                 u32 tx_ifindex =
5391                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5392
5393                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5394                     (config->index && tx_ifindex == dev->ifindex))
5395                         return -EINVAL;
5396
5397                 if (tx_ifindex != dev->ifindex) {
5398                         struct net_device *tx_netdev =
5399                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5400
5401                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5402                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5403                             tx_netdev->ieee80211_ptr->iftype !=
5404                                                         NL80211_IFTYPE_AP) {
5405                                 dev_put(tx_netdev);
5406                                 return -EINVAL;
5407                         }
5408
5409                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5410                 } else {
5411                         config->tx_wdev = dev->ieee80211_ptr;
5412                 }
5413         } else if (!config->index) {
5414                 config->tx_wdev = dev->ieee80211_ptr;
5415         } else {
5416                 return -EINVAL;
5417         }
5418
5419         return 0;
5420 }
5421
5422 static struct cfg80211_mbssid_elems *
5423 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5424 {
5425         struct nlattr *nl_elems;
5426         struct cfg80211_mbssid_elems *elems;
5427         int rem_elems;
5428         u8 i = 0, num_elems = 0;
5429
5430         if (!wiphy->mbssid_max_interfaces)
5431                 return ERR_PTR(-EINVAL);
5432
5433         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5434                 if (num_elems >= 255)
5435                         return ERR_PTR(-EINVAL);
5436                 num_elems++;
5437         }
5438
5439         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5440         if (!elems)
5441                 return ERR_PTR(-ENOMEM);
5442
5443         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5444                 elems->elem[i].data = nla_data(nl_elems);
5445                 elems->elem[i].len = nla_len(nl_elems);
5446                 i++;
5447         }
5448         elems->cnt = num_elems;
5449         return elems;
5450 }
5451
5452 static struct cfg80211_rnr_elems *
5453 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5454                         struct netlink_ext_ack *extack)
5455 {
5456         struct nlattr *nl_elems;
5457         struct cfg80211_rnr_elems *elems;
5458         int rem_elems;
5459         u8 i = 0, num_elems = 0;
5460
5461         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5462                 int ret;
5463
5464                 ret = validate_ie_attr(nl_elems, extack);
5465                 if (ret)
5466                         return ERR_PTR(ret);
5467
5468                 num_elems++;
5469         }
5470
5471         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5472         if (!elems)
5473                 return ERR_PTR(-ENOMEM);
5474
5475         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5476                 elems->elem[i].data = nla_data(nl_elems);
5477                 elems->elem[i].len = nla_len(nl_elems);
5478                 i++;
5479         }
5480         elems->cnt = num_elems;
5481         return elems;
5482 }
5483
5484 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5485                                       struct cfg80211_he_bss_color *he_bss_color)
5486 {
5487         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5488         int err;
5489
5490         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5491                                he_bss_color_policy, NULL);
5492         if (err)
5493                 return err;
5494
5495         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5496                 return -EINVAL;
5497
5498         he_bss_color->color =
5499                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5500         he_bss_color->enabled =
5501                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5502         he_bss_color->partial =
5503                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5504
5505         return 0;
5506 }
5507
5508 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5509                                 struct nlattr *attrs[],
5510                                 struct cfg80211_beacon_data *bcn,
5511                                 struct netlink_ext_ack *extack)
5512 {
5513         bool haveinfo = false;
5514         int err;
5515
5516         memset(bcn, 0, sizeof(*bcn));
5517
5518         bcn->link_id = nl80211_link_id(attrs);
5519
5520         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5521                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5522                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5523                 if (!bcn->head_len)
5524                         return -EINVAL;
5525                 haveinfo = true;
5526         }
5527
5528         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5529                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5530                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5531                 haveinfo = true;
5532         }
5533
5534         if (!haveinfo)
5535                 return -EINVAL;
5536
5537         if (attrs[NL80211_ATTR_IE]) {
5538                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5539                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5540         }
5541
5542         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5543                 bcn->proberesp_ies =
5544                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5545                 bcn->proberesp_ies_len =
5546                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5547         }
5548
5549         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5550                 bcn->assocresp_ies =
5551                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5552                 bcn->assocresp_ies_len =
5553                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5554         }
5555
5556         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5557                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5558                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5559         }
5560
5561         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5562                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5563
5564                 err = nla_parse_nested_deprecated(tb,
5565                                                   NL80211_FTM_RESP_ATTR_MAX,
5566                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5567                                                   NULL, NULL);
5568                 if (err)
5569                         return err;
5570
5571                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5572                     wiphy_ext_feature_isset(&rdev->wiphy,
5573                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5574                         bcn->ftm_responder = 1;
5575                 else
5576                         return -EOPNOTSUPP;
5577
5578                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5579                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5580                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5581                 }
5582
5583                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5584                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5585                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5586                 }
5587         } else {
5588                 bcn->ftm_responder = -1;
5589         }
5590
5591         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5592                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5593                                                  &bcn->he_bss_color);
5594                 if (err)
5595                         return err;
5596                 bcn->he_bss_color_valid = true;
5597         }
5598
5599         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5600                 struct cfg80211_mbssid_elems *mbssid =
5601                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5602                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5603
5604                 if (IS_ERR(mbssid))
5605                         return PTR_ERR(mbssid);
5606
5607                 bcn->mbssid_ies = mbssid;
5608
5609                 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5610                         struct cfg80211_rnr_elems *rnr =
5611                                 nl80211_parse_rnr_elems(&rdev->wiphy,
5612                                                         attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5613                                                         extack);
5614
5615                         if (IS_ERR(rnr))
5616                                 return PTR_ERR(rnr);
5617
5618                         if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5619                                 return -EINVAL;
5620
5621                         bcn->rnr_ies = rnr;
5622                 }
5623         }
5624
5625         return 0;
5626 }
5627
5628 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5629                                     struct ieee80211_he_obss_pd *he_obss_pd)
5630 {
5631         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5632         int err;
5633
5634         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5635                                he_obss_pd_policy, NULL);
5636         if (err)
5637                 return err;
5638
5639         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5640                 return -EINVAL;
5641
5642         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5643
5644         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5645                 he_obss_pd->min_offset =
5646                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5647         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5648                 he_obss_pd->max_offset =
5649                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5650         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5651                 he_obss_pd->non_srg_max_offset =
5652                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5653
5654         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5655                 return -EINVAL;
5656
5657         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5658                 memcpy(he_obss_pd->bss_color_bitmap,
5659                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5660                        sizeof(he_obss_pd->bss_color_bitmap));
5661
5662         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5663                 memcpy(he_obss_pd->partial_bssid_bitmap,
5664                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5665                        sizeof(he_obss_pd->partial_bssid_bitmap));
5666
5667         he_obss_pd->enable = true;
5668
5669         return 0;
5670 }
5671
5672 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5673                                         struct nlattr *attrs,
5674                                         struct cfg80211_ap_settings *params)
5675 {
5676         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5677         int ret;
5678         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5679
5680         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5681                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5682                 return -EINVAL;
5683
5684         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5685                                NULL, NULL);
5686         if (ret)
5687                 return ret;
5688
5689         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5690             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5691             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5692                 return -EINVAL;
5693
5694         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5695         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5696         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5697         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5698
5699         return 0;
5700 }
5701
5702 static int
5703 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5704                                      struct nlattr *attrs,
5705                                      struct cfg80211_ap_settings *params)
5706 {
5707         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5708         int ret;
5709         struct cfg80211_unsol_bcast_probe_resp *presp =
5710                                         &params->unsol_bcast_probe_resp;
5711
5712         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5713                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5714                 return -EINVAL;
5715
5716         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5717                                attrs, NULL, NULL);
5718         if (ret)
5719                 return ret;
5720
5721         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5722             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5723                 return -EINVAL;
5724
5725         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5726         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5727         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5728         return 0;
5729 }
5730
5731 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5732                                             const struct element *rates)
5733 {
5734         int i;
5735
5736         if (!rates)
5737                 return;
5738
5739         for (i = 0; i < rates->datalen; i++) {
5740                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5741                         params->ht_required = true;
5742                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5743                         params->vht_required = true;
5744                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5745                         params->he_required = true;
5746                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5747                         params->sae_h2e_required = true;
5748         }
5749 }
5750
5751 /*
5752  * Since the nl80211 API didn't include, from the beginning, attributes about
5753  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5754  * benefit of drivers that rebuild IEs in the firmware.
5755  */
5756 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5757 {
5758         const struct cfg80211_beacon_data *bcn = &params->beacon;
5759         size_t ies_len = bcn->tail_len;
5760         const u8 *ies = bcn->tail;
5761         const struct element *rates;
5762         const struct element *cap;
5763
5764         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5765         nl80211_check_ap_rate_selectors(params, rates);
5766
5767         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5768         nl80211_check_ap_rate_selectors(params, rates);
5769
5770         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5771         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5772                 params->ht_cap = (void *)cap->data;
5773         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5774         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5775                 params->vht_cap = (void *)cap->data;
5776         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5777         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5778                 params->he_cap = (void *)(cap->data + 1);
5779         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5780         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5781                 params->he_oper = (void *)(cap->data + 1);
5782         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5783         if (cap) {
5784                 if (!cap->datalen)
5785                         return -EINVAL;
5786                 params->eht_cap = (void *)(cap->data + 1);
5787                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5788                                                 (const u8 *)params->eht_cap,
5789                                                 cap->datalen - 1, true))
5790                         return -EINVAL;
5791         }
5792         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5793         if (cap) {
5794                 if (!cap->datalen)
5795                         return -EINVAL;
5796                 params->eht_oper = (void *)(cap->data + 1);
5797                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5798                                                 cap->datalen - 1))
5799                         return -EINVAL;
5800         }
5801         return 0;
5802 }
5803
5804 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5805                                    struct cfg80211_ap_settings *params)
5806 {
5807         struct wireless_dev *wdev;
5808
5809         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5810                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5811                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5812                         continue;
5813
5814                 if (!wdev->u.ap.preset_chandef.chan)
5815                         continue;
5816
5817                 params->chandef = wdev->u.ap.preset_chandef;
5818                 return true;
5819         }
5820
5821         return false;
5822 }
5823
5824 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5825                                     enum nl80211_auth_type auth_type,
5826                                     enum nl80211_commands cmd)
5827 {
5828         if (auth_type > NL80211_AUTHTYPE_MAX)
5829                 return false;
5830
5831         switch (cmd) {
5832         case NL80211_CMD_AUTHENTICATE:
5833                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5834                     auth_type == NL80211_AUTHTYPE_SAE)
5835                         return false;
5836                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5837                                              NL80211_EXT_FEATURE_FILS_STA) &&
5838                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5839                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5840                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5841                         return false;
5842                 return true;
5843         case NL80211_CMD_CONNECT:
5844                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5845                     !wiphy_ext_feature_isset(&rdev->wiphy,
5846                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5847                     auth_type == NL80211_AUTHTYPE_SAE)
5848                         return false;
5849
5850                 /* FILS with SK PFS or PK not supported yet */
5851                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5852                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5853                         return false;
5854                 if (!wiphy_ext_feature_isset(
5855                             &rdev->wiphy,
5856                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5857                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5858                         return false;
5859                 return true;
5860         case NL80211_CMD_START_AP:
5861                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5862                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5863                     auth_type == NL80211_AUTHTYPE_SAE)
5864                         return false;
5865                 /* FILS not supported yet */
5866                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5867                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5868                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5869                         return false;
5870                 return true;
5871         default:
5872                 return false;
5873         }
5874 }
5875
5876 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5877                                     unsigned int link_id)
5878 {
5879         struct wiphy *wiphy = wdev->wiphy;
5880         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5881         struct sk_buff *msg;
5882         void *hdr;
5883
5884         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5885         if (!msg)
5886                 return;
5887
5888         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5889         if (!hdr)
5890                 goto out;
5891
5892         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5893             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5894             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5895                               NL80211_ATTR_PAD) ||
5896             (wdev->u.ap.ssid_len &&
5897              nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5898                      wdev->u.ap.ssid)) ||
5899             (wdev->valid_links &&
5900              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5901                 goto out;
5902
5903         genlmsg_end(msg, hdr);
5904
5905         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5906                                 NL80211_MCGRP_MLME, GFP_KERNEL);
5907         return;
5908 out:
5909         nlmsg_free(msg);
5910 }
5911
5912 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5913 {
5914         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5915         unsigned int link_id = nl80211_link_id(info->attrs);
5916         struct net_device *dev = info->user_ptr[1];
5917         struct wireless_dev *wdev = dev->ieee80211_ptr;
5918         struct cfg80211_ap_settings *params;
5919         int err;
5920
5921         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5922             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5923                 return -EOPNOTSUPP;
5924
5925         if (!rdev->ops->start_ap)
5926                 return -EOPNOTSUPP;
5927
5928         if (wdev->links[link_id].ap.beacon_interval)
5929                 return -EALREADY;
5930
5931         /* these are required for START_AP */
5932         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5933             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5934             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5935                 return -EINVAL;
5936
5937         params = kzalloc(sizeof(*params), GFP_KERNEL);
5938         if (!params)
5939                 return -ENOMEM;
5940
5941         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
5942                                    info->extack);
5943         if (err)
5944                 goto out;
5945
5946         params->beacon_interval =
5947                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5948         params->dtim_period =
5949                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5950
5951         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5952                                            params->beacon_interval);
5953         if (err)
5954                 goto out;
5955
5956         /*
5957          * In theory, some of these attributes should be required here
5958          * but since they were not used when the command was originally
5959          * added, keep them optional for old user space programs to let
5960          * them continue to work with drivers that do not need the
5961          * additional information -- drivers must check!
5962          */
5963         if (info->attrs[NL80211_ATTR_SSID]) {
5964                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5965                 params->ssid_len =
5966                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5967                 if (params->ssid_len == 0) {
5968                         err = -EINVAL;
5969                         goto out;
5970                 }
5971
5972                 if (wdev->u.ap.ssid_len &&
5973                     (wdev->u.ap.ssid_len != params->ssid_len ||
5974                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5975                         /* require identical SSID for MLO */
5976                         err = -EINVAL;
5977                         goto out;
5978                 }
5979         } else if (wdev->valid_links) {
5980                 /* require SSID for MLO */
5981                 err = -EINVAL;
5982                 goto out;
5983         }
5984
5985         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5986                 params->hidden_ssid = nla_get_u32(
5987                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5988
5989         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5990
5991         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5992                 params->auth_type = nla_get_u32(
5993                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5994                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5995                                              NL80211_CMD_START_AP)) {
5996                         err = -EINVAL;
5997                         goto out;
5998                 }
5999         } else
6000                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
6001
6002         err = nl80211_crypto_settings(rdev, info, &params->crypto,
6003                                       NL80211_MAX_NR_CIPHER_SUITES);
6004         if (err)
6005                 goto out;
6006
6007         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6008                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6009                         err = -EOPNOTSUPP;
6010                         goto out;
6011                 }
6012                 params->inactivity_timeout = nla_get_u16(
6013                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6014         }
6015
6016         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6017                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6018                         err = -EINVAL;
6019                         goto out;
6020                 }
6021                 params->p2p_ctwindow =
6022                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6023                 if (params->p2p_ctwindow != 0 &&
6024                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6025                         err = -EINVAL;
6026                         goto out;
6027                 }
6028         }
6029
6030         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6031                 u8 tmp;
6032
6033                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6034                         err = -EINVAL;
6035                         goto out;
6036                 }
6037                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6038                 params->p2p_opp_ps = tmp;
6039                 if (params->p2p_opp_ps != 0 &&
6040                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6041                         err = -EINVAL;
6042                         goto out;
6043                 }
6044         }
6045
6046         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6047                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6048                 if (err)
6049                         goto out;
6050         } else if (wdev->valid_links) {
6051                 /* with MLD need to specify the channel configuration */
6052                 err = -EINVAL;
6053                 goto out;
6054         } else if (wdev->u.ap.preset_chandef.chan) {
6055                 params->chandef = wdev->u.ap.preset_chandef;
6056         } else if (!nl80211_get_ap_channel(rdev, params)) {
6057                 err = -EINVAL;
6058                 goto out;
6059         }
6060
6061         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
6062                 err = nl80211_parse_punct_bitmap(rdev, info,
6063                                                  &params->chandef,
6064                                                  &params->punct_bitmap);
6065                 if (err)
6066                         goto out;
6067         }
6068
6069         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
6070                                            wdev->iftype)) {
6071                 err = -EINVAL;
6072                 goto out;
6073         }
6074
6075         wdev_lock(wdev);
6076
6077         if (info->attrs[NL80211_ATTR_TX_RATES]) {
6078                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6079                                                     NL80211_ATTR_TX_RATES,
6080                                                     &params->beacon_rate,
6081                                                     dev, false, link_id);
6082                 if (err)
6083                         goto out_unlock;
6084
6085                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6086                                               &params->beacon_rate);
6087                 if (err)
6088                         goto out_unlock;
6089         }
6090
6091         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6092                 params->smps_mode =
6093                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6094                 switch (params->smps_mode) {
6095                 case NL80211_SMPS_OFF:
6096                         break;
6097                 case NL80211_SMPS_STATIC:
6098                         if (!(rdev->wiphy.features &
6099                               NL80211_FEATURE_STATIC_SMPS)) {
6100                                 err = -EINVAL;
6101                                 goto out_unlock;
6102                         }
6103                         break;
6104                 case NL80211_SMPS_DYNAMIC:
6105                         if (!(rdev->wiphy.features &
6106                               NL80211_FEATURE_DYNAMIC_SMPS)) {
6107                                 err = -EINVAL;
6108                                 goto out_unlock;
6109                         }
6110                         break;
6111                 default:
6112                         err = -EINVAL;
6113                         goto out_unlock;
6114                 }
6115         } else {
6116                 params->smps_mode = NL80211_SMPS_OFF;
6117         }
6118
6119         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6120         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6121                 err = -EOPNOTSUPP;
6122                 goto out_unlock;
6123         }
6124
6125         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6126                 params->acl = parse_acl_data(&rdev->wiphy, info);
6127                 if (IS_ERR(params->acl)) {
6128                         err = PTR_ERR(params->acl);
6129                         params->acl = NULL;
6130                         goto out_unlock;
6131                 }
6132         }
6133
6134         params->twt_responder =
6135                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6136
6137         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6138                 err = nl80211_parse_he_obss_pd(
6139                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
6140                                         &params->he_obss_pd);
6141                 if (err)
6142                         goto out_unlock;
6143         }
6144
6145         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6146                 err = nl80211_parse_fils_discovery(rdev,
6147                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6148                                                    params);
6149                 if (err)
6150                         goto out_unlock;
6151         }
6152
6153         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6154                 err = nl80211_parse_unsol_bcast_probe_resp(
6155                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6156                         params);
6157                 if (err)
6158                         goto out_unlock;
6159         }
6160
6161         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6162                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6163                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6164                                                   &params->mbssid_config,
6165                                                   params->beacon.mbssid_ies ?
6166                                                         params->beacon.mbssid_ies->cnt :
6167                                                         0);
6168                 if (err)
6169                         goto out_unlock;
6170         }
6171
6172         if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6173                 err = -EINVAL;
6174                 goto out_unlock;
6175         }
6176
6177         err = nl80211_calculate_ap_params(params);
6178         if (err)
6179                 goto out_unlock;
6180
6181         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6182                 params->flags = nla_get_u32(
6183                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6184         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6185                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6186
6187         if (wdev->conn_owner_nlportid &&
6188             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6189             wdev->conn_owner_nlportid != info->snd_portid) {
6190                 err = -EINVAL;
6191                 goto out_unlock;
6192         }
6193
6194         /* FIXME: validate MLO/link-id against driver capabilities */
6195
6196         err = rdev_start_ap(rdev, dev, params);
6197         if (!err) {
6198                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6199                 wdev->links[link_id].ap.chandef = params->chandef;
6200                 wdev->u.ap.ssid_len = params->ssid_len;
6201                 memcpy(wdev->u.ap.ssid, params->ssid,
6202                        params->ssid_len);
6203
6204                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6205                         wdev->conn_owner_nlportid = info->snd_portid;
6206
6207                 nl80211_send_ap_started(wdev, link_id);
6208         }
6209 out_unlock:
6210         wdev_unlock(wdev);
6211 out:
6212         kfree(params->acl);
6213         kfree(params->beacon.mbssid_ies);
6214         if (params->mbssid_config.tx_wdev &&
6215             params->mbssid_config.tx_wdev->netdev &&
6216             params->mbssid_config.tx_wdev->netdev != dev)
6217                 dev_put(params->mbssid_config.tx_wdev->netdev);
6218         kfree(params->beacon.rnr_ies);
6219         kfree(params);
6220
6221         return err;
6222 }
6223
6224 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6225 {
6226         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6227         unsigned int link_id = nl80211_link_id(info->attrs);
6228         struct net_device *dev = info->user_ptr[1];
6229         struct wireless_dev *wdev = dev->ieee80211_ptr;
6230         struct cfg80211_beacon_data params;
6231         int err;
6232
6233         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6234             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6235                 return -EOPNOTSUPP;
6236
6237         if (!rdev->ops->change_beacon)
6238                 return -EOPNOTSUPP;
6239
6240         if (!wdev->links[link_id].ap.beacon_interval)
6241                 return -EINVAL;
6242
6243         err = nl80211_parse_beacon(rdev, info->attrs, &params, info->extack);
6244         if (err)
6245                 goto out;
6246
6247         wdev_lock(wdev);
6248         err = rdev_change_beacon(rdev, dev, &params);
6249         wdev_unlock(wdev);
6250
6251 out:
6252         kfree(params.mbssid_ies);
6253         kfree(params.rnr_ies);
6254         return err;
6255 }
6256
6257 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6258 {
6259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6260         unsigned int link_id = nl80211_link_id(info->attrs);
6261         struct net_device *dev = info->user_ptr[1];
6262
6263         return cfg80211_stop_ap(rdev, dev, link_id, false);
6264 }
6265
6266 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6267         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6268         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6269         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6270         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6271         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6272         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6273 };
6274
6275 static int parse_station_flags(struct genl_info *info,
6276                                enum nl80211_iftype iftype,
6277                                struct station_parameters *params)
6278 {
6279         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6280         struct nlattr *nla;
6281         int flag;
6282
6283         /*
6284          * Try parsing the new attribute first so userspace
6285          * can specify both for older kernels.
6286          */
6287         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6288         if (nla) {
6289                 struct nl80211_sta_flag_update *sta_flags;
6290
6291                 sta_flags = nla_data(nla);
6292                 params->sta_flags_mask = sta_flags->mask;
6293                 params->sta_flags_set = sta_flags->set;
6294                 params->sta_flags_set &= params->sta_flags_mask;
6295                 if ((params->sta_flags_mask |
6296                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6297                         return -EINVAL;
6298                 return 0;
6299         }
6300
6301         /* if present, parse the old attribute */
6302
6303         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6304         if (!nla)
6305                 return 0;
6306
6307         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6308                 return -EINVAL;
6309
6310         /*
6311          * Only allow certain flags for interface types so that
6312          * other attributes are silently ignored. Remember that
6313          * this is backward compatibility code with old userspace
6314          * and shouldn't be hit in other cases anyway.
6315          */
6316         switch (iftype) {
6317         case NL80211_IFTYPE_AP:
6318         case NL80211_IFTYPE_AP_VLAN:
6319         case NL80211_IFTYPE_P2P_GO:
6320                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6321                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6322                                          BIT(NL80211_STA_FLAG_WME) |
6323                                          BIT(NL80211_STA_FLAG_MFP);
6324                 break;
6325         case NL80211_IFTYPE_P2P_CLIENT:
6326         case NL80211_IFTYPE_STATION:
6327                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6328                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6329                 break;
6330         case NL80211_IFTYPE_MESH_POINT:
6331                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6332                                          BIT(NL80211_STA_FLAG_MFP) |
6333                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6334                 break;
6335         default:
6336                 return -EINVAL;
6337         }
6338
6339         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6340                 if (flags[flag]) {
6341                         params->sta_flags_set |= (1<<flag);
6342
6343                         /* no longer support new API additions in old API */
6344                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6345                                 return -EINVAL;
6346                 }
6347         }
6348
6349         return 0;
6350 }
6351
6352 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6353 {
6354         struct nlattr *rate;
6355         u32 bitrate;
6356         u16 bitrate_compat;
6357         enum nl80211_rate_info rate_flg;
6358
6359         rate = nla_nest_start_noflag(msg, attr);
6360         if (!rate)
6361                 return false;
6362
6363         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6364         bitrate = cfg80211_calculate_bitrate(info);
6365         /* report 16-bit bitrate only if we can */
6366         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6367         if (bitrate > 0 &&
6368             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6369                 return false;
6370         if (bitrate_compat > 0 &&
6371             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6372                 return false;
6373
6374         switch (info->bw) {
6375         case RATE_INFO_BW_1:
6376                 rate_flg = NL80211_RATE_INFO_1_MHZ_WIDTH;
6377                 break;
6378         case RATE_INFO_BW_2:
6379                 rate_flg = NL80211_RATE_INFO_2_MHZ_WIDTH;
6380                 break;
6381         case RATE_INFO_BW_4:
6382                 rate_flg = NL80211_RATE_INFO_4_MHZ_WIDTH;
6383                 break;
6384         case RATE_INFO_BW_5:
6385                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6386                 break;
6387         case RATE_INFO_BW_8:
6388                 rate_flg = NL80211_RATE_INFO_8_MHZ_WIDTH;
6389                 break;
6390         case RATE_INFO_BW_10:
6391                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6392                 break;
6393         case RATE_INFO_BW_16:
6394                 rate_flg = NL80211_RATE_INFO_16_MHZ_WIDTH;
6395                 break;
6396         default:
6397                 WARN_ON(1);
6398                 fallthrough;
6399         case RATE_INFO_BW_20:
6400                 rate_flg = 0;
6401                 break;
6402         case RATE_INFO_BW_40:
6403                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6404                 break;
6405         case RATE_INFO_BW_80:
6406                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6407                 break;
6408         case RATE_INFO_BW_160:
6409                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6410                 break;
6411         case RATE_INFO_BW_HE_RU:
6412                 rate_flg = 0;
6413                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6414                 break;
6415         case RATE_INFO_BW_320:
6416                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6417                 break;
6418         case RATE_INFO_BW_EHT_RU:
6419                 rate_flg = 0;
6420                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6421                 break;
6422         }
6423
6424         if (rate_flg && nla_put_flag(msg, rate_flg))
6425                 return false;
6426
6427         if (info->flags & RATE_INFO_FLAGS_MCS) {
6428                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6429                         return false;
6430                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6431                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6432                         return false;
6433         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6434                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6435                         return false;
6436                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6437                         return false;
6438                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6439                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6440                         return false;
6441         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6442                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6443                         return false;
6444                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6445                         return false;
6446                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6447                         return false;
6448                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6449                         return false;
6450                 if (info->bw == RATE_INFO_BW_HE_RU &&
6451                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6452                                info->he_ru_alloc))
6453                         return false;
6454         } else if (info->flags & RATE_INFO_FLAGS_S1G_MCS) {
6455                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_MCS, info->mcs))
6456                         return false;
6457                 if (nla_put_u8(msg, NL80211_RATE_INFO_S1G_NSS, info->nss))
6458                         return false;
6459                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6460                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6461                         return false;
6462         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6463                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6464                         return false;
6465                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6466                         return false;
6467                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6468                         return false;
6469                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6470                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6471                                info->eht_ru_alloc))
6472                         return false;
6473         }
6474
6475         nla_nest_end(msg, rate);
6476         return true;
6477 }
6478
6479 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6480                                int id)
6481 {
6482         void *attr;
6483         int i = 0;
6484
6485         if (!mask)
6486                 return true;
6487
6488         attr = nla_nest_start_noflag(msg, id);
6489         if (!attr)
6490                 return false;
6491
6492         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6493                 if (!(mask & BIT(i)))
6494                         continue;
6495
6496                 if (nla_put_u8(msg, i, signal[i]))
6497                         return false;
6498         }
6499
6500         nla_nest_end(msg, attr);
6501
6502         return true;
6503 }
6504
6505 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6506                                 u32 seq, int flags,
6507                                 struct cfg80211_registered_device *rdev,
6508                                 struct net_device *dev,
6509                                 const u8 *mac_addr, struct station_info *sinfo)
6510 {
6511         void *hdr;
6512         struct nlattr *sinfoattr, *bss_param;
6513
6514         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6515         if (!hdr) {
6516                 cfg80211_sinfo_release_content(sinfo);
6517                 return -1;
6518         }
6519
6520         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6521             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6522             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6523                 goto nla_put_failure;
6524
6525         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6526         if (!sinfoattr)
6527                 goto nla_put_failure;
6528
6529 #define PUT_SINFO(attr, memb, type) do {                                \
6530         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6531         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6532             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6533                              sinfo->memb))                              \
6534                 goto nla_put_failure;                                   \
6535         } while (0)
6536 #define PUT_SINFO_U64(attr, memb) do {                                  \
6537         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6538             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6539                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6540                 goto nla_put_failure;                                   \
6541         } while (0)
6542
6543         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6544         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6545         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6546
6547         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6548                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6549             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6550                         (u32)sinfo->rx_bytes))
6551                 goto nla_put_failure;
6552
6553         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6554                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6555             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6556                         (u32)sinfo->tx_bytes))
6557                 goto nla_put_failure;
6558
6559         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6560         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6561         PUT_SINFO(LLID, llid, u16);
6562         PUT_SINFO(PLID, plid, u16);
6563         PUT_SINFO(PLINK_STATE, plink_state, u8);
6564         PUT_SINFO_U64(RX_DURATION, rx_duration);
6565         PUT_SINFO_U64(TX_DURATION, tx_duration);
6566
6567         if (wiphy_ext_feature_isset(&rdev->wiphy,
6568                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6569                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6570
6571         switch (rdev->wiphy.signal_type) {
6572         case CFG80211_SIGNAL_TYPE_MBM:
6573                 PUT_SINFO(SIGNAL, signal, u8);
6574                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6575                 break;
6576         default:
6577                 break;
6578         }
6579         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6580                 if (!nl80211_put_signal(msg, sinfo->chains,
6581                                         sinfo->chain_signal,
6582                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6583                         goto nla_put_failure;
6584         }
6585         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6586                 if (!nl80211_put_signal(msg, sinfo->chains,
6587                                         sinfo->chain_signal_avg,
6588                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6589                         goto nla_put_failure;
6590         }
6591         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6592                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6593                                           NL80211_STA_INFO_TX_BITRATE))
6594                         goto nla_put_failure;
6595         }
6596         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6597                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6598                                           NL80211_STA_INFO_RX_BITRATE))
6599                         goto nla_put_failure;
6600         }
6601
6602         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6603         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6604         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6605         PUT_SINFO(TX_FAILED, tx_failed, u32);
6606         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6607         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6608         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6609         PUT_SINFO(LOCAL_PM, local_pm, u32);
6610         PUT_SINFO(PEER_PM, peer_pm, u32);
6611         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6612         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6613         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6614
6615         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6616                 bss_param = nla_nest_start_noflag(msg,
6617                                                   NL80211_STA_INFO_BSS_PARAM);
6618                 if (!bss_param)
6619                         goto nla_put_failure;
6620
6621                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6622                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6623                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6624                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6625                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6626                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6627                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6628                                sinfo->bss_param.dtim_period) ||
6629                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6630                                 sinfo->bss_param.beacon_interval))
6631                         goto nla_put_failure;
6632
6633                 nla_nest_end(msg, bss_param);
6634         }
6635         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6636             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6637                     sizeof(struct nl80211_sta_flag_update),
6638                     &sinfo->sta_flags))
6639                 goto nla_put_failure;
6640
6641         PUT_SINFO_U64(T_OFFSET, t_offset);
6642         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6643         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6644         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6645         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6646         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6647         if (wiphy_ext_feature_isset(&rdev->wiphy,
6648                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6649                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6650                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6651         }
6652
6653 #undef PUT_SINFO
6654 #undef PUT_SINFO_U64
6655
6656         if (sinfo->pertid) {
6657                 struct nlattr *tidsattr;
6658                 int tid;
6659
6660                 tidsattr = nla_nest_start_noflag(msg,
6661                                                  NL80211_STA_INFO_TID_STATS);
6662                 if (!tidsattr)
6663                         goto nla_put_failure;
6664
6665                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6666                         struct cfg80211_tid_stats *tidstats;
6667                         struct nlattr *tidattr;
6668
6669                         tidstats = &sinfo->pertid[tid];
6670
6671                         if (!tidstats->filled)
6672                                 continue;
6673
6674                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6675                         if (!tidattr)
6676                                 goto nla_put_failure;
6677
6678 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6679         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6680             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6681                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6682                 goto nla_put_failure;                                   \
6683         } while (0)
6684
6685                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6686                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6687                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6688                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6689
6690 #undef PUT_TIDVAL_U64
6691                         if ((tidstats->filled &
6692                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6693                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6694                                                    NL80211_TID_STATS_TXQ_STATS))
6695                                 goto nla_put_failure;
6696
6697                         nla_nest_end(msg, tidattr);
6698                 }
6699
6700                 nla_nest_end(msg, tidsattr);
6701         }
6702
6703         nla_nest_end(msg, sinfoattr);
6704
6705         if (sinfo->assoc_req_ies_len &&
6706             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6707                     sinfo->assoc_req_ies))
6708                 goto nla_put_failure;
6709
6710         if (sinfo->assoc_resp_ies_len &&
6711             nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6712                     sinfo->assoc_resp_ies))
6713                 goto nla_put_failure;
6714
6715         if (sinfo->mlo_params_valid) {
6716                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6717                                sinfo->assoc_link_id))
6718                         goto nla_put_failure;
6719
6720                 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6721                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6722                             sinfo->mld_addr))
6723                         goto nla_put_failure;
6724         }
6725
6726         cfg80211_sinfo_release_content(sinfo);
6727         genlmsg_end(msg, hdr);
6728         return 0;
6729
6730  nla_put_failure:
6731         cfg80211_sinfo_release_content(sinfo);
6732         genlmsg_cancel(msg, hdr);
6733         return -EMSGSIZE;
6734 }
6735
6736 static int nl80211_dump_station(struct sk_buff *skb,
6737                                 struct netlink_callback *cb)
6738 {
6739         struct station_info sinfo;
6740         struct cfg80211_registered_device *rdev;
6741         struct wireless_dev *wdev;
6742         u8 mac_addr[ETH_ALEN];
6743         int sta_idx = cb->args[2];
6744         int err;
6745
6746         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6747         if (err)
6748                 return err;
6749         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6750         __acquire(&rdev->wiphy.mtx);
6751
6752         if (!wdev->netdev) {
6753                 err = -EINVAL;
6754                 goto out_err;
6755         }
6756
6757         if (!rdev->ops->dump_station) {
6758                 err = -EOPNOTSUPP;
6759                 goto out_err;
6760         }
6761
6762         while (1) {
6763                 memset(&sinfo, 0, sizeof(sinfo));
6764                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6765                                         mac_addr, &sinfo);
6766                 if (err == -ENOENT)
6767                         break;
6768                 if (err)
6769                         goto out_err;
6770
6771                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6772                                 NETLINK_CB(cb->skb).portid,
6773                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6774                                 rdev, wdev->netdev, mac_addr,
6775                                 &sinfo) < 0)
6776                         goto out;
6777
6778                 sta_idx++;
6779         }
6780
6781  out:
6782         cb->args[2] = sta_idx;
6783         err = skb->len;
6784  out_err:
6785         wiphy_unlock(&rdev->wiphy);
6786
6787         return err;
6788 }
6789
6790 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6791 {
6792         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6793         struct net_device *dev = info->user_ptr[1];
6794         struct station_info sinfo;
6795         struct sk_buff *msg;
6796         u8 *mac_addr = NULL;
6797         int err;
6798
6799         memset(&sinfo, 0, sizeof(sinfo));
6800
6801         if (!info->attrs[NL80211_ATTR_MAC])
6802                 return -EINVAL;
6803
6804         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6805
6806         if (!rdev->ops->get_station)
6807                 return -EOPNOTSUPP;
6808
6809         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6810         if (err)
6811                 return err;
6812
6813         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6814         if (!msg) {
6815                 cfg80211_sinfo_release_content(&sinfo);
6816                 return -ENOMEM;
6817         }
6818
6819         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6820                                  info->snd_portid, info->snd_seq, 0,
6821                                  rdev, dev, mac_addr, &sinfo) < 0) {
6822                 nlmsg_free(msg);
6823                 return -ENOBUFS;
6824         }
6825
6826         return genlmsg_reply(msg, info);
6827 }
6828
6829 int cfg80211_check_station_change(struct wiphy *wiphy,
6830                                   struct station_parameters *params,
6831                                   enum cfg80211_station_type statype)
6832 {
6833         if (params->listen_interval != -1 &&
6834             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6835                 return -EINVAL;
6836
6837         if (params->support_p2p_ps != -1 &&
6838             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6839                 return -EINVAL;
6840
6841         if (params->aid &&
6842             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6843             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6844                 return -EINVAL;
6845
6846         /* When you run into this, adjust the code below for the new flag */
6847         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6848
6849         switch (statype) {
6850         case CFG80211_STA_MESH_PEER_KERNEL:
6851         case CFG80211_STA_MESH_PEER_USER:
6852                 /*
6853                  * No ignoring the TDLS flag here -- the userspace mesh
6854                  * code doesn't have the bug of including TDLS in the
6855                  * mask everywhere.
6856                  */
6857                 if (params->sta_flags_mask &
6858                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6859                                   BIT(NL80211_STA_FLAG_MFP) |
6860                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6861                         return -EINVAL;
6862                 break;
6863         case CFG80211_STA_TDLS_PEER_SETUP:
6864         case CFG80211_STA_TDLS_PEER_ACTIVE:
6865                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6866                         return -EINVAL;
6867                 /* ignore since it can't change */
6868                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6869                 break;
6870         default:
6871                 /* disallow mesh-specific things */
6872                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6873                         return -EINVAL;
6874                 if (params->local_pm)
6875                         return -EINVAL;
6876                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6877                         return -EINVAL;
6878         }
6879
6880         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6881             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6882                 /* TDLS can't be set, ... */
6883                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6884                         return -EINVAL;
6885                 /*
6886                  * ... but don't bother the driver with it. This works around
6887                  * a hostapd/wpa_supplicant issue -- it always includes the
6888                  * TLDS_PEER flag in the mask even for AP mode.
6889                  */
6890                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6891         }
6892
6893         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6894             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6895                 /* reject other things that can't change */
6896                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6897                         return -EINVAL;
6898                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6899                         return -EINVAL;
6900                 if (params->link_sta_params.supported_rates)
6901                         return -EINVAL;
6902                 if (params->ext_capab || params->link_sta_params.ht_capa ||
6903                     params->link_sta_params.vht_capa ||
6904                     params->link_sta_params.he_capa ||
6905                     params->link_sta_params.eht_capa)
6906                         return -EINVAL;
6907         }
6908
6909         if (statype != CFG80211_STA_AP_CLIENT &&
6910             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6911                 if (params->vlan)
6912                         return -EINVAL;
6913         }
6914
6915         switch (statype) {
6916         case CFG80211_STA_AP_MLME_CLIENT:
6917                 /* Use this only for authorizing/unauthorizing a station */
6918                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6919                         return -EOPNOTSUPP;
6920                 break;
6921         case CFG80211_STA_AP_CLIENT:
6922         case CFG80211_STA_AP_CLIENT_UNASSOC:
6923                 /* accept only the listed bits */
6924                 if (params->sta_flags_mask &
6925                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6926                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6927                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6928                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6929                                   BIT(NL80211_STA_FLAG_WME) |
6930                                   BIT(NL80211_STA_FLAG_MFP)))
6931                         return -EINVAL;
6932
6933                 /* but authenticated/associated only if driver handles it */
6934                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6935                     params->sta_flags_mask &
6936                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6937                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6938                         return -EINVAL;
6939                 break;
6940         case CFG80211_STA_IBSS:
6941         case CFG80211_STA_AP_STA:
6942                 /* reject any changes other than AUTHORIZED */
6943                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6944                         return -EINVAL;
6945                 break;
6946         case CFG80211_STA_TDLS_PEER_SETUP:
6947                 /* reject any changes other than AUTHORIZED or WME */
6948                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6949                                                BIT(NL80211_STA_FLAG_WME)))
6950                         return -EINVAL;
6951                 /* force (at least) rates when authorizing */
6952                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6953                     !params->link_sta_params.supported_rates)
6954                         return -EINVAL;
6955                 break;
6956         case CFG80211_STA_TDLS_PEER_ACTIVE:
6957                 /* reject any changes */
6958                 return -EINVAL;
6959         case CFG80211_STA_MESH_PEER_KERNEL:
6960                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6961                         return -EINVAL;
6962                 break;
6963         case CFG80211_STA_MESH_PEER_USER:
6964                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6965                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6966                         return -EINVAL;
6967                 break;
6968         }
6969
6970         /*
6971          * Older kernel versions ignored this attribute entirely, so don't
6972          * reject attempts to update it but mark it as unused instead so the
6973          * driver won't look at the data.
6974          */
6975         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6976             statype != CFG80211_STA_TDLS_PEER_SETUP)
6977                 params->link_sta_params.opmode_notif_used = false;
6978
6979         return 0;
6980 }
6981 EXPORT_SYMBOL(cfg80211_check_station_change);
6982
6983 /*
6984  * Get vlan interface making sure it is running and on the right wiphy.
6985  */
6986 static struct net_device *get_vlan(struct genl_info *info,
6987                                    struct cfg80211_registered_device *rdev)
6988 {
6989         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6990         struct net_device *v;
6991         int ret;
6992
6993         if (!vlanattr)
6994                 return NULL;
6995
6996         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6997         if (!v)
6998                 return ERR_PTR(-ENODEV);
6999
7000         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
7001                 ret = -EINVAL;
7002                 goto error;
7003         }
7004
7005         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
7006             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
7007             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
7008                 ret = -EINVAL;
7009                 goto error;
7010         }
7011
7012         if (!netif_running(v)) {
7013                 ret = -ENETDOWN;
7014                 goto error;
7015         }
7016
7017         return v;
7018  error:
7019         dev_put(v);
7020         return ERR_PTR(ret);
7021 }
7022
7023 static int nl80211_parse_sta_wme(struct genl_info *info,
7024                                  struct station_parameters *params)
7025 {
7026         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
7027         struct nlattr *nla;
7028         int err;
7029
7030         /* parse WME attributes if present */
7031         if (!info->attrs[NL80211_ATTR_STA_WME])
7032                 return 0;
7033
7034         nla = info->attrs[NL80211_ATTR_STA_WME];
7035         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7036                                           nl80211_sta_wme_policy,
7037                                           info->extack);
7038         if (err)
7039                 return err;
7040
7041         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7042                 params->uapsd_queues = nla_get_u8(
7043                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
7044         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7045                 return -EINVAL;
7046
7047         if (tb[NL80211_STA_WME_MAX_SP])
7048                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7049
7050         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7051                 return -EINVAL;
7052
7053         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7054
7055         return 0;
7056 }
7057
7058 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7059                                       struct station_parameters *params)
7060 {
7061         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7062                 params->supported_channels =
7063                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7064                 params->supported_channels_len =
7065                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7066                 /*
7067                  * Need to include at least one (first channel, number of
7068                  * channels) tuple for each subband (checked in policy),
7069                  * and must have proper tuples for the rest of the data as well.
7070                  */
7071                 if (params->supported_channels_len % 2)
7072                         return -EINVAL;
7073         }
7074
7075         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7076                 params->supported_oper_classes =
7077                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7078                 params->supported_oper_classes_len =
7079                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7080         }
7081         return 0;
7082 }
7083
7084 static int nl80211_set_station_tdls(struct genl_info *info,
7085                                     struct station_parameters *params)
7086 {
7087         int err;
7088         /* Dummy STA entry gets updated once the peer capabilities are known */
7089         if (info->attrs[NL80211_ATTR_PEER_AID])
7090                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7091         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7092                 params->link_sta_params.ht_capa =
7093                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7094         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7095                 params->link_sta_params.vht_capa =
7096                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7097         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7098                 params->link_sta_params.he_capa =
7099                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7100                 params->link_sta_params.he_capa_len =
7101                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7102
7103                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7104                         params->link_sta_params.eht_capa =
7105                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7106                         params->link_sta_params.eht_capa_len =
7107                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7108
7109                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7110                                                         (const u8 *)params->link_sta_params.eht_capa,
7111                                                         params->link_sta_params.eht_capa_len,
7112                                                         false))
7113                                 return -EINVAL;
7114                 }
7115         }
7116
7117         err = nl80211_parse_sta_channel_info(info, params);
7118         if (err)
7119                 return err;
7120
7121         return nl80211_parse_sta_wme(info, params);
7122 }
7123
7124 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7125                                              struct sta_txpwr *txpwr,
7126                                              bool *txpwr_set)
7127 {
7128         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7129         int idx;
7130
7131         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7132                 if (!rdev->ops->set_tx_power ||
7133                     !wiphy_ext_feature_isset(&rdev->wiphy,
7134                                          NL80211_EXT_FEATURE_STA_TX_PWR))
7135                         return -EOPNOTSUPP;
7136
7137                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7138                 txpwr->type = nla_get_u8(info->attrs[idx]);
7139
7140                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7141                         idx = NL80211_ATTR_STA_TX_POWER;
7142
7143                         if (info->attrs[idx])
7144                                 txpwr->power = nla_get_s16(info->attrs[idx]);
7145                         else
7146                                 return -EINVAL;
7147                 }
7148
7149                 *txpwr_set = true;
7150         } else {
7151                 *txpwr_set = false;
7152         }
7153
7154         return 0;
7155 }
7156
7157 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7158 {
7159         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7160         struct net_device *dev = info->user_ptr[1];
7161         struct station_parameters params;
7162         u8 *mac_addr;
7163         int err;
7164
7165         memset(&params, 0, sizeof(params));
7166
7167         if (!rdev->ops->change_station)
7168                 return -EOPNOTSUPP;
7169
7170         /*
7171          * AID and listen_interval properties can be set only for unassociated
7172          * station. Include these parameters here and will check them in
7173          * cfg80211_check_station_change().
7174          */
7175         if (info->attrs[NL80211_ATTR_STA_AID])
7176                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7177
7178         if (info->attrs[NL80211_ATTR_VLAN_ID])
7179                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7180
7181         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7182                 params.listen_interval =
7183                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7184         else
7185                 params.listen_interval = -1;
7186
7187         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7188                 params.support_p2p_ps =
7189                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7190         else
7191                 params.support_p2p_ps = -1;
7192
7193         if (!info->attrs[NL80211_ATTR_MAC])
7194                 return -EINVAL;
7195
7196         params.link_sta_params.link_id =
7197                 nl80211_link_id_or_invalid(info->attrs);
7198
7199         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7200                 /* If MLD_ADDR attribute is set then this is an MLD station
7201                  * and the MLD_ADDR attribute holds the MLD address and the
7202                  * MAC attribute holds for the LINK address.
7203                  * In that case, the link_id is also expected to be valid.
7204                  */
7205                 if (params.link_sta_params.link_id < 0)
7206                         return -EINVAL;
7207
7208                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7209                 params.link_sta_params.mld_mac = mac_addr;
7210                 params.link_sta_params.link_mac =
7211                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7212                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7213                         return -EINVAL;
7214         } else {
7215                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7216         }
7217
7218
7219         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7220                 params.link_sta_params.supported_rates =
7221                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7222                 params.link_sta_params.supported_rates_len =
7223                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7224         }
7225
7226         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7227                 params.capability =
7228                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7229                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7230         }
7231
7232         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7233                 params.ext_capab =
7234                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7235                 params.ext_capab_len =
7236                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7237         }
7238
7239         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7240                 return -EINVAL;
7241
7242         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7243                 params.plink_action =
7244                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7245
7246         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7247                 params.plink_state =
7248                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7249                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7250                         params.peer_aid = nla_get_u16(
7251                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7252                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7253         }
7254
7255         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7256                 params.local_pm = nla_get_u32(
7257                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7258
7259         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7260                 params.link_sta_params.opmode_notif_used = true;
7261                 params.link_sta_params.opmode_notif =
7262                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7263         }
7264
7265         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7266                 params.link_sta_params.he_6ghz_capa =
7267                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7268
7269         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7270                 params.airtime_weight =
7271                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7272
7273         if (params.airtime_weight &&
7274             !wiphy_ext_feature_isset(&rdev->wiphy,
7275                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7276                 return -EOPNOTSUPP;
7277
7278         err = nl80211_parse_sta_txpower_setting(info,
7279                                                 &params.link_sta_params.txpwr,
7280                                                 &params.link_sta_params.txpwr_set);
7281         if (err)
7282                 return err;
7283
7284         /* Include parameters for TDLS peer (will check later) */
7285         err = nl80211_set_station_tdls(info, &params);
7286         if (err)
7287                 return err;
7288
7289         params.vlan = get_vlan(info, rdev);
7290         if (IS_ERR(params.vlan))
7291                 return PTR_ERR(params.vlan);
7292
7293         switch (dev->ieee80211_ptr->iftype) {
7294         case NL80211_IFTYPE_AP:
7295         case NL80211_IFTYPE_AP_VLAN:
7296         case NL80211_IFTYPE_P2P_GO:
7297         case NL80211_IFTYPE_P2P_CLIENT:
7298         case NL80211_IFTYPE_STATION:
7299         case NL80211_IFTYPE_ADHOC:
7300         case NL80211_IFTYPE_MESH_POINT:
7301                 break;
7302         default:
7303                 err = -EOPNOTSUPP;
7304                 goto out_put_vlan;
7305         }
7306
7307         /* driver will call cfg80211_check_station_change() */
7308         wdev_lock(dev->ieee80211_ptr);
7309         err = rdev_change_station(rdev, dev, mac_addr, &params);
7310         wdev_unlock(dev->ieee80211_ptr);
7311
7312  out_put_vlan:
7313         dev_put(params.vlan);
7314
7315         return err;
7316 }
7317
7318 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7319 {
7320         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7321         int err;
7322         struct net_device *dev = info->user_ptr[1];
7323         struct wireless_dev *wdev = dev->ieee80211_ptr;
7324         struct station_parameters params;
7325         u8 *mac_addr = NULL;
7326         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7327                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7328
7329         memset(&params, 0, sizeof(params));
7330
7331         if (!rdev->ops->add_station)
7332                 return -EOPNOTSUPP;
7333
7334         if (!info->attrs[NL80211_ATTR_MAC])
7335                 return -EINVAL;
7336
7337         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7338                 return -EINVAL;
7339
7340         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7341                 return -EINVAL;
7342
7343         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7344             !info->attrs[NL80211_ATTR_PEER_AID])
7345                 return -EINVAL;
7346
7347         params.link_sta_params.link_id =
7348                 nl80211_link_id_or_invalid(info->attrs);
7349
7350         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7351                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7352                 params.link_sta_params.mld_mac = mac_addr;
7353                 params.link_sta_params.link_mac =
7354                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7355                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7356                         return -EINVAL;
7357         } else {
7358                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7359         }
7360
7361         params.link_sta_params.supported_rates =
7362                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7363         params.link_sta_params.supported_rates_len =
7364                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7365         params.listen_interval =
7366                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7367
7368         if (info->attrs[NL80211_ATTR_VLAN_ID])
7369                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7370
7371         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7372                 params.support_p2p_ps =
7373                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7374         } else {
7375                 /*
7376                  * if not specified, assume it's supported for P2P GO interface,
7377                  * and is NOT supported for AP interface
7378                  */
7379                 params.support_p2p_ps =
7380                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7381         }
7382
7383         if (info->attrs[NL80211_ATTR_PEER_AID])
7384                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7385         else
7386                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7387
7388         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7389                 params.capability =
7390                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7391                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7392         }
7393
7394         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7395                 params.ext_capab =
7396                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7397                 params.ext_capab_len =
7398                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7399         }
7400
7401         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7402                 params.link_sta_params.ht_capa =
7403                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7404
7405         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7406                 params.link_sta_params.vht_capa =
7407                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7408
7409         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7410                 params.link_sta_params.he_capa =
7411                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7412                 params.link_sta_params.he_capa_len =
7413                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7414
7415                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7416                         params.link_sta_params.eht_capa =
7417                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7418                         params.link_sta_params.eht_capa_len =
7419                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7420
7421                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7422                                                         (const u8 *)params.link_sta_params.eht_capa,
7423                                                         params.link_sta_params.eht_capa_len,
7424                                                         false))
7425                                 return -EINVAL;
7426                 }
7427         }
7428
7429         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7430                 params.link_sta_params.he_6ghz_capa =
7431                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7432
7433         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7434                 params.link_sta_params.opmode_notif_used = true;
7435                 params.link_sta_params.opmode_notif =
7436                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7437         }
7438
7439         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7440                 params.plink_action =
7441                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7442
7443         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7444                 params.airtime_weight =
7445                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7446
7447         if (params.airtime_weight &&
7448             !wiphy_ext_feature_isset(&rdev->wiphy,
7449                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7450                 return -EOPNOTSUPP;
7451
7452         err = nl80211_parse_sta_txpower_setting(info,
7453                                                 &params.link_sta_params.txpwr,
7454                                                 &params.link_sta_params.txpwr_set);
7455         if (err)
7456                 return err;
7457
7458         err = nl80211_parse_sta_channel_info(info, &params);
7459         if (err)
7460                 return err;
7461
7462         err = nl80211_parse_sta_wme(info, &params);
7463         if (err)
7464                 return err;
7465
7466         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7467                 return -EINVAL;
7468
7469         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7470          * as userspace might just pass through the capabilities from the IEs
7471          * directly, rather than enforcing this restriction and returning an
7472          * error in this case.
7473          */
7474         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7475                 params.link_sta_params.ht_capa = NULL;
7476                 params.link_sta_params.vht_capa = NULL;
7477
7478                 /* HE and EHT require WME */
7479                 if (params.link_sta_params.he_capa_len ||
7480                     params.link_sta_params.he_6ghz_capa ||
7481                     params.link_sta_params.eht_capa_len)
7482                         return -EINVAL;
7483         }
7484
7485         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7486         if (params.link_sta_params.he_6ghz_capa &&
7487             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7488                 return -EINVAL;
7489
7490         /* When you run into this, adjust the code below for the new flag */
7491         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7492
7493         switch (dev->ieee80211_ptr->iftype) {
7494         case NL80211_IFTYPE_AP:
7495         case NL80211_IFTYPE_AP_VLAN:
7496         case NL80211_IFTYPE_P2P_GO:
7497                 /* ignore WME attributes if iface/sta is not capable */
7498                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7499                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7500                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7501
7502                 /* TDLS peers cannot be added */
7503                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7504                     info->attrs[NL80211_ATTR_PEER_AID])
7505                         return -EINVAL;
7506                 /* but don't bother the driver with it */
7507                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7508
7509                 /* allow authenticated/associated only if driver handles it */
7510                 if (!(rdev->wiphy.features &
7511                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7512                     params.sta_flags_mask & auth_assoc)
7513                         return -EINVAL;
7514
7515                 /* Older userspace, or userspace wanting to be compatible with
7516                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7517                  * and assoc flags in the mask, but assumes the station will be
7518                  * added as associated anyway since this was the required driver
7519                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7520                  * introduced.
7521                  * In order to not bother drivers with this quirk in the API
7522                  * set the flags in both the mask and set for new stations in
7523                  * this case.
7524                  */
7525                 if (!(params.sta_flags_mask & auth_assoc)) {
7526                         params.sta_flags_mask |= auth_assoc;
7527                         params.sta_flags_set |= auth_assoc;
7528                 }
7529
7530                 /* must be last in here for error handling */
7531                 params.vlan = get_vlan(info, rdev);
7532                 if (IS_ERR(params.vlan))
7533                         return PTR_ERR(params.vlan);
7534                 break;
7535         case NL80211_IFTYPE_MESH_POINT:
7536                 /* ignore uAPSD data */
7537                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7538
7539                 /* associated is disallowed */
7540                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7541                         return -EINVAL;
7542                 /* TDLS peers cannot be added */
7543                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7544                     info->attrs[NL80211_ATTR_PEER_AID])
7545                         return -EINVAL;
7546                 break;
7547         case NL80211_IFTYPE_STATION:
7548         case NL80211_IFTYPE_P2P_CLIENT:
7549                 /* ignore uAPSD data */
7550                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7551
7552                 /* these are disallowed */
7553                 if (params.sta_flags_mask &
7554                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7555                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7556                         return -EINVAL;
7557                 /* Only TDLS peers can be added */
7558                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7559                         return -EINVAL;
7560                 /* Can only add if TDLS ... */
7561                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7562                         return -EOPNOTSUPP;
7563                 /* ... with external setup is supported */
7564                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7565                         return -EOPNOTSUPP;
7566                 /*
7567                  * Older wpa_supplicant versions always mark the TDLS peer
7568                  * as authorized, but it shouldn't yet be.
7569                  */
7570                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7571                 break;
7572         default:
7573                 return -EOPNOTSUPP;
7574         }
7575
7576         /* be aware of params.vlan when changing code here */
7577
7578         wdev_lock(dev->ieee80211_ptr);
7579         if (wdev->valid_links) {
7580                 if (params.link_sta_params.link_id < 0) {
7581                         err = -EINVAL;
7582                         goto out;
7583                 }
7584                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7585                         err = -ENOLINK;
7586                         goto out;
7587                 }
7588         } else {
7589                 if (params.link_sta_params.link_id >= 0) {
7590                         err = -EINVAL;
7591                         goto out;
7592                 }
7593         }
7594         err = rdev_add_station(rdev, dev, mac_addr, &params);
7595 out:
7596         wdev_unlock(dev->ieee80211_ptr);
7597         dev_put(params.vlan);
7598         return err;
7599 }
7600
7601 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7602 {
7603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7604         struct net_device *dev = info->user_ptr[1];
7605         struct station_del_parameters params;
7606         int ret;
7607
7608         memset(&params, 0, sizeof(params));
7609
7610         if (info->attrs[NL80211_ATTR_MAC])
7611                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7612
7613         switch (dev->ieee80211_ptr->iftype) {
7614         case NL80211_IFTYPE_AP:
7615         case NL80211_IFTYPE_AP_VLAN:
7616         case NL80211_IFTYPE_MESH_POINT:
7617         case NL80211_IFTYPE_P2P_GO:
7618                 /* always accept these */
7619                 break;
7620         case NL80211_IFTYPE_ADHOC:
7621                 /* conditionally accept */
7622                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7623                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7624                         break;
7625                 return -EINVAL;
7626         default:
7627                 return -EINVAL;
7628         }
7629
7630         if (!rdev->ops->del_station)
7631                 return -EOPNOTSUPP;
7632
7633         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7634                 params.subtype =
7635                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7636                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7637                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7638                         return -EINVAL;
7639         } else {
7640                 /* Default to Deauthentication frame */
7641                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7642         }
7643
7644         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7645                 params.reason_code =
7646                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7647                 if (params.reason_code == 0)
7648                         return -EINVAL; /* 0 is reserved */
7649         } else {
7650                 /* Default to reason code 2 */
7651                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7652         }
7653
7654         wdev_lock(dev->ieee80211_ptr);
7655         ret = rdev_del_station(rdev, dev, &params);
7656         wdev_unlock(dev->ieee80211_ptr);
7657
7658         return ret;
7659 }
7660
7661 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7662                                 int flags, struct net_device *dev,
7663                                 u8 *dst, u8 *next_hop,
7664                                 struct mpath_info *pinfo)
7665 {
7666         void *hdr;
7667         struct nlattr *pinfoattr;
7668
7669         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7670         if (!hdr)
7671                 return -1;
7672
7673         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7674             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7675             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7676             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7677                 goto nla_put_failure;
7678
7679         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7680         if (!pinfoattr)
7681                 goto nla_put_failure;
7682         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7683             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7684                         pinfo->frame_qlen))
7685                 goto nla_put_failure;
7686         if (((pinfo->filled & MPATH_INFO_SN) &&
7687              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7688             ((pinfo->filled & MPATH_INFO_METRIC) &&
7689              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7690                          pinfo->metric)) ||
7691             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7692              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7693                          pinfo->exptime)) ||
7694             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7695              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7696                         pinfo->flags)) ||
7697             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7698              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7699                          pinfo->discovery_timeout)) ||
7700             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7701              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7702                         pinfo->discovery_retries)) ||
7703             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7704              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7705                         pinfo->hop_count)) ||
7706             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7707              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7708                          pinfo->path_change_count)))
7709                 goto nla_put_failure;
7710
7711         nla_nest_end(msg, pinfoattr);
7712
7713         genlmsg_end(msg, hdr);
7714         return 0;
7715
7716  nla_put_failure:
7717         genlmsg_cancel(msg, hdr);
7718         return -EMSGSIZE;
7719 }
7720
7721 static int nl80211_dump_mpath(struct sk_buff *skb,
7722                               struct netlink_callback *cb)
7723 {
7724         struct mpath_info pinfo;
7725         struct cfg80211_registered_device *rdev;
7726         struct wireless_dev *wdev;
7727         u8 dst[ETH_ALEN];
7728         u8 next_hop[ETH_ALEN];
7729         int path_idx = cb->args[2];
7730         int err;
7731
7732         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7733         if (err)
7734                 return err;
7735         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7736         __acquire(&rdev->wiphy.mtx);
7737
7738         if (!rdev->ops->dump_mpath) {
7739                 err = -EOPNOTSUPP;
7740                 goto out_err;
7741         }
7742
7743         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7744                 err = -EOPNOTSUPP;
7745                 goto out_err;
7746         }
7747
7748         while (1) {
7749                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7750                                       next_hop, &pinfo);
7751                 if (err == -ENOENT)
7752                         break;
7753                 if (err)
7754                         goto out_err;
7755
7756                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7757                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7758                                        wdev->netdev, dst, next_hop,
7759                                        &pinfo) < 0)
7760                         goto out;
7761
7762                 path_idx++;
7763         }
7764
7765  out:
7766         cb->args[2] = path_idx;
7767         err = skb->len;
7768  out_err:
7769         wiphy_unlock(&rdev->wiphy);
7770         return err;
7771 }
7772
7773 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7774 {
7775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7776         int err;
7777         struct net_device *dev = info->user_ptr[1];
7778         struct mpath_info pinfo;
7779         struct sk_buff *msg;
7780         u8 *dst = NULL;
7781         u8 next_hop[ETH_ALEN];
7782
7783         memset(&pinfo, 0, sizeof(pinfo));
7784
7785         if (!info->attrs[NL80211_ATTR_MAC])
7786                 return -EINVAL;
7787
7788         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7789
7790         if (!rdev->ops->get_mpath)
7791                 return -EOPNOTSUPP;
7792
7793         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7794                 return -EOPNOTSUPP;
7795
7796         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7797         if (err)
7798                 return err;
7799
7800         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7801         if (!msg)
7802                 return -ENOMEM;
7803
7804         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7805                                  dev, dst, next_hop, &pinfo) < 0) {
7806                 nlmsg_free(msg);
7807                 return -ENOBUFS;
7808         }
7809
7810         return genlmsg_reply(msg, info);
7811 }
7812
7813 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7814 {
7815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7816         struct net_device *dev = info->user_ptr[1];
7817         u8 *dst = NULL;
7818         u8 *next_hop = NULL;
7819
7820         if (!info->attrs[NL80211_ATTR_MAC])
7821                 return -EINVAL;
7822
7823         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7824                 return -EINVAL;
7825
7826         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7827         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7828
7829         if (!rdev->ops->change_mpath)
7830                 return -EOPNOTSUPP;
7831
7832         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7833                 return -EOPNOTSUPP;
7834
7835         return rdev_change_mpath(rdev, dev, dst, next_hop);
7836 }
7837
7838 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7839 {
7840         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7841         struct net_device *dev = info->user_ptr[1];
7842         u8 *dst = NULL;
7843         u8 *next_hop = NULL;
7844
7845         if (!info->attrs[NL80211_ATTR_MAC])
7846                 return -EINVAL;
7847
7848         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7849                 return -EINVAL;
7850
7851         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7852         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7853
7854         if (!rdev->ops->add_mpath)
7855                 return -EOPNOTSUPP;
7856
7857         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7858                 return -EOPNOTSUPP;
7859
7860         return rdev_add_mpath(rdev, dev, dst, next_hop);
7861 }
7862
7863 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7864 {
7865         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7866         struct net_device *dev = info->user_ptr[1];
7867         u8 *dst = NULL;
7868
7869         if (info->attrs[NL80211_ATTR_MAC])
7870                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7871
7872         if (!rdev->ops->del_mpath)
7873                 return -EOPNOTSUPP;
7874
7875         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7876                 return -EOPNOTSUPP;
7877
7878         return rdev_del_mpath(rdev, dev, dst);
7879 }
7880
7881 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7882 {
7883         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7884         int err;
7885         struct net_device *dev = info->user_ptr[1];
7886         struct mpath_info pinfo;
7887         struct sk_buff *msg;
7888         u8 *dst = NULL;
7889         u8 mpp[ETH_ALEN];
7890
7891         memset(&pinfo, 0, sizeof(pinfo));
7892
7893         if (!info->attrs[NL80211_ATTR_MAC])
7894                 return -EINVAL;
7895
7896         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7897
7898         if (!rdev->ops->get_mpp)
7899                 return -EOPNOTSUPP;
7900
7901         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7902                 return -EOPNOTSUPP;
7903
7904         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7905         if (err)
7906                 return err;
7907
7908         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7909         if (!msg)
7910                 return -ENOMEM;
7911
7912         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7913                                dev, dst, mpp, &pinfo) < 0) {
7914                 nlmsg_free(msg);
7915                 return -ENOBUFS;
7916         }
7917
7918         return genlmsg_reply(msg, info);
7919 }
7920
7921 static int nl80211_dump_mpp(struct sk_buff *skb,
7922                             struct netlink_callback *cb)
7923 {
7924         struct mpath_info pinfo;
7925         struct cfg80211_registered_device *rdev;
7926         struct wireless_dev *wdev;
7927         u8 dst[ETH_ALEN];
7928         u8 mpp[ETH_ALEN];
7929         int path_idx = cb->args[2];
7930         int err;
7931
7932         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7933         if (err)
7934                 return err;
7935         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7936         __acquire(&rdev->wiphy.mtx);
7937
7938         if (!rdev->ops->dump_mpp) {
7939                 err = -EOPNOTSUPP;
7940                 goto out_err;
7941         }
7942
7943         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7944                 err = -EOPNOTSUPP;
7945                 goto out_err;
7946         }
7947
7948         while (1) {
7949                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7950                                     mpp, &pinfo);
7951                 if (err == -ENOENT)
7952                         break;
7953                 if (err)
7954                         goto out_err;
7955
7956                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7957                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7958                                        wdev->netdev, dst, mpp,
7959                                        &pinfo) < 0)
7960                         goto out;
7961
7962                 path_idx++;
7963         }
7964
7965  out:
7966         cb->args[2] = path_idx;
7967         err = skb->len;
7968  out_err:
7969         wiphy_unlock(&rdev->wiphy);
7970         return err;
7971 }
7972
7973 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7974 {
7975         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7976         struct net_device *dev = info->user_ptr[1];
7977         struct wireless_dev *wdev = dev->ieee80211_ptr;
7978         struct bss_parameters params;
7979         int err;
7980
7981         memset(&params, 0, sizeof(params));
7982         params.link_id = nl80211_link_id_or_invalid(info->attrs);
7983         /* default to not changing parameters */
7984         params.use_cts_prot = -1;
7985         params.use_short_preamble = -1;
7986         params.use_short_slot_time = -1;
7987         params.ap_isolate = -1;
7988         params.ht_opmode = -1;
7989         params.p2p_ctwindow = -1;
7990         params.p2p_opp_ps = -1;
7991
7992         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7993                 params.use_cts_prot =
7994                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7995         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7996                 params.use_short_preamble =
7997                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7998         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7999                 params.use_short_slot_time =
8000                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
8001         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8002                 params.basic_rates =
8003                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8004                 params.basic_rates_len =
8005                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8006         }
8007         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
8008                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
8009         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
8010                 params.ht_opmode =
8011                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
8012
8013         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
8014                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8015                         return -EINVAL;
8016                 params.p2p_ctwindow =
8017                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
8018                 if (params.p2p_ctwindow != 0 &&
8019                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
8020                         return -EINVAL;
8021         }
8022
8023         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
8024                 u8 tmp;
8025
8026                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8027                         return -EINVAL;
8028                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
8029                 params.p2p_opp_ps = tmp;
8030                 if (params.p2p_opp_ps &&
8031                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8032                         return -EINVAL;
8033         }
8034
8035         if (!rdev->ops->change_bss)
8036                 return -EOPNOTSUPP;
8037
8038         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8039             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8040                 return -EOPNOTSUPP;
8041
8042         wdev_lock(wdev);
8043         err = rdev_change_bss(rdev, dev, &params);
8044         wdev_unlock(wdev);
8045
8046         return err;
8047 }
8048
8049 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8050 {
8051         char *data = NULL;
8052         bool is_indoor;
8053         enum nl80211_user_reg_hint_type user_reg_hint_type;
8054         u32 owner_nlportid;
8055
8056         /*
8057          * You should only get this when cfg80211 hasn't yet initialized
8058          * completely when built-in to the kernel right between the time
8059          * window between nl80211_init() and regulatory_init(), if that is
8060          * even possible.
8061          */
8062         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8063                 return -EINPROGRESS;
8064
8065         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8066                 user_reg_hint_type =
8067                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8068         else
8069                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8070
8071         switch (user_reg_hint_type) {
8072         case NL80211_USER_REG_HINT_USER:
8073         case NL80211_USER_REG_HINT_CELL_BASE:
8074                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8075                         return -EINVAL;
8076
8077                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8078                 return regulatory_hint_user(data, user_reg_hint_type);
8079         case NL80211_USER_REG_HINT_INDOOR:
8080                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8081                         owner_nlportid = info->snd_portid;
8082                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8083                 } else {
8084                         owner_nlportid = 0;
8085                         is_indoor = true;
8086                 }
8087
8088                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
8089         default:
8090                 return -EINVAL;
8091         }
8092 }
8093
8094 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8095 {
8096         return reg_reload_regdb();
8097 }
8098
8099 static int nl80211_get_mesh_config(struct sk_buff *skb,
8100                                    struct genl_info *info)
8101 {
8102         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8103         struct net_device *dev = info->user_ptr[1];
8104         struct wireless_dev *wdev = dev->ieee80211_ptr;
8105         struct mesh_config cur_params;
8106         int err = 0;
8107         void *hdr;
8108         struct nlattr *pinfoattr;
8109         struct sk_buff *msg;
8110
8111         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8112                 return -EOPNOTSUPP;
8113
8114         if (!rdev->ops->get_mesh_config)
8115                 return -EOPNOTSUPP;
8116
8117         wdev_lock(wdev);
8118         /* If not connected, get default parameters */
8119         if (!wdev->u.mesh.id_len)
8120                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8121         else
8122                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8123         wdev_unlock(wdev);
8124
8125         if (err)
8126                 return err;
8127
8128         /* Draw up a netlink message to send back */
8129         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8130         if (!msg)
8131                 return -ENOMEM;
8132         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8133                              NL80211_CMD_GET_MESH_CONFIG);
8134         if (!hdr)
8135                 goto out;
8136         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8137         if (!pinfoattr)
8138                 goto nla_put_failure;
8139         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8140             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8141                         cur_params.dot11MeshRetryTimeout) ||
8142             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8143                         cur_params.dot11MeshConfirmTimeout) ||
8144             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8145                         cur_params.dot11MeshHoldingTimeout) ||
8146             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8147                         cur_params.dot11MeshMaxPeerLinks) ||
8148             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8149                        cur_params.dot11MeshMaxRetries) ||
8150             nla_put_u8(msg, NL80211_MESHCONF_TTL,
8151                        cur_params.dot11MeshTTL) ||
8152             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8153                        cur_params.element_ttl) ||
8154             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8155                        cur_params.auto_open_plinks) ||
8156             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8157                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8158             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8159                        cur_params.dot11MeshHWMPmaxPREQretries) ||
8160             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8161                         cur_params.path_refresh_time) ||
8162             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8163                         cur_params.min_discovery_timeout) ||
8164             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8165                         cur_params.dot11MeshHWMPactivePathTimeout) ||
8166             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8167                         cur_params.dot11MeshHWMPpreqMinInterval) ||
8168             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8169                         cur_params.dot11MeshHWMPperrMinInterval) ||
8170             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8171                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8172             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8173                        cur_params.dot11MeshHWMPRootMode) ||
8174             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8175                         cur_params.dot11MeshHWMPRannInterval) ||
8176             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8177                        cur_params.dot11MeshGateAnnouncementProtocol) ||
8178             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8179                        cur_params.dot11MeshForwarding) ||
8180             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8181                         cur_params.rssi_threshold) ||
8182             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8183                         cur_params.ht_opmode) ||
8184             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8185                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8186             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8187                         cur_params.dot11MeshHWMProotInterval) ||
8188             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8189                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8190             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8191                         cur_params.power_mode) ||
8192             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8193                         cur_params.dot11MeshAwakeWindowDuration) ||
8194             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8195                         cur_params.plink_timeout) ||
8196             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8197                        cur_params.dot11MeshConnectedToMeshGate) ||
8198             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8199                        cur_params.dot11MeshNolearn) ||
8200             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8201                        cur_params.dot11MeshConnectedToAuthServer))
8202                 goto nla_put_failure;
8203         nla_nest_end(msg, pinfoattr);
8204         genlmsg_end(msg, hdr);
8205         return genlmsg_reply(msg, info);
8206
8207  nla_put_failure:
8208  out:
8209         nlmsg_free(msg);
8210         return -ENOBUFS;
8211 }
8212
8213 static const struct nla_policy
8214 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8215         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8216                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8217         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8218                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8219         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8220                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8221         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8222                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8223         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8224         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8225         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8226         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8227         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8228                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8229         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8230         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8231         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8232         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8233         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8234                 NLA_POLICY_MIN(NLA_U16, 1),
8235         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8236                 NLA_POLICY_MIN(NLA_U16, 1),
8237         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8238                 NLA_POLICY_MIN(NLA_U16, 1),
8239         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8240         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8241                 NLA_POLICY_MIN(NLA_U16, 1),
8242         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8243         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8244         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8245                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8246         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8247         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8248         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8249                 NLA_POLICY_MIN(NLA_U16, 1),
8250         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8251                 NLA_POLICY_MIN(NLA_U16, 1),
8252         [NL80211_MESHCONF_POWER_MODE] =
8253                 NLA_POLICY_RANGE(NLA_U32,
8254                                  NL80211_MESH_POWER_ACTIVE,
8255                                  NL80211_MESH_POWER_MAX),
8256         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8257         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8258         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8259         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8260         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8261 };
8262
8263 static const struct nla_policy
8264         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8265         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8266         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8267         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8268         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8269         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8270         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8271         [NL80211_MESH_SETUP_IE] =
8272                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8273                                        IEEE80211_MAX_DATA_LEN),
8274         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8275 };
8276
8277 static int nl80211_parse_mesh_config(struct genl_info *info,
8278                                      struct mesh_config *cfg,
8279                                      u32 *mask_out)
8280 {
8281         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8282         u32 mask = 0;
8283         u16 ht_opmode;
8284
8285 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8286 do {                                                                    \
8287         if (tb[attr]) {                                                 \
8288                 cfg->param = fn(tb[attr]);                              \
8289                 mask |= BIT((attr) - 1);                                \
8290         }                                                               \
8291 } while (0)
8292
8293         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8294                 return -EINVAL;
8295         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8296                 return -EINVAL;
8297
8298         /* This makes sure that there aren't more than 32 mesh config
8299          * parameters (otherwise our bitfield scheme would not work.) */
8300         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8301
8302         /* Fill in the params struct */
8303         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8304                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8305         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8306                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8307                                   nla_get_u16);
8308         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8309                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8310                                   nla_get_u16);
8311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8312                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8313                                   nla_get_u16);
8314         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8315                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8316         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8317                                   NL80211_MESHCONF_TTL, nla_get_u8);
8318         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8319                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8321                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8322                                   nla_get_u8);
8323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8324                                   mask,
8325                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8326                                   nla_get_u32);
8327         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8328                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8329                                   nla_get_u8);
8330         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8331                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8332                                   nla_get_u32);
8333         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8334             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8335                 return -EINVAL;
8336         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8337                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8338                                   nla_get_u16);
8339         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8340                                   mask,
8341                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8342                                   nla_get_u32);
8343         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8344             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8345              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8346                 return -EINVAL;
8347         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8348                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8349                                   nla_get_u16);
8350         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8351                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8352                                   nla_get_u16);
8353         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8354                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8355                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8356                                   nla_get_u16);
8357         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8358                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8359         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8360                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8361                                   nla_get_u16);
8362         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8363                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8364                                   nla_get_u8);
8365         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8366                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8367         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8368                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8369                                   nla_get_s32);
8370         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8371                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8372                                   nla_get_u8);
8373         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8374                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8375                                   nla_get_u8);
8376         /*
8377          * Check HT operation mode based on
8378          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8379          */
8380         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8381                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8382
8383                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8384                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8385                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8386                         return -EINVAL;
8387
8388                 /* NON_HT_STA bit is reserved, but some programs set it */
8389                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8390
8391                 cfg->ht_opmode = ht_opmode;
8392                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8393         }
8394         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8395                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8396                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8397                                   nla_get_u32);
8398         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8399             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8400              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8401                 return -EINVAL;
8402         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8403                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8404                                   nla_get_u16);
8405         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8406                                   mask,
8407                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8408                                   nla_get_u16);
8409         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8410                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8411         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8412                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8413         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8414                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8415         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8416                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8417         if (mask_out)
8418                 *mask_out = mask;
8419
8420         return 0;
8421
8422 #undef FILL_IN_MESH_PARAM_IF_SET
8423 }
8424
8425 static int nl80211_parse_mesh_setup(struct genl_info *info,
8426                                      struct mesh_setup *setup)
8427 {
8428         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8429         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8430
8431         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8432                 return -EINVAL;
8433         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8434                 return -EINVAL;
8435
8436         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8437                 setup->sync_method =
8438                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8439                  IEEE80211_SYNC_METHOD_VENDOR :
8440                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8441
8442         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8443                 setup->path_sel_proto =
8444                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8445                  IEEE80211_PATH_PROTOCOL_VENDOR :
8446                  IEEE80211_PATH_PROTOCOL_HWMP;
8447
8448         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8449                 setup->path_metric =
8450                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8451                  IEEE80211_PATH_METRIC_VENDOR :
8452                  IEEE80211_PATH_METRIC_AIRTIME;
8453
8454         if (tb[NL80211_MESH_SETUP_IE]) {
8455                 struct nlattr *ieattr =
8456                         tb[NL80211_MESH_SETUP_IE];
8457                 setup->ie = nla_data(ieattr);
8458                 setup->ie_len = nla_len(ieattr);
8459         }
8460         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8461             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8462                 return -EINVAL;
8463         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8464         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8465         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8466         if (setup->is_secure)
8467                 setup->user_mpm = true;
8468
8469         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8470                 if (!setup->user_mpm)
8471                         return -EINVAL;
8472                 setup->auth_id =
8473                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8474         }
8475
8476         return 0;
8477 }
8478
8479 static int nl80211_update_mesh_config(struct sk_buff *skb,
8480                                       struct genl_info *info)
8481 {
8482         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8483         struct net_device *dev = info->user_ptr[1];
8484         struct wireless_dev *wdev = dev->ieee80211_ptr;
8485         struct mesh_config cfg;
8486         u32 mask;
8487         int err;
8488
8489         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8490                 return -EOPNOTSUPP;
8491
8492         if (!rdev->ops->update_mesh_config)
8493                 return -EOPNOTSUPP;
8494
8495         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8496         if (err)
8497                 return err;
8498
8499         wdev_lock(wdev);
8500         if (!wdev->u.mesh.id_len)
8501                 err = -ENOLINK;
8502
8503         if (!err)
8504                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8505
8506         wdev_unlock(wdev);
8507
8508         return err;
8509 }
8510
8511 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8512                               struct sk_buff *msg)
8513 {
8514         struct nlattr *nl_reg_rules;
8515         unsigned int i;
8516
8517         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8518             (regdom->dfs_region &&
8519              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8520                 goto nla_put_failure;
8521
8522         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8523         if (!nl_reg_rules)
8524                 goto nla_put_failure;
8525
8526         for (i = 0; i < regdom->n_reg_rules; i++) {
8527                 struct nlattr *nl_reg_rule;
8528                 const struct ieee80211_reg_rule *reg_rule;
8529                 const struct ieee80211_freq_range *freq_range;
8530                 const struct ieee80211_power_rule *power_rule;
8531                 unsigned int max_bandwidth_khz;
8532
8533                 reg_rule = &regdom->reg_rules[i];
8534                 freq_range = &reg_rule->freq_range;
8535                 power_rule = &reg_rule->power_rule;
8536
8537                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8538                 if (!nl_reg_rule)
8539                         goto nla_put_failure;
8540
8541                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8542                 if (!max_bandwidth_khz)
8543                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8544                                                                   reg_rule);
8545
8546                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8547                                 reg_rule->flags) ||
8548                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8549                                 freq_range->start_freq_khz) ||
8550                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8551                                 freq_range->end_freq_khz) ||
8552                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8553                                 max_bandwidth_khz) ||
8554                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8555                                 power_rule->max_antenna_gain) ||
8556                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8557                                 power_rule->max_eirp) ||
8558                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8559                                 reg_rule->dfs_cac_ms))
8560                         goto nla_put_failure;
8561
8562                 nla_nest_end(msg, nl_reg_rule);
8563         }
8564
8565         nla_nest_end(msg, nl_reg_rules);
8566         return 0;
8567
8568 nla_put_failure:
8569         return -EMSGSIZE;
8570 }
8571
8572 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8573 {
8574         const struct ieee80211_regdomain *regdom = NULL;
8575         struct cfg80211_registered_device *rdev;
8576         struct wiphy *wiphy = NULL;
8577         struct sk_buff *msg;
8578         int err = -EMSGSIZE;
8579         void *hdr;
8580
8581         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8582         if (!msg)
8583                 return -ENOBUFS;
8584
8585         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8586                              NL80211_CMD_GET_REG);
8587         if (!hdr)
8588                 goto put_failure;
8589
8590         rtnl_lock();
8591
8592         if (info->attrs[NL80211_ATTR_WIPHY]) {
8593                 bool self_managed;
8594
8595                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8596                 if (IS_ERR(rdev)) {
8597                         err = PTR_ERR(rdev);
8598                         goto nla_put_failure;
8599                 }
8600
8601                 wiphy = &rdev->wiphy;
8602                 self_managed = wiphy->regulatory_flags &
8603                                REGULATORY_WIPHY_SELF_MANAGED;
8604
8605                 rcu_read_lock();
8606
8607                 regdom = get_wiphy_regdom(wiphy);
8608
8609                 /* a self-managed-reg device must have a private regdom */
8610                 if (WARN_ON(!regdom && self_managed)) {
8611                         err = -EINVAL;
8612                         goto nla_put_failure_rcu;
8613                 }
8614
8615                 if (regdom &&
8616                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8617                         goto nla_put_failure_rcu;
8618         } else {
8619                 rcu_read_lock();
8620         }
8621
8622         if (!wiphy && reg_last_request_cell_base() &&
8623             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8624                         NL80211_USER_REG_HINT_CELL_BASE))
8625                 goto nla_put_failure_rcu;
8626
8627         if (!regdom)
8628                 regdom = rcu_dereference(cfg80211_regdomain);
8629
8630         if (nl80211_put_regdom(regdom, msg))
8631                 goto nla_put_failure_rcu;
8632
8633         rcu_read_unlock();
8634
8635         genlmsg_end(msg, hdr);
8636         rtnl_unlock();
8637         return genlmsg_reply(msg, info);
8638
8639 nla_put_failure_rcu:
8640         rcu_read_unlock();
8641 nla_put_failure:
8642         rtnl_unlock();
8643 put_failure:
8644         nlmsg_free(msg);
8645         return err;
8646 }
8647
8648 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8649                                u32 seq, int flags, struct wiphy *wiphy,
8650                                const struct ieee80211_regdomain *regdom)
8651 {
8652         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8653                                    NL80211_CMD_GET_REG);
8654
8655         if (!hdr)
8656                 return -1;
8657
8658         genl_dump_check_consistent(cb, hdr);
8659
8660         if (nl80211_put_regdom(regdom, msg))
8661                 goto nla_put_failure;
8662
8663         if (!wiphy && reg_last_request_cell_base() &&
8664             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8665                         NL80211_USER_REG_HINT_CELL_BASE))
8666                 goto nla_put_failure;
8667
8668         if (wiphy &&
8669             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8670                 goto nla_put_failure;
8671
8672         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8673             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8674                 goto nla_put_failure;
8675
8676         genlmsg_end(msg, hdr);
8677         return 0;
8678
8679 nla_put_failure:
8680         genlmsg_cancel(msg, hdr);
8681         return -EMSGSIZE;
8682 }
8683
8684 static int nl80211_get_reg_dump(struct sk_buff *skb,
8685                                 struct netlink_callback *cb)
8686 {
8687         const struct ieee80211_regdomain *regdom = NULL;
8688         struct cfg80211_registered_device *rdev;
8689         int err, reg_idx, start = cb->args[2];
8690
8691         rcu_read_lock();
8692
8693         if (cfg80211_regdomain && start == 0) {
8694                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8695                                           NLM_F_MULTI, NULL,
8696                                           rcu_dereference(cfg80211_regdomain));
8697                 if (err < 0)
8698                         goto out_err;
8699         }
8700
8701         /* the global regdom is idx 0 */
8702         reg_idx = 1;
8703         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8704                 regdom = get_wiphy_regdom(&rdev->wiphy);
8705                 if (!regdom)
8706                         continue;
8707
8708                 if (++reg_idx <= start)
8709                         continue;
8710
8711                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8712                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8713                 if (err < 0) {
8714                         reg_idx--;
8715                         break;
8716                 }
8717         }
8718
8719         cb->args[2] = reg_idx;
8720         err = skb->len;
8721 out_err:
8722         rcu_read_unlock();
8723         return err;
8724 }
8725
8726 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8727 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8728         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8729         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8730         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8731         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8732         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8733         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8734         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8735 };
8736
8737 static int parse_reg_rule(struct nlattr *tb[],
8738         struct ieee80211_reg_rule *reg_rule)
8739 {
8740         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8741         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8742
8743         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8744                 return -EINVAL;
8745         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8746                 return -EINVAL;
8747         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8748                 return -EINVAL;
8749         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8750                 return -EINVAL;
8751         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8752                 return -EINVAL;
8753
8754         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8755
8756         freq_range->start_freq_khz =
8757                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8758         freq_range->end_freq_khz =
8759                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8760         freq_range->max_bandwidth_khz =
8761                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8762
8763         power_rule->max_eirp =
8764                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8765
8766         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8767                 power_rule->max_antenna_gain =
8768                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8769
8770         if (tb[NL80211_ATTR_DFS_CAC_TIME])
8771                 reg_rule->dfs_cac_ms =
8772                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8773
8774         return 0;
8775 }
8776
8777 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8778 {
8779         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8780         struct nlattr *nl_reg_rule;
8781         char *alpha2;
8782         int rem_reg_rules, r;
8783         u32 num_rules = 0, rule_idx = 0;
8784         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8785         struct ieee80211_regdomain *rd;
8786
8787         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8788                 return -EINVAL;
8789
8790         if (!info->attrs[NL80211_ATTR_REG_RULES])
8791                 return -EINVAL;
8792
8793         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8794
8795         if (info->attrs[NL80211_ATTR_DFS_REGION])
8796                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8797
8798         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8799                             rem_reg_rules) {
8800                 num_rules++;
8801                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8802                         return -EINVAL;
8803         }
8804
8805         rtnl_lock();
8806         if (!reg_is_valid_request(alpha2)) {
8807                 r = -EINVAL;
8808                 goto out;
8809         }
8810
8811         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8812         if (!rd) {
8813                 r = -ENOMEM;
8814                 goto out;
8815         }
8816
8817         rd->n_reg_rules = num_rules;
8818         rd->alpha2[0] = alpha2[0];
8819         rd->alpha2[1] = alpha2[1];
8820
8821         /*
8822          * Disable DFS master mode if the DFS region was
8823          * not supported or known on this kernel.
8824          */
8825         if (reg_supported_dfs_region(dfs_region))
8826                 rd->dfs_region = dfs_region;
8827
8828         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8829                             rem_reg_rules) {
8830                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8831                                                 nl_reg_rule, reg_rule_policy,
8832                                                 info->extack);
8833                 if (r)
8834                         goto bad_reg;
8835                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8836                 if (r)
8837                         goto bad_reg;
8838
8839                 rule_idx++;
8840
8841                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8842                         r = -EINVAL;
8843                         goto bad_reg;
8844                 }
8845         }
8846
8847         r = set_regdom(rd, REGD_SOURCE_CRDA);
8848         /* set_regdom takes ownership of rd */
8849         rd = NULL;
8850  bad_reg:
8851         kfree(rd);
8852  out:
8853         rtnl_unlock();
8854         return r;
8855 }
8856 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8857
8858 static int validate_scan_freqs(struct nlattr *freqs)
8859 {
8860         struct nlattr *attr1, *attr2;
8861         int n_channels = 0, tmp1, tmp2;
8862
8863         nla_for_each_nested(attr1, freqs, tmp1)
8864                 if (nla_len(attr1) != sizeof(u32))
8865                         return 0;
8866
8867         nla_for_each_nested(attr1, freqs, tmp1) {
8868                 n_channels++;
8869                 /*
8870                  * Some hardware has a limited channel list for
8871                  * scanning, and it is pretty much nonsensical
8872                  * to scan for a channel twice, so disallow that
8873                  * and don't require drivers to check that the
8874                  * channel list they get isn't longer than what
8875                  * they can scan, as long as they can scan all
8876                  * the channels they registered at once.
8877                  */
8878                 nla_for_each_nested(attr2, freqs, tmp2)
8879                         if (attr1 != attr2 &&
8880                             nla_get_u32(attr1) == nla_get_u32(attr2))
8881                                 return 0;
8882         }
8883
8884         return n_channels;
8885 }
8886
8887 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8888 {
8889         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8890 }
8891
8892 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8893                             struct cfg80211_bss_selection *bss_select)
8894 {
8895         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8896         struct nlattr *nest;
8897         int err;
8898         bool found = false;
8899         int i;
8900
8901         /* only process one nested attribute */
8902         nest = nla_data(nla);
8903         if (!nla_ok(nest, nla_len(nest)))
8904                 return -EINVAL;
8905
8906         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8907                                           nest, nl80211_bss_select_policy,
8908                                           NULL);
8909         if (err)
8910                 return err;
8911
8912         /* only one attribute may be given */
8913         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8914                 if (attr[i]) {
8915                         if (found)
8916                                 return -EINVAL;
8917                         found = true;
8918                 }
8919         }
8920
8921         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8922
8923         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8924                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8925
8926         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8927                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8928                 bss_select->param.band_pref =
8929                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8930                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8931                         return -EINVAL;
8932         }
8933
8934         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8935                 struct nl80211_bss_select_rssi_adjust *adj_param;
8936
8937                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8938                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8939                 bss_select->param.adjust.band = adj_param->band;
8940                 bss_select->param.adjust.delta = adj_param->delta;
8941                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8942                         return -EINVAL;
8943         }
8944
8945         /* user-space did not provide behaviour attribute */
8946         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8947                 return -EINVAL;
8948
8949         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8950                 return -EINVAL;
8951
8952         return 0;
8953 }
8954
8955 int nl80211_parse_random_mac(struct nlattr **attrs,
8956                              u8 *mac_addr, u8 *mac_addr_mask)
8957 {
8958         int i;
8959
8960         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8961                 eth_zero_addr(mac_addr);
8962                 eth_zero_addr(mac_addr_mask);
8963                 mac_addr[0] = 0x2;
8964                 mac_addr_mask[0] = 0x3;
8965
8966                 return 0;
8967         }
8968
8969         /* need both or none */
8970         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8971                 return -EINVAL;
8972
8973         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8974         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8975
8976         /* don't allow or configure an mcast address */
8977         if (!is_multicast_ether_addr(mac_addr_mask) ||
8978             is_multicast_ether_addr(mac_addr))
8979                 return -EINVAL;
8980
8981         /*
8982          * allow users to pass a MAC address that has bits set outside
8983          * of the mask, but don't bother drivers with having to deal
8984          * with such bits
8985          */
8986         for (i = 0; i < ETH_ALEN; i++)
8987                 mac_addr[i] &= mac_addr_mask[i];
8988
8989         return 0;
8990 }
8991
8992 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8993                                               struct ieee80211_channel *chan)
8994 {
8995         unsigned int link_id;
8996         bool all_ok = true;
8997
8998         ASSERT_WDEV_LOCK(wdev);
8999
9000         if (!cfg80211_beaconing_iface_active(wdev))
9001                 return true;
9002
9003         /*
9004          * FIXME: check if we have a free HW resource/link for chan
9005          *
9006          * This, as well as the FIXME below, requires knowing the link
9007          * capabilities of the hardware.
9008          */
9009
9010         /* we cannot leave radar channels */
9011         for_each_valid_link(wdev, link_id) {
9012                 struct cfg80211_chan_def *chandef;
9013
9014                 chandef = wdev_chandef(wdev, link_id);
9015                 if (!chandef || !chandef->chan)
9016                         continue;
9017
9018                 /*
9019                  * FIXME: don't require all_ok, but rather check only the
9020                  *        correct HW resource/link onto which 'chan' falls,
9021                  *        as only that link leaves the channel for doing
9022                  *        the off-channel operation.
9023                  */
9024
9025                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
9026                         all_ok = false;
9027         }
9028
9029         if (all_ok)
9030                 return true;
9031
9032         return regulatory_pre_cac_allowed(wdev->wiphy);
9033 }
9034
9035 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9036                                     enum nl80211_ext_feature_index feat)
9037 {
9038         if (!(flags & flag))
9039                 return true;
9040         if (wiphy_ext_feature_isset(wiphy, feat))
9041                 return true;
9042         return false;
9043 }
9044
9045 static int
9046 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9047                          void *request, struct nlattr **attrs,
9048                          bool is_sched_scan)
9049 {
9050         u8 *mac_addr, *mac_addr_mask;
9051         u32 *flags;
9052         enum nl80211_feature_flags randomness_flag;
9053
9054         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9055                 return 0;
9056
9057         if (is_sched_scan) {
9058                 struct cfg80211_sched_scan_request *req = request;
9059
9060                 randomness_flag = wdev ?
9061                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9062                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9063                 flags = &req->flags;
9064                 mac_addr = req->mac_addr;
9065                 mac_addr_mask = req->mac_addr_mask;
9066         } else {
9067                 struct cfg80211_scan_request *req = request;
9068
9069                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9070                 flags = &req->flags;
9071                 mac_addr = req->mac_addr;
9072                 mac_addr_mask = req->mac_addr_mask;
9073         }
9074
9075         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9076
9077         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9078              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9079             !nl80211_check_scan_feat(wiphy, *flags,
9080                                      NL80211_SCAN_FLAG_LOW_SPAN,
9081                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9082             !nl80211_check_scan_feat(wiphy, *flags,
9083                                      NL80211_SCAN_FLAG_LOW_POWER,
9084                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9085             !nl80211_check_scan_feat(wiphy, *flags,
9086                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
9087                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9088             !nl80211_check_scan_feat(wiphy, *flags,
9089                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9090                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9091             !nl80211_check_scan_feat(wiphy, *flags,
9092                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9093                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9094             !nl80211_check_scan_feat(wiphy, *flags,
9095                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9096                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9097             !nl80211_check_scan_feat(wiphy, *flags,
9098                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9099                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9100             !nl80211_check_scan_feat(wiphy, *flags,
9101                                      NL80211_SCAN_FLAG_RANDOM_SN,
9102                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9103             !nl80211_check_scan_feat(wiphy, *flags,
9104                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9105                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9106                 return -EOPNOTSUPP;
9107
9108         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9109                 int err;
9110
9111                 if (!(wiphy->features & randomness_flag) ||
9112                     (wdev && wdev->connected))
9113                         return -EOPNOTSUPP;
9114
9115                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9116                 if (err)
9117                         return err;
9118         }
9119
9120         return 0;
9121 }
9122
9123 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9124 {
9125         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9126         struct wireless_dev *wdev = info->user_ptr[1];
9127         struct cfg80211_scan_request *request;
9128         struct nlattr *scan_freqs = NULL;
9129         bool scan_freqs_khz = false;
9130         struct nlattr *attr;
9131         struct wiphy *wiphy;
9132         int err, tmp, n_ssids = 0, n_channels, i;
9133         size_t ie_len, size;
9134
9135         wiphy = &rdev->wiphy;
9136
9137         if (wdev->iftype == NL80211_IFTYPE_NAN)
9138                 return -EOPNOTSUPP;
9139
9140         if (!rdev->ops->scan)
9141                 return -EOPNOTSUPP;
9142
9143         if (rdev->scan_req || rdev->scan_msg)
9144                 return -EBUSY;
9145
9146         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9147                 if (!wiphy_ext_feature_isset(wiphy,
9148                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9149                         return -EOPNOTSUPP;
9150                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9151                 scan_freqs_khz = true;
9152         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9153                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9154
9155         if (scan_freqs) {
9156                 n_channels = validate_scan_freqs(scan_freqs);
9157                 if (!n_channels)
9158                         return -EINVAL;
9159         } else {
9160                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9161         }
9162
9163         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9164                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9165                         n_ssids++;
9166
9167         if (n_ssids > wiphy->max_scan_ssids)
9168                 return -EINVAL;
9169
9170         if (info->attrs[NL80211_ATTR_IE])
9171                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9172         else
9173                 ie_len = 0;
9174
9175         if (ie_len > wiphy->max_scan_ie_len)
9176                 return -EINVAL;
9177
9178         size = struct_size(request, channels, n_channels);
9179         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9180         size = size_add(size, ie_len);
9181         request = kzalloc(size, GFP_KERNEL);
9182         if (!request)
9183                 return -ENOMEM;
9184
9185         if (n_ssids)
9186                 request->ssids = (void *)&request->channels[n_channels];
9187         request->n_ssids = n_ssids;
9188         if (ie_len) {
9189                 if (n_ssids)
9190                         request->ie = (void *)(request->ssids + n_ssids);
9191                 else
9192                         request->ie = (void *)(request->channels + n_channels);
9193         }
9194
9195         i = 0;
9196         if (scan_freqs) {
9197                 /* user specified, bail out if channel not found */
9198                 nla_for_each_nested(attr, scan_freqs, tmp) {
9199                         struct ieee80211_channel *chan;
9200                         int freq = nla_get_u32(attr);
9201
9202                         if (!scan_freqs_khz)
9203                                 freq = MHZ_TO_KHZ(freq);
9204
9205                         chan = ieee80211_get_channel_khz(wiphy, freq);
9206                         if (!chan) {
9207                                 err = -EINVAL;
9208                                 goto out_free;
9209                         }
9210
9211                         /* ignore disabled channels */
9212                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9213                                 continue;
9214
9215                         request->channels[i] = chan;
9216                         i++;
9217                 }
9218         } else {
9219                 enum nl80211_band band;
9220
9221                 /* all channels */
9222                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9223                         int j;
9224
9225                         if (!wiphy->bands[band])
9226                                 continue;
9227                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9228                                 struct ieee80211_channel *chan;
9229
9230                                 chan = &wiphy->bands[band]->channels[j];
9231
9232                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9233                                         continue;
9234
9235                                 request->channels[i] = chan;
9236                                 i++;
9237                         }
9238                 }
9239         }
9240
9241         if (!i) {
9242                 err = -EINVAL;
9243                 goto out_free;
9244         }
9245
9246         request->n_channels = i;
9247
9248         wdev_lock(wdev);
9249         for (i = 0; i < request->n_channels; i++) {
9250                 struct ieee80211_channel *chan = request->channels[i];
9251
9252                 /* if we can go off-channel to the target channel we're good */
9253                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9254                         continue;
9255
9256                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9257                         wdev_unlock(wdev);
9258                         err = -EBUSY;
9259                         goto out_free;
9260                 }
9261         }
9262         wdev_unlock(wdev);
9263
9264         i = 0;
9265         if (n_ssids) {
9266                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9267                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9268                                 err = -EINVAL;
9269                                 goto out_free;
9270                         }
9271                         request->ssids[i].ssid_len = nla_len(attr);
9272                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9273                         i++;
9274                 }
9275         }
9276
9277         if (info->attrs[NL80211_ATTR_IE]) {
9278                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9279                 memcpy((void *)request->ie,
9280                        nla_data(info->attrs[NL80211_ATTR_IE]),
9281                        request->ie_len);
9282         }
9283
9284         for (i = 0; i < NUM_NL80211_BANDS; i++)
9285                 if (wiphy->bands[i])
9286                         request->rates[i] =
9287                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9288
9289         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9290                 nla_for_each_nested(attr,
9291                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9292                                     tmp) {
9293                         enum nl80211_band band = nla_type(attr);
9294
9295                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9296                                 err = -EINVAL;
9297                                 goto out_free;
9298                         }
9299
9300                         if (!wiphy->bands[band])
9301                                 continue;
9302
9303                         err = ieee80211_get_ratemask(wiphy->bands[band],
9304                                                      nla_data(attr),
9305                                                      nla_len(attr),
9306                                                      &request->rates[band]);
9307                         if (err)
9308                                 goto out_free;
9309                 }
9310         }
9311
9312         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9313                 request->duration =
9314                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9315                 request->duration_mandatory =
9316                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9317         }
9318
9319         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9320                                        false);
9321         if (err)
9322                 goto out_free;
9323
9324         request->no_cck =
9325                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9326
9327         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9328          * BSSID to scan for. This was problematic because that same attribute
9329          * was already used for another purpose (local random MAC address). The
9330          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9331          * compatibility with older userspace components, also use the
9332          * NL80211_ATTR_MAC value here if it can be determined to be used for
9333          * the specific BSSID use case instead of the random MAC address
9334          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9335          */
9336         if (info->attrs[NL80211_ATTR_BSSID])
9337                 memcpy(request->bssid,
9338                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9339         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9340                  info->attrs[NL80211_ATTR_MAC])
9341                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9342                        ETH_ALEN);
9343         else
9344                 eth_broadcast_addr(request->bssid);
9345
9346         request->wdev = wdev;
9347         request->wiphy = &rdev->wiphy;
9348         request->scan_start = jiffies;
9349
9350         rdev->scan_req = request;
9351         err = cfg80211_scan(rdev);
9352
9353         if (err)
9354                 goto out_free;
9355
9356         nl80211_send_scan_start(rdev, wdev);
9357         dev_hold(wdev->netdev);
9358
9359         return 0;
9360
9361  out_free:
9362         rdev->scan_req = NULL;
9363         kfree(request);
9364
9365         return err;
9366 }
9367
9368 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9369 {
9370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9371         struct wireless_dev *wdev = info->user_ptr[1];
9372
9373         if (!rdev->ops->abort_scan)
9374                 return -EOPNOTSUPP;
9375
9376         if (rdev->scan_msg)
9377                 return 0;
9378
9379         if (!rdev->scan_req)
9380                 return -ENOENT;
9381
9382         rdev_abort_scan(rdev, wdev);
9383         return 0;
9384 }
9385
9386 static int
9387 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9388                                struct cfg80211_sched_scan_request *request,
9389                                struct nlattr **attrs)
9390 {
9391         int tmp, err, i = 0;
9392         struct nlattr *attr;
9393
9394         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9395                 u32 interval;
9396
9397                 /*
9398                  * If scan plans are not specified,
9399                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9400                  * case one scan plan will be set with the specified scan
9401                  * interval and infinite number of iterations.
9402                  */
9403                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9404                 if (!interval)
9405                         return -EINVAL;
9406
9407                 request->scan_plans[0].interval =
9408                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9409                 if (!request->scan_plans[0].interval)
9410                         return -EINVAL;
9411
9412                 if (request->scan_plans[0].interval >
9413                     wiphy->max_sched_scan_plan_interval)
9414                         request->scan_plans[0].interval =
9415                                 wiphy->max_sched_scan_plan_interval;
9416
9417                 return 0;
9418         }
9419
9420         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9421                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9422
9423                 if (WARN_ON(i >= n_plans))
9424                         return -EINVAL;
9425
9426                 err = nla_parse_nested_deprecated(plan,
9427                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9428                                                   attr, nl80211_plan_policy,
9429                                                   NULL);
9430                 if (err)
9431                         return err;
9432
9433                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9434                         return -EINVAL;
9435
9436                 request->scan_plans[i].interval =
9437                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9438                 if (!request->scan_plans[i].interval ||
9439                     request->scan_plans[i].interval >
9440                     wiphy->max_sched_scan_plan_interval)
9441                         return -EINVAL;
9442
9443                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9444                         request->scan_plans[i].iterations =
9445                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9446                         if (!request->scan_plans[i].iterations ||
9447                             (request->scan_plans[i].iterations >
9448                              wiphy->max_sched_scan_plan_iterations))
9449                                 return -EINVAL;
9450                 } else if (i < n_plans - 1) {
9451                         /*
9452                          * All scan plans but the last one must specify
9453                          * a finite number of iterations
9454                          */
9455                         return -EINVAL;
9456                 }
9457
9458                 i++;
9459         }
9460
9461         /*
9462          * The last scan plan must not specify the number of
9463          * iterations, it is supposed to run infinitely
9464          */
9465         if (request->scan_plans[n_plans - 1].iterations)
9466                 return  -EINVAL;
9467
9468         return 0;
9469 }
9470
9471 static int
9472 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9473                                        struct cfg80211_match_set *match_sets,
9474                                        struct nlattr *tb_band_rssi,
9475                                        s32 rssi_thold)
9476 {
9477         struct nlattr *attr;
9478         int i, tmp, ret = 0;
9479
9480         if (!wiphy_ext_feature_isset(wiphy,
9481                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9482                 if (tb_band_rssi)
9483                         ret = -EOPNOTSUPP;
9484                 else
9485                         for (i = 0; i < NUM_NL80211_BANDS; i++)
9486                                 match_sets->per_band_rssi_thold[i] =
9487                                         NL80211_SCAN_RSSI_THOLD_OFF;
9488                 return ret;
9489         }
9490
9491         for (i = 0; i < NUM_NL80211_BANDS; i++)
9492                 match_sets->per_band_rssi_thold[i] = rssi_thold;
9493
9494         nla_for_each_nested(attr, tb_band_rssi, tmp) {
9495                 enum nl80211_band band = nla_type(attr);
9496
9497                 if (band < 0 || band >= NUM_NL80211_BANDS)
9498                         return -EINVAL;
9499
9500                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9501         }
9502
9503         return 0;
9504 }
9505
9506 static struct cfg80211_sched_scan_request *
9507 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9508                          struct nlattr **attrs, int max_match_sets)
9509 {
9510         struct cfg80211_sched_scan_request *request;
9511         struct nlattr *attr;
9512         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9513         enum nl80211_band band;
9514         size_t ie_len, size;
9515         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9516         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9517
9518         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9519                 n_channels = validate_scan_freqs(
9520                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9521                 if (!n_channels)
9522                         return ERR_PTR(-EINVAL);
9523         } else {
9524                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9525         }
9526
9527         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9528                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9529                                     tmp)
9530                         n_ssids++;
9531
9532         if (n_ssids > wiphy->max_sched_scan_ssids)
9533                 return ERR_PTR(-EINVAL);
9534
9535         /*
9536          * First, count the number of 'real' matchsets. Due to an issue with
9537          * the old implementation, matchsets containing only the RSSI attribute
9538          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9539          * RSSI for all matchsets, rather than their own matchset for reporting
9540          * all APs with a strong RSSI. This is needed to be compatible with
9541          * older userspace that treated a matchset with only the RSSI as the
9542          * global RSSI for all other matchsets - if there are other matchsets.
9543          */
9544         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9545                 nla_for_each_nested(attr,
9546                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9547                                     tmp) {
9548                         struct nlattr *rssi;
9549
9550                         err = nla_parse_nested_deprecated(tb,
9551                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9552                                                           attr,
9553                                                           nl80211_match_policy,
9554                                                           NULL);
9555                         if (err)
9556                                 return ERR_PTR(err);
9557
9558                         /* SSID and BSSID are mutually exclusive */
9559                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9560                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9561                                 return ERR_PTR(-EINVAL);
9562
9563                         /* add other standalone attributes here */
9564                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9565                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9566                                 n_match_sets++;
9567                                 continue;
9568                         }
9569                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9570                         if (rssi)
9571                                 default_match_rssi = nla_get_s32(rssi);
9572                 }
9573         }
9574
9575         /* However, if there's no other matchset, add the RSSI one */
9576         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9577                 n_match_sets = 1;
9578
9579         if (n_match_sets > max_match_sets)
9580                 return ERR_PTR(-EINVAL);
9581
9582         if (attrs[NL80211_ATTR_IE])
9583                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9584         else
9585                 ie_len = 0;
9586
9587         if (ie_len > wiphy->max_sched_scan_ie_len)
9588                 return ERR_PTR(-EINVAL);
9589
9590         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9591                 /*
9592                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9593                  * each scan plan already specifies its own interval
9594                  */
9595                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9596                         return ERR_PTR(-EINVAL);
9597
9598                 nla_for_each_nested(attr,
9599                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9600                         n_plans++;
9601         } else {
9602                 /*
9603                  * The scan interval attribute is kept for backward
9604                  * compatibility. If no scan plans are specified and sched scan
9605                  * interval is specified, one scan plan will be set with this
9606                  * scan interval and infinite number of iterations.
9607                  */
9608                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9609                         return ERR_PTR(-EINVAL);
9610
9611                 n_plans = 1;
9612         }
9613
9614         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9615                 return ERR_PTR(-EINVAL);
9616
9617         if (!wiphy_ext_feature_isset(
9618                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9619             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9620              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9621                 return ERR_PTR(-EINVAL);
9622
9623         size = struct_size(request, channels, n_channels);
9624         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9625         size = size_add(size, array_size(sizeof(*request->match_sets),
9626                                          n_match_sets));
9627         size = size_add(size, array_size(sizeof(*request->scan_plans),
9628                                          n_plans));
9629         size = size_add(size, ie_len);
9630         request = kzalloc(size, GFP_KERNEL);
9631         if (!request)
9632                 return ERR_PTR(-ENOMEM);
9633
9634         if (n_ssids)
9635                 request->ssids = (void *)&request->channels[n_channels];
9636         request->n_ssids = n_ssids;
9637         if (ie_len) {
9638                 if (n_ssids)
9639                         request->ie = (void *)(request->ssids + n_ssids);
9640                 else
9641                         request->ie = (void *)(request->channels + n_channels);
9642         }
9643
9644         if (n_match_sets) {
9645                 if (request->ie)
9646                         request->match_sets = (void *)(request->ie + ie_len);
9647                 else if (n_ssids)
9648                         request->match_sets =
9649                                 (void *)(request->ssids + n_ssids);
9650                 else
9651                         request->match_sets =
9652                                 (void *)(request->channels + n_channels);
9653         }
9654         request->n_match_sets = n_match_sets;
9655
9656         if (n_match_sets)
9657                 request->scan_plans = (void *)(request->match_sets +
9658                                                n_match_sets);
9659         else if (request->ie)
9660                 request->scan_plans = (void *)(request->ie + ie_len);
9661         else if (n_ssids)
9662                 request->scan_plans = (void *)(request->ssids + n_ssids);
9663         else
9664                 request->scan_plans = (void *)(request->channels + n_channels);
9665
9666         request->n_scan_plans = n_plans;
9667
9668         i = 0;
9669         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9670                 /* user specified, bail out if channel not found */
9671                 nla_for_each_nested(attr,
9672                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9673                                     tmp) {
9674                         struct ieee80211_channel *chan;
9675
9676                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9677
9678                         if (!chan) {
9679                                 err = -EINVAL;
9680                                 goto out_free;
9681                         }
9682
9683                         /* ignore disabled channels */
9684                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9685                                 continue;
9686
9687                         request->channels[i] = chan;
9688                         i++;
9689                 }
9690         } else {
9691                 /* all channels */
9692                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9693                         int j;
9694
9695                         if (!wiphy->bands[band])
9696                                 continue;
9697                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9698                                 struct ieee80211_channel *chan;
9699
9700                                 chan = &wiphy->bands[band]->channels[j];
9701
9702                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9703                                         continue;
9704
9705                                 request->channels[i] = chan;
9706                                 i++;
9707                         }
9708                 }
9709         }
9710
9711         if (!i) {
9712                 err = -EINVAL;
9713                 goto out_free;
9714         }
9715
9716         request->n_channels = i;
9717
9718         i = 0;
9719         if (n_ssids) {
9720                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9721                                     tmp) {
9722                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9723                                 err = -EINVAL;
9724                                 goto out_free;
9725                         }
9726                         request->ssids[i].ssid_len = nla_len(attr);
9727                         memcpy(request->ssids[i].ssid, nla_data(attr),
9728                                nla_len(attr));
9729                         i++;
9730                 }
9731         }
9732
9733         i = 0;
9734         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9735                 nla_for_each_nested(attr,
9736                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9737                                     tmp) {
9738                         struct nlattr *ssid, *bssid, *rssi;
9739
9740                         err = nla_parse_nested_deprecated(tb,
9741                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9742                                                           attr,
9743                                                           nl80211_match_policy,
9744                                                           NULL);
9745                         if (err)
9746                                 goto out_free;
9747                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9748                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9749
9750                         if (!ssid && !bssid) {
9751                                 i++;
9752                                 continue;
9753                         }
9754
9755                         if (WARN_ON(i >= n_match_sets)) {
9756                                 /* this indicates a programming error,
9757                                  * the loop above should have verified
9758                                  * things properly
9759                                  */
9760                                 err = -EINVAL;
9761                                 goto out_free;
9762                         }
9763
9764                         if (ssid) {
9765                                 memcpy(request->match_sets[i].ssid.ssid,
9766                                        nla_data(ssid), nla_len(ssid));
9767                                 request->match_sets[i].ssid.ssid_len =
9768                                         nla_len(ssid);
9769                         }
9770                         if (bssid)
9771                                 memcpy(request->match_sets[i].bssid,
9772                                        nla_data(bssid), ETH_ALEN);
9773
9774                         /* special attribute - old implementation w/a */
9775                         request->match_sets[i].rssi_thold = default_match_rssi;
9776                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9777                         if (rssi)
9778                                 request->match_sets[i].rssi_thold =
9779                                         nla_get_s32(rssi);
9780
9781                         /* Parse per band RSSI attribute */
9782                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9783                                 &request->match_sets[i],
9784                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9785                                 request->match_sets[i].rssi_thold);
9786                         if (err)
9787                                 goto out_free;
9788
9789                         i++;
9790                 }
9791
9792                 /* there was no other matchset, so the RSSI one is alone */
9793                 if (i == 0 && n_match_sets)
9794                         request->match_sets[0].rssi_thold = default_match_rssi;
9795
9796                 request->min_rssi_thold = INT_MAX;
9797                 for (i = 0; i < n_match_sets; i++)
9798                         request->min_rssi_thold =
9799                                 min(request->match_sets[i].rssi_thold,
9800                                     request->min_rssi_thold);
9801         } else {
9802                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9803         }
9804
9805         if (ie_len) {
9806                 request->ie_len = ie_len;
9807                 memcpy((void *)request->ie,
9808                        nla_data(attrs[NL80211_ATTR_IE]),
9809                        request->ie_len);
9810         }
9811
9812         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9813         if (err)
9814                 goto out_free;
9815
9816         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9817                 request->delay =
9818                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9819
9820         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9821                 request->relative_rssi = nla_get_s8(
9822                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9823                 request->relative_rssi_set = true;
9824         }
9825
9826         if (request->relative_rssi_set &&
9827             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9828                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9829
9830                 rssi_adjust = nla_data(
9831                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9832                 request->rssi_adjust.band = rssi_adjust->band;
9833                 request->rssi_adjust.delta = rssi_adjust->delta;
9834                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9835                         err = -EINVAL;
9836                         goto out_free;
9837                 }
9838         }
9839
9840         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9841         if (err)
9842                 goto out_free;
9843
9844         request->scan_start = jiffies;
9845
9846         return request;
9847
9848 out_free:
9849         kfree(request);
9850         return ERR_PTR(err);
9851 }
9852
9853 static int nl80211_start_sched_scan(struct sk_buff *skb,
9854                                     struct genl_info *info)
9855 {
9856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9857         struct net_device *dev = info->user_ptr[1];
9858         struct wireless_dev *wdev = dev->ieee80211_ptr;
9859         struct cfg80211_sched_scan_request *sched_scan_req;
9860         bool want_multi;
9861         int err;
9862
9863         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9864                 return -EOPNOTSUPP;
9865
9866         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9867         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9868         if (err)
9869                 return err;
9870
9871         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9872                                                   info->attrs,
9873                                                   rdev->wiphy.max_match_sets);
9874
9875         err = PTR_ERR_OR_ZERO(sched_scan_req);
9876         if (err)
9877                 goto out_err;
9878
9879         /* leave request id zero for legacy request
9880          * or if driver does not support multi-scheduled scan
9881          */
9882         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9883                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9884
9885         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9886         if (err)
9887                 goto out_free;
9888
9889         sched_scan_req->dev = dev;
9890         sched_scan_req->wiphy = &rdev->wiphy;
9891
9892         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9893                 sched_scan_req->owner_nlportid = info->snd_portid;
9894
9895         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9896
9897         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9898         return 0;
9899
9900 out_free:
9901         kfree(sched_scan_req);
9902 out_err:
9903         return err;
9904 }
9905
9906 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9907                                    struct genl_info *info)
9908 {
9909         struct cfg80211_sched_scan_request *req;
9910         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9911         u64 cookie;
9912
9913         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9914                 return -EOPNOTSUPP;
9915
9916         if (info->attrs[NL80211_ATTR_COOKIE]) {
9917                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9918                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9919         }
9920
9921         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9922                                      struct cfg80211_sched_scan_request,
9923                                      list);
9924         if (!req || req->reqid ||
9925             (req->owner_nlportid &&
9926              req->owner_nlportid != info->snd_portid))
9927                 return -ENOENT;
9928
9929         return cfg80211_stop_sched_scan_req(rdev, req, false);
9930 }
9931
9932 static int nl80211_start_radar_detection(struct sk_buff *skb,
9933                                          struct genl_info *info)
9934 {
9935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9936         struct net_device *dev = info->user_ptr[1];
9937         struct wireless_dev *wdev = dev->ieee80211_ptr;
9938         struct wiphy *wiphy = wdev->wiphy;
9939         struct cfg80211_chan_def chandef;
9940         enum nl80211_dfs_regions dfs_region;
9941         unsigned int cac_time_ms;
9942         int err = -EINVAL;
9943
9944         flush_delayed_work(&rdev->dfs_update_channels_wk);
9945
9946         wiphy_lock(wiphy);
9947
9948         dfs_region = reg_get_dfs_region(wiphy);
9949         if (dfs_region == NL80211_DFS_UNSET)
9950                 goto unlock;
9951
9952         err = nl80211_parse_chandef(rdev, info, &chandef);
9953         if (err)
9954                 goto unlock;
9955
9956         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9957         if (err < 0)
9958                 goto unlock;
9959
9960         if (err == 0) {
9961                 err = -EINVAL;
9962                 goto unlock;
9963         }
9964
9965         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9966                 err = -EINVAL;
9967                 goto unlock;
9968         }
9969
9970         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9971                 err = cfg80211_start_background_radar_detection(rdev, wdev,
9972                                                                 &chandef);
9973                 goto unlock;
9974         }
9975
9976         if (netif_carrier_ok(dev)) {
9977                 err = -EBUSY;
9978                 goto unlock;
9979         }
9980
9981         if (wdev->cac_started) {
9982                 err = -EBUSY;
9983                 goto unlock;
9984         }
9985
9986         /* CAC start is offloaded to HW and can't be started manually */
9987         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9988                 err = -EOPNOTSUPP;
9989                 goto unlock;
9990         }
9991
9992         if (!rdev->ops->start_radar_detection) {
9993                 err = -EOPNOTSUPP;
9994                 goto unlock;
9995         }
9996
9997         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9998         if (WARN_ON(!cac_time_ms))
9999                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
10000
10001         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
10002         if (!err) {
10003                 wdev->links[0].ap.chandef = chandef;
10004                 wdev->cac_started = true;
10005                 wdev->cac_start_time = jiffies;
10006                 wdev->cac_time_ms = cac_time_ms;
10007         }
10008 unlock:
10009         wiphy_unlock(wiphy);
10010
10011         return err;
10012 }
10013
10014 static int nl80211_notify_radar_detection(struct sk_buff *skb,
10015                                           struct genl_info *info)
10016 {
10017         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10018         struct net_device *dev = info->user_ptr[1];
10019         struct wireless_dev *wdev = dev->ieee80211_ptr;
10020         struct wiphy *wiphy = wdev->wiphy;
10021         struct cfg80211_chan_def chandef;
10022         enum nl80211_dfs_regions dfs_region;
10023         int err;
10024
10025         dfs_region = reg_get_dfs_region(wiphy);
10026         if (dfs_region == NL80211_DFS_UNSET) {
10027                 GENL_SET_ERR_MSG(info,
10028                                  "DFS Region is not set. Unexpected Radar indication");
10029                 return -EINVAL;
10030         }
10031
10032         err = nl80211_parse_chandef(rdev, info, &chandef);
10033         if (err) {
10034                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10035                 return err;
10036         }
10037
10038         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10039         if (err < 0) {
10040                 GENL_SET_ERR_MSG(info, "chandef is invalid");
10041                 return err;
10042         }
10043
10044         if (err == 0) {
10045                 GENL_SET_ERR_MSG(info,
10046                                  "Unexpected Radar indication for chandef/iftype");
10047                 return -EINVAL;
10048         }
10049
10050         /* Do not process this notification if radar is already detected
10051          * by kernel on this channel, and return success.
10052          */
10053         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10054                 return 0;
10055
10056         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10057
10058         cfg80211_sched_dfs_chan_update(rdev);
10059
10060         rdev->radar_chandef = chandef;
10061
10062         /* Propagate this notification to other radios as well */
10063         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10064
10065         return 0;
10066 }
10067
10068 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10069 {
10070         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10071         unsigned int link_id = nl80211_link_id(info->attrs);
10072         struct net_device *dev = info->user_ptr[1];
10073         struct wireless_dev *wdev = dev->ieee80211_ptr;
10074         struct cfg80211_csa_settings params;
10075         struct nlattr **csa_attrs = NULL;
10076         int err;
10077         bool need_new_beacon = false;
10078         bool need_handle_dfs_flag = true;
10079         int len, i;
10080         u32 cs_count;
10081
10082         if (!rdev->ops->channel_switch ||
10083             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10084                 return -EOPNOTSUPP;
10085
10086         switch (dev->ieee80211_ptr->iftype) {
10087         case NL80211_IFTYPE_AP:
10088         case NL80211_IFTYPE_P2P_GO:
10089                 need_new_beacon = true;
10090                 /* For all modes except AP the handle_dfs flag needs to be
10091                  * supplied to tell the kernel that userspace will handle radar
10092                  * events when they happen. Otherwise a switch to a channel
10093                  * requiring DFS will be rejected.
10094                  */
10095                 need_handle_dfs_flag = false;
10096
10097                 /* useless if AP is not running */
10098                 if (!wdev->links[link_id].ap.beacon_interval)
10099                         return -ENOTCONN;
10100                 break;
10101         case NL80211_IFTYPE_ADHOC:
10102                 if (!wdev->u.ibss.ssid_len)
10103                         return -ENOTCONN;
10104                 break;
10105         case NL80211_IFTYPE_MESH_POINT:
10106                 if (!wdev->u.mesh.id_len)
10107                         return -ENOTCONN;
10108                 break;
10109         default:
10110                 return -EOPNOTSUPP;
10111         }
10112
10113         memset(&params, 0, sizeof(params));
10114         params.beacon_csa.ftm_responder = -1;
10115
10116         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10117             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10118                 return -EINVAL;
10119
10120         /* only important for AP, IBSS and mesh create IEs internally */
10121         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10122                 return -EINVAL;
10123
10124         /* Even though the attribute is u32, the specification says
10125          * u8, so let's make sure we don't overflow.
10126          */
10127         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10128         if (cs_count > 255)
10129                 return -EINVAL;
10130
10131         params.count = cs_count;
10132
10133         if (!need_new_beacon)
10134                 goto skip_beacons;
10135
10136         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10137                                    info->extack);
10138         if (err)
10139                 goto free;
10140
10141         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10142                             GFP_KERNEL);
10143         if (!csa_attrs) {
10144                 err = -ENOMEM;
10145                 goto free;
10146         }
10147
10148         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10149                                           info->attrs[NL80211_ATTR_CSA_IES],
10150                                           nl80211_policy, info->extack);
10151         if (err)
10152                 goto free;
10153
10154         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10155                                    info->extack);
10156         if (err)
10157                 goto free;
10158
10159         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10160                 err = -EINVAL;
10161                 goto free;
10162         }
10163
10164         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10165         if (!len || (len % sizeof(u16))) {
10166                 err = -EINVAL;
10167                 goto free;
10168         }
10169
10170         params.n_counter_offsets_beacon = len / sizeof(u16);
10171         if (rdev->wiphy.max_num_csa_counters &&
10172             (params.n_counter_offsets_beacon >
10173              rdev->wiphy.max_num_csa_counters)) {
10174                 err = -EINVAL;
10175                 goto free;
10176         }
10177
10178         params.counter_offsets_beacon =
10179                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10180
10181         /* sanity checks - counters should fit and be the same */
10182         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10183                 u16 offset = params.counter_offsets_beacon[i];
10184
10185                 if (offset >= params.beacon_csa.tail_len) {
10186                         err = -EINVAL;
10187                         goto free;
10188                 }
10189
10190                 if (params.beacon_csa.tail[offset] != params.count) {
10191                         err = -EINVAL;
10192                         goto free;
10193                 }
10194         }
10195
10196         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10197                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10198                 if (!len || (len % sizeof(u16))) {
10199                         err = -EINVAL;
10200                         goto free;
10201                 }
10202
10203                 params.n_counter_offsets_presp = len / sizeof(u16);
10204                 if (rdev->wiphy.max_num_csa_counters &&
10205                     (params.n_counter_offsets_presp >
10206                      rdev->wiphy.max_num_csa_counters)) {
10207                         err = -EINVAL;
10208                         goto free;
10209                 }
10210
10211                 params.counter_offsets_presp =
10212                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10213
10214                 /* sanity checks - counters should fit and be the same */
10215                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10216                         u16 offset = params.counter_offsets_presp[i];
10217
10218                         if (offset >= params.beacon_csa.probe_resp_len) {
10219                                 err = -EINVAL;
10220                                 goto free;
10221                         }
10222
10223                         if (params.beacon_csa.probe_resp[offset] !=
10224                             params.count) {
10225                                 err = -EINVAL;
10226                                 goto free;
10227                         }
10228                 }
10229         }
10230
10231 skip_beacons:
10232         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10233         if (err)
10234                 goto free;
10235
10236         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10237                                            wdev->iftype)) {
10238                 err = -EINVAL;
10239                 goto free;
10240         }
10241
10242         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10243                                             &params.chandef,
10244                                             wdev->iftype);
10245         if (err < 0)
10246                 goto free;
10247
10248         if (err > 0) {
10249                 params.radar_required = true;
10250                 if (need_handle_dfs_flag &&
10251                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10252                         err = -EINVAL;
10253                         goto free;
10254                 }
10255         }
10256
10257         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10258                 params.block_tx = true;
10259
10260         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10261                 err = nl80211_parse_punct_bitmap(rdev, info,
10262                                                  &params.chandef,
10263                                                  &params.punct_bitmap);
10264                 if (err)
10265                         goto free;
10266         }
10267
10268         wdev_lock(wdev);
10269         err = rdev_channel_switch(rdev, dev, &params);
10270         wdev_unlock(wdev);
10271
10272 free:
10273         kfree(params.beacon_after.mbssid_ies);
10274         kfree(params.beacon_csa.mbssid_ies);
10275         kfree(params.beacon_after.rnr_ies);
10276         kfree(params.beacon_csa.rnr_ies);
10277         kfree(csa_attrs);
10278         return err;
10279 }
10280
10281 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10282                             u32 seq, int flags,
10283                             struct cfg80211_registered_device *rdev,
10284                             struct wireless_dev *wdev,
10285                             struct cfg80211_internal_bss *intbss)
10286 {
10287         struct cfg80211_bss *res = &intbss->pub;
10288         const struct cfg80211_bss_ies *ies;
10289         unsigned int link_id;
10290         void *hdr;
10291         struct nlattr *bss;
10292
10293         ASSERT_WDEV_LOCK(wdev);
10294
10295         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10296                              NL80211_CMD_NEW_SCAN_RESULTS);
10297         if (!hdr)
10298                 return -1;
10299
10300         genl_dump_check_consistent(cb, hdr);
10301
10302         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10303                 goto nla_put_failure;
10304         if (wdev->netdev &&
10305             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10306                 goto nla_put_failure;
10307         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10308                               NL80211_ATTR_PAD))
10309                 goto nla_put_failure;
10310
10311         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10312         if (!bss)
10313                 goto nla_put_failure;
10314         if ((!is_zero_ether_addr(res->bssid) &&
10315              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10316                 goto nla_put_failure;
10317
10318         rcu_read_lock();
10319         /* indicate whether we have probe response data or not */
10320         if (rcu_access_pointer(res->proberesp_ies) &&
10321             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10322                 goto fail_unlock_rcu;
10323
10324         /* this pointer prefers to be pointed to probe response data
10325          * but is always valid
10326          */
10327         ies = rcu_dereference(res->ies);
10328         if (ies) {
10329                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10330                                       NL80211_BSS_PAD))
10331                         goto fail_unlock_rcu;
10332                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10333                                         ies->len, ies->data))
10334                         goto fail_unlock_rcu;
10335         }
10336
10337         /* and this pointer is always (unless driver didn't know) beacon data */
10338         ies = rcu_dereference(res->beacon_ies);
10339         if (ies && ies->from_beacon) {
10340                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10341                                       NL80211_BSS_PAD))
10342                         goto fail_unlock_rcu;
10343                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10344                                         ies->len, ies->data))
10345                         goto fail_unlock_rcu;
10346         }
10347         rcu_read_unlock();
10348
10349         if (res->beacon_interval &&
10350             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10351                 goto nla_put_failure;
10352         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10353             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10354             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10355                         res->channel->freq_offset) ||
10356             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10357             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10358                         jiffies_to_msecs(jiffies - intbss->ts)))
10359                 goto nla_put_failure;
10360
10361         if (intbss->parent_tsf &&
10362             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10363                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10364              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10365                      intbss->parent_bssid)))
10366                 goto nla_put_failure;
10367
10368         if (intbss->ts_boottime &&
10369             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10370                               intbss->ts_boottime, NL80211_BSS_PAD))
10371                 goto nla_put_failure;
10372
10373         if (!nl80211_put_signal(msg, intbss->pub.chains,
10374                                 intbss->pub.chain_signal,
10375                                 NL80211_BSS_CHAIN_SIGNAL))
10376                 goto nla_put_failure;
10377
10378         switch (rdev->wiphy.signal_type) {
10379         case CFG80211_SIGNAL_TYPE_MBM:
10380                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10381                         goto nla_put_failure;
10382                 break;
10383         case CFG80211_SIGNAL_TYPE_UNSPEC:
10384                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10385                         goto nla_put_failure;
10386                 break;
10387         default:
10388                 break;
10389         }
10390
10391         switch (wdev->iftype) {
10392         case NL80211_IFTYPE_P2P_CLIENT:
10393         case NL80211_IFTYPE_STATION:
10394                 for_each_valid_link(wdev, link_id) {
10395                         if (intbss == wdev->links[link_id].client.current_bss &&
10396                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10397                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10398                              (wdev->valid_links &&
10399                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10400                                           link_id) ||
10401                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10402                                        wdev->u.client.connected_addr)))))
10403                                 goto nla_put_failure;
10404                 }
10405                 break;
10406         case NL80211_IFTYPE_ADHOC:
10407                 if (intbss == wdev->u.ibss.current_bss &&
10408                     nla_put_u32(msg, NL80211_BSS_STATUS,
10409                                 NL80211_BSS_STATUS_IBSS_JOINED))
10410                         goto nla_put_failure;
10411                 break;
10412         default:
10413                 break;
10414         }
10415
10416         nla_nest_end(msg, bss);
10417
10418         genlmsg_end(msg, hdr);
10419         return 0;
10420
10421  fail_unlock_rcu:
10422         rcu_read_unlock();
10423  nla_put_failure:
10424         genlmsg_cancel(msg, hdr);
10425         return -EMSGSIZE;
10426 }
10427
10428 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10429 {
10430         struct cfg80211_registered_device *rdev;
10431         struct cfg80211_internal_bss *scan;
10432         struct wireless_dev *wdev;
10433         int start = cb->args[2], idx = 0;
10434         int err;
10435
10436         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10437         if (err)
10438                 return err;
10439         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10440         __acquire(&rdev->wiphy.mtx);
10441
10442         wdev_lock(wdev);
10443         spin_lock_bh(&rdev->bss_lock);
10444
10445         /*
10446          * dump_scan will be called multiple times to break up the scan results
10447          * into multiple messages.  It is unlikely that any more bss-es will be
10448          * expired after the first call, so only call only call this on the
10449          * first dump_scan invocation.
10450          */
10451         if (start == 0)
10452                 cfg80211_bss_expire(rdev);
10453
10454         cb->seq = rdev->bss_generation;
10455
10456         list_for_each_entry(scan, &rdev->bss_list, list) {
10457                 if (++idx <= start)
10458                         continue;
10459                 if (nl80211_send_bss(skb, cb,
10460                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10461                                 rdev, wdev, scan) < 0) {
10462                         idx--;
10463                         break;
10464                 }
10465         }
10466
10467         spin_unlock_bh(&rdev->bss_lock);
10468         wdev_unlock(wdev);
10469
10470         cb->args[2] = idx;
10471         wiphy_unlock(&rdev->wiphy);
10472
10473         return skb->len;
10474 }
10475
10476 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10477                                int flags, struct net_device *dev,
10478                                bool allow_radio_stats,
10479                                struct survey_info *survey)
10480 {
10481         void *hdr;
10482         struct nlattr *infoattr;
10483
10484         /* skip radio stats if userspace didn't request them */
10485         if (!survey->channel && !allow_radio_stats)
10486                 return 0;
10487
10488         hdr = nl80211hdr_put(msg, portid, seq, flags,
10489                              NL80211_CMD_NEW_SURVEY_RESULTS);
10490         if (!hdr)
10491                 return -ENOMEM;
10492
10493         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10494                 goto nla_put_failure;
10495
10496         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10497         if (!infoattr)
10498                 goto nla_put_failure;
10499
10500         if (survey->channel &&
10501             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10502                         survey->channel->center_freq))
10503                 goto nla_put_failure;
10504
10505         if (survey->channel && survey->channel->freq_offset &&
10506             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10507                         survey->channel->freq_offset))
10508                 goto nla_put_failure;
10509
10510         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10511             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10512                 goto nla_put_failure;
10513         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10514             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10515                 goto nla_put_failure;
10516         if ((survey->filled & SURVEY_INFO_TIME) &&
10517             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10518                         survey->time, NL80211_SURVEY_INFO_PAD))
10519                 goto nla_put_failure;
10520         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10521             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10522                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10523                 goto nla_put_failure;
10524         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10525             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10526                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10527                 goto nla_put_failure;
10528         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10529             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10530                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10531                 goto nla_put_failure;
10532         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10533             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10534                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10535                 goto nla_put_failure;
10536         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10537             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10538                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10539                 goto nla_put_failure;
10540         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10541             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10542                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10543                 goto nla_put_failure;
10544
10545         nla_nest_end(msg, infoattr);
10546
10547         genlmsg_end(msg, hdr);
10548         return 0;
10549
10550  nla_put_failure:
10551         genlmsg_cancel(msg, hdr);
10552         return -EMSGSIZE;
10553 }
10554
10555 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10556 {
10557         struct nlattr **attrbuf;
10558         struct survey_info survey;
10559         struct cfg80211_registered_device *rdev;
10560         struct wireless_dev *wdev;
10561         int survey_idx = cb->args[2];
10562         int res;
10563         bool radio_stats;
10564
10565         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10566         if (!attrbuf)
10567                 return -ENOMEM;
10568
10569         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10570         if (res) {
10571                 kfree(attrbuf);
10572                 return res;
10573         }
10574         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10575         __acquire(&rdev->wiphy.mtx);
10576
10577         /* prepare_wdev_dump parsed the attributes */
10578         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10579
10580         if (!wdev->netdev) {
10581                 res = -EINVAL;
10582                 goto out_err;
10583         }
10584
10585         if (!rdev->ops->dump_survey) {
10586                 res = -EOPNOTSUPP;
10587                 goto out_err;
10588         }
10589
10590         while (1) {
10591                 wdev_lock(wdev);
10592                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10593                 wdev_unlock(wdev);
10594                 if (res == -ENOENT)
10595                         break;
10596                 if (res)
10597                         goto out_err;
10598
10599                 /* don't send disabled channels, but do send non-channel data */
10600                 if (survey.channel &&
10601                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10602                         survey_idx++;
10603                         continue;
10604                 }
10605
10606                 if (nl80211_send_survey(skb,
10607                                 NETLINK_CB(cb->skb).portid,
10608                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10609                                 wdev->netdev, radio_stats, &survey) < 0)
10610                         goto out;
10611                 survey_idx++;
10612         }
10613
10614  out:
10615         cb->args[2] = survey_idx;
10616         res = skb->len;
10617  out_err:
10618         kfree(attrbuf);
10619         wiphy_unlock(&rdev->wiphy);
10620         return res;
10621 }
10622
10623 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10624 {
10625         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10626                                   NL80211_WPA_VERSION_2 |
10627                                   NL80211_WPA_VERSION_3));
10628 }
10629
10630 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10631 {
10632         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10633         struct net_device *dev = info->user_ptr[1];
10634         struct ieee80211_channel *chan;
10635         const u8 *bssid, *ssid;
10636         int err, ssid_len;
10637         enum nl80211_auth_type auth_type;
10638         struct key_parse key;
10639         bool local_state_change;
10640         struct cfg80211_auth_request req = {};
10641         u32 freq;
10642
10643         if (!info->attrs[NL80211_ATTR_MAC])
10644                 return -EINVAL;
10645
10646         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10647                 return -EINVAL;
10648
10649         if (!info->attrs[NL80211_ATTR_SSID])
10650                 return -EINVAL;
10651
10652         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10653                 return -EINVAL;
10654
10655         err = nl80211_parse_key(info, &key);
10656         if (err)
10657                 return err;
10658
10659         if (key.idx >= 0) {
10660                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10661                         return -EINVAL;
10662                 if (!key.p.key || !key.p.key_len)
10663                         return -EINVAL;
10664                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10665                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10666                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10667                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10668                         return -EINVAL;
10669                 if (key.idx > 3)
10670                         return -EINVAL;
10671         } else {
10672                 key.p.key_len = 0;
10673                 key.p.key = NULL;
10674         }
10675
10676         if (key.idx >= 0) {
10677                 int i;
10678                 bool ok = false;
10679
10680                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10681                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10682                                 ok = true;
10683                                 break;
10684                         }
10685                 }
10686                 if (!ok)
10687                         return -EINVAL;
10688         }
10689
10690         if (!rdev->ops->auth)
10691                 return -EOPNOTSUPP;
10692
10693         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10694             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10695                 return -EOPNOTSUPP;
10696
10697         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10698         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10699         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10700                 freq +=
10701                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10702
10703         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10704         if (!chan)
10705                 return -EINVAL;
10706
10707         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10708         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10709
10710         if (info->attrs[NL80211_ATTR_IE]) {
10711                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10712                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10713         }
10714
10715         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10716         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10717                 return -EINVAL;
10718
10719         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10720              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10721              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10722              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10723             !info->attrs[NL80211_ATTR_AUTH_DATA])
10724                 return -EINVAL;
10725
10726         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10727                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10728                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10729                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10730                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10731                         return -EINVAL;
10732                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10733                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10734         }
10735
10736         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10737
10738         /*
10739          * Since we no longer track auth state, ignore
10740          * requests to only change local state.
10741          */
10742         if (local_state_change)
10743                 return 0;
10744
10745         req.auth_type = auth_type;
10746         req.key = key.p.key;
10747         req.key_len = key.p.key_len;
10748         req.key_idx = key.idx;
10749         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10750         if (req.link_id >= 0) {
10751                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10752                         return -EINVAL;
10753                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10754                         return -EINVAL;
10755                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10756                 if (!is_valid_ether_addr(req.ap_mld_addr))
10757                         return -EINVAL;
10758         }
10759
10760         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10761                                    IEEE80211_BSS_TYPE_ESS,
10762                                    IEEE80211_PRIVACY_ANY);
10763         if (!req.bss)
10764                 return -ENOENT;
10765
10766         wdev_lock(dev->ieee80211_ptr);
10767         err = cfg80211_mlme_auth(rdev, dev, &req);
10768         wdev_unlock(dev->ieee80211_ptr);
10769
10770         cfg80211_put_bss(&rdev->wiphy, req.bss);
10771
10772         return err;
10773 }
10774
10775 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10776                                      struct genl_info *info)
10777 {
10778         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10779                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10780                 return -EINVAL;
10781         }
10782
10783         if (!rdev->ops->tx_control_port ||
10784             !wiphy_ext_feature_isset(&rdev->wiphy,
10785                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10786                 return -EOPNOTSUPP;
10787
10788         return 0;
10789 }
10790
10791 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10792                                    struct genl_info *info,
10793                                    struct cfg80211_crypto_settings *settings,
10794                                    int cipher_limit)
10795 {
10796         memset(settings, 0, sizeof(*settings));
10797
10798         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10799
10800         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10801                 u16 proto;
10802
10803                 proto = nla_get_u16(
10804                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10805                 settings->control_port_ethertype = cpu_to_be16(proto);
10806                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10807                     proto != ETH_P_PAE)
10808                         return -EINVAL;
10809                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10810                         settings->control_port_no_encrypt = true;
10811         } else
10812                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10813
10814         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10815                 int r = validate_pae_over_nl80211(rdev, info);
10816
10817                 if (r < 0)
10818                         return r;
10819
10820                 settings->control_port_over_nl80211 = true;
10821
10822                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10823                         settings->control_port_no_preauth = true;
10824         }
10825
10826         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10827                 void *data;
10828                 int len, i;
10829
10830                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10831                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10832                 settings->n_ciphers_pairwise = len / sizeof(u32);
10833
10834                 if (len % sizeof(u32))
10835                         return -EINVAL;
10836
10837                 if (settings->n_ciphers_pairwise > cipher_limit)
10838                         return -EINVAL;
10839
10840                 memcpy(settings->ciphers_pairwise, data, len);
10841
10842                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10843                         if (!cfg80211_supported_cipher_suite(
10844                                         &rdev->wiphy,
10845                                         settings->ciphers_pairwise[i]))
10846                                 return -EINVAL;
10847         }
10848
10849         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10850                 settings->cipher_group =
10851                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10852                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10853                                                      settings->cipher_group))
10854                         return -EINVAL;
10855         }
10856
10857         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10858                 settings->wpa_versions =
10859                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10860                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10861                         return -EINVAL;
10862         }
10863
10864         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10865                 void *data;
10866                 int len;
10867
10868                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10869                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10870                 settings->n_akm_suites = len / sizeof(u32);
10871
10872                 if (len % sizeof(u32))
10873                         return -EINVAL;
10874
10875                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10876                         return -EINVAL;
10877
10878                 memcpy(settings->akm_suites, data, len);
10879         }
10880
10881         if (info->attrs[NL80211_ATTR_PMK]) {
10882                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10883                         return -EINVAL;
10884                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10885                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10886                     !wiphy_ext_feature_isset(&rdev->wiphy,
10887                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10888                         return -EINVAL;
10889                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10890         }
10891
10892         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10893                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10894                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10895                     !wiphy_ext_feature_isset(&rdev->wiphy,
10896                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10897                         return -EINVAL;
10898                 settings->sae_pwd =
10899                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10900                 settings->sae_pwd_len =
10901                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10902         }
10903
10904         if (info->attrs[NL80211_ATTR_SAE_PWE])
10905                 settings->sae_pwe =
10906                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10907         else
10908                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10909
10910         return 0;
10911 }
10912
10913 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10914                                               const u8 *ssid, int ssid_len,
10915                                               struct nlattr **attrs)
10916 {
10917         struct ieee80211_channel *chan;
10918         struct cfg80211_bss *bss;
10919         const u8 *bssid;
10920         u32 freq;
10921
10922         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10923                 return ERR_PTR(-EINVAL);
10924
10925         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10926
10927         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10928         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10929                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10930
10931         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10932         if (!chan)
10933                 return ERR_PTR(-EINVAL);
10934
10935         bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10936                                ssid, ssid_len,
10937                                IEEE80211_BSS_TYPE_ESS,
10938                                IEEE80211_PRIVACY_ANY);
10939         if (!bss)
10940                 return ERR_PTR(-ENOENT);
10941
10942         return bss;
10943 }
10944
10945 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10946 {
10947         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10948         struct net_device *dev = info->user_ptr[1];
10949         struct cfg80211_assoc_request req = {};
10950         struct nlattr **attrs = NULL;
10951         const u8 *ap_addr, *ssid;
10952         unsigned int link_id;
10953         int err, ssid_len;
10954
10955         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10956             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10957                 return -EPERM;
10958
10959         if (!info->attrs[NL80211_ATTR_SSID])
10960                 return -EINVAL;
10961
10962         if (!rdev->ops->assoc)
10963                 return -EOPNOTSUPP;
10964
10965         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10966             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10967                 return -EOPNOTSUPP;
10968
10969         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10970         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10971
10972         if (info->attrs[NL80211_ATTR_IE]) {
10973                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10974                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10975
10976                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10977                                            req.ie, req.ie_len)) {
10978                         GENL_SET_ERR_MSG(info,
10979                                          "non-inheritance makes no sense");
10980                         return -EINVAL;
10981                 }
10982         }
10983
10984         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10985                 enum nl80211_mfp mfp =
10986                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10987                 if (mfp == NL80211_MFP_REQUIRED)
10988                         req.use_mfp = true;
10989                 else if (mfp != NL80211_MFP_NO)
10990                         return -EINVAL;
10991         }
10992
10993         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10994                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10995
10996         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10997                 req.flags |= ASSOC_REQ_DISABLE_HT;
10998
10999         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11000                 memcpy(&req.ht_capa_mask,
11001                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11002                        sizeof(req.ht_capa_mask));
11003
11004         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11005                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11006                         return -EINVAL;
11007                 memcpy(&req.ht_capa,
11008                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11009                        sizeof(req.ht_capa));
11010         }
11011
11012         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11013                 req.flags |= ASSOC_REQ_DISABLE_VHT;
11014
11015         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11016                 req.flags |= ASSOC_REQ_DISABLE_HE;
11017
11018         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11019                 req.flags |= ASSOC_REQ_DISABLE_EHT;
11020
11021         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11022                 memcpy(&req.vht_capa_mask,
11023                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11024                        sizeof(req.vht_capa_mask));
11025
11026         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11027                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11028                         return -EINVAL;
11029                 memcpy(&req.vht_capa,
11030                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11031                        sizeof(req.vht_capa));
11032         }
11033
11034         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11035                 if (!((rdev->wiphy.features &
11036                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11037                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11038                     !wiphy_ext_feature_isset(&rdev->wiphy,
11039                                              NL80211_EXT_FEATURE_RRM))
11040                         return -EINVAL;
11041                 req.flags |= ASSOC_REQ_USE_RRM;
11042         }
11043
11044         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11045                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11046                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11047                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11048                         return -EINVAL;
11049                 req.fils_nonces =
11050                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11051         }
11052
11053         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11054                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11055                         return -EINVAL;
11056                 memcpy(&req.s1g_capa_mask,
11057                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11058                        sizeof(req.s1g_capa_mask));
11059         }
11060
11061         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11062                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11063                         return -EINVAL;
11064                 memcpy(&req.s1g_capa,
11065                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11066                        sizeof(req.s1g_capa));
11067         }
11068
11069         req.link_id = nl80211_link_id_or_invalid(info->attrs);
11070
11071         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11072                 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11073                 struct nlattr *link;
11074                 int rem = 0;
11075
11076                 if (req.link_id < 0)
11077                         return -EINVAL;
11078
11079                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11080                         return -EINVAL;
11081
11082                 if (info->attrs[NL80211_ATTR_MAC] ||
11083                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11084                     !info->attrs[NL80211_ATTR_MLD_ADDR])
11085                         return -EINVAL;
11086
11087                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11088                 ap_addr = req.ap_mld_addr;
11089
11090                 attrs = kzalloc(attrsize, GFP_KERNEL);
11091                 if (!attrs)
11092                         return -ENOMEM;
11093
11094                 nla_for_each_nested(link,
11095                                     info->attrs[NL80211_ATTR_MLO_LINKS],
11096                                     rem) {
11097                         memset(attrs, 0, attrsize);
11098
11099                         nla_parse_nested(attrs, NL80211_ATTR_MAX,
11100                                          link, NULL, NULL);
11101
11102                         if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11103                                 err = -EINVAL;
11104                                 goto free;
11105                         }
11106
11107                         link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11108                         /* cannot use the same link ID again */
11109                         if (req.links[link_id].bss) {
11110                                 err = -EINVAL;
11111                                 goto free;
11112                         }
11113                         req.links[link_id].bss =
11114                                 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11115                         if (IS_ERR(req.links[link_id].bss)) {
11116                                 err = PTR_ERR(req.links[link_id].bss);
11117                                 req.links[link_id].bss = NULL;
11118                                 goto free;
11119                         }
11120
11121                         if (attrs[NL80211_ATTR_IE]) {
11122                                 req.links[link_id].elems =
11123                                         nla_data(attrs[NL80211_ATTR_IE]);
11124                                 req.links[link_id].elems_len =
11125                                         nla_len(attrs[NL80211_ATTR_IE]);
11126
11127                                 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11128                                                        req.links[link_id].elems,
11129                                                        req.links[link_id].elems_len)) {
11130                                         GENL_SET_ERR_MSG(info,
11131                                                          "cannot deal with fragmentation");
11132                                         err = -EINVAL;
11133                                         goto free;
11134                                 }
11135
11136                                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11137                                                            req.links[link_id].elems,
11138                                                            req.links[link_id].elems_len)) {
11139                                         GENL_SET_ERR_MSG(info,
11140                                                          "cannot deal with non-inheritance");
11141                                         err = -EINVAL;
11142                                         goto free;
11143                                 }
11144                         }
11145
11146                         req.links[link_id].disabled =
11147                                 nla_get_flag(attrs[NL80211_ATTR_MLO_LINK_DISABLED]);
11148                 }
11149
11150                 if (!req.links[req.link_id].bss) {
11151                         err = -EINVAL;
11152                         goto free;
11153                 }
11154
11155                 if (req.links[req.link_id].elems_len) {
11156                         GENL_SET_ERR_MSG(info,
11157                                          "cannot have per-link elems on assoc link");
11158                         err = -EINVAL;
11159                         goto free;
11160                 }
11161
11162                 if (req.links[req.link_id].disabled) {
11163                         GENL_SET_ERR_MSG(info,
11164                                          "cannot have assoc link disabled");
11165                         err = -EINVAL;
11166                         goto free;
11167                 }
11168
11169                 kfree(attrs);
11170                 attrs = NULL;
11171         } else {
11172                 if (req.link_id >= 0)
11173                         return -EINVAL;
11174
11175                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11176                 if (IS_ERR(req.bss))
11177                         return PTR_ERR(req.bss);
11178                 ap_addr = req.bss->bssid;
11179         }
11180
11181         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11182         if (!err) {
11183                 wdev_lock(dev->ieee80211_ptr);
11184
11185                 err = cfg80211_mlme_assoc(rdev, dev, &req);
11186
11187                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11188                         dev->ieee80211_ptr->conn_owner_nlportid =
11189                                 info->snd_portid;
11190                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11191                                ap_addr, ETH_ALEN);
11192                 }
11193
11194                 wdev_unlock(dev->ieee80211_ptr);
11195         }
11196
11197 free:
11198         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11199                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11200         cfg80211_put_bss(&rdev->wiphy, req.bss);
11201         kfree(attrs);
11202
11203         return err;
11204 }
11205
11206 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11207 {
11208         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11209         struct net_device *dev = info->user_ptr[1];
11210         const u8 *ie = NULL, *bssid;
11211         int ie_len = 0, err;
11212         u16 reason_code;
11213         bool local_state_change;
11214
11215         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11216             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11217                 return -EPERM;
11218
11219         if (!info->attrs[NL80211_ATTR_MAC])
11220                 return -EINVAL;
11221
11222         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11223                 return -EINVAL;
11224
11225         if (!rdev->ops->deauth)
11226                 return -EOPNOTSUPP;
11227
11228         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11229             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11230                 return -EOPNOTSUPP;
11231
11232         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11233
11234         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11235         if (reason_code == 0) {
11236                 /* Reason Code 0 is reserved */
11237                 return -EINVAL;
11238         }
11239
11240         if (info->attrs[NL80211_ATTR_IE]) {
11241                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11242                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11243         }
11244
11245         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11246
11247         wdev_lock(dev->ieee80211_ptr);
11248         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11249                                    local_state_change);
11250         wdev_unlock(dev->ieee80211_ptr);
11251         return err;
11252 }
11253
11254 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11255 {
11256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11257         struct net_device *dev = info->user_ptr[1];
11258         const u8 *ie = NULL, *bssid;
11259         int ie_len = 0, err;
11260         u16 reason_code;
11261         bool local_state_change;
11262
11263         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11264             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11265                 return -EPERM;
11266
11267         if (!info->attrs[NL80211_ATTR_MAC])
11268                 return -EINVAL;
11269
11270         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11271                 return -EINVAL;
11272
11273         if (!rdev->ops->disassoc)
11274                 return -EOPNOTSUPP;
11275
11276         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11277             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11278                 return -EOPNOTSUPP;
11279
11280         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11281
11282         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11283         if (reason_code == 0) {
11284                 /* Reason Code 0 is reserved */
11285                 return -EINVAL;
11286         }
11287
11288         if (info->attrs[NL80211_ATTR_IE]) {
11289                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11290                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11291         }
11292
11293         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11294
11295         wdev_lock(dev->ieee80211_ptr);
11296         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11297                                      local_state_change);
11298         wdev_unlock(dev->ieee80211_ptr);
11299         return err;
11300 }
11301
11302 static bool
11303 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11304                          int mcast_rate[NUM_NL80211_BANDS],
11305                          int rateval)
11306 {
11307         struct wiphy *wiphy = &rdev->wiphy;
11308         bool found = false;
11309         int band, i;
11310
11311         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11312                 struct ieee80211_supported_band *sband;
11313
11314                 sband = wiphy->bands[band];
11315                 if (!sband)
11316                         continue;
11317
11318                 for (i = 0; i < sband->n_bitrates; i++) {
11319                         if (sband->bitrates[i].bitrate == rateval) {
11320                                 mcast_rate[band] = i + 1;
11321                                 found = true;
11322                                 break;
11323                         }
11324                 }
11325         }
11326
11327         return found;
11328 }
11329
11330 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11331 {
11332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11333         struct net_device *dev = info->user_ptr[1];
11334         struct cfg80211_ibss_params ibss;
11335         struct wiphy *wiphy;
11336         struct cfg80211_cached_keys *connkeys = NULL;
11337         int err;
11338
11339         memset(&ibss, 0, sizeof(ibss));
11340
11341         if (!info->attrs[NL80211_ATTR_SSID] ||
11342             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11343                 return -EINVAL;
11344
11345         ibss.beacon_interval = 100;
11346
11347         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11348                 ibss.beacon_interval =
11349                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11350
11351         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11352                                            ibss.beacon_interval);
11353         if (err)
11354                 return err;
11355
11356         if (!rdev->ops->join_ibss)
11357                 return -EOPNOTSUPP;
11358
11359         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11360                 return -EOPNOTSUPP;
11361
11362         wiphy = &rdev->wiphy;
11363
11364         if (info->attrs[NL80211_ATTR_MAC]) {
11365                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11366
11367                 if (!is_valid_ether_addr(ibss.bssid))
11368                         return -EINVAL;
11369         }
11370         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11371         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11372
11373         if (info->attrs[NL80211_ATTR_IE]) {
11374                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11375                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11376         }
11377
11378         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11379         if (err)
11380                 return err;
11381
11382         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11383                                      NL80211_IFTYPE_ADHOC))
11384                 return -EINVAL;
11385
11386         switch (ibss.chandef.width) {
11387         case NL80211_CHAN_WIDTH_5:
11388         case NL80211_CHAN_WIDTH_10:
11389         case NL80211_CHAN_WIDTH_20_NOHT:
11390                 break;
11391         case NL80211_CHAN_WIDTH_20:
11392         case NL80211_CHAN_WIDTH_40:
11393                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11394                         return -EINVAL;
11395                 break;
11396         case NL80211_CHAN_WIDTH_80:
11397         case NL80211_CHAN_WIDTH_80P80:
11398         case NL80211_CHAN_WIDTH_160:
11399                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11400                         return -EINVAL;
11401                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11402                                              NL80211_EXT_FEATURE_VHT_IBSS))
11403                         return -EINVAL;
11404                 break;
11405         case NL80211_CHAN_WIDTH_320:
11406                 return -EINVAL;
11407         default:
11408                 return -EINVAL;
11409         }
11410
11411         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11412         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11413
11414         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11415                 u8 *rates =
11416                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11417                 int n_rates =
11418                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11419                 struct ieee80211_supported_band *sband =
11420                         wiphy->bands[ibss.chandef.chan->band];
11421
11422                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11423                                              &ibss.basic_rates);
11424                 if (err)
11425                         return err;
11426         }
11427
11428         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11429                 memcpy(&ibss.ht_capa_mask,
11430                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11431                        sizeof(ibss.ht_capa_mask));
11432
11433         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11434                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11435                         return -EINVAL;
11436                 memcpy(&ibss.ht_capa,
11437                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11438                        sizeof(ibss.ht_capa));
11439         }
11440
11441         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11442             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11443                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11444                 return -EINVAL;
11445
11446         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11447                 bool no_ht = false;
11448
11449                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11450                 if (IS_ERR(connkeys))
11451                         return PTR_ERR(connkeys);
11452
11453                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11454                     no_ht) {
11455                         kfree_sensitive(connkeys);
11456                         return -EINVAL;
11457                 }
11458         }
11459
11460         ibss.control_port =
11461                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11462
11463         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11464                 int r = validate_pae_over_nl80211(rdev, info);
11465
11466                 if (r < 0) {
11467                         kfree_sensitive(connkeys);
11468                         return r;
11469                 }
11470
11471                 ibss.control_port_over_nl80211 = true;
11472         }
11473
11474         ibss.userspace_handles_dfs =
11475                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11476
11477         wdev_lock(dev->ieee80211_ptr);
11478         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11479         if (err)
11480                 kfree_sensitive(connkeys);
11481         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11482                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11483         wdev_unlock(dev->ieee80211_ptr);
11484
11485         return err;
11486 }
11487
11488 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11489 {
11490         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11491         struct net_device *dev = info->user_ptr[1];
11492
11493         if (!rdev->ops->leave_ibss)
11494                 return -EOPNOTSUPP;
11495
11496         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11497                 return -EOPNOTSUPP;
11498
11499         return cfg80211_leave_ibss(rdev, dev, false);
11500 }
11501
11502 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11503 {
11504         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11505         struct net_device *dev = info->user_ptr[1];
11506         int mcast_rate[NUM_NL80211_BANDS];
11507         u32 nla_rate;
11508
11509         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11510             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11511             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11512                 return -EOPNOTSUPP;
11513
11514         if (!rdev->ops->set_mcast_rate)
11515                 return -EOPNOTSUPP;
11516
11517         memset(mcast_rate, 0, sizeof(mcast_rate));
11518
11519         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11520                 return -EINVAL;
11521
11522         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11523         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11524                 return -EINVAL;
11525
11526         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11527 }
11528
11529 static struct sk_buff *
11530 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11531                             struct wireless_dev *wdev, int approxlen,
11532                             u32 portid, u32 seq, enum nl80211_commands cmd,
11533                             enum nl80211_attrs attr,
11534                             const struct nl80211_vendor_cmd_info *info,
11535                             gfp_t gfp)
11536 {
11537         struct sk_buff *skb;
11538         void *hdr;
11539         struct nlattr *data;
11540
11541         skb = nlmsg_new(approxlen + 100, gfp);
11542         if (!skb)
11543                 return NULL;
11544
11545         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11546         if (!hdr) {
11547                 kfree_skb(skb);
11548                 return NULL;
11549         }
11550
11551         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11552                 goto nla_put_failure;
11553
11554         if (info) {
11555                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11556                                 info->vendor_id))
11557                         goto nla_put_failure;
11558                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11559                                 info->subcmd))
11560                         goto nla_put_failure;
11561         }
11562
11563         if (wdev) {
11564                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11565                                       wdev_id(wdev), NL80211_ATTR_PAD))
11566                         goto nla_put_failure;
11567                 if (wdev->netdev &&
11568                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11569                                 wdev->netdev->ifindex))
11570                         goto nla_put_failure;
11571         }
11572
11573         data = nla_nest_start_noflag(skb, attr);
11574         if (!data)
11575                 goto nla_put_failure;
11576
11577         ((void **)skb->cb)[0] = rdev;
11578         ((void **)skb->cb)[1] = hdr;
11579         ((void **)skb->cb)[2] = data;
11580
11581         return skb;
11582
11583  nla_put_failure:
11584         kfree_skb(skb);
11585         return NULL;
11586 }
11587
11588 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11589                                            struct wireless_dev *wdev,
11590                                            enum nl80211_commands cmd,
11591                                            enum nl80211_attrs attr,
11592                                            unsigned int portid,
11593                                            int vendor_event_idx,
11594                                            int approxlen, gfp_t gfp)
11595 {
11596         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11597         const struct nl80211_vendor_cmd_info *info;
11598
11599         switch (cmd) {
11600         case NL80211_CMD_TESTMODE:
11601                 if (WARN_ON(vendor_event_idx != -1))
11602                         return NULL;
11603                 info = NULL;
11604                 break;
11605         case NL80211_CMD_VENDOR:
11606                 if (WARN_ON(vendor_event_idx < 0 ||
11607                             vendor_event_idx >= wiphy->n_vendor_events))
11608                         return NULL;
11609                 info = &wiphy->vendor_events[vendor_event_idx];
11610                 break;
11611         default:
11612                 WARN_ON(1);
11613                 return NULL;
11614         }
11615
11616         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11617                                            cmd, attr, info, gfp);
11618 }
11619 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11620
11621 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11622 {
11623         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11624         void *hdr = ((void **)skb->cb)[1];
11625         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11626         struct nlattr *data = ((void **)skb->cb)[2];
11627         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11628
11629         /* clear CB data for netlink core to own from now on */
11630         memset(skb->cb, 0, sizeof(skb->cb));
11631
11632         nla_nest_end(skb, data);
11633         genlmsg_end(skb, hdr);
11634
11635         if (nlhdr->nlmsg_pid) {
11636                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11637                                 nlhdr->nlmsg_pid);
11638         } else {
11639                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11640                         mcgrp = NL80211_MCGRP_VENDOR;
11641
11642                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11643                                         skb, 0, mcgrp, gfp);
11644         }
11645 }
11646 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11647
11648 #ifdef CONFIG_NL80211_TESTMODE
11649 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11650 {
11651         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11652         struct wireless_dev *wdev;
11653         int err;
11654
11655         lockdep_assert_held(&rdev->wiphy.mtx);
11656
11657         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11658                                           info->attrs);
11659
11660         if (!rdev->ops->testmode_cmd)
11661                 return -EOPNOTSUPP;
11662
11663         if (IS_ERR(wdev)) {
11664                 err = PTR_ERR(wdev);
11665                 if (err != -EINVAL)
11666                         return err;
11667                 wdev = NULL;
11668         } else if (wdev->wiphy != &rdev->wiphy) {
11669                 return -EINVAL;
11670         }
11671
11672         if (!info->attrs[NL80211_ATTR_TESTDATA])
11673                 return -EINVAL;
11674
11675         rdev->cur_cmd_info = info;
11676         err = rdev_testmode_cmd(rdev, wdev,
11677                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11678                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11679         rdev->cur_cmd_info = NULL;
11680
11681         return err;
11682 }
11683
11684 static int nl80211_testmode_dump(struct sk_buff *skb,
11685                                  struct netlink_callback *cb)
11686 {
11687         struct cfg80211_registered_device *rdev;
11688         struct nlattr **attrbuf = NULL;
11689         int err;
11690         long phy_idx;
11691         void *data = NULL;
11692         int data_len = 0;
11693
11694         rtnl_lock();
11695
11696         if (cb->args[0]) {
11697                 /*
11698                  * 0 is a valid index, but not valid for args[0],
11699                  * so we need to offset by 1.
11700                  */
11701                 phy_idx = cb->args[0] - 1;
11702
11703                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11704                 if (!rdev) {
11705                         err = -ENOENT;
11706                         goto out_err;
11707                 }
11708         } else {
11709                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11710                                   GFP_KERNEL);
11711                 if (!attrbuf) {
11712                         err = -ENOMEM;
11713                         goto out_err;
11714                 }
11715
11716                 err = nlmsg_parse_deprecated(cb->nlh,
11717                                              GENL_HDRLEN + nl80211_fam.hdrsize,
11718                                              attrbuf, nl80211_fam.maxattr,
11719                                              nl80211_policy, NULL);
11720                 if (err)
11721                         goto out_err;
11722
11723                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11724                 if (IS_ERR(rdev)) {
11725                         err = PTR_ERR(rdev);
11726                         goto out_err;
11727                 }
11728                 phy_idx = rdev->wiphy_idx;
11729
11730                 if (attrbuf[NL80211_ATTR_TESTDATA])
11731                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11732         }
11733
11734         if (cb->args[1]) {
11735                 data = nla_data((void *)cb->args[1]);
11736                 data_len = nla_len((void *)cb->args[1]);
11737         }
11738
11739         if (!rdev->ops->testmode_dump) {
11740                 err = -EOPNOTSUPP;
11741                 goto out_err;
11742         }
11743
11744         while (1) {
11745                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11746                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11747                                            NL80211_CMD_TESTMODE);
11748                 struct nlattr *tmdata;
11749
11750                 if (!hdr)
11751                         break;
11752
11753                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11754                         genlmsg_cancel(skb, hdr);
11755                         break;
11756                 }
11757
11758                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11759                 if (!tmdata) {
11760                         genlmsg_cancel(skb, hdr);
11761                         break;
11762                 }
11763                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11764                 nla_nest_end(skb, tmdata);
11765
11766                 if (err == -ENOBUFS || err == -ENOENT) {
11767                         genlmsg_cancel(skb, hdr);
11768                         break;
11769                 } else if (err) {
11770                         genlmsg_cancel(skb, hdr);
11771                         goto out_err;
11772                 }
11773
11774                 genlmsg_end(skb, hdr);
11775         }
11776
11777         err = skb->len;
11778         /* see above */
11779         cb->args[0] = phy_idx + 1;
11780  out_err:
11781         kfree(attrbuf);
11782         rtnl_unlock();
11783         return err;
11784 }
11785 #endif
11786
11787 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11788 {
11789         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11790         struct net_device *dev = info->user_ptr[1];
11791         struct cfg80211_connect_params connect;
11792         struct wiphy *wiphy;
11793         struct cfg80211_cached_keys *connkeys = NULL;
11794         u32 freq = 0;
11795         int err;
11796
11797         memset(&connect, 0, sizeof(connect));
11798
11799         if (!info->attrs[NL80211_ATTR_SSID] ||
11800             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11801                 return -EINVAL;
11802
11803         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11804                 connect.auth_type =
11805                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11806                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11807                                              NL80211_CMD_CONNECT))
11808                         return -EINVAL;
11809         } else
11810                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11811
11812         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11813
11814         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11815             !wiphy_ext_feature_isset(&rdev->wiphy,
11816                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11817                 return -EINVAL;
11818         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11819
11820         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11821                                       NL80211_MAX_NR_CIPHER_SUITES);
11822         if (err)
11823                 return err;
11824
11825         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11826             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11827                 return -EOPNOTSUPP;
11828
11829         wiphy = &rdev->wiphy;
11830
11831         connect.bg_scan_period = -1;
11832         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11833                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11834                 connect.bg_scan_period =
11835                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11836         }
11837
11838         if (info->attrs[NL80211_ATTR_MAC])
11839                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11840         else if (info->attrs[NL80211_ATTR_MAC_HINT])
11841                 connect.bssid_hint =
11842                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11843         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11844         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11845
11846         if (info->attrs[NL80211_ATTR_IE]) {
11847                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11848                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11849         }
11850
11851         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11852                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11853                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11854                     !wiphy_ext_feature_isset(&rdev->wiphy,
11855                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
11856                         return -EOPNOTSUPP;
11857         } else {
11858                 connect.mfp = NL80211_MFP_NO;
11859         }
11860
11861         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11862                 connect.prev_bssid =
11863                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11864
11865         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11866                 freq = MHZ_TO_KHZ(nla_get_u32(
11867                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11868         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11869                 freq +=
11870                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11871
11872         if (freq) {
11873                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11874                 if (!connect.channel)
11875                         return -EINVAL;
11876         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11877                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11878                 freq = MHZ_TO_KHZ(freq);
11879                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11880                 if (!connect.channel_hint)
11881                         return -EINVAL;
11882         }
11883
11884         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11885                 connect.edmg.channels =
11886                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11887
11888                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11889                         connect.edmg.bw_config =
11890                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11891         }
11892
11893         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11894                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11895                 if (IS_ERR(connkeys))
11896                         return PTR_ERR(connkeys);
11897         }
11898
11899         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11900                 connect.flags |= ASSOC_REQ_DISABLE_HT;
11901
11902         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11903                 memcpy(&connect.ht_capa_mask,
11904                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11905                        sizeof(connect.ht_capa_mask));
11906
11907         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11908                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11909                         kfree_sensitive(connkeys);
11910                         return -EINVAL;
11911                 }
11912                 memcpy(&connect.ht_capa,
11913                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11914                        sizeof(connect.ht_capa));
11915         }
11916
11917         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11918                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11919
11920         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11921                 connect.flags |= ASSOC_REQ_DISABLE_HE;
11922
11923         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11924                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11925
11926         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11927                 memcpy(&connect.vht_capa_mask,
11928                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11929                        sizeof(connect.vht_capa_mask));
11930
11931         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11932                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11933                         kfree_sensitive(connkeys);
11934                         return -EINVAL;
11935                 }
11936                 memcpy(&connect.vht_capa,
11937                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11938                        sizeof(connect.vht_capa));
11939         }
11940
11941         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11942                 if (!((rdev->wiphy.features &
11943                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11944                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11945                     !wiphy_ext_feature_isset(&rdev->wiphy,
11946                                              NL80211_EXT_FEATURE_RRM)) {
11947                         kfree_sensitive(connkeys);
11948                         return -EINVAL;
11949                 }
11950                 connect.flags |= ASSOC_REQ_USE_RRM;
11951         }
11952
11953         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11954         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11955                 kfree_sensitive(connkeys);
11956                 return -EOPNOTSUPP;
11957         }
11958
11959         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11960                 /* bss selection makes no sense if bssid is set */
11961                 if (connect.bssid) {
11962                         kfree_sensitive(connkeys);
11963                         return -EINVAL;
11964                 }
11965
11966                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11967                                        wiphy, &connect.bss_select);
11968                 if (err) {
11969                         kfree_sensitive(connkeys);
11970                         return err;
11971                 }
11972         }
11973
11974         if (wiphy_ext_feature_isset(&rdev->wiphy,
11975                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11976             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11977             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11978             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11979             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11980                 connect.fils_erp_username =
11981                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11982                 connect.fils_erp_username_len =
11983                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11984                 connect.fils_erp_realm =
11985                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11986                 connect.fils_erp_realm_len =
11987                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11988                 connect.fils_erp_next_seq_num =
11989                         nla_get_u16(
11990                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11991                 connect.fils_erp_rrk =
11992                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11993                 connect.fils_erp_rrk_len =
11994                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11995         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11996                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11997                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11998                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11999                 kfree_sensitive(connkeys);
12000                 return -EINVAL;
12001         }
12002
12003         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
12004                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12005                         kfree_sensitive(connkeys);
12006                         GENL_SET_ERR_MSG(info,
12007                                          "external auth requires connection ownership");
12008                         return -EINVAL;
12009                 }
12010                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
12011         }
12012
12013         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
12014                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
12015
12016         wdev_lock(dev->ieee80211_ptr);
12017
12018         err = cfg80211_connect(rdev, dev, &connect, connkeys,
12019                                connect.prev_bssid);
12020         if (err)
12021                 kfree_sensitive(connkeys);
12022
12023         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
12024                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
12025                 if (connect.bssid)
12026                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
12027                                connect.bssid, ETH_ALEN);
12028                 else
12029                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
12030         }
12031
12032         wdev_unlock(dev->ieee80211_ptr);
12033
12034         return err;
12035 }
12036
12037 static int nl80211_update_connect_params(struct sk_buff *skb,
12038                                          struct genl_info *info)
12039 {
12040         struct cfg80211_connect_params connect = {};
12041         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12042         struct net_device *dev = info->user_ptr[1];
12043         struct wireless_dev *wdev = dev->ieee80211_ptr;
12044         bool fils_sk_offload;
12045         u32 auth_type;
12046         u32 changed = 0;
12047         int ret;
12048
12049         if (!rdev->ops->update_connect_params)
12050                 return -EOPNOTSUPP;
12051
12052         if (info->attrs[NL80211_ATTR_IE]) {
12053                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12054                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12055                 changed |= UPDATE_ASSOC_IES;
12056         }
12057
12058         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12059                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12060
12061         /*
12062          * when driver supports fils-sk offload all attributes must be
12063          * provided. So the else covers "fils-sk-not-all" and
12064          * "no-fils-sk-any".
12065          */
12066         if (fils_sk_offload &&
12067             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12068             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12069             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12070             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12071                 connect.fils_erp_username =
12072                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12073                 connect.fils_erp_username_len =
12074                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12075                 connect.fils_erp_realm =
12076                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12077                 connect.fils_erp_realm_len =
12078                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12079                 connect.fils_erp_next_seq_num =
12080                         nla_get_u16(
12081                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12082                 connect.fils_erp_rrk =
12083                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12084                 connect.fils_erp_rrk_len =
12085                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12086                 changed |= UPDATE_FILS_ERP_INFO;
12087         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12088                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12089                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12090                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12091                 return -EINVAL;
12092         }
12093
12094         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12095                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12096                 if (!nl80211_valid_auth_type(rdev, auth_type,
12097                                              NL80211_CMD_CONNECT))
12098                         return -EINVAL;
12099
12100                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12101                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12102                         return -EINVAL;
12103
12104                 connect.auth_type = auth_type;
12105                 changed |= UPDATE_AUTH_TYPE;
12106         }
12107
12108         wdev_lock(dev->ieee80211_ptr);
12109         if (!wdev->connected)
12110                 ret = -ENOLINK;
12111         else
12112                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
12113         wdev_unlock(dev->ieee80211_ptr);
12114
12115         return ret;
12116 }
12117
12118 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12119 {
12120         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12121         struct net_device *dev = info->user_ptr[1];
12122         u16 reason;
12123         int ret;
12124
12125         if (dev->ieee80211_ptr->conn_owner_nlportid &&
12126             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12127                 return -EPERM;
12128
12129         if (!info->attrs[NL80211_ATTR_REASON_CODE])
12130                 reason = WLAN_REASON_DEAUTH_LEAVING;
12131         else
12132                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12133
12134         if (reason == 0)
12135                 return -EINVAL;
12136
12137         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12138             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12139                 return -EOPNOTSUPP;
12140
12141         wdev_lock(dev->ieee80211_ptr);
12142         ret = cfg80211_disconnect(rdev, dev, reason, true);
12143         wdev_unlock(dev->ieee80211_ptr);
12144         return ret;
12145 }
12146
12147 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12148 {
12149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12150         struct net *net;
12151         int err;
12152
12153         if (info->attrs[NL80211_ATTR_PID]) {
12154                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12155
12156                 net = get_net_ns_by_pid(pid);
12157         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12158                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12159
12160                 net = get_net_ns_by_fd(fd);
12161         } else {
12162                 return -EINVAL;
12163         }
12164
12165         if (IS_ERR(net))
12166                 return PTR_ERR(net);
12167
12168         err = 0;
12169
12170         /* check if anything to do */
12171         if (!net_eq(wiphy_net(&rdev->wiphy), net))
12172                 err = cfg80211_switch_netns(rdev, net);
12173
12174         put_net(net);
12175         return err;
12176 }
12177
12178 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12179 {
12180         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12181         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12182                         struct cfg80211_pmksa *pmksa) = NULL;
12183         struct net_device *dev = info->user_ptr[1];
12184         struct cfg80211_pmksa pmksa;
12185
12186         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12187
12188         if (!info->attrs[NL80211_ATTR_PMKID])
12189                 return -EINVAL;
12190
12191         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12192
12193         if (info->attrs[NL80211_ATTR_MAC]) {
12194                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12195         } else if (info->attrs[NL80211_ATTR_SSID] &&
12196                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12197                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12198                     info->attrs[NL80211_ATTR_PMK])) {
12199                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12200                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12201                 pmksa.cache_id =
12202                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12203         } else {
12204                 return -EINVAL;
12205         }
12206         if (info->attrs[NL80211_ATTR_PMK]) {
12207                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12208                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12209         }
12210
12211         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12212                 pmksa.pmk_lifetime =
12213                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12214
12215         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12216                 pmksa.pmk_reauth_threshold =
12217                         nla_get_u8(
12218                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12219
12220         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12221             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12222             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12223               wiphy_ext_feature_isset(&rdev->wiphy,
12224                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12225                 return -EOPNOTSUPP;
12226
12227         switch (info->genlhdr->cmd) {
12228         case NL80211_CMD_SET_PMKSA:
12229                 rdev_ops = rdev->ops->set_pmksa;
12230                 break;
12231         case NL80211_CMD_DEL_PMKSA:
12232                 rdev_ops = rdev->ops->del_pmksa;
12233                 break;
12234         default:
12235                 WARN_ON(1);
12236                 break;
12237         }
12238
12239         if (!rdev_ops)
12240                 return -EOPNOTSUPP;
12241
12242         return rdev_ops(&rdev->wiphy, dev, &pmksa);
12243 }
12244
12245 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12246 {
12247         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12248         struct net_device *dev = info->user_ptr[1];
12249
12250         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12251             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12252                 return -EOPNOTSUPP;
12253
12254         if (!rdev->ops->flush_pmksa)
12255                 return -EOPNOTSUPP;
12256
12257         return rdev_flush_pmksa(rdev, dev);
12258 }
12259
12260 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12261 {
12262         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12263         struct net_device *dev = info->user_ptr[1];
12264         u8 action_code, dialog_token;
12265         u32 peer_capability = 0;
12266         u16 status_code;
12267         u8 *peer;
12268         int link_id;
12269         bool initiator;
12270
12271         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12272             !rdev->ops->tdls_mgmt)
12273                 return -EOPNOTSUPP;
12274
12275         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12276             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12277             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12278             !info->attrs[NL80211_ATTR_IE] ||
12279             !info->attrs[NL80211_ATTR_MAC])
12280                 return -EINVAL;
12281
12282         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12283         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12284         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12285         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12286         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12287         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12288                 peer_capability =
12289                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12290         link_id = nl80211_link_id_or_invalid(info->attrs);
12291
12292         return rdev_tdls_mgmt(rdev, dev, peer, link_id, action_code,
12293                               dialog_token, status_code, peer_capability,
12294                               initiator,
12295                               nla_data(info->attrs[NL80211_ATTR_IE]),
12296                               nla_len(info->attrs[NL80211_ATTR_IE]));
12297 }
12298
12299 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12300 {
12301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12302         struct net_device *dev = info->user_ptr[1];
12303         enum nl80211_tdls_operation operation;
12304         u8 *peer;
12305
12306         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12307             !rdev->ops->tdls_oper)
12308                 return -EOPNOTSUPP;
12309
12310         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12311             !info->attrs[NL80211_ATTR_MAC])
12312                 return -EINVAL;
12313
12314         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12315         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12316
12317         return rdev_tdls_oper(rdev, dev, peer, operation);
12318 }
12319
12320 static int nl80211_remain_on_channel(struct sk_buff *skb,
12321                                      struct genl_info *info)
12322 {
12323         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12324         unsigned int link_id = nl80211_link_id(info->attrs);
12325         struct wireless_dev *wdev = info->user_ptr[1];
12326         struct cfg80211_chan_def chandef;
12327         struct sk_buff *msg;
12328         void *hdr;
12329         u64 cookie;
12330         u32 duration;
12331         int err;
12332
12333         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12334             !info->attrs[NL80211_ATTR_DURATION])
12335                 return -EINVAL;
12336
12337         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12338
12339         if (!rdev->ops->remain_on_channel ||
12340             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12341                 return -EOPNOTSUPP;
12342
12343         /*
12344          * We should be on that channel for at least a minimum amount of
12345          * time (10ms) but no longer than the driver supports.
12346          */
12347         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12348             duration > rdev->wiphy.max_remain_on_channel_duration)
12349                 return -EINVAL;
12350
12351         err = nl80211_parse_chandef(rdev, info, &chandef);
12352         if (err)
12353                 return err;
12354
12355         wdev_lock(wdev);
12356         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12357                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12358
12359                 oper_chandef = wdev_chandef(wdev, link_id);
12360
12361                 if (WARN_ON(!oper_chandef)) {
12362                         /* cannot happen since we must beacon to get here */
12363                         WARN_ON(1);
12364                         wdev_unlock(wdev);
12365                         return -EBUSY;
12366                 }
12367
12368                 /* note: returns first one if identical chandefs */
12369                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12370                                                              oper_chandef);
12371
12372                 if (compat_chandef != &chandef) {
12373                         wdev_unlock(wdev);
12374                         return -EBUSY;
12375                 }
12376         }
12377         wdev_unlock(wdev);
12378
12379         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12380         if (!msg)
12381                 return -ENOMEM;
12382
12383         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12384                              NL80211_CMD_REMAIN_ON_CHANNEL);
12385         if (!hdr) {
12386                 err = -ENOBUFS;
12387                 goto free_msg;
12388         }
12389
12390         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12391                                      duration, &cookie);
12392
12393         if (err)
12394                 goto free_msg;
12395
12396         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12397                               NL80211_ATTR_PAD))
12398                 goto nla_put_failure;
12399
12400         genlmsg_end(msg, hdr);
12401
12402         return genlmsg_reply(msg, info);
12403
12404  nla_put_failure:
12405         err = -ENOBUFS;
12406  free_msg:
12407         nlmsg_free(msg);
12408         return err;
12409 }
12410
12411 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12412                                             struct genl_info *info)
12413 {
12414         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12415         struct wireless_dev *wdev = info->user_ptr[1];
12416         u64 cookie;
12417
12418         if (!info->attrs[NL80211_ATTR_COOKIE])
12419                 return -EINVAL;
12420
12421         if (!rdev->ops->cancel_remain_on_channel)
12422                 return -EOPNOTSUPP;
12423
12424         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12425
12426         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12427 }
12428
12429 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12430                                        struct genl_info *info)
12431 {
12432         struct cfg80211_bitrate_mask mask;
12433         unsigned int link_id = nl80211_link_id(info->attrs);
12434         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12435         struct net_device *dev = info->user_ptr[1];
12436         struct wireless_dev *wdev = dev->ieee80211_ptr;
12437         int err;
12438
12439         if (!rdev->ops->set_bitrate_mask)
12440                 return -EOPNOTSUPP;
12441
12442         wdev_lock(wdev);
12443         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12444                                             NL80211_ATTR_TX_RATES, &mask,
12445                                             dev, true, link_id);
12446         if (err)
12447                 goto out;
12448
12449         err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12450 out:
12451         wdev_unlock(wdev);
12452         return err;
12453 }
12454
12455 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12456 {
12457         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12458         struct wireless_dev *wdev = info->user_ptr[1];
12459         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12460
12461         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12462                 return -EINVAL;
12463
12464         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12465                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12466
12467         switch (wdev->iftype) {
12468         case NL80211_IFTYPE_STATION:
12469         case NL80211_IFTYPE_ADHOC:
12470         case NL80211_IFTYPE_P2P_CLIENT:
12471         case NL80211_IFTYPE_AP:
12472         case NL80211_IFTYPE_AP_VLAN:
12473         case NL80211_IFTYPE_MESH_POINT:
12474         case NL80211_IFTYPE_P2P_GO:
12475         case NL80211_IFTYPE_P2P_DEVICE:
12476                 break;
12477         case NL80211_IFTYPE_NAN:
12478                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12479                                              NL80211_EXT_FEATURE_SECURE_NAN))
12480                         return -EOPNOTSUPP;
12481                 break;
12482         default:
12483                 return -EOPNOTSUPP;
12484         }
12485
12486         /* not much point in registering if we can't reply */
12487         if (!rdev->ops->mgmt_tx)
12488                 return -EOPNOTSUPP;
12489
12490         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12491             !wiphy_ext_feature_isset(&rdev->wiphy,
12492                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12493                 GENL_SET_ERR_MSG(info,
12494                                  "multicast RX registrations are not supported");
12495                 return -EOPNOTSUPP;
12496         }
12497
12498         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12499                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12500                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12501                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12502                                            info->extack);
12503 }
12504
12505 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12506 {
12507         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12508         struct wireless_dev *wdev = info->user_ptr[1];
12509         struct cfg80211_chan_def chandef;
12510         int err;
12511         void *hdr = NULL;
12512         u64 cookie;
12513         struct sk_buff *msg = NULL;
12514         struct cfg80211_mgmt_tx_params params = {
12515                 .dont_wait_for_ack =
12516                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12517         };
12518
12519         if (!info->attrs[NL80211_ATTR_FRAME])
12520                 return -EINVAL;
12521
12522         if (!rdev->ops->mgmt_tx)
12523                 return -EOPNOTSUPP;
12524
12525         switch (wdev->iftype) {
12526         case NL80211_IFTYPE_P2P_DEVICE:
12527                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12528                         return -EINVAL;
12529                 break;
12530         case NL80211_IFTYPE_STATION:
12531         case NL80211_IFTYPE_ADHOC:
12532         case NL80211_IFTYPE_P2P_CLIENT:
12533         case NL80211_IFTYPE_AP:
12534         case NL80211_IFTYPE_AP_VLAN:
12535         case NL80211_IFTYPE_MESH_POINT:
12536         case NL80211_IFTYPE_P2P_GO:
12537                 break;
12538         case NL80211_IFTYPE_NAN:
12539                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12540                                              NL80211_EXT_FEATURE_SECURE_NAN))
12541                         return -EOPNOTSUPP;
12542                 break;
12543         default:
12544                 return -EOPNOTSUPP;
12545         }
12546
12547         if (info->attrs[NL80211_ATTR_DURATION]) {
12548                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12549                         return -EINVAL;
12550                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12551
12552                 /*
12553                  * We should wait on the channel for at least a minimum amount
12554                  * of time (10ms) but no longer than the driver supports.
12555                  */
12556                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12557                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12558                         return -EINVAL;
12559         }
12560
12561         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12562
12563         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12564                 return -EINVAL;
12565
12566         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12567
12568         /* get the channel if any has been specified, otherwise pass NULL to
12569          * the driver. The latter will use the current one
12570          */
12571         chandef.chan = NULL;
12572         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12573                 err = nl80211_parse_chandef(rdev, info, &chandef);
12574                 if (err)
12575                         return err;
12576         }
12577
12578         if (!chandef.chan && params.offchan)
12579                 return -EINVAL;
12580
12581         wdev_lock(wdev);
12582         if (params.offchan &&
12583             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12584                 wdev_unlock(wdev);
12585                 return -EBUSY;
12586         }
12587
12588         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12589         /*
12590          * This now races due to the unlock, but we cannot check
12591          * the valid links for the _station_ anyway, so that's up
12592          * to the driver.
12593          */
12594         if (params.link_id >= 0 &&
12595             !(wdev->valid_links & BIT(params.link_id))) {
12596                 wdev_unlock(wdev);
12597                 return -EINVAL;
12598         }
12599         wdev_unlock(wdev);
12600
12601         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12602         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12603
12604         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12605                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12606                 int i;
12607
12608                 if (len % sizeof(u16))
12609                         return -EINVAL;
12610
12611                 params.n_csa_offsets = len / sizeof(u16);
12612                 params.csa_offsets =
12613                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12614
12615                 /* check that all the offsets fit the frame */
12616                 for (i = 0; i < params.n_csa_offsets; i++) {
12617                         if (params.csa_offsets[i] >= params.len)
12618                                 return -EINVAL;
12619                 }
12620         }
12621
12622         if (!params.dont_wait_for_ack) {
12623                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12624                 if (!msg)
12625                         return -ENOMEM;
12626
12627                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12628                                      NL80211_CMD_FRAME);
12629                 if (!hdr) {
12630                         err = -ENOBUFS;
12631                         goto free_msg;
12632                 }
12633         }
12634
12635         params.chan = chandef.chan;
12636         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12637         if (err)
12638                 goto free_msg;
12639
12640         if (msg) {
12641                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12642                                       NL80211_ATTR_PAD))
12643                         goto nla_put_failure;
12644
12645                 genlmsg_end(msg, hdr);
12646                 return genlmsg_reply(msg, info);
12647         }
12648
12649         return 0;
12650
12651  nla_put_failure:
12652         err = -ENOBUFS;
12653  free_msg:
12654         nlmsg_free(msg);
12655         return err;
12656 }
12657
12658 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12659 {
12660         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12661         struct wireless_dev *wdev = info->user_ptr[1];
12662         u64 cookie;
12663
12664         if (!info->attrs[NL80211_ATTR_COOKIE])
12665                 return -EINVAL;
12666
12667         if (!rdev->ops->mgmt_tx_cancel_wait)
12668                 return -EOPNOTSUPP;
12669
12670         switch (wdev->iftype) {
12671         case NL80211_IFTYPE_STATION:
12672         case NL80211_IFTYPE_ADHOC:
12673         case NL80211_IFTYPE_P2P_CLIENT:
12674         case NL80211_IFTYPE_AP:
12675         case NL80211_IFTYPE_AP_VLAN:
12676         case NL80211_IFTYPE_P2P_GO:
12677         case NL80211_IFTYPE_P2P_DEVICE:
12678                 break;
12679         case NL80211_IFTYPE_NAN:
12680                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12681                                              NL80211_EXT_FEATURE_SECURE_NAN))
12682                         return -EOPNOTSUPP;
12683                 break;
12684         default:
12685                 return -EOPNOTSUPP;
12686         }
12687
12688         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12689
12690         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12691 }
12692
12693 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12694 {
12695         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12696         struct wireless_dev *wdev;
12697         struct net_device *dev = info->user_ptr[1];
12698         u8 ps_state;
12699         bool state;
12700         int err;
12701
12702         if (!info->attrs[NL80211_ATTR_PS_STATE])
12703                 return -EINVAL;
12704
12705         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12706
12707         wdev = dev->ieee80211_ptr;
12708
12709         if (!rdev->ops->set_power_mgmt)
12710                 return -EOPNOTSUPP;
12711
12712         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12713
12714         if (state == wdev->ps)
12715                 return 0;
12716
12717         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12718         if (!err)
12719                 wdev->ps = state;
12720         return err;
12721 }
12722
12723 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12724 {
12725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12726         enum nl80211_ps_state ps_state;
12727         struct wireless_dev *wdev;
12728         struct net_device *dev = info->user_ptr[1];
12729         struct sk_buff *msg;
12730         void *hdr;
12731         int err;
12732
12733         wdev = dev->ieee80211_ptr;
12734
12735         if (!rdev->ops->set_power_mgmt)
12736                 return -EOPNOTSUPP;
12737
12738         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12739         if (!msg)
12740                 return -ENOMEM;
12741
12742         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12743                              NL80211_CMD_GET_POWER_SAVE);
12744         if (!hdr) {
12745                 err = -ENOBUFS;
12746                 goto free_msg;
12747         }
12748
12749         if (wdev->ps)
12750                 ps_state = NL80211_PS_ENABLED;
12751         else
12752                 ps_state = NL80211_PS_DISABLED;
12753
12754         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12755                 goto nla_put_failure;
12756
12757         genlmsg_end(msg, hdr);
12758         return genlmsg_reply(msg, info);
12759
12760  nla_put_failure:
12761         err = -ENOBUFS;
12762  free_msg:
12763         nlmsg_free(msg);
12764         return err;
12765 }
12766
12767 static const struct nla_policy
12768 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12769         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12770         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12771         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12772         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12773         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12774         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12775         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12776 };
12777
12778 static int nl80211_set_cqm_txe(struct genl_info *info,
12779                                u32 rate, u32 pkts, u32 intvl)
12780 {
12781         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12782         struct net_device *dev = info->user_ptr[1];
12783         struct wireless_dev *wdev = dev->ieee80211_ptr;
12784
12785         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12786                 return -EINVAL;
12787
12788         if (!rdev->ops->set_cqm_txe_config)
12789                 return -EOPNOTSUPP;
12790
12791         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12792             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12793                 return -EOPNOTSUPP;
12794
12795         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12796 }
12797
12798 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12799                                     struct net_device *dev)
12800 {
12801         struct wireless_dev *wdev = dev->ieee80211_ptr;
12802         s32 last, low, high;
12803         u32 hyst;
12804         int i, n, low_index;
12805         int err;
12806
12807         /* RSSI reporting disabled? */
12808         if (!wdev->cqm_config)
12809                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12810
12811         /*
12812          * Obtain current RSSI value if possible, if not and no RSSI threshold
12813          * event has been received yet, we should receive an event after a
12814          * connection is established and enough beacons received to calculate
12815          * the average.
12816          */
12817         if (!wdev->cqm_config->last_rssi_event_value &&
12818             wdev->links[0].client.current_bss &&
12819             rdev->ops->get_station) {
12820                 struct station_info sinfo = {};
12821                 u8 *mac_addr;
12822
12823                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12824
12825                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12826                 if (err)
12827                         return err;
12828
12829                 cfg80211_sinfo_release_content(&sinfo);
12830                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12831                         wdev->cqm_config->last_rssi_event_value =
12832                                 (s8) sinfo.rx_beacon_signal_avg;
12833         }
12834
12835         last = wdev->cqm_config->last_rssi_event_value;
12836         hyst = wdev->cqm_config->rssi_hyst;
12837         n = wdev->cqm_config->n_rssi_thresholds;
12838
12839         for (i = 0; i < n; i++) {
12840                 i = array_index_nospec(i, n);
12841                 if (last < wdev->cqm_config->rssi_thresholds[i])
12842                         break;
12843         }
12844
12845         low_index = i - 1;
12846         if (low_index >= 0) {
12847                 low_index = array_index_nospec(low_index, n);
12848                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
12849         } else {
12850                 low = S32_MIN;
12851         }
12852         if (i < n) {
12853                 i = array_index_nospec(i, n);
12854                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
12855         } else {
12856                 high = S32_MAX;
12857         }
12858
12859         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12860 }
12861
12862 static int nl80211_set_cqm_rssi(struct genl_info *info,
12863                                 const s32 *thresholds, int n_thresholds,
12864                                 u32 hysteresis)
12865 {
12866         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12867         struct net_device *dev = info->user_ptr[1];
12868         struct wireless_dev *wdev = dev->ieee80211_ptr;
12869         int i, err;
12870         s32 prev = S32_MIN;
12871
12872         /* Check all values negative and sorted */
12873         for (i = 0; i < n_thresholds; i++) {
12874                 if (thresholds[i] > 0 || thresholds[i] <= prev)
12875                         return -EINVAL;
12876
12877                 prev = thresholds[i];
12878         }
12879
12880         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12881             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12882                 return -EOPNOTSUPP;
12883
12884         wdev_lock(wdev);
12885         cfg80211_cqm_config_free(wdev);
12886         wdev_unlock(wdev);
12887
12888         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12889                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12890                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12891
12892                 return rdev_set_cqm_rssi_config(rdev, dev,
12893                                                 thresholds[0], hysteresis);
12894         }
12895
12896         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12897                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12898                 return -EOPNOTSUPP;
12899
12900         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12901                 n_thresholds = 0;
12902
12903         wdev_lock(wdev);
12904         if (n_thresholds) {
12905                 struct cfg80211_cqm_config *cqm_config;
12906
12907                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12908                                                  n_thresholds),
12909                                      GFP_KERNEL);
12910                 if (!cqm_config) {
12911                         err = -ENOMEM;
12912                         goto unlock;
12913                 }
12914
12915                 cqm_config->rssi_hyst = hysteresis;
12916                 cqm_config->n_rssi_thresholds = n_thresholds;
12917                 memcpy(cqm_config->rssi_thresholds, thresholds,
12918                        flex_array_size(cqm_config, rssi_thresholds,
12919                                        n_thresholds));
12920
12921                 wdev->cqm_config = cqm_config;
12922         }
12923
12924         err = cfg80211_cqm_rssi_update(rdev, dev);
12925
12926 unlock:
12927         wdev_unlock(wdev);
12928
12929         return err;
12930 }
12931
12932 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12933 {
12934         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12935         struct nlattr *cqm;
12936         int err;
12937
12938         cqm = info->attrs[NL80211_ATTR_CQM];
12939         if (!cqm)
12940                 return -EINVAL;
12941
12942         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12943                                           nl80211_attr_cqm_policy,
12944                                           info->extack);
12945         if (err)
12946                 return err;
12947
12948         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12949             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12950                 const s32 *thresholds =
12951                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12952                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12953                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12954
12955                 if (len % 4)
12956                         return -EINVAL;
12957
12958                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12959                                             hysteresis);
12960         }
12961
12962         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12963             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12964             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12965                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12966                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12967                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12968
12969                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12970         }
12971
12972         return -EINVAL;
12973 }
12974
12975 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12976 {
12977         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12978         struct net_device *dev = info->user_ptr[1];
12979         struct ocb_setup setup = {};
12980         int err;
12981
12982         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12983         if (err)
12984                 return err;
12985
12986         return cfg80211_join_ocb(rdev, dev, &setup);
12987 }
12988
12989 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12990 {
12991         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12992         struct net_device *dev = info->user_ptr[1];
12993
12994         return cfg80211_leave_ocb(rdev, dev);
12995 }
12996
12997 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12998 {
12999         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13000         struct net_device *dev = info->user_ptr[1];
13001         struct mesh_config cfg;
13002         struct mesh_setup setup;
13003         int err;
13004
13005         /* start with default */
13006         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
13007         memcpy(&setup, &default_mesh_setup, sizeof(setup));
13008
13009         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
13010                 /* and parse parameters if given */
13011                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
13012                 if (err)
13013                         return err;
13014         }
13015
13016         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
13017             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
13018                 return -EINVAL;
13019
13020         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
13021         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
13022
13023         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
13024             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
13025                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
13026                         return -EINVAL;
13027
13028         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
13029                 setup.beacon_interval =
13030                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
13031
13032                 err = cfg80211_validate_beacon_int(rdev,
13033                                                    NL80211_IFTYPE_MESH_POINT,
13034                                                    setup.beacon_interval);
13035                 if (err)
13036                         return err;
13037         }
13038
13039         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
13040                 setup.dtim_period =
13041                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13042                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13043                         return -EINVAL;
13044         }
13045
13046         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13047                 /* parse additional setup parameters if given */
13048                 err = nl80211_parse_mesh_setup(info, &setup);
13049                 if (err)
13050                         return err;
13051         }
13052
13053         if (setup.user_mpm)
13054                 cfg.auto_open_plinks = false;
13055
13056         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13057                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13058                 if (err)
13059                         return err;
13060         } else {
13061                 /* __cfg80211_join_mesh() will sort it out */
13062                 setup.chandef.chan = NULL;
13063         }
13064
13065         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13066                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13067                 int n_rates =
13068                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13069                 struct ieee80211_supported_band *sband;
13070
13071                 if (!setup.chandef.chan)
13072                         return -EINVAL;
13073
13074                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13075
13076                 err = ieee80211_get_ratemask(sband, rates, n_rates,
13077                                              &setup.basic_rates);
13078                 if (err)
13079                         return err;
13080         }
13081
13082         if (info->attrs[NL80211_ATTR_TX_RATES]) {
13083                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13084                                                     NL80211_ATTR_TX_RATES,
13085                                                     &setup.beacon_rate,
13086                                                     dev, false, 0);
13087                 if (err)
13088                         return err;
13089
13090                 if (!setup.chandef.chan)
13091                         return -EINVAL;
13092
13093                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13094                                               &setup.beacon_rate);
13095                 if (err)
13096                         return err;
13097         }
13098
13099         setup.userspace_handles_dfs =
13100                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13101
13102         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13103                 int r = validate_pae_over_nl80211(rdev, info);
13104
13105                 if (r < 0)
13106                         return r;
13107
13108                 setup.control_port_over_nl80211 = true;
13109         }
13110
13111         wdev_lock(dev->ieee80211_ptr);
13112         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13113         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13114                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13115         wdev_unlock(dev->ieee80211_ptr);
13116
13117         return err;
13118 }
13119
13120 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13121 {
13122         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13123         struct net_device *dev = info->user_ptr[1];
13124
13125         return cfg80211_leave_mesh(rdev, dev);
13126 }
13127
13128 #ifdef CONFIG_PM
13129 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13130                                         struct cfg80211_registered_device *rdev)
13131 {
13132         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13133         struct nlattr *nl_pats, *nl_pat;
13134         int i, pat_len;
13135
13136         if (!wowlan->n_patterns)
13137                 return 0;
13138
13139         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13140         if (!nl_pats)
13141                 return -ENOBUFS;
13142
13143         for (i = 0; i < wowlan->n_patterns; i++) {
13144                 nl_pat = nla_nest_start_noflag(msg, i + 1);
13145                 if (!nl_pat)
13146                         return -ENOBUFS;
13147                 pat_len = wowlan->patterns[i].pattern_len;
13148                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13149                             wowlan->patterns[i].mask) ||
13150                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13151                             wowlan->patterns[i].pattern) ||
13152                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13153                                 wowlan->patterns[i].pkt_offset))
13154                         return -ENOBUFS;
13155                 nla_nest_end(msg, nl_pat);
13156         }
13157         nla_nest_end(msg, nl_pats);
13158
13159         return 0;
13160 }
13161
13162 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13163                                    struct cfg80211_wowlan_tcp *tcp)
13164 {
13165         struct nlattr *nl_tcp;
13166
13167         if (!tcp)
13168                 return 0;
13169
13170         nl_tcp = nla_nest_start_noflag(msg,
13171                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13172         if (!nl_tcp)
13173                 return -ENOBUFS;
13174
13175         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13176             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13177             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13178             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13179             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13180             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13181                     tcp->payload_len, tcp->payload) ||
13182             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13183                         tcp->data_interval) ||
13184             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13185                     tcp->wake_len, tcp->wake_data) ||
13186             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13187                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13188                 return -ENOBUFS;
13189
13190         if (tcp->payload_seq.len &&
13191             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13192                     sizeof(tcp->payload_seq), &tcp->payload_seq))
13193                 return -ENOBUFS;
13194
13195         if (tcp->payload_tok.len &&
13196             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13197                     sizeof(tcp->payload_tok) + tcp->tokens_size,
13198                     &tcp->payload_tok))
13199                 return -ENOBUFS;
13200
13201         nla_nest_end(msg, nl_tcp);
13202
13203         return 0;
13204 }
13205
13206 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13207                                   struct cfg80211_sched_scan_request *req)
13208 {
13209         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13210         int i;
13211
13212         if (!req)
13213                 return 0;
13214
13215         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13216         if (!nd)
13217                 return -ENOBUFS;
13218
13219         if (req->n_scan_plans == 1 &&
13220             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13221                         req->scan_plans[0].interval * 1000))
13222                 return -ENOBUFS;
13223
13224         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13225                 return -ENOBUFS;
13226
13227         if (req->relative_rssi_set) {
13228                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13229
13230                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13231                                req->relative_rssi))
13232                         return -ENOBUFS;
13233
13234                 rssi_adjust.band = req->rssi_adjust.band;
13235                 rssi_adjust.delta = req->rssi_adjust.delta;
13236                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13237                             sizeof(rssi_adjust), &rssi_adjust))
13238                         return -ENOBUFS;
13239         }
13240
13241         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13242         if (!freqs)
13243                 return -ENOBUFS;
13244
13245         for (i = 0; i < req->n_channels; i++) {
13246                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13247                         return -ENOBUFS;
13248         }
13249
13250         nla_nest_end(msg, freqs);
13251
13252         if (req->n_match_sets) {
13253                 matches = nla_nest_start_noflag(msg,
13254                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13255                 if (!matches)
13256                         return -ENOBUFS;
13257
13258                 for (i = 0; i < req->n_match_sets; i++) {
13259                         match = nla_nest_start_noflag(msg, i);
13260                         if (!match)
13261                                 return -ENOBUFS;
13262
13263                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13264                                     req->match_sets[i].ssid.ssid_len,
13265                                     req->match_sets[i].ssid.ssid))
13266                                 return -ENOBUFS;
13267                         nla_nest_end(msg, match);
13268                 }
13269                 nla_nest_end(msg, matches);
13270         }
13271
13272         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13273         if (!scan_plans)
13274                 return -ENOBUFS;
13275
13276         for (i = 0; i < req->n_scan_plans; i++) {
13277                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13278                 if (!scan_plan)
13279                         return -ENOBUFS;
13280
13281                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13282                                 req->scan_plans[i].interval) ||
13283                     (req->scan_plans[i].iterations &&
13284                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13285                                  req->scan_plans[i].iterations)))
13286                         return -ENOBUFS;
13287                 nla_nest_end(msg, scan_plan);
13288         }
13289         nla_nest_end(msg, scan_plans);
13290
13291         nla_nest_end(msg, nd);
13292
13293         return 0;
13294 }
13295
13296 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13297 {
13298         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13299         struct sk_buff *msg;
13300         void *hdr;
13301         u32 size = NLMSG_DEFAULT_SIZE;
13302
13303         if (!rdev->wiphy.wowlan)
13304                 return -EOPNOTSUPP;
13305
13306         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13307                 /* adjust size to have room for all the data */
13308                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13309                         rdev->wiphy.wowlan_config->tcp->payload_len +
13310                         rdev->wiphy.wowlan_config->tcp->wake_len +
13311                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13312         }
13313
13314         msg = nlmsg_new(size, GFP_KERNEL);
13315         if (!msg)
13316                 return -ENOMEM;
13317
13318         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13319                              NL80211_CMD_GET_WOWLAN);
13320         if (!hdr)
13321                 goto nla_put_failure;
13322
13323         if (rdev->wiphy.wowlan_config) {
13324                 struct nlattr *nl_wowlan;
13325
13326                 nl_wowlan = nla_nest_start_noflag(msg,
13327                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13328                 if (!nl_wowlan)
13329                         goto nla_put_failure;
13330
13331                 if ((rdev->wiphy.wowlan_config->any &&
13332                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13333                     (rdev->wiphy.wowlan_config->disconnect &&
13334                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13335                     (rdev->wiphy.wowlan_config->magic_pkt &&
13336                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13337                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13338                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13339                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13340                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13341                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13342                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13343                     (rdev->wiphy.wowlan_config->rfkill_release &&
13344                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13345                         goto nla_put_failure;
13346
13347                 if (nl80211_send_wowlan_patterns(msg, rdev))
13348                         goto nla_put_failure;
13349
13350                 if (nl80211_send_wowlan_tcp(msg,
13351                                             rdev->wiphy.wowlan_config->tcp))
13352                         goto nla_put_failure;
13353
13354                 if (nl80211_send_wowlan_nd(
13355                             msg,
13356                             rdev->wiphy.wowlan_config->nd_config))
13357                         goto nla_put_failure;
13358
13359                 nla_nest_end(msg, nl_wowlan);
13360         }
13361
13362         genlmsg_end(msg, hdr);
13363         return genlmsg_reply(msg, info);
13364
13365 nla_put_failure:
13366         nlmsg_free(msg);
13367         return -ENOBUFS;
13368 }
13369
13370 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13371                                     struct nlattr *attr,
13372                                     struct cfg80211_wowlan *trig)
13373 {
13374         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13375         struct cfg80211_wowlan_tcp *cfg;
13376         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13377         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13378         u32 size;
13379         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13380         int err, port;
13381
13382         if (!rdev->wiphy.wowlan->tcp)
13383                 return -EINVAL;
13384
13385         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13386                                           nl80211_wowlan_tcp_policy, NULL);
13387         if (err)
13388                 return err;
13389
13390         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13391             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13392             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13393             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13394             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13395             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13396             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13397             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13398                 return -EINVAL;
13399
13400         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13401         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13402                 return -EINVAL;
13403
13404         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13405                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13406             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13407                 return -EINVAL;
13408
13409         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13410         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13411                 return -EINVAL;
13412
13413         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13414         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13415                 return -EINVAL;
13416
13417         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13418                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13419
13420                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13421                 tokens_size = tokln - sizeof(*tok);
13422
13423                 if (!tok->len || tokens_size % tok->len)
13424                         return -EINVAL;
13425                 if (!rdev->wiphy.wowlan->tcp->tok)
13426                         return -EINVAL;
13427                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13428                         return -EINVAL;
13429                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13430                         return -EINVAL;
13431                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13432                         return -EINVAL;
13433                 if (tok->offset + tok->len > data_size)
13434                         return -EINVAL;
13435         }
13436
13437         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13438                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13439                 if (!rdev->wiphy.wowlan->tcp->seq)
13440                         return -EINVAL;
13441                 if (seq->len == 0 || seq->len > 4)
13442                         return -EINVAL;
13443                 if (seq->len + seq->offset > data_size)
13444                         return -EINVAL;
13445         }
13446
13447         size = sizeof(*cfg);
13448         size += data_size;
13449         size += wake_size + wake_mask_size;
13450         size += tokens_size;
13451
13452         cfg = kzalloc(size, GFP_KERNEL);
13453         if (!cfg)
13454                 return -ENOMEM;
13455         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13456         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13457         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13458                ETH_ALEN);
13459         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13460                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13461         else
13462                 port = 0;
13463 #ifdef CONFIG_INET
13464         /* allocate a socket and port for it and use it */
13465         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13466                             IPPROTO_TCP, &cfg->sock, 1);
13467         if (err) {
13468                 kfree(cfg);
13469                 return err;
13470         }
13471         if (inet_csk_get_port(cfg->sock->sk, port)) {
13472                 sock_release(cfg->sock);
13473                 kfree(cfg);
13474                 return -EADDRINUSE;
13475         }
13476         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13477 #else
13478         if (!port) {
13479                 kfree(cfg);
13480                 return -EINVAL;
13481         }
13482         cfg->src_port = port;
13483 #endif
13484
13485         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13486         cfg->payload_len = data_size;
13487         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13488         memcpy((void *)cfg->payload,
13489                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13490                data_size);
13491         if (seq)
13492                 cfg->payload_seq = *seq;
13493         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13494         cfg->wake_len = wake_size;
13495         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13496         memcpy((void *)cfg->wake_data,
13497                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13498                wake_size);
13499         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13500                          data_size + wake_size;
13501         memcpy((void *)cfg->wake_mask,
13502                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13503                wake_mask_size);
13504         if (tok) {
13505                 cfg->tokens_size = tokens_size;
13506                 cfg->payload_tok = *tok;
13507                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13508                        tokens_size);
13509         }
13510
13511         trig->tcp = cfg;
13512
13513         return 0;
13514 }
13515
13516 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13517                                    const struct wiphy_wowlan_support *wowlan,
13518                                    struct nlattr *attr,
13519                                    struct cfg80211_wowlan *trig)
13520 {
13521         struct nlattr **tb;
13522         int err;
13523
13524         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13525         if (!tb)
13526                 return -ENOMEM;
13527
13528         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13529                 err = -EOPNOTSUPP;
13530                 goto out;
13531         }
13532
13533         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13534                                           nl80211_policy, NULL);
13535         if (err)
13536                 goto out;
13537
13538         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13539                                                    wowlan->max_nd_match_sets);
13540         err = PTR_ERR_OR_ZERO(trig->nd_config);
13541         if (err)
13542                 trig->nd_config = NULL;
13543
13544 out:
13545         kfree(tb);
13546         return err;
13547 }
13548
13549 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13550 {
13551         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13552         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13553         struct cfg80211_wowlan new_triggers = {};
13554         struct cfg80211_wowlan *ntrig;
13555         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13556         int err, i;
13557         bool prev_enabled = rdev->wiphy.wowlan_config;
13558         bool regular = false;
13559
13560         if (!wowlan)
13561                 return -EOPNOTSUPP;
13562
13563         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13564                 cfg80211_rdev_free_wowlan(rdev);
13565                 rdev->wiphy.wowlan_config = NULL;
13566                 goto set_wakeup;
13567         }
13568
13569         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13570                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13571                                           nl80211_wowlan_policy, info->extack);
13572         if (err)
13573                 return err;
13574
13575         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13576                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13577                         return -EINVAL;
13578                 new_triggers.any = true;
13579         }
13580
13581         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13582                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13583                         return -EINVAL;
13584                 new_triggers.disconnect = true;
13585                 regular = true;
13586         }
13587
13588         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13589                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13590                         return -EINVAL;
13591                 new_triggers.magic_pkt = true;
13592                 regular = true;
13593         }
13594
13595         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13596                 return -EINVAL;
13597
13598         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13599                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13600                         return -EINVAL;
13601                 new_triggers.gtk_rekey_failure = true;
13602                 regular = true;
13603         }
13604
13605         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13606                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13607                         return -EINVAL;
13608                 new_triggers.eap_identity_req = true;
13609                 regular = true;
13610         }
13611
13612         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13613                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13614                         return -EINVAL;
13615                 new_triggers.four_way_handshake = true;
13616                 regular = true;
13617         }
13618
13619         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13620                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13621                         return -EINVAL;
13622                 new_triggers.rfkill_release = true;
13623                 regular = true;
13624         }
13625
13626         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13627                 struct nlattr *pat;
13628                 int n_patterns = 0;
13629                 int rem, pat_len, mask_len, pkt_offset;
13630                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13631
13632                 regular = true;
13633
13634                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13635                                     rem)
13636                         n_patterns++;
13637                 if (n_patterns > wowlan->n_patterns)
13638                         return -EINVAL;
13639
13640                 new_triggers.patterns = kcalloc(n_patterns,
13641                                                 sizeof(new_triggers.patterns[0]),
13642                                                 GFP_KERNEL);
13643                 if (!new_triggers.patterns)
13644                         return -ENOMEM;
13645
13646                 new_triggers.n_patterns = n_patterns;
13647                 i = 0;
13648
13649                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13650                                     rem) {
13651                         u8 *mask_pat;
13652
13653                         err = nla_parse_nested_deprecated(pat_tb,
13654                                                           MAX_NL80211_PKTPAT,
13655                                                           pat,
13656                                                           nl80211_packet_pattern_policy,
13657                                                           info->extack);
13658                         if (err)
13659                                 goto error;
13660
13661                         err = -EINVAL;
13662                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13663                             !pat_tb[NL80211_PKTPAT_PATTERN])
13664                                 goto error;
13665                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13666                         mask_len = DIV_ROUND_UP(pat_len, 8);
13667                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13668                                 goto error;
13669                         if (pat_len > wowlan->pattern_max_len ||
13670                             pat_len < wowlan->pattern_min_len)
13671                                 goto error;
13672
13673                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
13674                                 pkt_offset = 0;
13675                         else
13676                                 pkt_offset = nla_get_u32(
13677                                         pat_tb[NL80211_PKTPAT_OFFSET]);
13678                         if (pkt_offset > wowlan->max_pkt_offset)
13679                                 goto error;
13680                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13681
13682                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13683                         if (!mask_pat) {
13684                                 err = -ENOMEM;
13685                                 goto error;
13686                         }
13687                         new_triggers.patterns[i].mask = mask_pat;
13688                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13689                                mask_len);
13690                         mask_pat += mask_len;
13691                         new_triggers.patterns[i].pattern = mask_pat;
13692                         new_triggers.patterns[i].pattern_len = pat_len;
13693                         memcpy(mask_pat,
13694                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13695                                pat_len);
13696                         i++;
13697                 }
13698         }
13699
13700         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13701                 regular = true;
13702                 err = nl80211_parse_wowlan_tcp(
13703                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13704                         &new_triggers);
13705                 if (err)
13706                         goto error;
13707         }
13708
13709         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13710                 regular = true;
13711                 err = nl80211_parse_wowlan_nd(
13712                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13713                         &new_triggers);
13714                 if (err)
13715                         goto error;
13716         }
13717
13718         /* The 'any' trigger means the device continues operating more or less
13719          * as in its normal operation mode and wakes up the host on most of the
13720          * normal interrupts (like packet RX, ...)
13721          * It therefore makes little sense to combine with the more constrained
13722          * wakeup trigger modes.
13723          */
13724         if (new_triggers.any && regular) {
13725                 err = -EINVAL;
13726                 goto error;
13727         }
13728
13729         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13730         if (!ntrig) {
13731                 err = -ENOMEM;
13732                 goto error;
13733         }
13734         cfg80211_rdev_free_wowlan(rdev);
13735         rdev->wiphy.wowlan_config = ntrig;
13736
13737  set_wakeup:
13738         if (rdev->ops->set_wakeup &&
13739             prev_enabled != !!rdev->wiphy.wowlan_config)
13740                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13741
13742         return 0;
13743  error:
13744         for (i = 0; i < new_triggers.n_patterns; i++)
13745                 kfree(new_triggers.patterns[i].mask);
13746         kfree(new_triggers.patterns);
13747         if (new_triggers.tcp && new_triggers.tcp->sock)
13748                 sock_release(new_triggers.tcp->sock);
13749         kfree(new_triggers.tcp);
13750         kfree(new_triggers.nd_config);
13751         return err;
13752 }
13753 #endif
13754
13755 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13756                                        struct cfg80211_registered_device *rdev)
13757 {
13758         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13759         int i, j, pat_len;
13760         struct cfg80211_coalesce_rules *rule;
13761
13762         if (!rdev->coalesce->n_rules)
13763                 return 0;
13764
13765         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13766         if (!nl_rules)
13767                 return -ENOBUFS;
13768
13769         for (i = 0; i < rdev->coalesce->n_rules; i++) {
13770                 nl_rule = nla_nest_start_noflag(msg, i + 1);
13771                 if (!nl_rule)
13772                         return -ENOBUFS;
13773
13774                 rule = &rdev->coalesce->rules[i];
13775                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13776                                 rule->delay))
13777                         return -ENOBUFS;
13778
13779                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13780                                 rule->condition))
13781                         return -ENOBUFS;
13782
13783                 nl_pats = nla_nest_start_noflag(msg,
13784                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13785                 if (!nl_pats)
13786                         return -ENOBUFS;
13787
13788                 for (j = 0; j < rule->n_patterns; j++) {
13789                         nl_pat = nla_nest_start_noflag(msg, j + 1);
13790                         if (!nl_pat)
13791                                 return -ENOBUFS;
13792                         pat_len = rule->patterns[j].pattern_len;
13793                         if (nla_put(msg, NL80211_PKTPAT_MASK,
13794                                     DIV_ROUND_UP(pat_len, 8),
13795                                     rule->patterns[j].mask) ||
13796                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13797                                     rule->patterns[j].pattern) ||
13798                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13799                                         rule->patterns[j].pkt_offset))
13800                                 return -ENOBUFS;
13801                         nla_nest_end(msg, nl_pat);
13802                 }
13803                 nla_nest_end(msg, nl_pats);
13804                 nla_nest_end(msg, nl_rule);
13805         }
13806         nla_nest_end(msg, nl_rules);
13807
13808         return 0;
13809 }
13810
13811 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13812 {
13813         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13814         struct sk_buff *msg;
13815         void *hdr;
13816
13817         if (!rdev->wiphy.coalesce)
13818                 return -EOPNOTSUPP;
13819
13820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13821         if (!msg)
13822                 return -ENOMEM;
13823
13824         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13825                              NL80211_CMD_GET_COALESCE);
13826         if (!hdr)
13827                 goto nla_put_failure;
13828
13829         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13830                 goto nla_put_failure;
13831
13832         genlmsg_end(msg, hdr);
13833         return genlmsg_reply(msg, info);
13834
13835 nla_put_failure:
13836         nlmsg_free(msg);
13837         return -ENOBUFS;
13838 }
13839
13840 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13841 {
13842         struct cfg80211_coalesce *coalesce = rdev->coalesce;
13843         int i, j;
13844         struct cfg80211_coalesce_rules *rule;
13845
13846         if (!coalesce)
13847                 return;
13848
13849         for (i = 0; i < coalesce->n_rules; i++) {
13850                 rule = &coalesce->rules[i];
13851                 for (j = 0; j < rule->n_patterns; j++)
13852                         kfree(rule->patterns[j].mask);
13853                 kfree(rule->patterns);
13854         }
13855         kfree(coalesce->rules);
13856         kfree(coalesce);
13857         rdev->coalesce = NULL;
13858 }
13859
13860 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13861                                        struct nlattr *rule,
13862                                        struct cfg80211_coalesce_rules *new_rule)
13863 {
13864         int err, i;
13865         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13866         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13867         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13868         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13869
13870         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13871                                           rule, nl80211_coalesce_policy, NULL);
13872         if (err)
13873                 return err;
13874
13875         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13876                 new_rule->delay =
13877                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13878         if (new_rule->delay > coalesce->max_delay)
13879                 return -EINVAL;
13880
13881         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13882                 new_rule->condition =
13883                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13884
13885         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13886                 return -EINVAL;
13887
13888         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13889                             rem)
13890                 n_patterns++;
13891         if (n_patterns > coalesce->n_patterns)
13892                 return -EINVAL;
13893
13894         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13895                                      GFP_KERNEL);
13896         if (!new_rule->patterns)
13897                 return -ENOMEM;
13898
13899         new_rule->n_patterns = n_patterns;
13900         i = 0;
13901
13902         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13903                             rem) {
13904                 u8 *mask_pat;
13905
13906                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13907                                                   pat,
13908                                                   nl80211_packet_pattern_policy,
13909                                                   NULL);
13910                 if (err)
13911                         return err;
13912
13913                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13914                     !pat_tb[NL80211_PKTPAT_PATTERN])
13915                         return -EINVAL;
13916                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13917                 mask_len = DIV_ROUND_UP(pat_len, 8);
13918                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13919                         return -EINVAL;
13920                 if (pat_len > coalesce->pattern_max_len ||
13921                     pat_len < coalesce->pattern_min_len)
13922                         return -EINVAL;
13923
13924                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13925                         pkt_offset = 0;
13926                 else
13927                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13928                 if (pkt_offset > coalesce->max_pkt_offset)
13929                         return -EINVAL;
13930                 new_rule->patterns[i].pkt_offset = pkt_offset;
13931
13932                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13933                 if (!mask_pat)
13934                         return -ENOMEM;
13935
13936                 new_rule->patterns[i].mask = mask_pat;
13937                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13938                        mask_len);
13939
13940                 mask_pat += mask_len;
13941                 new_rule->patterns[i].pattern = mask_pat;
13942                 new_rule->patterns[i].pattern_len = pat_len;
13943                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13944                        pat_len);
13945                 i++;
13946         }
13947
13948         return 0;
13949 }
13950
13951 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13952 {
13953         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13954         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13955         struct cfg80211_coalesce new_coalesce = {};
13956         struct cfg80211_coalesce *n_coalesce;
13957         int err, rem_rule, n_rules = 0, i, j;
13958         struct nlattr *rule;
13959         struct cfg80211_coalesce_rules *tmp_rule;
13960
13961         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13962                 return -EOPNOTSUPP;
13963
13964         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13965                 cfg80211_rdev_free_coalesce(rdev);
13966                 rdev_set_coalesce(rdev, NULL);
13967                 return 0;
13968         }
13969
13970         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13971                             rem_rule)
13972                 n_rules++;
13973         if (n_rules > coalesce->n_rules)
13974                 return -EINVAL;
13975
13976         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13977                                      GFP_KERNEL);
13978         if (!new_coalesce.rules)
13979                 return -ENOMEM;
13980
13981         new_coalesce.n_rules = n_rules;
13982         i = 0;
13983
13984         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13985                             rem_rule) {
13986                 err = nl80211_parse_coalesce_rule(rdev, rule,
13987                                                   &new_coalesce.rules[i]);
13988                 if (err)
13989                         goto error;
13990
13991                 i++;
13992         }
13993
13994         err = rdev_set_coalesce(rdev, &new_coalesce);
13995         if (err)
13996                 goto error;
13997
13998         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13999         if (!n_coalesce) {
14000                 err = -ENOMEM;
14001                 goto error;
14002         }
14003         cfg80211_rdev_free_coalesce(rdev);
14004         rdev->coalesce = n_coalesce;
14005
14006         return 0;
14007 error:
14008         for (i = 0; i < new_coalesce.n_rules; i++) {
14009                 tmp_rule = &new_coalesce.rules[i];
14010                 for (j = 0; j < tmp_rule->n_patterns; j++)
14011                         kfree(tmp_rule->patterns[j].mask);
14012                 kfree(tmp_rule->patterns);
14013         }
14014         kfree(new_coalesce.rules);
14015
14016         return err;
14017 }
14018
14019 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
14020 {
14021         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14022         struct net_device *dev = info->user_ptr[1];
14023         struct wireless_dev *wdev = dev->ieee80211_ptr;
14024         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
14025         struct cfg80211_gtk_rekey_data rekey_data = {};
14026         int err;
14027
14028         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
14029                 return -EINVAL;
14030
14031         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
14032                                           info->attrs[NL80211_ATTR_REKEY_DATA],
14033                                           nl80211_rekey_policy, info->extack);
14034         if (err)
14035                 return err;
14036
14037         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
14038             !tb[NL80211_REKEY_DATA_KCK])
14039                 return -EINVAL;
14040         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
14041             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14042               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14043                 return -ERANGE;
14044         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14045             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14046               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14047              !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14048                nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14049                 return -ERANGE;
14050
14051         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14052         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14053         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14054         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14055         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14056         if (tb[NL80211_REKEY_DATA_AKM])
14057                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14058
14059         wdev_lock(wdev);
14060         if (!wdev->connected) {
14061                 err = -ENOTCONN;
14062                 goto out;
14063         }
14064
14065         if (!rdev->ops->set_rekey_data) {
14066                 err = -EOPNOTSUPP;
14067                 goto out;
14068         }
14069
14070         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
14071  out:
14072         wdev_unlock(wdev);
14073         return err;
14074 }
14075
14076 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14077                                              struct genl_info *info)
14078 {
14079         struct net_device *dev = info->user_ptr[1];
14080         struct wireless_dev *wdev = dev->ieee80211_ptr;
14081
14082         if (wdev->iftype != NL80211_IFTYPE_AP &&
14083             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14084                 return -EINVAL;
14085
14086         if (wdev->ap_unexpected_nlportid)
14087                 return -EBUSY;
14088
14089         wdev->ap_unexpected_nlportid = info->snd_portid;
14090         return 0;
14091 }
14092
14093 static int nl80211_probe_client(struct sk_buff *skb,
14094                                 struct genl_info *info)
14095 {
14096         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14097         struct net_device *dev = info->user_ptr[1];
14098         struct wireless_dev *wdev = dev->ieee80211_ptr;
14099         struct sk_buff *msg;
14100         void *hdr;
14101         const u8 *addr;
14102         u64 cookie;
14103         int err;
14104
14105         if (wdev->iftype != NL80211_IFTYPE_AP &&
14106             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14107                 return -EOPNOTSUPP;
14108
14109         if (!info->attrs[NL80211_ATTR_MAC])
14110                 return -EINVAL;
14111
14112         if (!rdev->ops->probe_client)
14113                 return -EOPNOTSUPP;
14114
14115         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14116         if (!msg)
14117                 return -ENOMEM;
14118
14119         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14120                              NL80211_CMD_PROBE_CLIENT);
14121         if (!hdr) {
14122                 err = -ENOBUFS;
14123                 goto free_msg;
14124         }
14125
14126         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14127
14128         err = rdev_probe_client(rdev, dev, addr, &cookie);
14129         if (err)
14130                 goto free_msg;
14131
14132         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14133                               NL80211_ATTR_PAD))
14134                 goto nla_put_failure;
14135
14136         genlmsg_end(msg, hdr);
14137
14138         return genlmsg_reply(msg, info);
14139
14140  nla_put_failure:
14141         err = -ENOBUFS;
14142  free_msg:
14143         nlmsg_free(msg);
14144         return err;
14145 }
14146
14147 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14148 {
14149         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14150         struct cfg80211_beacon_registration *reg, *nreg;
14151         int rv;
14152
14153         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14154                 return -EOPNOTSUPP;
14155
14156         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14157         if (!nreg)
14158                 return -ENOMEM;
14159
14160         /* First, check if already registered. */
14161         spin_lock_bh(&rdev->beacon_registrations_lock);
14162         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14163                 if (reg->nlportid == info->snd_portid) {
14164                         rv = -EALREADY;
14165                         goto out_err;
14166                 }
14167         }
14168         /* Add it to the list */
14169         nreg->nlportid = info->snd_portid;
14170         list_add(&nreg->list, &rdev->beacon_registrations);
14171
14172         spin_unlock_bh(&rdev->beacon_registrations_lock);
14173
14174         return 0;
14175 out_err:
14176         spin_unlock_bh(&rdev->beacon_registrations_lock);
14177         kfree(nreg);
14178         return rv;
14179 }
14180
14181 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14182 {
14183         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14184         struct wireless_dev *wdev = info->user_ptr[1];
14185         int err;
14186
14187         if (!rdev->ops->start_p2p_device)
14188                 return -EOPNOTSUPP;
14189
14190         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14191                 return -EOPNOTSUPP;
14192
14193         if (wdev_running(wdev))
14194                 return 0;
14195
14196         if (rfkill_blocked(rdev->wiphy.rfkill))
14197                 return -ERFKILL;
14198
14199         err = rdev_start_p2p_device(rdev, wdev);
14200         if (err)
14201                 return err;
14202
14203         wdev->is_running = true;
14204         rdev->opencount++;
14205
14206         return 0;
14207 }
14208
14209 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14210 {
14211         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14212         struct wireless_dev *wdev = info->user_ptr[1];
14213
14214         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14215                 return -EOPNOTSUPP;
14216
14217         if (!rdev->ops->stop_p2p_device)
14218                 return -EOPNOTSUPP;
14219
14220         cfg80211_stop_p2p_device(rdev, wdev);
14221
14222         return 0;
14223 }
14224
14225 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14226 {
14227         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14228         struct wireless_dev *wdev = info->user_ptr[1];
14229         struct cfg80211_nan_conf conf = {};
14230         int err;
14231
14232         if (wdev->iftype != NL80211_IFTYPE_NAN)
14233                 return -EOPNOTSUPP;
14234
14235         if (wdev_running(wdev))
14236                 return -EEXIST;
14237
14238         if (rfkill_blocked(rdev->wiphy.rfkill))
14239                 return -ERFKILL;
14240
14241         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14242                 return -EINVAL;
14243
14244         conf.master_pref =
14245                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14246
14247         if (info->attrs[NL80211_ATTR_BANDS]) {
14248                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14249
14250                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14251                         return -EOPNOTSUPP;
14252
14253                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14254                         return -EINVAL;
14255
14256                 conf.bands = bands;
14257         }
14258
14259         err = rdev_start_nan(rdev, wdev, &conf);
14260         if (err)
14261                 return err;
14262
14263         wdev->is_running = true;
14264         rdev->opencount++;
14265
14266         return 0;
14267 }
14268
14269 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14270 {
14271         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14272         struct wireless_dev *wdev = info->user_ptr[1];
14273
14274         if (wdev->iftype != NL80211_IFTYPE_NAN)
14275                 return -EOPNOTSUPP;
14276
14277         cfg80211_stop_nan(rdev, wdev);
14278
14279         return 0;
14280 }
14281
14282 static int validate_nan_filter(struct nlattr *filter_attr)
14283 {
14284         struct nlattr *attr;
14285         int len = 0, n_entries = 0, rem;
14286
14287         nla_for_each_nested(attr, filter_attr, rem) {
14288                 len += nla_len(attr);
14289                 n_entries++;
14290         }
14291
14292         if (len >= U8_MAX)
14293                 return -EINVAL;
14294
14295         return n_entries;
14296 }
14297
14298 static int handle_nan_filter(struct nlattr *attr_filter,
14299                              struct cfg80211_nan_func *func,
14300                              bool tx)
14301 {
14302         struct nlattr *attr;
14303         int n_entries, rem, i;
14304         struct cfg80211_nan_func_filter *filter;
14305
14306         n_entries = validate_nan_filter(attr_filter);
14307         if (n_entries < 0)
14308                 return n_entries;
14309
14310         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14311
14312         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14313         if (!filter)
14314                 return -ENOMEM;
14315
14316         i = 0;
14317         nla_for_each_nested(attr, attr_filter, rem) {
14318                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14319                 if (!filter[i].filter)
14320                         goto err;
14321
14322                 filter[i].len = nla_len(attr);
14323                 i++;
14324         }
14325         if (tx) {
14326                 func->num_tx_filters = n_entries;
14327                 func->tx_filters = filter;
14328         } else {
14329                 func->num_rx_filters = n_entries;
14330                 func->rx_filters = filter;
14331         }
14332
14333         return 0;
14334
14335 err:
14336         i = 0;
14337         nla_for_each_nested(attr, attr_filter, rem) {
14338                 kfree(filter[i].filter);
14339                 i++;
14340         }
14341         kfree(filter);
14342         return -ENOMEM;
14343 }
14344
14345 static int nl80211_nan_add_func(struct sk_buff *skb,
14346                                 struct genl_info *info)
14347 {
14348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14349         struct wireless_dev *wdev = info->user_ptr[1];
14350         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14351         struct cfg80211_nan_func *func;
14352         struct sk_buff *msg = NULL;
14353         void *hdr = NULL;
14354         int err = 0;
14355
14356         if (wdev->iftype != NL80211_IFTYPE_NAN)
14357                 return -EOPNOTSUPP;
14358
14359         if (!wdev_running(wdev))
14360                 return -ENOTCONN;
14361
14362         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14363                 return -EINVAL;
14364
14365         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14366                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14367                                           nl80211_nan_func_policy,
14368                                           info->extack);
14369         if (err)
14370                 return err;
14371
14372         func = kzalloc(sizeof(*func), GFP_KERNEL);
14373         if (!func)
14374                 return -ENOMEM;
14375
14376         func->cookie = cfg80211_assign_cookie(rdev);
14377
14378         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14379                 err = -EINVAL;
14380                 goto out;
14381         }
14382
14383
14384         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14385
14386         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14387                 err = -EINVAL;
14388                 goto out;
14389         }
14390
14391         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14392                sizeof(func->service_id));
14393
14394         func->close_range =
14395                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14396
14397         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14398                 func->serv_spec_info_len =
14399                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14400                 func->serv_spec_info =
14401                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14402                                 func->serv_spec_info_len,
14403                                 GFP_KERNEL);
14404                 if (!func->serv_spec_info) {
14405                         err = -ENOMEM;
14406                         goto out;
14407                 }
14408         }
14409
14410         if (tb[NL80211_NAN_FUNC_TTL])
14411                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14412
14413         switch (func->type) {
14414         case NL80211_NAN_FUNC_PUBLISH:
14415                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14416                         err = -EINVAL;
14417                         goto out;
14418                 }
14419
14420                 func->publish_type =
14421                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14422                 func->publish_bcast =
14423                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14424
14425                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14426                         func->publish_bcast) {
14427                         err = -EINVAL;
14428                         goto out;
14429                 }
14430                 break;
14431         case NL80211_NAN_FUNC_SUBSCRIBE:
14432                 func->subscribe_active =
14433                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14434                 break;
14435         case NL80211_NAN_FUNC_FOLLOW_UP:
14436                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14437                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14438                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14439                         err = -EINVAL;
14440                         goto out;
14441                 }
14442
14443                 func->followup_id =
14444                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14445                 func->followup_reqid =
14446                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14447                 memcpy(func->followup_dest.addr,
14448                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14449                        sizeof(func->followup_dest.addr));
14450                 if (func->ttl) {
14451                         err = -EINVAL;
14452                         goto out;
14453                 }
14454                 break;
14455         default:
14456                 err = -EINVAL;
14457                 goto out;
14458         }
14459
14460         if (tb[NL80211_NAN_FUNC_SRF]) {
14461                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14462
14463                 err = nla_parse_nested_deprecated(srf_tb,
14464                                                   NL80211_NAN_SRF_ATTR_MAX,
14465                                                   tb[NL80211_NAN_FUNC_SRF],
14466                                                   nl80211_nan_srf_policy,
14467                                                   info->extack);
14468                 if (err)
14469                         goto out;
14470
14471                 func->srf_include =
14472                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14473
14474                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14475                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14476                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14477                                 err = -EINVAL;
14478                                 goto out;
14479                         }
14480
14481                         func->srf_bf_len =
14482                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14483                         func->srf_bf =
14484                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14485                                         func->srf_bf_len, GFP_KERNEL);
14486                         if (!func->srf_bf) {
14487                                 err = -ENOMEM;
14488                                 goto out;
14489                         }
14490
14491                         func->srf_bf_idx =
14492                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14493                 } else {
14494                         struct nlattr *attr, *mac_attr =
14495                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14496                         int n_entries, rem, i = 0;
14497
14498                         if (!mac_attr) {
14499                                 err = -EINVAL;
14500                                 goto out;
14501                         }
14502
14503                         n_entries = validate_acl_mac_addrs(mac_attr);
14504                         if (n_entries <= 0) {
14505                                 err = -EINVAL;
14506                                 goto out;
14507                         }
14508
14509                         func->srf_num_macs = n_entries;
14510                         func->srf_macs =
14511                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14512                                         GFP_KERNEL);
14513                         if (!func->srf_macs) {
14514                                 err = -ENOMEM;
14515                                 goto out;
14516                         }
14517
14518                         nla_for_each_nested(attr, mac_attr, rem)
14519                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14520                                        sizeof(*func->srf_macs));
14521                 }
14522         }
14523
14524         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14525                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14526                                         func, true);
14527                 if (err)
14528                         goto out;
14529         }
14530
14531         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14532                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14533                                         func, false);
14534                 if (err)
14535                         goto out;
14536         }
14537
14538         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14539         if (!msg) {
14540                 err = -ENOMEM;
14541                 goto out;
14542         }
14543
14544         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14545                              NL80211_CMD_ADD_NAN_FUNCTION);
14546         /* This can't really happen - we just allocated 4KB */
14547         if (WARN_ON(!hdr)) {
14548                 err = -ENOMEM;
14549                 goto out;
14550         }
14551
14552         err = rdev_add_nan_func(rdev, wdev, func);
14553 out:
14554         if (err < 0) {
14555                 cfg80211_free_nan_func(func);
14556                 nlmsg_free(msg);
14557                 return err;
14558         }
14559
14560         /* propagate the instance id and cookie to userspace  */
14561         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14562                               NL80211_ATTR_PAD))
14563                 goto nla_put_failure;
14564
14565         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14566         if (!func_attr)
14567                 goto nla_put_failure;
14568
14569         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14570                        func->instance_id))
14571                 goto nla_put_failure;
14572
14573         nla_nest_end(msg, func_attr);
14574
14575         genlmsg_end(msg, hdr);
14576         return genlmsg_reply(msg, info);
14577
14578 nla_put_failure:
14579         nlmsg_free(msg);
14580         return -ENOBUFS;
14581 }
14582
14583 static int nl80211_nan_del_func(struct sk_buff *skb,
14584                                struct genl_info *info)
14585 {
14586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14587         struct wireless_dev *wdev = info->user_ptr[1];
14588         u64 cookie;
14589
14590         if (wdev->iftype != NL80211_IFTYPE_NAN)
14591                 return -EOPNOTSUPP;
14592
14593         if (!wdev_running(wdev))
14594                 return -ENOTCONN;
14595
14596         if (!info->attrs[NL80211_ATTR_COOKIE])
14597                 return -EINVAL;
14598
14599         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14600
14601         rdev_del_nan_func(rdev, wdev, cookie);
14602
14603         return 0;
14604 }
14605
14606 static int nl80211_nan_change_config(struct sk_buff *skb,
14607                                      struct genl_info *info)
14608 {
14609         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14610         struct wireless_dev *wdev = info->user_ptr[1];
14611         struct cfg80211_nan_conf conf = {};
14612         u32 changed = 0;
14613
14614         if (wdev->iftype != NL80211_IFTYPE_NAN)
14615                 return -EOPNOTSUPP;
14616
14617         if (!wdev_running(wdev))
14618                 return -ENOTCONN;
14619
14620         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14621                 conf.master_pref =
14622                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14623                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14624                         return -EINVAL;
14625
14626                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14627         }
14628
14629         if (info->attrs[NL80211_ATTR_BANDS]) {
14630                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14631
14632                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14633                         return -EOPNOTSUPP;
14634
14635                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14636                         return -EINVAL;
14637
14638                 conf.bands = bands;
14639                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14640         }
14641
14642         if (!changed)
14643                 return -EINVAL;
14644
14645         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14646 }
14647
14648 void cfg80211_nan_match(struct wireless_dev *wdev,
14649                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14650 {
14651         struct wiphy *wiphy = wdev->wiphy;
14652         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14653         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14654         struct sk_buff *msg;
14655         void *hdr;
14656
14657         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14658                 return;
14659
14660         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14661         if (!msg)
14662                 return;
14663
14664         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14665         if (!hdr) {
14666                 nlmsg_free(msg);
14667                 return;
14668         }
14669
14670         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14671             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14672                                          wdev->netdev->ifindex)) ||
14673             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14674                               NL80211_ATTR_PAD))
14675                 goto nla_put_failure;
14676
14677         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14678                               NL80211_ATTR_PAD) ||
14679             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14680                 goto nla_put_failure;
14681
14682         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14683         if (!match_attr)
14684                 goto nla_put_failure;
14685
14686         local_func_attr = nla_nest_start_noflag(msg,
14687                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14688         if (!local_func_attr)
14689                 goto nla_put_failure;
14690
14691         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14692                 goto nla_put_failure;
14693
14694         nla_nest_end(msg, local_func_attr);
14695
14696         peer_func_attr = nla_nest_start_noflag(msg,
14697                                                NL80211_NAN_MATCH_FUNC_PEER);
14698         if (!peer_func_attr)
14699                 goto nla_put_failure;
14700
14701         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14702             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14703                 goto nla_put_failure;
14704
14705         if (match->info && match->info_len &&
14706             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14707                     match->info))
14708                 goto nla_put_failure;
14709
14710         nla_nest_end(msg, peer_func_attr);
14711         nla_nest_end(msg, match_attr);
14712         genlmsg_end(msg, hdr);
14713
14714         if (!wdev->owner_nlportid)
14715                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14716                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14717         else
14718                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14719                                 wdev->owner_nlportid);
14720
14721         return;
14722
14723 nla_put_failure:
14724         nlmsg_free(msg);
14725 }
14726 EXPORT_SYMBOL(cfg80211_nan_match);
14727
14728 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14729                                   u8 inst_id,
14730                                   enum nl80211_nan_func_term_reason reason,
14731                                   u64 cookie, gfp_t gfp)
14732 {
14733         struct wiphy *wiphy = wdev->wiphy;
14734         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14735         struct sk_buff *msg;
14736         struct nlattr *func_attr;
14737         void *hdr;
14738
14739         if (WARN_ON(!inst_id))
14740                 return;
14741
14742         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14743         if (!msg)
14744                 return;
14745
14746         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14747         if (!hdr) {
14748                 nlmsg_free(msg);
14749                 return;
14750         }
14751
14752         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14753             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14754                                          wdev->netdev->ifindex)) ||
14755             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14756                               NL80211_ATTR_PAD))
14757                 goto nla_put_failure;
14758
14759         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14760                               NL80211_ATTR_PAD))
14761                 goto nla_put_failure;
14762
14763         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14764         if (!func_attr)
14765                 goto nla_put_failure;
14766
14767         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14768             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14769                 goto nla_put_failure;
14770
14771         nla_nest_end(msg, func_attr);
14772         genlmsg_end(msg, hdr);
14773
14774         if (!wdev->owner_nlportid)
14775                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14776                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14777         else
14778                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14779                                 wdev->owner_nlportid);
14780
14781         return;
14782
14783 nla_put_failure:
14784         nlmsg_free(msg);
14785 }
14786 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14787
14788 static int nl80211_get_protocol_features(struct sk_buff *skb,
14789                                          struct genl_info *info)
14790 {
14791         void *hdr;
14792         struct sk_buff *msg;
14793
14794         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14795         if (!msg)
14796                 return -ENOMEM;
14797
14798         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14799                              NL80211_CMD_GET_PROTOCOL_FEATURES);
14800         if (!hdr)
14801                 goto nla_put_failure;
14802
14803         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14804                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14805                 goto nla_put_failure;
14806
14807         genlmsg_end(msg, hdr);
14808         return genlmsg_reply(msg, info);
14809
14810  nla_put_failure:
14811         kfree_skb(msg);
14812         return -ENOBUFS;
14813 }
14814
14815 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14816 {
14817         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14818         struct cfg80211_update_ft_ies_params ft_params;
14819         struct net_device *dev = info->user_ptr[1];
14820
14821         if (!rdev->ops->update_ft_ies)
14822                 return -EOPNOTSUPP;
14823
14824         if (!info->attrs[NL80211_ATTR_MDID] ||
14825             !info->attrs[NL80211_ATTR_IE])
14826                 return -EINVAL;
14827
14828         memset(&ft_params, 0, sizeof(ft_params));
14829         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14830         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14831         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14832
14833         return rdev_update_ft_ies(rdev, dev, &ft_params);
14834 }
14835
14836 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14837                                        struct genl_info *info)
14838 {
14839         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14840         struct wireless_dev *wdev = info->user_ptr[1];
14841         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14842         u16 duration;
14843         int ret;
14844
14845         if (!rdev->ops->crit_proto_start)
14846                 return -EOPNOTSUPP;
14847
14848         if (WARN_ON(!rdev->ops->crit_proto_stop))
14849                 return -EINVAL;
14850
14851         if (rdev->crit_proto_nlportid)
14852                 return -EBUSY;
14853
14854         /* determine protocol if provided */
14855         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14856                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14857
14858         if (proto >= NUM_NL80211_CRIT_PROTO)
14859                 return -EINVAL;
14860
14861         /* timeout must be provided */
14862         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14863                 return -EINVAL;
14864
14865         duration =
14866                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14867
14868         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14869         if (!ret)
14870                 rdev->crit_proto_nlportid = info->snd_portid;
14871
14872         return ret;
14873 }
14874
14875 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14876                                       struct genl_info *info)
14877 {
14878         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14879         struct wireless_dev *wdev = info->user_ptr[1];
14880
14881         if (!rdev->ops->crit_proto_stop)
14882                 return -EOPNOTSUPP;
14883
14884         if (rdev->crit_proto_nlportid) {
14885                 rdev->crit_proto_nlportid = 0;
14886                 rdev_crit_proto_stop(rdev, wdev);
14887         }
14888         return 0;
14889 }
14890
14891 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14892                                        struct nlattr *attr,
14893                                        struct netlink_ext_ack *extack)
14894 {
14895         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14896                 if (attr->nla_type & NLA_F_NESTED) {
14897                         NL_SET_ERR_MSG_ATTR(extack, attr,
14898                                             "unexpected nested data");
14899                         return -EINVAL;
14900                 }
14901
14902                 return 0;
14903         }
14904
14905         if (!(attr->nla_type & NLA_F_NESTED)) {
14906                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14907                 return -EINVAL;
14908         }
14909
14910         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14911 }
14912
14913 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14914 {
14915         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14916         struct wireless_dev *wdev =
14917                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14918                                            info->attrs);
14919         int i, err;
14920         u32 vid, subcmd;
14921
14922         if (!rdev->wiphy.vendor_commands)
14923                 return -EOPNOTSUPP;
14924
14925         if (IS_ERR(wdev)) {
14926                 err = PTR_ERR(wdev);
14927                 if (err != -EINVAL)
14928                         return err;
14929                 wdev = NULL;
14930         } else if (wdev->wiphy != &rdev->wiphy) {
14931                 return -EINVAL;
14932         }
14933
14934         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14935             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14936                 return -EINVAL;
14937
14938         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14939         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14940         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14941                 const struct wiphy_vendor_command *vcmd;
14942                 void *data = NULL;
14943                 int len = 0;
14944
14945                 vcmd = &rdev->wiphy.vendor_commands[i];
14946
14947                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14948                         continue;
14949
14950                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14951                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14952                         if (!wdev)
14953                                 return -EINVAL;
14954                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14955                             !wdev->netdev)
14956                                 return -EINVAL;
14957
14958                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14959                                 if (!wdev_running(wdev))
14960                                         return -ENETDOWN;
14961                         }
14962                 } else {
14963                         wdev = NULL;
14964                 }
14965
14966                 if (!vcmd->doit)
14967                         return -EOPNOTSUPP;
14968
14969                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14970                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14971                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14972
14973                         err = nl80211_vendor_check_policy(vcmd,
14974                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
14975                                         info->extack);
14976                         if (err)
14977                                 return err;
14978                 }
14979
14980                 rdev->cur_cmd_info = info;
14981                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14982                 rdev->cur_cmd_info = NULL;
14983                 return err;
14984         }
14985
14986         return -EOPNOTSUPP;
14987 }
14988
14989 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14990                                        struct netlink_callback *cb,
14991                                        struct cfg80211_registered_device **rdev,
14992                                        struct wireless_dev **wdev)
14993 {
14994         struct nlattr **attrbuf;
14995         u32 vid, subcmd;
14996         unsigned int i;
14997         int vcmd_idx = -1;
14998         int err;
14999         void *data = NULL;
15000         unsigned int data_len = 0;
15001
15002         if (cb->args[0]) {
15003                 /* subtract the 1 again here */
15004                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
15005                 struct wireless_dev *tmp;
15006
15007                 if (!wiphy)
15008                         return -ENODEV;
15009                 *rdev = wiphy_to_rdev(wiphy);
15010                 *wdev = NULL;
15011
15012                 if (cb->args[1]) {
15013                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
15014                                 if (tmp->identifier == cb->args[1] - 1) {
15015                                         *wdev = tmp;
15016                                         break;
15017                                 }
15018                         }
15019                 }
15020
15021                 /* keep rtnl locked in successful case */
15022                 return 0;
15023         }
15024
15025         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
15026         if (!attrbuf)
15027                 return -ENOMEM;
15028
15029         err = nlmsg_parse_deprecated(cb->nlh,
15030                                      GENL_HDRLEN + nl80211_fam.hdrsize,
15031                                      attrbuf, nl80211_fam.maxattr,
15032                                      nl80211_policy, NULL);
15033         if (err)
15034                 goto out;
15035
15036         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
15037             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
15038                 err = -EINVAL;
15039                 goto out;
15040         }
15041
15042         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15043         if (IS_ERR(*wdev))
15044                 *wdev = NULL;
15045
15046         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15047         if (IS_ERR(*rdev)) {
15048                 err = PTR_ERR(*rdev);
15049                 goto out;
15050         }
15051
15052         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15053         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15054
15055         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15056                 const struct wiphy_vendor_command *vcmd;
15057
15058                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15059
15060                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15061                         continue;
15062
15063                 if (!vcmd->dumpit) {
15064                         err = -EOPNOTSUPP;
15065                         goto out;
15066                 }
15067
15068                 vcmd_idx = i;
15069                 break;
15070         }
15071
15072         if (vcmd_idx < 0) {
15073                 err = -EOPNOTSUPP;
15074                 goto out;
15075         }
15076
15077         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15078                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15079                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15080
15081                 err = nl80211_vendor_check_policy(
15082                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15083                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
15084                                 cb->extack);
15085                 if (err)
15086                         goto out;
15087         }
15088
15089         /* 0 is the first index - add 1 to parse only once */
15090         cb->args[0] = (*rdev)->wiphy_idx + 1;
15091         /* add 1 to know if it was NULL */
15092         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15093         cb->args[2] = vcmd_idx;
15094         cb->args[3] = (unsigned long)data;
15095         cb->args[4] = data_len;
15096
15097         /* keep rtnl locked in successful case */
15098         err = 0;
15099 out:
15100         kfree(attrbuf);
15101         return err;
15102 }
15103
15104 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15105                                    struct netlink_callback *cb)
15106 {
15107         struct cfg80211_registered_device *rdev;
15108         struct wireless_dev *wdev;
15109         unsigned int vcmd_idx;
15110         const struct wiphy_vendor_command *vcmd;
15111         void *data;
15112         int data_len;
15113         int err;
15114         struct nlattr *vendor_data;
15115
15116         rtnl_lock();
15117         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15118         if (err)
15119                 goto out;
15120
15121         vcmd_idx = cb->args[2];
15122         data = (void *)cb->args[3];
15123         data_len = cb->args[4];
15124         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15125
15126         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15127                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15128                 if (!wdev) {
15129                         err = -EINVAL;
15130                         goto out;
15131                 }
15132                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15133                     !wdev->netdev) {
15134                         err = -EINVAL;
15135                         goto out;
15136                 }
15137
15138                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15139                         if (!wdev_running(wdev)) {
15140                                 err = -ENETDOWN;
15141                                 goto out;
15142                         }
15143                 }
15144         }
15145
15146         while (1) {
15147                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15148                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
15149                                            NL80211_CMD_VENDOR);
15150                 if (!hdr)
15151                         break;
15152
15153                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15154                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15155                                                wdev_id(wdev),
15156                                                NL80211_ATTR_PAD))) {
15157                         genlmsg_cancel(skb, hdr);
15158                         break;
15159                 }
15160
15161                 vendor_data = nla_nest_start_noflag(skb,
15162                                                     NL80211_ATTR_VENDOR_DATA);
15163                 if (!vendor_data) {
15164                         genlmsg_cancel(skb, hdr);
15165                         break;
15166                 }
15167
15168                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15169                                    (unsigned long *)&cb->args[5]);
15170                 nla_nest_end(skb, vendor_data);
15171
15172                 if (err == -ENOBUFS || err == -ENOENT) {
15173                         genlmsg_cancel(skb, hdr);
15174                         break;
15175                 } else if (err <= 0) {
15176                         genlmsg_cancel(skb, hdr);
15177                         goto out;
15178                 }
15179
15180                 genlmsg_end(skb, hdr);
15181         }
15182
15183         err = skb->len;
15184  out:
15185         rtnl_unlock();
15186         return err;
15187 }
15188
15189 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15190                                            enum nl80211_commands cmd,
15191                                            enum nl80211_attrs attr,
15192                                            int approxlen)
15193 {
15194         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15195
15196         if (WARN_ON(!rdev->cur_cmd_info))
15197                 return NULL;
15198
15199         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15200                                            rdev->cur_cmd_info->snd_portid,
15201                                            rdev->cur_cmd_info->snd_seq,
15202                                            cmd, attr, NULL, GFP_KERNEL);
15203 }
15204 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15205
15206 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15207 {
15208         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15209         void *hdr = ((void **)skb->cb)[1];
15210         struct nlattr *data = ((void **)skb->cb)[2];
15211
15212         /* clear CB data for netlink core to own from now on */
15213         memset(skb->cb, 0, sizeof(skb->cb));
15214
15215         if (WARN_ON(!rdev->cur_cmd_info)) {
15216                 kfree_skb(skb);
15217                 return -EINVAL;
15218         }
15219
15220         nla_nest_end(skb, data);
15221         genlmsg_end(skb, hdr);
15222         return genlmsg_reply(skb, rdev->cur_cmd_info);
15223 }
15224 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15225
15226 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15227 {
15228         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15229
15230         if (WARN_ON(!rdev->cur_cmd_info))
15231                 return 0;
15232
15233         return rdev->cur_cmd_info->snd_portid;
15234 }
15235 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15236
15237 static int nl80211_set_qos_map(struct sk_buff *skb,
15238                                struct genl_info *info)
15239 {
15240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15241         struct cfg80211_qos_map *qos_map = NULL;
15242         struct net_device *dev = info->user_ptr[1];
15243         u8 *pos, len, num_des, des_len, des;
15244         int ret;
15245
15246         if (!rdev->ops->set_qos_map)
15247                 return -EOPNOTSUPP;
15248
15249         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15250                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15251                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15252
15253                 if (len % 2)
15254                         return -EINVAL;
15255
15256                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15257                 if (!qos_map)
15258                         return -ENOMEM;
15259
15260                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15261                 if (num_des) {
15262                         des_len = num_des *
15263                                 sizeof(struct cfg80211_dscp_exception);
15264                         memcpy(qos_map->dscp_exception, pos, des_len);
15265                         qos_map->num_des = num_des;
15266                         for (des = 0; des < num_des; des++) {
15267                                 if (qos_map->dscp_exception[des].up > 7) {
15268                                         kfree(qos_map);
15269                                         return -EINVAL;
15270                                 }
15271                         }
15272                         pos += des_len;
15273                 }
15274                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15275         }
15276
15277         wdev_lock(dev->ieee80211_ptr);
15278         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15279         if (!ret)
15280                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15281         wdev_unlock(dev->ieee80211_ptr);
15282
15283         kfree(qos_map);
15284         return ret;
15285 }
15286
15287 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15288 {
15289         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15290         struct net_device *dev = info->user_ptr[1];
15291         struct wireless_dev *wdev = dev->ieee80211_ptr;
15292         const u8 *peer;
15293         u8 tsid, up;
15294         u16 admitted_time = 0;
15295         int err;
15296
15297         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15298                 return -EOPNOTSUPP;
15299
15300         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15301             !info->attrs[NL80211_ATTR_USER_PRIO])
15302                 return -EINVAL;
15303
15304         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15305         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15306
15307         /* WMM uses TIDs 0-7 even for TSPEC */
15308         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15309                 /* TODO: handle 802.11 TSPEC/admission control
15310                  * need more attributes for that (e.g. BA session requirement);
15311                  * change the WMM adminssion test above to allow both then
15312                  */
15313                 return -EINVAL;
15314         }
15315
15316         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15317
15318         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15319                 admitted_time =
15320                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15321                 if (!admitted_time)
15322                         return -EINVAL;
15323         }
15324
15325         wdev_lock(wdev);
15326         switch (wdev->iftype) {
15327         case NL80211_IFTYPE_STATION:
15328         case NL80211_IFTYPE_P2P_CLIENT:
15329                 if (wdev->connected)
15330                         break;
15331                 err = -ENOTCONN;
15332                 goto out;
15333         default:
15334                 err = -EOPNOTSUPP;
15335                 goto out;
15336         }
15337
15338         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15339
15340  out:
15341         wdev_unlock(wdev);
15342         return err;
15343 }
15344
15345 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15346 {
15347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15348         struct net_device *dev = info->user_ptr[1];
15349         struct wireless_dev *wdev = dev->ieee80211_ptr;
15350         const u8 *peer;
15351         u8 tsid;
15352         int err;
15353
15354         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15355                 return -EINVAL;
15356
15357         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15358         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15359
15360         wdev_lock(wdev);
15361         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15362         wdev_unlock(wdev);
15363
15364         return err;
15365 }
15366
15367 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15368                                        struct genl_info *info)
15369 {
15370         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15371         struct net_device *dev = info->user_ptr[1];
15372         struct wireless_dev *wdev = dev->ieee80211_ptr;
15373         struct cfg80211_chan_def chandef = {};
15374         const u8 *addr;
15375         u8 oper_class;
15376         int err;
15377
15378         if (!rdev->ops->tdls_channel_switch ||
15379             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15380                 return -EOPNOTSUPP;
15381
15382         switch (dev->ieee80211_ptr->iftype) {
15383         case NL80211_IFTYPE_STATION:
15384         case NL80211_IFTYPE_P2P_CLIENT:
15385                 break;
15386         default:
15387                 return -EOPNOTSUPP;
15388         }
15389
15390         if (!info->attrs[NL80211_ATTR_MAC] ||
15391             !info->attrs[NL80211_ATTR_OPER_CLASS])
15392                 return -EINVAL;
15393
15394         err = nl80211_parse_chandef(rdev, info, &chandef);
15395         if (err)
15396                 return err;
15397
15398         /*
15399          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15400          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15401          * specification is not defined for them.
15402          */
15403         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15404             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15405             chandef.width != NL80211_CHAN_WIDTH_20)
15406                 return -EINVAL;
15407
15408         /* we will be active on the TDLS link */
15409         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15410                                            wdev->iftype))
15411                 return -EINVAL;
15412
15413         /* don't allow switching to DFS channels */
15414         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15415                 return -EINVAL;
15416
15417         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15418         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15419
15420         wdev_lock(wdev);
15421         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15422         wdev_unlock(wdev);
15423
15424         return err;
15425 }
15426
15427 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15428                                               struct genl_info *info)
15429 {
15430         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15431         struct net_device *dev = info->user_ptr[1];
15432         struct wireless_dev *wdev = dev->ieee80211_ptr;
15433         const u8 *addr;
15434
15435         if (!rdev->ops->tdls_channel_switch ||
15436             !rdev->ops->tdls_cancel_channel_switch ||
15437             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15438                 return -EOPNOTSUPP;
15439
15440         switch (dev->ieee80211_ptr->iftype) {
15441         case NL80211_IFTYPE_STATION:
15442         case NL80211_IFTYPE_P2P_CLIENT:
15443                 break;
15444         default:
15445                 return -EOPNOTSUPP;
15446         }
15447
15448         if (!info->attrs[NL80211_ATTR_MAC])
15449                 return -EINVAL;
15450
15451         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15452
15453         wdev_lock(wdev);
15454         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15455         wdev_unlock(wdev);
15456
15457         return 0;
15458 }
15459
15460 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15461                                             struct genl_info *info)
15462 {
15463         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15464         struct net_device *dev = info->user_ptr[1];
15465         struct wireless_dev *wdev = dev->ieee80211_ptr;
15466         const struct nlattr *nla;
15467         bool enabled;
15468
15469         if (!rdev->ops->set_multicast_to_unicast)
15470                 return -EOPNOTSUPP;
15471
15472         if (wdev->iftype != NL80211_IFTYPE_AP &&
15473             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15474                 return -EOPNOTSUPP;
15475
15476         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15477         enabled = nla_get_flag(nla);
15478
15479         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15480 }
15481
15482 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15483 {
15484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15485         struct net_device *dev = info->user_ptr[1];
15486         struct wireless_dev *wdev = dev->ieee80211_ptr;
15487         struct cfg80211_pmk_conf pmk_conf = {};
15488         int ret;
15489
15490         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15491             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15492                 return -EOPNOTSUPP;
15493
15494         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15495                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15496                 return -EOPNOTSUPP;
15497
15498         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15499                 return -EINVAL;
15500
15501         wdev_lock(wdev);
15502         if (!wdev->connected) {
15503                 ret = -ENOTCONN;
15504                 goto out;
15505         }
15506
15507         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15508         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15509                 ret = -EINVAL;
15510                 goto out;
15511         }
15512
15513         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15514         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15515         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15516             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15517                 ret = -EINVAL;
15518                 goto out;
15519         }
15520
15521         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15522                 pmk_conf.pmk_r0_name =
15523                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15524
15525         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15526 out:
15527         wdev_unlock(wdev);
15528         return ret;
15529 }
15530
15531 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15532 {
15533         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15534         struct net_device *dev = info->user_ptr[1];
15535         struct wireless_dev *wdev = dev->ieee80211_ptr;
15536         const u8 *aa;
15537         int ret;
15538
15539         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15540             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15541                 return -EOPNOTSUPP;
15542
15543         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15544                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15545                 return -EOPNOTSUPP;
15546
15547         if (!info->attrs[NL80211_ATTR_MAC])
15548                 return -EINVAL;
15549
15550         wdev_lock(wdev);
15551         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15552         ret = rdev_del_pmk(rdev, dev, aa);
15553         wdev_unlock(wdev);
15554
15555         return ret;
15556 }
15557
15558 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15559 {
15560         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15561         struct net_device *dev = info->user_ptr[1];
15562         struct cfg80211_external_auth_params params;
15563
15564         if (!rdev->ops->external_auth)
15565                 return -EOPNOTSUPP;
15566
15567         if (!info->attrs[NL80211_ATTR_SSID] &&
15568             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15569             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15570                 return -EINVAL;
15571
15572         if (!info->attrs[NL80211_ATTR_BSSID])
15573                 return -EINVAL;
15574
15575         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15576                 return -EINVAL;
15577
15578         memset(&params, 0, sizeof(params));
15579
15580         if (info->attrs[NL80211_ATTR_SSID]) {
15581                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15582                 if (params.ssid.ssid_len == 0)
15583                         return -EINVAL;
15584                 memcpy(params.ssid.ssid,
15585                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15586                        params.ssid.ssid_len);
15587         }
15588
15589         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15590                ETH_ALEN);
15591
15592         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15593
15594         if (info->attrs[NL80211_ATTR_PMKID])
15595                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15596
15597         return rdev_external_auth(rdev, dev, &params);
15598 }
15599
15600 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15601 {
15602         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15603         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15604         struct net_device *dev = info->user_ptr[1];
15605         struct wireless_dev *wdev = dev->ieee80211_ptr;
15606         const u8 *buf;
15607         size_t len;
15608         u8 *dest;
15609         u16 proto;
15610         bool noencrypt;
15611         u64 cookie = 0;
15612         int link_id;
15613         int err;
15614
15615         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15616                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15617                 return -EOPNOTSUPP;
15618
15619         if (!rdev->ops->tx_control_port)
15620                 return -EOPNOTSUPP;
15621
15622         if (!info->attrs[NL80211_ATTR_FRAME] ||
15623             !info->attrs[NL80211_ATTR_MAC] ||
15624             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15625                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15626                 return -EINVAL;
15627         }
15628
15629         wdev_lock(wdev);
15630
15631         switch (wdev->iftype) {
15632         case NL80211_IFTYPE_AP:
15633         case NL80211_IFTYPE_P2P_GO:
15634         case NL80211_IFTYPE_MESH_POINT:
15635                 break;
15636         case NL80211_IFTYPE_ADHOC:
15637                 if (wdev->u.ibss.current_bss)
15638                         break;
15639                 err = -ENOTCONN;
15640                 goto out;
15641         case NL80211_IFTYPE_STATION:
15642         case NL80211_IFTYPE_P2P_CLIENT:
15643                 if (wdev->connected)
15644                         break;
15645                 err = -ENOTCONN;
15646                 goto out;
15647         default:
15648                 err = -EOPNOTSUPP;
15649                 goto out;
15650         }
15651
15652         wdev_unlock(wdev);
15653
15654         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15655         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15656         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15657         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15658         noencrypt =
15659                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15660
15661         link_id = nl80211_link_id_or_invalid(info->attrs);
15662
15663         err = rdev_tx_control_port(rdev, dev, buf, len,
15664                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15665                                    dont_wait_for_ack ? NULL : &cookie);
15666         if (!err && !dont_wait_for_ack)
15667                 nl_set_extack_cookie_u64(info->extack, cookie);
15668         return err;
15669  out:
15670         wdev_unlock(wdev);
15671         return err;
15672 }
15673
15674 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15675                                            struct genl_info *info)
15676 {
15677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15678         struct net_device *dev = info->user_ptr[1];
15679         struct wireless_dev *wdev = dev->ieee80211_ptr;
15680         struct cfg80211_ftm_responder_stats ftm_stats = {};
15681         unsigned int link_id = nl80211_link_id(info->attrs);
15682         struct sk_buff *msg;
15683         void *hdr;
15684         struct nlattr *ftm_stats_attr;
15685         int err;
15686
15687         if (wdev->iftype != NL80211_IFTYPE_AP ||
15688             !wdev->links[link_id].ap.beacon_interval)
15689                 return -EOPNOTSUPP;
15690
15691         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15692         if (err)
15693                 return err;
15694
15695         if (!ftm_stats.filled)
15696                 return -ENODATA;
15697
15698         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15699         if (!msg)
15700                 return -ENOMEM;
15701
15702         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15703                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15704         if (!hdr)
15705                 goto nla_put_failure;
15706
15707         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15708                 goto nla_put_failure;
15709
15710         ftm_stats_attr = nla_nest_start_noflag(msg,
15711                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15712         if (!ftm_stats_attr)
15713                 goto nla_put_failure;
15714
15715 #define SET_FTM(field, name, type)                                       \
15716         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15717             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15718                              ftm_stats.field))                           \
15719                 goto nla_put_failure; } while (0)
15720 #define SET_FTM_U64(field, name)                                         \
15721         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15722             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15723                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15724                 goto nla_put_failure; } while (0)
15725
15726         SET_FTM(success_num, SUCCESS_NUM, u32);
15727         SET_FTM(partial_num, PARTIAL_NUM, u32);
15728         SET_FTM(failed_num, FAILED_NUM, u32);
15729         SET_FTM(asap_num, ASAP_NUM, u32);
15730         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15731         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15732         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15733         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15734         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15735 #undef SET_FTM
15736
15737         nla_nest_end(msg, ftm_stats_attr);
15738
15739         genlmsg_end(msg, hdr);
15740         return genlmsg_reply(msg, info);
15741
15742 nla_put_failure:
15743         nlmsg_free(msg);
15744         return -ENOBUFS;
15745 }
15746
15747 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15748 {
15749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15750         struct cfg80211_update_owe_info owe_info;
15751         struct net_device *dev = info->user_ptr[1];
15752
15753         if (!rdev->ops->update_owe_info)
15754                 return -EOPNOTSUPP;
15755
15756         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15757             !info->attrs[NL80211_ATTR_MAC])
15758                 return -EINVAL;
15759
15760         memset(&owe_info, 0, sizeof(owe_info));
15761         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15762         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15763
15764         if (info->attrs[NL80211_ATTR_IE]) {
15765                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15766                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15767         }
15768
15769         return rdev_update_owe_info(rdev, dev, &owe_info);
15770 }
15771
15772 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15773 {
15774         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15775         struct net_device *dev = info->user_ptr[1];
15776         struct wireless_dev *wdev = dev->ieee80211_ptr;
15777         struct station_info sinfo = {};
15778         const u8 *buf;
15779         size_t len;
15780         u8 *dest;
15781         int err;
15782
15783         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15784                 return -EOPNOTSUPP;
15785
15786         if (!info->attrs[NL80211_ATTR_MAC] ||
15787             !info->attrs[NL80211_ATTR_FRAME]) {
15788                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15789                 return -EINVAL;
15790         }
15791
15792         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15793                 return -EOPNOTSUPP;
15794
15795         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15796         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15797         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15798
15799         if (len < sizeof(struct ethhdr))
15800                 return -EINVAL;
15801
15802         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15803             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15804                 return -EINVAL;
15805
15806         err = rdev_get_station(rdev, dev, dest, &sinfo);
15807         if (err)
15808                 return err;
15809
15810         cfg80211_sinfo_release_content(&sinfo);
15811
15812         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15813 }
15814
15815 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15816                           struct nlattr *attrs[], struct net_device *dev,
15817                           struct cfg80211_tid_cfg *tid_conf,
15818                           struct genl_info *info, const u8 *peer,
15819                           unsigned int link_id)
15820 {
15821         struct netlink_ext_ack *extack = info->extack;
15822         u64 mask;
15823         int err;
15824
15825         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15826                 return -EINVAL;
15827
15828         tid_conf->config_override =
15829                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15830         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15831
15832         if (tid_conf->config_override) {
15833                 if (rdev->ops->reset_tid_config) {
15834                         err = rdev_reset_tid_config(rdev, dev, peer,
15835                                                     tid_conf->tids);
15836                         if (err)
15837                                 return err;
15838                 } else {
15839                         return -EINVAL;
15840                 }
15841         }
15842
15843         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15844                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15845                 tid_conf->noack =
15846                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15847         }
15848
15849         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15850                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15851                 tid_conf->retry_short =
15852                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15853
15854                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15855                         return -EINVAL;
15856         }
15857
15858         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15859                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15860                 tid_conf->retry_long =
15861                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15862
15863                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15864                         return -EINVAL;
15865         }
15866
15867         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15868                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15869                 tid_conf->ampdu =
15870                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15871         }
15872
15873         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15874                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15875                 tid_conf->rtscts =
15876                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15877         }
15878
15879         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15880                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15881                 tid_conf->amsdu =
15882                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15883         }
15884
15885         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15886                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15887
15888                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15889
15890                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15891                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15892                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15893                                                     &tid_conf->txrate_mask, dev,
15894                                                     true, link_id);
15895                         if (err)
15896                                 return err;
15897
15898                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15899                 }
15900                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15901         }
15902
15903         if (peer)
15904                 mask = rdev->wiphy.tid_config_support.peer;
15905         else
15906                 mask = rdev->wiphy.tid_config_support.vif;
15907
15908         if (tid_conf->mask & ~mask) {
15909                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15910                 return -ENOTSUPP;
15911         }
15912
15913         return 0;
15914 }
15915
15916 static int nl80211_set_tid_config(struct sk_buff *skb,
15917                                   struct genl_info *info)
15918 {
15919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15920         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15921         unsigned int link_id = nl80211_link_id(info->attrs);
15922         struct net_device *dev = info->user_ptr[1];
15923         struct cfg80211_tid_config *tid_config;
15924         struct nlattr *tid;
15925         int conf_idx = 0, rem_conf;
15926         int ret = -EINVAL;
15927         u32 num_conf = 0;
15928
15929         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15930                 return -EINVAL;
15931
15932         if (!rdev->ops->set_tid_config)
15933                 return -EOPNOTSUPP;
15934
15935         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15936                             rem_conf)
15937                 num_conf++;
15938
15939         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15940                              GFP_KERNEL);
15941         if (!tid_config)
15942                 return -ENOMEM;
15943
15944         tid_config->n_tid_conf = num_conf;
15945
15946         if (info->attrs[NL80211_ATTR_MAC])
15947                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15948
15949         wdev_lock(dev->ieee80211_ptr);
15950
15951         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15952                             rem_conf) {
15953                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15954                                        tid, NULL, NULL);
15955
15956                 if (ret)
15957                         goto bad_tid_conf;
15958
15959                 ret = parse_tid_conf(rdev, attrs, dev,
15960                                      &tid_config->tid_conf[conf_idx],
15961                                      info, tid_config->peer, link_id);
15962                 if (ret)
15963                         goto bad_tid_conf;
15964
15965                 conf_idx++;
15966         }
15967
15968         ret = rdev_set_tid_config(rdev, dev, tid_config);
15969
15970 bad_tid_conf:
15971         kfree(tid_config);
15972         wdev_unlock(dev->ieee80211_ptr);
15973         return ret;
15974 }
15975
15976 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15977 {
15978         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15979         struct cfg80211_color_change_settings params = {};
15980         struct net_device *dev = info->user_ptr[1];
15981         struct wireless_dev *wdev = dev->ieee80211_ptr;
15982         struct nlattr **tb;
15983         u16 offset;
15984         int err;
15985
15986         if (!rdev->ops->color_change)
15987                 return -EOPNOTSUPP;
15988
15989         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15990                                      NL80211_EXT_FEATURE_BSS_COLOR))
15991                 return -EOPNOTSUPP;
15992
15993         if (wdev->iftype != NL80211_IFTYPE_AP)
15994                 return -EOPNOTSUPP;
15995
15996         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15997             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15998             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15999                 return -EINVAL;
16000
16001         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
16002         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
16003
16004         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
16005                                    info->extack);
16006         if (err)
16007                 return err;
16008
16009         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
16010         if (!tb)
16011                 return -ENOMEM;
16012
16013         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
16014                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
16015                                nl80211_policy, info->extack);
16016         if (err)
16017                 goto out;
16018
16019         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
16020                                    info->extack);
16021         if (err)
16022                 goto out;
16023
16024         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
16025                 err = -EINVAL;
16026                 goto out;
16027         }
16028
16029         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
16030                 err = -EINVAL;
16031                 goto out;
16032         }
16033
16034         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
16035         if (offset >= params.beacon_color_change.tail_len) {
16036                 err = -EINVAL;
16037                 goto out;
16038         }
16039
16040         if (params.beacon_color_change.tail[offset] != params.count) {
16041                 err = -EINVAL;
16042                 goto out;
16043         }
16044
16045         params.counter_offset_beacon = offset;
16046
16047         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16048                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16049                     sizeof(u16)) {
16050                         err = -EINVAL;
16051                         goto out;
16052                 }
16053
16054                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16055                 if (offset >= params.beacon_color_change.probe_resp_len) {
16056                         err = -EINVAL;
16057                         goto out;
16058                 }
16059
16060                 if (params.beacon_color_change.probe_resp[offset] !=
16061                     params.count) {
16062                         err = -EINVAL;
16063                         goto out;
16064                 }
16065
16066                 params.counter_offset_presp = offset;
16067         }
16068
16069         wdev_lock(wdev);
16070         err = rdev_color_change(rdev, dev, &params);
16071         wdev_unlock(wdev);
16072
16073 out:
16074         kfree(params.beacon_next.mbssid_ies);
16075         kfree(params.beacon_color_change.mbssid_ies);
16076         kfree(params.beacon_next.rnr_ies);
16077         kfree(params.beacon_color_change.rnr_ies);
16078         kfree(tb);
16079         return err;
16080 }
16081
16082 static int nl80211_set_fils_aad(struct sk_buff *skb,
16083                                 struct genl_info *info)
16084 {
16085         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16086         struct net_device *dev = info->user_ptr[1];
16087         struct cfg80211_fils_aad fils_aad = {};
16088         u8 *nonces;
16089
16090         if (!info->attrs[NL80211_ATTR_MAC] ||
16091             !info->attrs[NL80211_ATTR_FILS_KEK] ||
16092             !info->attrs[NL80211_ATTR_FILS_NONCES])
16093                 return -EINVAL;
16094
16095         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16096         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16097         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16098         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16099         fils_aad.snonce = nonces;
16100         fils_aad.anonce = nonces + FILS_NONCE_LEN;
16101
16102         return rdev_set_fils_aad(rdev, dev, &fils_aad);
16103 }
16104
16105 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16106 {
16107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16108         unsigned int link_id = nl80211_link_id(info->attrs);
16109         struct net_device *dev = info->user_ptr[1];
16110         struct wireless_dev *wdev = dev->ieee80211_ptr;
16111         int ret;
16112
16113         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16114                 return -EINVAL;
16115
16116         switch (wdev->iftype) {
16117         case NL80211_IFTYPE_AP:
16118                 break;
16119         default:
16120                 return -EINVAL;
16121         }
16122
16123         if (!info->attrs[NL80211_ATTR_MAC] ||
16124             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16125                 return -EINVAL;
16126
16127         wdev_lock(wdev);
16128         wdev->valid_links |= BIT(link_id);
16129         ether_addr_copy(wdev->links[link_id].addr,
16130                         nla_data(info->attrs[NL80211_ATTR_MAC]));
16131
16132         ret = rdev_add_intf_link(rdev, wdev, link_id);
16133         if (ret) {
16134                 wdev->valid_links &= ~BIT(link_id);
16135                 eth_zero_addr(wdev->links[link_id].addr);
16136         }
16137         wdev_unlock(wdev);
16138
16139         return ret;
16140 }
16141
16142 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16143 {
16144         unsigned int link_id = nl80211_link_id(info->attrs);
16145         struct net_device *dev = info->user_ptr[1];
16146         struct wireless_dev *wdev = dev->ieee80211_ptr;
16147
16148         /* cannot remove if there's no link */
16149         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16150                 return -EINVAL;
16151
16152         switch (wdev->iftype) {
16153         case NL80211_IFTYPE_AP:
16154                 break;
16155         default:
16156                 return -EINVAL;
16157         }
16158
16159         wdev_lock(wdev);
16160         cfg80211_remove_link(wdev, link_id);
16161         wdev_unlock(wdev);
16162
16163         return 0;
16164 }
16165
16166 static int
16167 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16168                              bool add)
16169 {
16170         struct link_station_parameters params = {};
16171         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16172         struct net_device *dev = info->user_ptr[1];
16173         int err;
16174
16175         if ((add && !rdev->ops->add_link_station) ||
16176             (!add && !rdev->ops->mod_link_station))
16177                 return -EOPNOTSUPP;
16178
16179         if (add && !info->attrs[NL80211_ATTR_MAC])
16180                 return -EINVAL;
16181
16182         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16183                 return -EINVAL;
16184
16185         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16186                 return -EINVAL;
16187
16188         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16189
16190         if (info->attrs[NL80211_ATTR_MAC]) {
16191                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16192                 if (!is_valid_ether_addr(params.link_mac))
16193                         return -EINVAL;
16194         }
16195
16196         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16197                 return -EINVAL;
16198
16199         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16200
16201         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16202                 params.supported_rates =
16203                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16204                 params.supported_rates_len =
16205                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16206         }
16207
16208         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16209                 params.ht_capa =
16210                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16211
16212         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16213                 params.vht_capa =
16214                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16215
16216         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16217                 params.he_capa =
16218                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16219                 params.he_capa_len =
16220                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16221
16222                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16223                         params.eht_capa =
16224                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16225                         params.eht_capa_len =
16226                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16227
16228                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16229                                                         (const u8 *)params.eht_capa,
16230                                                         params.eht_capa_len,
16231                                                         false))
16232                                 return -EINVAL;
16233                 }
16234         }
16235
16236         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16237                 params.he_6ghz_capa =
16238                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16239
16240         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16241                 params.opmode_notif_used = true;
16242                 params.opmode_notif =
16243                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16244         }
16245
16246         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16247                                                 &params.txpwr_set);
16248         if (err)
16249                 return err;
16250
16251         wdev_lock(dev->ieee80211_ptr);
16252         if (add)
16253                 err = rdev_add_link_station(rdev, dev, &params);
16254         else
16255                 err = rdev_mod_link_station(rdev, dev, &params);
16256         wdev_unlock(dev->ieee80211_ptr);
16257
16258         return err;
16259 }
16260
16261 static int
16262 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16263 {
16264         return nl80211_add_mod_link_station(skb, info, true);
16265 }
16266
16267 static int
16268 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16269 {
16270         return nl80211_add_mod_link_station(skb, info, false);
16271 }
16272
16273 static int
16274 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16275 {
16276         struct link_station_del_parameters params = {};
16277         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16278         struct net_device *dev = info->user_ptr[1];
16279         int ret;
16280
16281         if (!rdev->ops->del_link_station)
16282                 return -EOPNOTSUPP;
16283
16284         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16285             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16286                 return -EINVAL;
16287
16288         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16289         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16290
16291         wdev_lock(dev->ieee80211_ptr);
16292         ret = rdev_del_link_station(rdev, dev, &params);
16293         wdev_unlock(dev->ieee80211_ptr);
16294
16295         return ret;
16296 }
16297
16298 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16299                                     struct genl_info *info)
16300 {
16301         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16302         struct net_device *dev = info->user_ptr[1];
16303         struct cfg80211_set_hw_timestamp hwts = {};
16304
16305         if (!rdev->wiphy.hw_timestamp_max_peers)
16306                 return -EOPNOTSUPP;
16307
16308         if (!info->attrs[NL80211_ATTR_MAC] &&
16309             rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16310                 return -EOPNOTSUPP;
16311
16312         if (info->attrs[NL80211_ATTR_MAC])
16313                 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16314
16315         hwts.enable =
16316                 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16317
16318         return rdev_set_hw_timestamp(rdev, dev, &hwts);
16319 }
16320
16321 #define NL80211_FLAG_NEED_WIPHY         0x01
16322 #define NL80211_FLAG_NEED_NETDEV        0x02
16323 #define NL80211_FLAG_NEED_RTNL          0x04
16324 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16325 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16326                                          NL80211_FLAG_CHECK_NETDEV_UP)
16327 #define NL80211_FLAG_NEED_WDEV          0x10
16328 /* If a netdev is associated, it must be UP, P2P must be started */
16329 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16330                                          NL80211_FLAG_CHECK_NETDEV_UP)
16331 #define NL80211_FLAG_CLEAR_SKB          0x20
16332 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16333 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16334 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16335
16336 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16337         SELECTOR(__sel, NONE, 0) /* must be first */    \
16338         SELECTOR(__sel, WIPHY,                          \
16339                  NL80211_FLAG_NEED_WIPHY)               \
16340         SELECTOR(__sel, WDEV,                           \
16341                  NL80211_FLAG_NEED_WDEV)                \
16342         SELECTOR(__sel, NETDEV,                         \
16343                  NL80211_FLAG_NEED_NETDEV)              \
16344         SELECTOR(__sel, NETDEV_LINK,                    \
16345                  NL80211_FLAG_NEED_NETDEV |             \
16346                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16347         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16348                  NL80211_FLAG_NEED_NETDEV |             \
16349                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16350         SELECTOR(__sel, WIPHY_RTNL,                     \
16351                  NL80211_FLAG_NEED_WIPHY |              \
16352                  NL80211_FLAG_NEED_RTNL)                \
16353         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16354                  NL80211_FLAG_NEED_WIPHY |              \
16355                  NL80211_FLAG_NEED_RTNL |               \
16356                  NL80211_FLAG_NO_WIPHY_MTX)             \
16357         SELECTOR(__sel, WDEV_RTNL,                      \
16358                  NL80211_FLAG_NEED_WDEV |               \
16359                  NL80211_FLAG_NEED_RTNL)                \
16360         SELECTOR(__sel, NETDEV_RTNL,                    \
16361                  NL80211_FLAG_NEED_NETDEV |             \
16362                  NL80211_FLAG_NEED_RTNL)                \
16363         SELECTOR(__sel, NETDEV_UP,                      \
16364                  NL80211_FLAG_NEED_NETDEV_UP)           \
16365         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16366                  NL80211_FLAG_NEED_NETDEV_UP |          \
16367                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16368         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16369                  NL80211_FLAG_NEED_NETDEV_UP |          \
16370                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16371         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16372                  NL80211_FLAG_NEED_NETDEV_UP |          \
16373                  NL80211_FLAG_CLEAR_SKB |               \
16374                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16375         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16376                  NL80211_FLAG_NEED_NETDEV_UP |          \
16377                  NL80211_FLAG_NO_WIPHY_MTX)             \
16378         SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,          \
16379                  NL80211_FLAG_NEED_NETDEV_UP |          \
16380                  NL80211_FLAG_NO_WIPHY_MTX |            \
16381                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16382         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16383                  NL80211_FLAG_NEED_NETDEV_UP |          \
16384                  NL80211_FLAG_CLEAR_SKB)                \
16385         SELECTOR(__sel, WDEV_UP,                        \
16386                  NL80211_FLAG_NEED_WDEV_UP)             \
16387         SELECTOR(__sel, WDEV_UP_LINK,                   \
16388                  NL80211_FLAG_NEED_WDEV_UP |            \
16389                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16390         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16391                  NL80211_FLAG_NEED_WDEV_UP |            \
16392                  NL80211_FLAG_NEED_RTNL)                \
16393         SELECTOR(__sel, WIPHY_CLEAR,                    \
16394                  NL80211_FLAG_NEED_WIPHY |              \
16395                  NL80211_FLAG_CLEAR_SKB)
16396
16397 enum nl80211_internal_flags_selector {
16398 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16399         INTERNAL_FLAG_SELECTORS(_)
16400 #undef SELECTOR
16401 };
16402
16403 static u32 nl80211_internal_flags[] = {
16404 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16405         INTERNAL_FLAG_SELECTORS(_)
16406 #undef SELECTOR
16407 };
16408
16409 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16410                             struct sk_buff *skb,
16411                             struct genl_info *info)
16412 {
16413         struct cfg80211_registered_device *rdev = NULL;
16414         struct wireless_dev *wdev = NULL;
16415         struct net_device *dev = NULL;
16416         u32 internal_flags;
16417         int err;
16418
16419         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16420                 return -EINVAL;
16421
16422         internal_flags = nl80211_internal_flags[ops->internal_flags];
16423
16424         rtnl_lock();
16425         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16426                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16427                 if (IS_ERR(rdev)) {
16428                         err = PTR_ERR(rdev);
16429                         goto out_unlock;
16430                 }
16431                 info->user_ptr[0] = rdev;
16432         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16433                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16434                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16435                                                   info->attrs);
16436                 if (IS_ERR(wdev)) {
16437                         err = PTR_ERR(wdev);
16438                         goto out_unlock;
16439                 }
16440
16441                 dev = wdev->netdev;
16442                 dev_hold(dev);
16443                 rdev = wiphy_to_rdev(wdev->wiphy);
16444
16445                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16446                         if (!dev) {
16447                                 err = -EINVAL;
16448                                 goto out_unlock;
16449                         }
16450
16451                         info->user_ptr[1] = dev;
16452                 } else {
16453                         info->user_ptr[1] = wdev;
16454                 }
16455
16456                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16457                     !wdev_running(wdev)) {
16458                         err = -ENETDOWN;
16459                         goto out_unlock;
16460                 }
16461
16462                 info->user_ptr[0] = rdev;
16463         }
16464
16465         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16466                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16467
16468                 if (!wdev) {
16469                         err = -EINVAL;
16470                         goto out_unlock;
16471                 }
16472
16473                 /* MLO -> require valid link ID */
16474                 if (wdev->valid_links &&
16475                     (!link_id ||
16476                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16477                         err = -EINVAL;
16478                         goto out_unlock;
16479                 }
16480
16481                 /* non-MLO -> no link ID attribute accepted */
16482                 if (!wdev->valid_links && link_id) {
16483                         err = -EINVAL;
16484                         goto out_unlock;
16485                 }
16486         }
16487
16488         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16489                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16490                     (wdev && wdev->valid_links)) {
16491                         err = -EINVAL;
16492                         goto out_unlock;
16493                 }
16494         }
16495
16496         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16497                 wiphy_lock(&rdev->wiphy);
16498                 /* we keep the mutex locked until post_doit */
16499                 __release(&rdev->wiphy.mtx);
16500         }
16501         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16502                 rtnl_unlock();
16503
16504         return 0;
16505 out_unlock:
16506         rtnl_unlock();
16507         dev_put(dev);
16508         return err;
16509 }
16510
16511 static void nl80211_post_doit(const struct genl_split_ops *ops,
16512                               struct sk_buff *skb,
16513                               struct genl_info *info)
16514 {
16515         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16516
16517         if (info->user_ptr[1]) {
16518                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16519                         struct wireless_dev *wdev = info->user_ptr[1];
16520
16521                         dev_put(wdev->netdev);
16522                 } else {
16523                         dev_put(info->user_ptr[1]);
16524                 }
16525         }
16526
16527         if (info->user_ptr[0] &&
16528             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16529                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16530
16531                 /* we kept the mutex locked since pre_doit */
16532                 __acquire(&rdev->wiphy.mtx);
16533                 wiphy_unlock(&rdev->wiphy);
16534         }
16535
16536         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16537                 rtnl_unlock();
16538
16539         /* If needed, clear the netlink message payload from the SKB
16540          * as it might contain key data that shouldn't stick around on
16541          * the heap after the SKB is freed. The netlink message header
16542          * is still needed for further processing, so leave it intact.
16543          */
16544         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16545                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16546
16547                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16548         }
16549 }
16550
16551 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16552                                      struct cfg80211_sar_specs *sar_specs,
16553                                      struct nlattr *spec[], int index)
16554 {
16555         u32 range_index, i;
16556
16557         if (!sar_specs || !spec)
16558                 return -EINVAL;
16559
16560         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16561             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16562                 return -EINVAL;
16563
16564         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16565
16566         /* check if range_index exceeds num_freq_ranges */
16567         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16568                 return -EINVAL;
16569
16570         /* check if range_index duplicates */
16571         for (i = 0; i < index; i++) {
16572                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16573                         return -EINVAL;
16574         }
16575
16576         sar_specs->sub_specs[index].power =
16577                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16578
16579         sar_specs->sub_specs[index].freq_range_index = range_index;
16580
16581         return 0;
16582 }
16583
16584 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16585 {
16586         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16587         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16588         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16589         struct cfg80211_sar_specs *sar_spec;
16590         enum nl80211_sar_type type;
16591         struct nlattr *spec_list;
16592         u32 specs;
16593         int rem, err;
16594
16595         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16596                 return -EOPNOTSUPP;
16597
16598         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16599                 return -EINVAL;
16600
16601         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16602                          info->attrs[NL80211_ATTR_SAR_SPEC],
16603                          NULL, NULL);
16604
16605         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16606                 return -EINVAL;
16607
16608         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16609         if (type != rdev->wiphy.sar_capa->type)
16610                 return -EINVAL;
16611
16612         specs = 0;
16613         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16614                 specs++;
16615
16616         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16617                 return -EINVAL;
16618
16619         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16620         if (!sar_spec)
16621                 return -ENOMEM;
16622
16623         sar_spec->type = type;
16624         specs = 0;
16625         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16626                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16627                                  spec_list, NULL, NULL);
16628
16629                 switch (type) {
16630                 case NL80211_SAR_TYPE_POWER:
16631                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16632                                                       spec, specs)) {
16633                                 err = -EINVAL;
16634                                 goto error;
16635                         }
16636                         break;
16637                 default:
16638                         err = -EINVAL;
16639                         goto error;
16640                 }
16641                 specs++;
16642         }
16643
16644         sar_spec->num_sub_specs = specs;
16645
16646         rdev->cur_cmd_info = info;
16647         err = rdev_set_sar_specs(rdev, sar_spec);
16648         rdev->cur_cmd_info = NULL;
16649 error:
16650         kfree(sar_spec);
16651         return err;
16652 }
16653
16654 #define SELECTOR(__sel, name, value) \
16655         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16656 int __missing_selector(void);
16657 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16658
16659 static const struct genl_ops nl80211_ops[] = {
16660         {
16661                 .cmd = NL80211_CMD_GET_WIPHY,
16662                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16663                 .doit = nl80211_get_wiphy,
16664                 .dumpit = nl80211_dump_wiphy,
16665                 .done = nl80211_dump_wiphy_done,
16666                 /* can be retrieved by unprivileged users */
16667                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16668         },
16669 };
16670
16671 static const struct genl_small_ops nl80211_small_ops[] = {
16672         {
16673                 .cmd = NL80211_CMD_SET_WIPHY,
16674                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16675                 .doit = nl80211_set_wiphy,
16676                 .flags = GENL_UNS_ADMIN_PERM,
16677         },
16678         {
16679                 .cmd = NL80211_CMD_GET_INTERFACE,
16680                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16681                 .doit = nl80211_get_interface,
16682                 .dumpit = nl80211_dump_interface,
16683                 /* can be retrieved by unprivileged users */
16684                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16685         },
16686         {
16687                 .cmd = NL80211_CMD_SET_INTERFACE,
16688                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16689                 .doit = nl80211_set_interface,
16690                 .flags = GENL_UNS_ADMIN_PERM,
16691                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16692                                          NL80211_FLAG_NEED_RTNL),
16693         },
16694         {
16695                 .cmd = NL80211_CMD_NEW_INTERFACE,
16696                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16697                 .doit = nl80211_new_interface,
16698                 .flags = GENL_UNS_ADMIN_PERM,
16699                 .internal_flags =
16700                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
16701                                NL80211_FLAG_NEED_RTNL |
16702                                /* we take the wiphy mutex later ourselves */
16703                                NL80211_FLAG_NO_WIPHY_MTX),
16704         },
16705         {
16706                 .cmd = NL80211_CMD_DEL_INTERFACE,
16707                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16708                 .doit = nl80211_del_interface,
16709                 .flags = GENL_UNS_ADMIN_PERM,
16710                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16711                                          NL80211_FLAG_NEED_RTNL),
16712         },
16713         {
16714                 .cmd = NL80211_CMD_GET_KEY,
16715                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16716                 .doit = nl80211_get_key,
16717                 .flags = GENL_UNS_ADMIN_PERM,
16718                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16719         },
16720         {
16721                 .cmd = NL80211_CMD_SET_KEY,
16722                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16723                 .doit = nl80211_set_key,
16724                 .flags = GENL_UNS_ADMIN_PERM,
16725                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16726                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16727                                          NL80211_FLAG_CLEAR_SKB),
16728         },
16729         {
16730                 .cmd = NL80211_CMD_NEW_KEY,
16731                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16732                 .doit = nl80211_new_key,
16733                 .flags = GENL_UNS_ADMIN_PERM,
16734                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16735                                          NL80211_FLAG_CLEAR_SKB),
16736         },
16737         {
16738                 .cmd = NL80211_CMD_DEL_KEY,
16739                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16740                 .doit = nl80211_del_key,
16741                 .flags = GENL_UNS_ADMIN_PERM,
16742                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16743         },
16744         {
16745                 .cmd = NL80211_CMD_SET_BEACON,
16746                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16747                 .flags = GENL_UNS_ADMIN_PERM,
16748                 .doit = nl80211_set_beacon,
16749                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16750                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16751         },
16752         {
16753                 .cmd = NL80211_CMD_START_AP,
16754                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16755                 .flags = GENL_UNS_ADMIN_PERM,
16756                 .doit = nl80211_start_ap,
16757                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16758                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16759         },
16760         {
16761                 .cmd = NL80211_CMD_STOP_AP,
16762                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16763                 .flags = GENL_UNS_ADMIN_PERM,
16764                 .doit = nl80211_stop_ap,
16765                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16766                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16767         },
16768         {
16769                 .cmd = NL80211_CMD_GET_STATION,
16770                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16771                 .doit = nl80211_get_station,
16772                 .dumpit = nl80211_dump_station,
16773                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16774         },
16775         {
16776                 .cmd = NL80211_CMD_SET_STATION,
16777                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16778                 .doit = nl80211_set_station,
16779                 .flags = GENL_UNS_ADMIN_PERM,
16780                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16781         },
16782         {
16783                 .cmd = NL80211_CMD_NEW_STATION,
16784                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16785                 .doit = nl80211_new_station,
16786                 .flags = GENL_UNS_ADMIN_PERM,
16787                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16788         },
16789         {
16790                 .cmd = NL80211_CMD_DEL_STATION,
16791                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16792                 .doit = nl80211_del_station,
16793                 .flags = GENL_UNS_ADMIN_PERM,
16794                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16795         },
16796         {
16797                 .cmd = NL80211_CMD_GET_MPATH,
16798                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16799                 .doit = nl80211_get_mpath,
16800                 .dumpit = nl80211_dump_mpath,
16801                 .flags = GENL_UNS_ADMIN_PERM,
16802                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16803         },
16804         {
16805                 .cmd = NL80211_CMD_GET_MPP,
16806                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16807                 .doit = nl80211_get_mpp,
16808                 .dumpit = nl80211_dump_mpp,
16809                 .flags = GENL_UNS_ADMIN_PERM,
16810                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16811         },
16812         {
16813                 .cmd = NL80211_CMD_SET_MPATH,
16814                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16815                 .doit = nl80211_set_mpath,
16816                 .flags = GENL_UNS_ADMIN_PERM,
16817                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16818         },
16819         {
16820                 .cmd = NL80211_CMD_NEW_MPATH,
16821                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16822                 .doit = nl80211_new_mpath,
16823                 .flags = GENL_UNS_ADMIN_PERM,
16824                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16825         },
16826         {
16827                 .cmd = NL80211_CMD_DEL_MPATH,
16828                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16829                 .doit = nl80211_del_mpath,
16830                 .flags = GENL_UNS_ADMIN_PERM,
16831                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16832         },
16833         {
16834                 .cmd = NL80211_CMD_SET_BSS,
16835                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16836                 .doit = nl80211_set_bss,
16837                 .flags = GENL_UNS_ADMIN_PERM,
16838                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16839                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16840         },
16841         {
16842                 .cmd = NL80211_CMD_GET_REG,
16843                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16844                 .doit = nl80211_get_reg_do,
16845                 .dumpit = nl80211_get_reg_dump,
16846                 /* can be retrieved by unprivileged users */
16847         },
16848 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16849         {
16850                 .cmd = NL80211_CMD_SET_REG,
16851                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16852                 .doit = nl80211_set_reg,
16853                 .flags = GENL_ADMIN_PERM,
16854         },
16855 #endif
16856         {
16857                 .cmd = NL80211_CMD_REQ_SET_REG,
16858                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16859                 .doit = nl80211_req_set_reg,
16860                 .flags = GENL_ADMIN_PERM,
16861         },
16862         {
16863                 .cmd = NL80211_CMD_RELOAD_REGDB,
16864                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16865                 .doit = nl80211_reload_regdb,
16866                 .flags = GENL_ADMIN_PERM,
16867         },
16868         {
16869                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16870                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16871                 .doit = nl80211_get_mesh_config,
16872                 /* can be retrieved by unprivileged users */
16873                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16874         },
16875         {
16876                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16877                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16878                 .doit = nl80211_update_mesh_config,
16879                 .flags = GENL_UNS_ADMIN_PERM,
16880                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16881         },
16882         {
16883                 .cmd = NL80211_CMD_TRIGGER_SCAN,
16884                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16885                 .doit = nl80211_trigger_scan,
16886                 .flags = GENL_UNS_ADMIN_PERM,
16887                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16888         },
16889         {
16890                 .cmd = NL80211_CMD_ABORT_SCAN,
16891                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16892                 .doit = nl80211_abort_scan,
16893                 .flags = GENL_UNS_ADMIN_PERM,
16894                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16895         },
16896         {
16897                 .cmd = NL80211_CMD_GET_SCAN,
16898                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16899                 .dumpit = nl80211_dump_scan,
16900         },
16901         {
16902                 .cmd = NL80211_CMD_START_SCHED_SCAN,
16903                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16904                 .doit = nl80211_start_sched_scan,
16905                 .flags = GENL_UNS_ADMIN_PERM,
16906                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16907         },
16908         {
16909                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16910                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16911                 .doit = nl80211_stop_sched_scan,
16912                 .flags = GENL_UNS_ADMIN_PERM,
16913                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16914         },
16915         {
16916                 .cmd = NL80211_CMD_AUTHENTICATE,
16917                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16918                 .doit = nl80211_authenticate,
16919                 .flags = GENL_UNS_ADMIN_PERM,
16920                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16921                                          NL80211_FLAG_CLEAR_SKB),
16922         },
16923         {
16924                 .cmd = NL80211_CMD_ASSOCIATE,
16925                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16926                 .doit = nl80211_associate,
16927                 .flags = GENL_UNS_ADMIN_PERM,
16928                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16929                                          NL80211_FLAG_CLEAR_SKB),
16930         },
16931         {
16932                 .cmd = NL80211_CMD_DEAUTHENTICATE,
16933                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16934                 .doit = nl80211_deauthenticate,
16935                 .flags = GENL_UNS_ADMIN_PERM,
16936                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16937         },
16938         {
16939                 .cmd = NL80211_CMD_DISASSOCIATE,
16940                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16941                 .doit = nl80211_disassociate,
16942                 .flags = GENL_UNS_ADMIN_PERM,
16943                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16944         },
16945         {
16946                 .cmd = NL80211_CMD_JOIN_IBSS,
16947                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16948                 .doit = nl80211_join_ibss,
16949                 .flags = GENL_UNS_ADMIN_PERM,
16950                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16951         },
16952         {
16953                 .cmd = NL80211_CMD_LEAVE_IBSS,
16954                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16955                 .doit = nl80211_leave_ibss,
16956                 .flags = GENL_UNS_ADMIN_PERM,
16957                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16958         },
16959 #ifdef CONFIG_NL80211_TESTMODE
16960         {
16961                 .cmd = NL80211_CMD_TESTMODE,
16962                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16963                 .doit = nl80211_testmode_do,
16964                 .dumpit = nl80211_testmode_dump,
16965                 .flags = GENL_UNS_ADMIN_PERM,
16966                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16967         },
16968 #endif
16969         {
16970                 .cmd = NL80211_CMD_CONNECT,
16971                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16972                 .doit = nl80211_connect,
16973                 .flags = GENL_UNS_ADMIN_PERM,
16974                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16975                                          NL80211_FLAG_CLEAR_SKB),
16976         },
16977         {
16978                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16979                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16980                 .doit = nl80211_update_connect_params,
16981                 .flags = GENL_ADMIN_PERM,
16982                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16983                                          NL80211_FLAG_CLEAR_SKB),
16984         },
16985         {
16986                 .cmd = NL80211_CMD_DISCONNECT,
16987                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16988                 .doit = nl80211_disconnect,
16989                 .flags = GENL_UNS_ADMIN_PERM,
16990                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16991         },
16992         {
16993                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16994                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16995                 .doit = nl80211_wiphy_netns,
16996                 .flags = GENL_UNS_ADMIN_PERM,
16997                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16998                                          NL80211_FLAG_NEED_RTNL |
16999                                          NL80211_FLAG_NO_WIPHY_MTX),
17000         },
17001         {
17002                 .cmd = NL80211_CMD_GET_SURVEY,
17003                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17004                 .dumpit = nl80211_dump_survey,
17005         },
17006         {
17007                 .cmd = NL80211_CMD_SET_PMKSA,
17008                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17009                 .doit = nl80211_setdel_pmksa,
17010                 .flags = GENL_UNS_ADMIN_PERM,
17011                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17012                                          NL80211_FLAG_CLEAR_SKB),
17013         },
17014         {
17015                 .cmd = NL80211_CMD_DEL_PMKSA,
17016                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17017                 .doit = nl80211_setdel_pmksa,
17018                 .flags = GENL_UNS_ADMIN_PERM,
17019                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17020         },
17021         {
17022                 .cmd = NL80211_CMD_FLUSH_PMKSA,
17023                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17024                 .doit = nl80211_flush_pmksa,
17025                 .flags = GENL_UNS_ADMIN_PERM,
17026                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17027         },
17028         {
17029                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
17030                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17031                 .doit = nl80211_remain_on_channel,
17032                 .flags = GENL_UNS_ADMIN_PERM,
17033                 /* FIXME: requiring a link ID here is probably not good */
17034                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17035                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17036         },
17037         {
17038                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
17039                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17040                 .doit = nl80211_cancel_remain_on_channel,
17041                 .flags = GENL_UNS_ADMIN_PERM,
17042                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17043         },
17044         {
17045                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17046                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17047                 .doit = nl80211_set_tx_bitrate_mask,
17048                 .flags = GENL_UNS_ADMIN_PERM,
17049                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17050                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17051         },
17052         {
17053                 .cmd = NL80211_CMD_REGISTER_FRAME,
17054                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17055                 .doit = nl80211_register_mgmt,
17056                 .flags = GENL_UNS_ADMIN_PERM,
17057                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17058         },
17059         {
17060                 .cmd = NL80211_CMD_FRAME,
17061                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17062                 .doit = nl80211_tx_mgmt,
17063                 .flags = GENL_UNS_ADMIN_PERM,
17064                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17065         },
17066         {
17067                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17068                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17069                 .doit = nl80211_tx_mgmt_cancel_wait,
17070                 .flags = GENL_UNS_ADMIN_PERM,
17071                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17072         },
17073         {
17074                 .cmd = NL80211_CMD_SET_POWER_SAVE,
17075                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17076                 .doit = nl80211_set_power_save,
17077                 .flags = GENL_UNS_ADMIN_PERM,
17078                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17079         },
17080         {
17081                 .cmd = NL80211_CMD_GET_POWER_SAVE,
17082                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17083                 .doit = nl80211_get_power_save,
17084                 /* can be retrieved by unprivileged users */
17085                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17086         },
17087         {
17088                 .cmd = NL80211_CMD_SET_CQM,
17089                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17090                 .doit = nl80211_set_cqm,
17091                 .flags = GENL_UNS_ADMIN_PERM,
17092                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17093         },
17094         {
17095                 .cmd = NL80211_CMD_SET_CHANNEL,
17096                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17097                 .doit = nl80211_set_channel,
17098                 .flags = GENL_UNS_ADMIN_PERM,
17099                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17100                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17101         },
17102         {
17103                 .cmd = NL80211_CMD_JOIN_MESH,
17104                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17105                 .doit = nl80211_join_mesh,
17106                 .flags = GENL_UNS_ADMIN_PERM,
17107                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17108         },
17109         {
17110                 .cmd = NL80211_CMD_LEAVE_MESH,
17111                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17112                 .doit = nl80211_leave_mesh,
17113                 .flags = GENL_UNS_ADMIN_PERM,
17114                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17115         },
17116         {
17117                 .cmd = NL80211_CMD_JOIN_OCB,
17118                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17119                 .doit = nl80211_join_ocb,
17120                 .flags = GENL_UNS_ADMIN_PERM,
17121                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17122         },
17123         {
17124                 .cmd = NL80211_CMD_LEAVE_OCB,
17125                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17126                 .doit = nl80211_leave_ocb,
17127                 .flags = GENL_UNS_ADMIN_PERM,
17128                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17129         },
17130 #ifdef CONFIG_PM
17131         {
17132                 .cmd = NL80211_CMD_GET_WOWLAN,
17133                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17134                 .doit = nl80211_get_wowlan,
17135                 /* can be retrieved by unprivileged users */
17136                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17137         },
17138         {
17139                 .cmd = NL80211_CMD_SET_WOWLAN,
17140                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17141                 .doit = nl80211_set_wowlan,
17142                 .flags = GENL_UNS_ADMIN_PERM,
17143                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17144         },
17145 #endif
17146         {
17147                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17148                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17149                 .doit = nl80211_set_rekey_data,
17150                 .flags = GENL_UNS_ADMIN_PERM,
17151                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17152                                          NL80211_FLAG_CLEAR_SKB),
17153         },
17154         {
17155                 .cmd = NL80211_CMD_TDLS_MGMT,
17156                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17157                 .doit = nl80211_tdls_mgmt,
17158                 .flags = GENL_UNS_ADMIN_PERM,
17159                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17160                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17161         },
17162         {
17163                 .cmd = NL80211_CMD_TDLS_OPER,
17164                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17165                 .doit = nl80211_tdls_oper,
17166                 .flags = GENL_UNS_ADMIN_PERM,
17167                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17168         },
17169         {
17170                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17171                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17172                 .doit = nl80211_register_unexpected_frame,
17173                 .flags = GENL_UNS_ADMIN_PERM,
17174                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17175         },
17176         {
17177                 .cmd = NL80211_CMD_PROBE_CLIENT,
17178                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17179                 .doit = nl80211_probe_client,
17180                 .flags = GENL_UNS_ADMIN_PERM,
17181                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17182         },
17183         {
17184                 .cmd = NL80211_CMD_REGISTER_BEACONS,
17185                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17186                 .doit = nl80211_register_beacons,
17187                 .flags = GENL_UNS_ADMIN_PERM,
17188                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17189         },
17190         {
17191                 .cmd = NL80211_CMD_SET_NOACK_MAP,
17192                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17193                 .doit = nl80211_set_noack_map,
17194                 .flags = GENL_UNS_ADMIN_PERM,
17195                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17196         },
17197         {
17198                 .cmd = NL80211_CMD_START_P2P_DEVICE,
17199                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17200                 .doit = nl80211_start_p2p_device,
17201                 .flags = GENL_UNS_ADMIN_PERM,
17202                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17203                                          NL80211_FLAG_NEED_RTNL),
17204         },
17205         {
17206                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17207                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17208                 .doit = nl80211_stop_p2p_device,
17209                 .flags = GENL_UNS_ADMIN_PERM,
17210                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17211                                          NL80211_FLAG_NEED_RTNL),
17212         },
17213         {
17214                 .cmd = NL80211_CMD_START_NAN,
17215                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17216                 .doit = nl80211_start_nan,
17217                 .flags = GENL_ADMIN_PERM,
17218                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17219                                          NL80211_FLAG_NEED_RTNL),
17220         },
17221         {
17222                 .cmd = NL80211_CMD_STOP_NAN,
17223                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17224                 .doit = nl80211_stop_nan,
17225                 .flags = GENL_ADMIN_PERM,
17226                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17227                                          NL80211_FLAG_NEED_RTNL),
17228         },
17229         {
17230                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17231                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17232                 .doit = nl80211_nan_add_func,
17233                 .flags = GENL_ADMIN_PERM,
17234                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17235         },
17236         {
17237                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17238                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17239                 .doit = nl80211_nan_del_func,
17240                 .flags = GENL_ADMIN_PERM,
17241                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17242         },
17243         {
17244                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17245                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17246                 .doit = nl80211_nan_change_config,
17247                 .flags = GENL_ADMIN_PERM,
17248                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17249         },
17250         {
17251                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17252                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17253                 .doit = nl80211_set_mcast_rate,
17254                 .flags = GENL_UNS_ADMIN_PERM,
17255                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17256         },
17257         {
17258                 .cmd = NL80211_CMD_SET_MAC_ACL,
17259                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17260                 .doit = nl80211_set_mac_acl,
17261                 .flags = GENL_UNS_ADMIN_PERM,
17262                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17263                                          NL80211_FLAG_MLO_UNSUPPORTED),
17264         },
17265         {
17266                 .cmd = NL80211_CMD_RADAR_DETECT,
17267                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17268                 .doit = nl80211_start_radar_detection,
17269                 .flags = GENL_UNS_ADMIN_PERM,
17270                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17271                                          NL80211_FLAG_NO_WIPHY_MTX |
17272                                          NL80211_FLAG_MLO_UNSUPPORTED),
17273         },
17274         {
17275                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17276                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17277                 .doit = nl80211_get_protocol_features,
17278         },
17279         {
17280                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17281                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17282                 .doit = nl80211_update_ft_ies,
17283                 .flags = GENL_UNS_ADMIN_PERM,
17284                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17285         },
17286         {
17287                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17288                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17289                 .doit = nl80211_crit_protocol_start,
17290                 .flags = GENL_UNS_ADMIN_PERM,
17291                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17292         },
17293         {
17294                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17295                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17296                 .doit = nl80211_crit_protocol_stop,
17297                 .flags = GENL_UNS_ADMIN_PERM,
17298                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17299         },
17300         {
17301                 .cmd = NL80211_CMD_GET_COALESCE,
17302                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17303                 .doit = nl80211_get_coalesce,
17304                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17305         },
17306         {
17307                 .cmd = NL80211_CMD_SET_COALESCE,
17308                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17309                 .doit = nl80211_set_coalesce,
17310                 .flags = GENL_UNS_ADMIN_PERM,
17311                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17312         },
17313         {
17314                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17315                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17316                 .doit = nl80211_channel_switch,
17317                 .flags = GENL_UNS_ADMIN_PERM,
17318                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17319                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17320         },
17321         {
17322                 .cmd = NL80211_CMD_VENDOR,
17323                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17324                 .doit = nl80211_vendor_cmd,
17325                 .dumpit = nl80211_vendor_cmd_dump,
17326                 .flags = GENL_UNS_ADMIN_PERM,
17327                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17328                                          NL80211_FLAG_CLEAR_SKB),
17329         },
17330         {
17331                 .cmd = NL80211_CMD_SET_QOS_MAP,
17332                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17333                 .doit = nl80211_set_qos_map,
17334                 .flags = GENL_UNS_ADMIN_PERM,
17335                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17336         },
17337         {
17338                 .cmd = NL80211_CMD_ADD_TX_TS,
17339                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17340                 .doit = nl80211_add_tx_ts,
17341                 .flags = GENL_UNS_ADMIN_PERM,
17342                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17343                                          NL80211_FLAG_MLO_UNSUPPORTED),
17344         },
17345         {
17346                 .cmd = NL80211_CMD_DEL_TX_TS,
17347                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17348                 .doit = nl80211_del_tx_ts,
17349                 .flags = GENL_UNS_ADMIN_PERM,
17350                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17351         },
17352         {
17353                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17354                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17355                 .doit = nl80211_tdls_channel_switch,
17356                 .flags = GENL_UNS_ADMIN_PERM,
17357                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17358         },
17359         {
17360                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17361                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17362                 .doit = nl80211_tdls_cancel_channel_switch,
17363                 .flags = GENL_UNS_ADMIN_PERM,
17364                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17365         },
17366         {
17367                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17368                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17369                 .doit = nl80211_set_multicast_to_unicast,
17370                 .flags = GENL_UNS_ADMIN_PERM,
17371                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17372         },
17373         {
17374                 .cmd = NL80211_CMD_SET_PMK,
17375                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17376                 .doit = nl80211_set_pmk,
17377                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17378                                          NL80211_FLAG_CLEAR_SKB),
17379         },
17380         {
17381                 .cmd = NL80211_CMD_DEL_PMK,
17382                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17383                 .doit = nl80211_del_pmk,
17384                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17385         },
17386         {
17387                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17388                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17389                 .doit = nl80211_external_auth,
17390                 .flags = GENL_ADMIN_PERM,
17391                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17392         },
17393         {
17394                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17395                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17396                 .doit = nl80211_tx_control_port,
17397                 .flags = GENL_UNS_ADMIN_PERM,
17398                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17399         },
17400         {
17401                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17402                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17403                 .doit = nl80211_get_ftm_responder_stats,
17404                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17405                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17406         },
17407         {
17408                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17409                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17410                 .doit = nl80211_pmsr_start,
17411                 .flags = GENL_UNS_ADMIN_PERM,
17412                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17413         },
17414         {
17415                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17416                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17417                 .doit = nl80211_notify_radar_detection,
17418                 .flags = GENL_UNS_ADMIN_PERM,
17419                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17420         },
17421         {
17422                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17423                 .doit = nl80211_update_owe_info,
17424                 .flags = GENL_ADMIN_PERM,
17425                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17426         },
17427         {
17428                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17429                 .doit = nl80211_probe_mesh_link,
17430                 .flags = GENL_UNS_ADMIN_PERM,
17431                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17432         },
17433         {
17434                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17435                 .doit = nl80211_set_tid_config,
17436                 .flags = GENL_UNS_ADMIN_PERM,
17437                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17438                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17439         },
17440         {
17441                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17442                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17443                 .doit = nl80211_set_sar_specs,
17444                 .flags = GENL_UNS_ADMIN_PERM,
17445                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17446                                          NL80211_FLAG_NEED_RTNL),
17447         },
17448         {
17449                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17450                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17451                 .doit = nl80211_color_change,
17452                 .flags = GENL_UNS_ADMIN_PERM,
17453                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17454         },
17455         {
17456                 .cmd = NL80211_CMD_SET_FILS_AAD,
17457                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17458                 .doit = nl80211_set_fils_aad,
17459                 .flags = GENL_UNS_ADMIN_PERM,
17460                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17461         },
17462         {
17463                 .cmd = NL80211_CMD_ADD_LINK,
17464                 .doit = nl80211_add_link,
17465                 .flags = GENL_UNS_ADMIN_PERM,
17466                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17467         },
17468         {
17469                 .cmd = NL80211_CMD_REMOVE_LINK,
17470                 .doit = nl80211_remove_link,
17471                 .flags = GENL_UNS_ADMIN_PERM,
17472                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17473                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17474         },
17475         {
17476                 .cmd = NL80211_CMD_ADD_LINK_STA,
17477                 .doit = nl80211_add_link_station,
17478                 .flags = GENL_UNS_ADMIN_PERM,
17479                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17480                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17481         },
17482         {
17483                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17484                 .doit = nl80211_modify_link_station,
17485                 .flags = GENL_UNS_ADMIN_PERM,
17486                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17487                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17488         },
17489         {
17490                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17491                 .doit = nl80211_remove_link_station,
17492                 .flags = GENL_UNS_ADMIN_PERM,
17493                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17494                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17495         },
17496         {
17497                 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17498                 .doit = nl80211_set_hw_timestamp,
17499                 .flags = GENL_UNS_ADMIN_PERM,
17500                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17501         },
17502 };
17503
17504 static struct genl_family nl80211_fam __ro_after_init = {
17505         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17506         .hdrsize = 0,                   /* no private header */
17507         .version = 1,                   /* no particular meaning now */
17508         .maxattr = NL80211_ATTR_MAX,
17509         .policy = nl80211_policy,
17510         .netnsok = true,
17511         .pre_doit = nl80211_pre_doit,
17512         .post_doit = nl80211_post_doit,
17513         .module = THIS_MODULE,
17514         .ops = nl80211_ops,
17515         .n_ops = ARRAY_SIZE(nl80211_ops),
17516         .small_ops = nl80211_small_ops,
17517         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17518         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17519         .mcgrps = nl80211_mcgrps,
17520         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17521         .parallel_ops = true,
17522 };
17523
17524 /* notification functions */
17525
17526 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17527                           enum nl80211_commands cmd)
17528 {
17529         struct sk_buff *msg;
17530         struct nl80211_dump_wiphy_state state = {};
17531
17532         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17533                 cmd != NL80211_CMD_DEL_WIPHY);
17534
17535         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17536         if (!msg)
17537                 return;
17538
17539         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17540                 nlmsg_free(msg);
17541                 return;
17542         }
17543
17544         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17545                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17546 }
17547
17548 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17549                                 struct wireless_dev *wdev,
17550                                 enum nl80211_commands cmd)
17551 {
17552         struct sk_buff *msg;
17553
17554         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17555         if (!msg)
17556                 return;
17557
17558         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17559                 nlmsg_free(msg);
17560                 return;
17561         }
17562
17563         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17564                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17565 }
17566
17567 static int nl80211_add_scan_req(struct sk_buff *msg,
17568                                 struct cfg80211_registered_device *rdev)
17569 {
17570         struct cfg80211_scan_request *req = rdev->scan_req;
17571         struct nlattr *nest;
17572         int i;
17573         struct cfg80211_scan_info *info;
17574
17575         if (WARN_ON(!req))
17576                 return 0;
17577
17578         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17579         if (!nest)
17580                 goto nla_put_failure;
17581         for (i = 0; i < req->n_ssids; i++) {
17582                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17583                         goto nla_put_failure;
17584         }
17585         nla_nest_end(msg, nest);
17586
17587         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17588                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17589                 if (!nest)
17590                         goto nla_put_failure;
17591                 for (i = 0; i < req->n_channels; i++) {
17592                         if (nla_put_u32(msg, i,
17593                                    ieee80211_channel_to_khz(req->channels[i])))
17594                                 goto nla_put_failure;
17595                 }
17596                 nla_nest_end(msg, nest);
17597         } else {
17598                 nest = nla_nest_start_noflag(msg,
17599                                              NL80211_ATTR_SCAN_FREQUENCIES);
17600                 if (!nest)
17601                         goto nla_put_failure;
17602                 for (i = 0; i < req->n_channels; i++) {
17603                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17604                                 goto nla_put_failure;
17605                 }
17606                 nla_nest_end(msg, nest);
17607         }
17608
17609         if (req->ie &&
17610             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17611                 goto nla_put_failure;
17612
17613         if (req->flags &&
17614             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17615                 goto nla_put_failure;
17616
17617         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17618                 &rdev->scan_req->info;
17619         if (info->scan_start_tsf &&
17620             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17621                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17622              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17623                      info->tsf_bssid)))
17624                 goto nla_put_failure;
17625
17626         return 0;
17627  nla_put_failure:
17628         return -ENOBUFS;
17629 }
17630
17631 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17632                                  struct cfg80211_registered_device *rdev,
17633                                  struct wireless_dev *wdev,
17634                                  u32 portid, u32 seq, int flags,
17635                                  u32 cmd)
17636 {
17637         void *hdr;
17638
17639         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17640         if (!hdr)
17641                 return -1;
17642
17643         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17644             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17645                                          wdev->netdev->ifindex)) ||
17646             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17647                               NL80211_ATTR_PAD))
17648                 goto nla_put_failure;
17649
17650         /* ignore errors and send incomplete event anyway */
17651         nl80211_add_scan_req(msg, rdev);
17652
17653         genlmsg_end(msg, hdr);
17654         return 0;
17655
17656  nla_put_failure:
17657         genlmsg_cancel(msg, hdr);
17658         return -EMSGSIZE;
17659 }
17660
17661 static int
17662 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17663                             struct cfg80211_sched_scan_request *req, u32 cmd)
17664 {
17665         void *hdr;
17666
17667         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17668         if (!hdr)
17669                 return -1;
17670
17671         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17672                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17673             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17674             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17675                               NL80211_ATTR_PAD))
17676                 goto nla_put_failure;
17677
17678         genlmsg_end(msg, hdr);
17679         return 0;
17680
17681  nla_put_failure:
17682         genlmsg_cancel(msg, hdr);
17683         return -EMSGSIZE;
17684 }
17685
17686 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17687                              struct wireless_dev *wdev)
17688 {
17689         struct sk_buff *msg;
17690
17691         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17692         if (!msg)
17693                 return;
17694
17695         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17696                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
17697                 nlmsg_free(msg);
17698                 return;
17699         }
17700
17701         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17702                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17703 }
17704
17705 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17706                                        struct wireless_dev *wdev, bool aborted)
17707 {
17708         struct sk_buff *msg;
17709
17710         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17711         if (!msg)
17712                 return NULL;
17713
17714         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17715                                   aborted ? NL80211_CMD_SCAN_ABORTED :
17716                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17717                 nlmsg_free(msg);
17718                 return NULL;
17719         }
17720
17721         return msg;
17722 }
17723
17724 /* send message created by nl80211_build_scan_msg() */
17725 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17726                            struct sk_buff *msg)
17727 {
17728         if (!msg)
17729                 return;
17730
17731         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17732                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17733 }
17734
17735 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17736 {
17737         struct sk_buff *msg;
17738
17739         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17740         if (!msg)
17741                 return;
17742
17743         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17744                 nlmsg_free(msg);
17745                 return;
17746         }
17747
17748         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17749                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17750 }
17751
17752 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17753                                           struct regulatory_request *request)
17754 {
17755         /* Userspace can always count this one always being set */
17756         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17757                 goto nla_put_failure;
17758
17759         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17760                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17761                                NL80211_REGDOM_TYPE_WORLD))
17762                         goto nla_put_failure;
17763         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17764                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17765                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17766                         goto nla_put_failure;
17767         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17768                    request->intersect) {
17769                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17770                                NL80211_REGDOM_TYPE_INTERSECTION))
17771                         goto nla_put_failure;
17772         } else {
17773                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17774                                NL80211_REGDOM_TYPE_COUNTRY) ||
17775                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17776                                    request->alpha2))
17777                         goto nla_put_failure;
17778         }
17779
17780         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17781                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17782
17783                 if (wiphy &&
17784                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17785                         goto nla_put_failure;
17786
17787                 if (wiphy &&
17788                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17789                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17790                         goto nla_put_failure;
17791         }
17792
17793         return true;
17794
17795 nla_put_failure:
17796         return false;
17797 }
17798
17799 /*
17800  * This can happen on global regulatory changes or device specific settings
17801  * based on custom regulatory domains.
17802  */
17803 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17804                                      struct regulatory_request *request)
17805 {
17806         struct sk_buff *msg;
17807         void *hdr;
17808
17809         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17810         if (!msg)
17811                 return;
17812
17813         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17814         if (!hdr)
17815                 goto nla_put_failure;
17816
17817         if (!nl80211_reg_change_event_fill(msg, request))
17818                 goto nla_put_failure;
17819
17820         genlmsg_end(msg, hdr);
17821
17822         rcu_read_lock();
17823         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17824                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17825         rcu_read_unlock();
17826
17827         return;
17828
17829 nla_put_failure:
17830         nlmsg_free(msg);
17831 }
17832
17833 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17834                                     struct net_device *netdev,
17835                                     const u8 *buf, size_t len,
17836                                     enum nl80211_commands cmd, gfp_t gfp,
17837                                     int uapsd_queues, const u8 *req_ies,
17838                                     size_t req_ies_len, bool reconnect)
17839 {
17840         struct sk_buff *msg;
17841         void *hdr;
17842
17843         msg = nlmsg_new(100 + len + req_ies_len, gfp);
17844         if (!msg)
17845                 return;
17846
17847         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17848         if (!hdr) {
17849                 nlmsg_free(msg);
17850                 return;
17851         }
17852
17853         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17854             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17855             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17856             (req_ies &&
17857              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17858                 goto nla_put_failure;
17859
17860         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17861                 goto nla_put_failure;
17862
17863         if (uapsd_queues >= 0) {
17864                 struct nlattr *nla_wmm =
17865                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17866                 if (!nla_wmm)
17867                         goto nla_put_failure;
17868
17869                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17870                                uapsd_queues))
17871                         goto nla_put_failure;
17872
17873                 nla_nest_end(msg, nla_wmm);
17874         }
17875
17876         genlmsg_end(msg, hdr);
17877
17878         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17879                                 NL80211_MCGRP_MLME, gfp);
17880         return;
17881
17882  nla_put_failure:
17883         nlmsg_free(msg);
17884 }
17885
17886 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17887                           struct net_device *netdev, const u8 *buf,
17888                           size_t len, gfp_t gfp)
17889 {
17890         nl80211_send_mlme_event(rdev, netdev, buf, len,
17891                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17892                                 false);
17893 }
17894
17895 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17896                            struct net_device *netdev,
17897                            struct cfg80211_rx_assoc_resp *data)
17898 {
17899         nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17900                                 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17901                                 data->uapsd_queues,
17902                                 data->req_ies, data->req_ies_len, false);
17903 }
17904
17905 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17906                          struct net_device *netdev, const u8 *buf,
17907                          size_t len, bool reconnect, gfp_t gfp)
17908 {
17909         nl80211_send_mlme_event(rdev, netdev, buf, len,
17910                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17911                                 reconnect);
17912 }
17913
17914 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17915                            struct net_device *netdev, const u8 *buf,
17916                            size_t len, bool reconnect, gfp_t gfp)
17917 {
17918         nl80211_send_mlme_event(rdev, netdev, buf, len,
17919                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17920                                 reconnect);
17921 }
17922
17923 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17924                                   size_t len)
17925 {
17926         struct wireless_dev *wdev = dev->ieee80211_ptr;
17927         struct wiphy *wiphy = wdev->wiphy;
17928         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17929         const struct ieee80211_mgmt *mgmt = (void *)buf;
17930         u32 cmd;
17931
17932         if (WARN_ON(len < 2))
17933                 return;
17934
17935         if (ieee80211_is_deauth(mgmt->frame_control)) {
17936                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17937         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17938                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17939         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17940                 if (wdev->unprot_beacon_reported &&
17941                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17942                         return;
17943                 cmd = NL80211_CMD_UNPROT_BEACON;
17944                 wdev->unprot_beacon_reported = jiffies;
17945         } else {
17946                 return;
17947         }
17948
17949         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17950         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17951                                 NULL, 0, false);
17952 }
17953 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17954
17955 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17956                                       struct net_device *netdev, int cmd,
17957                                       const u8 *addr, gfp_t gfp)
17958 {
17959         struct sk_buff *msg;
17960         void *hdr;
17961
17962         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17963         if (!msg)
17964                 return;
17965
17966         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17967         if (!hdr) {
17968                 nlmsg_free(msg);
17969                 return;
17970         }
17971
17972         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17973             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17974             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17975             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17976                 goto nla_put_failure;
17977
17978         genlmsg_end(msg, hdr);
17979
17980         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17981                                 NL80211_MCGRP_MLME, gfp);
17982         return;
17983
17984  nla_put_failure:
17985         nlmsg_free(msg);
17986 }
17987
17988 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17989                                struct net_device *netdev, const u8 *addr,
17990                                gfp_t gfp)
17991 {
17992         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17993                                   addr, gfp);
17994 }
17995
17996 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17997                                 struct net_device *netdev, const u8 *addr,
17998                                 gfp_t gfp)
17999 {
18000         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
18001                                   addr, gfp);
18002 }
18003
18004 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
18005                                  struct net_device *netdev,
18006                                  struct cfg80211_connect_resp_params *cr,
18007                                  gfp_t gfp)
18008 {
18009         struct sk_buff *msg;
18010         void *hdr;
18011         unsigned int link;
18012         size_t link_info_size = 0;
18013         const u8 *connected_addr = cr->valid_links ?
18014                                    cr->ap_mld_addr : cr->links[0].bssid;
18015
18016         if (cr->valid_links) {
18017                 for_each_valid_link(cr, link) {
18018                         /* Nested attribute header */
18019                         link_info_size += NLA_HDRLEN;
18020                         /* Link ID */
18021                         link_info_size += nla_total_size(sizeof(u8));
18022                         link_info_size += cr->links[link].addr ?
18023                                           nla_total_size(ETH_ALEN) : 0;
18024                         link_info_size += (cr->links[link].bssid ||
18025                                            cr->links[link].bss) ?
18026                                           nla_total_size(ETH_ALEN) : 0;
18027                         link_info_size += nla_total_size(sizeof(u16));
18028                 }
18029         }
18030
18031         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
18032                         cr->fils.kek_len + cr->fils.pmk_len +
18033                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
18034                         gfp);
18035         if (!msg)
18036                 return;
18037
18038         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
18039         if (!hdr) {
18040                 nlmsg_free(msg);
18041                 return;
18042         }
18043
18044         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18045             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18046             (connected_addr &&
18047              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18048             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18049                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18050                         cr->status) ||
18051             (cr->status < 0 &&
18052              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18053               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18054                           cr->timeout_reason))) ||
18055             (cr->req_ie &&
18056              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18057             (cr->resp_ie &&
18058              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18059                      cr->resp_ie)) ||
18060             (cr->fils.update_erp_next_seq_num &&
18061              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18062                          cr->fils.erp_next_seq_num)) ||
18063             (cr->status == WLAN_STATUS_SUCCESS &&
18064              ((cr->fils.kek &&
18065                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18066                        cr->fils.kek)) ||
18067               (cr->fils.pmk &&
18068                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18069               (cr->fils.pmkid &&
18070                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18071                 goto nla_put_failure;
18072
18073         if (cr->valid_links) {
18074                 int i = 1;
18075                 struct nlattr *nested;
18076
18077                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18078                 if (!nested)
18079                         goto nla_put_failure;
18080
18081                 for_each_valid_link(cr, link) {
18082                         struct nlattr *nested_mlo_links;
18083                         const u8 *bssid = cr->links[link].bss ?
18084                                           cr->links[link].bss->bssid :
18085                                           cr->links[link].bssid;
18086
18087                         nested_mlo_links = nla_nest_start(msg, i);
18088                         if (!nested_mlo_links)
18089                                 goto nla_put_failure;
18090
18091                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18092                             (bssid &&
18093                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18094                             (cr->links[link].addr &&
18095                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18096                                      cr->links[link].addr)) ||
18097                             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18098                                         cr->links[link].status))
18099                                 goto nla_put_failure;
18100
18101                         nla_nest_end(msg, nested_mlo_links);
18102                         i++;
18103                 }
18104                 nla_nest_end(msg, nested);
18105         }
18106
18107         genlmsg_end(msg, hdr);
18108
18109         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18110                                 NL80211_MCGRP_MLME, gfp);
18111         return;
18112
18113  nla_put_failure:
18114         nlmsg_free(msg);
18115 }
18116
18117 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18118                          struct net_device *netdev,
18119                          struct cfg80211_roam_info *info, gfp_t gfp)
18120 {
18121         struct sk_buff *msg;
18122         void *hdr;
18123         size_t link_info_size = 0;
18124         unsigned int link;
18125         const u8 *connected_addr = info->ap_mld_addr ?
18126                                    info->ap_mld_addr :
18127                                    (info->links[0].bss ?
18128                                     info->links[0].bss->bssid :
18129                                     info->links[0].bssid);
18130
18131         if (info->valid_links) {
18132                 for_each_valid_link(info, link) {
18133                         /* Nested attribute header */
18134                         link_info_size += NLA_HDRLEN;
18135                         /* Link ID */
18136                         link_info_size += nla_total_size(sizeof(u8));
18137                         link_info_size += info->links[link].addr ?
18138                                           nla_total_size(ETH_ALEN) : 0;
18139                         link_info_size += (info->links[link].bssid ||
18140                                            info->links[link].bss) ?
18141                                           nla_total_size(ETH_ALEN) : 0;
18142                 }
18143         }
18144
18145         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18146                         info->fils.kek_len + info->fils.pmk_len +
18147                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18148                         link_info_size, gfp);
18149         if (!msg)
18150                 return;
18151
18152         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18153         if (!hdr) {
18154                 nlmsg_free(msg);
18155                 return;
18156         }
18157
18158         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18159             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18160             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18161             (info->req_ie &&
18162              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18163                      info->req_ie)) ||
18164             (info->resp_ie &&
18165              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18166                      info->resp_ie)) ||
18167             (info->fils.update_erp_next_seq_num &&
18168              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18169                          info->fils.erp_next_seq_num)) ||
18170             (info->fils.kek &&
18171              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18172                      info->fils.kek)) ||
18173             (info->fils.pmk &&
18174              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18175             (info->fils.pmkid &&
18176              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18177                 goto nla_put_failure;
18178
18179         if (info->valid_links) {
18180                 int i = 1;
18181                 struct nlattr *nested;
18182
18183                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18184                 if (!nested)
18185                         goto nla_put_failure;
18186
18187                 for_each_valid_link(info, link) {
18188                         struct nlattr *nested_mlo_links;
18189                         const u8 *bssid = info->links[link].bss ?
18190                                           info->links[link].bss->bssid :
18191                                           info->links[link].bssid;
18192
18193                         nested_mlo_links = nla_nest_start(msg, i);
18194                         if (!nested_mlo_links)
18195                                 goto nla_put_failure;
18196
18197                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18198                             (bssid &&
18199                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18200                             (info->links[link].addr &&
18201                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18202                                      info->links[link].addr)))
18203                                 goto nla_put_failure;
18204
18205                         nla_nest_end(msg, nested_mlo_links);
18206                         i++;
18207                 }
18208                 nla_nest_end(msg, nested);
18209         }
18210
18211         genlmsg_end(msg, hdr);
18212
18213         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18214                                 NL80211_MCGRP_MLME, gfp);
18215         return;
18216
18217  nla_put_failure:
18218         nlmsg_free(msg);
18219 }
18220
18221 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18222                                   struct net_device *netdev, const u8 *bssid,
18223                                   const u8 *td_bitmap, u8 td_bitmap_len)
18224 {
18225         struct sk_buff *msg;
18226         void *hdr;
18227
18228         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18229         if (!msg)
18230                 return;
18231
18232         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18233         if (!hdr) {
18234                 nlmsg_free(msg);
18235                 return;
18236         }
18237
18238         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18239             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18240             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18241                 goto nla_put_failure;
18242
18243         if ((td_bitmap_len > 0) && td_bitmap)
18244                 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18245                             td_bitmap_len, td_bitmap))
18246                         goto nla_put_failure;
18247
18248         genlmsg_end(msg, hdr);
18249
18250         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18251                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18252         return;
18253
18254  nla_put_failure:
18255         nlmsg_free(msg);
18256 }
18257
18258 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18259                                struct net_device *netdev, u16 reason,
18260                                const u8 *ie, size_t ie_len, bool from_ap)
18261 {
18262         struct sk_buff *msg;
18263         void *hdr;
18264
18265         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18266         if (!msg)
18267                 return;
18268
18269         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18270         if (!hdr) {
18271                 nlmsg_free(msg);
18272                 return;
18273         }
18274
18275         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18276             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18277             (reason &&
18278              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18279             (from_ap &&
18280              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18281             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18282                 goto nla_put_failure;
18283
18284         genlmsg_end(msg, hdr);
18285
18286         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18287                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18288         return;
18289
18290  nla_put_failure:
18291         nlmsg_free(msg);
18292 }
18293
18294 void cfg80211_links_removed(struct net_device *dev, u16 link_mask)
18295 {
18296         struct wireless_dev *wdev = dev->ieee80211_ptr;
18297         struct wiphy *wiphy = wdev->wiphy;
18298         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18299         struct sk_buff *msg;
18300         struct nlattr *links;
18301         void *hdr;
18302
18303         ASSERT_WDEV_LOCK(wdev);
18304         trace_cfg80211_links_removed(dev, link_mask);
18305
18306         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION &&
18307                     wdev->iftype != NL80211_IFTYPE_P2P_CLIENT))
18308                 return;
18309
18310         if (WARN_ON(!wdev->valid_links || !link_mask ||
18311                     (wdev->valid_links & link_mask) != link_mask ||
18312                     wdev->valid_links == link_mask))
18313                 return;
18314
18315         cfg80211_wdev_release_link_bsses(wdev, link_mask);
18316         wdev->valid_links &= ~link_mask;
18317
18318         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18319         if (!msg)
18320                 return;
18321
18322         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_LINKS_REMOVED);
18323         if (!hdr) {
18324                 nlmsg_free(msg);
18325                 return;
18326         }
18327
18328         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18329             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18330                 goto nla_put_failure;
18331
18332         links = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18333         if (!links)
18334                 goto nla_put_failure;
18335
18336         while (link_mask) {
18337                 struct nlattr *link;
18338                 int link_id = __ffs(link_mask);
18339
18340                 link = nla_nest_start(msg, link_id + 1);
18341                 if (!link)
18342                         goto nla_put_failure;
18343
18344                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
18345                         goto nla_put_failure;
18346
18347                 nla_nest_end(msg, link);
18348                 link_mask &= ~(1 << link_id);
18349         }
18350
18351         nla_nest_end(msg, links);
18352
18353         genlmsg_end(msg, hdr);
18354
18355         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18356                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18357         return;
18358
18359  nla_put_failure:
18360         nlmsg_free(msg);
18361 }
18362 EXPORT_SYMBOL(cfg80211_links_removed);
18363
18364 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18365                              struct net_device *netdev, const u8 *bssid,
18366                              gfp_t gfp)
18367 {
18368         struct sk_buff *msg;
18369         void *hdr;
18370
18371         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18372         if (!msg)
18373                 return;
18374
18375         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18376         if (!hdr) {
18377                 nlmsg_free(msg);
18378                 return;
18379         }
18380
18381         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18382             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18383             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18384                 goto nla_put_failure;
18385
18386         genlmsg_end(msg, hdr);
18387
18388         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18389                                 NL80211_MCGRP_MLME, gfp);
18390         return;
18391
18392  nla_put_failure:
18393         nlmsg_free(msg);
18394 }
18395
18396 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18397                                         const u8 *ie, u8 ie_len,
18398                                         int sig_dbm, gfp_t gfp)
18399 {
18400         struct wireless_dev *wdev = dev->ieee80211_ptr;
18401         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18402         struct sk_buff *msg;
18403         void *hdr;
18404
18405         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18406                 return;
18407
18408         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18409
18410         msg = nlmsg_new(100 + ie_len, gfp);
18411         if (!msg)
18412                 return;
18413
18414         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18415         if (!hdr) {
18416                 nlmsg_free(msg);
18417                 return;
18418         }
18419
18420         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18421             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18422             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18423             (ie_len && ie &&
18424              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18425             (sig_dbm &&
18426              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18427                 goto nla_put_failure;
18428
18429         genlmsg_end(msg, hdr);
18430
18431         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18432                                 NL80211_MCGRP_MLME, gfp);
18433         return;
18434
18435  nla_put_failure:
18436         nlmsg_free(msg);
18437 }
18438 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18439
18440 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18441                                  struct net_device *netdev, const u8 *addr,
18442                                  enum nl80211_key_type key_type, int key_id,
18443                                  const u8 *tsc, gfp_t gfp)
18444 {
18445         struct sk_buff *msg;
18446         void *hdr;
18447
18448         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18449         if (!msg)
18450                 return;
18451
18452         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18453         if (!hdr) {
18454                 nlmsg_free(msg);
18455                 return;
18456         }
18457
18458         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18459             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18460             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18461             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18462             (key_id != -1 &&
18463              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18464             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18465                 goto nla_put_failure;
18466
18467         genlmsg_end(msg, hdr);
18468
18469         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18470                                 NL80211_MCGRP_MLME, gfp);
18471         return;
18472
18473  nla_put_failure:
18474         nlmsg_free(msg);
18475 }
18476
18477 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18478                                     struct ieee80211_channel *channel_before,
18479                                     struct ieee80211_channel *channel_after)
18480 {
18481         struct sk_buff *msg;
18482         void *hdr;
18483         struct nlattr *nl_freq;
18484
18485         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18486         if (!msg)
18487                 return;
18488
18489         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18490         if (!hdr) {
18491                 nlmsg_free(msg);
18492                 return;
18493         }
18494
18495         /*
18496          * Since we are applying the beacon hint to a wiphy we know its
18497          * wiphy_idx is valid
18498          */
18499         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18500                 goto nla_put_failure;
18501
18502         /* Before */
18503         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18504         if (!nl_freq)
18505                 goto nla_put_failure;
18506
18507         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18508                 goto nla_put_failure;
18509         nla_nest_end(msg, nl_freq);
18510
18511         /* After */
18512         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18513         if (!nl_freq)
18514                 goto nla_put_failure;
18515
18516         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18517                 goto nla_put_failure;
18518         nla_nest_end(msg, nl_freq);
18519
18520         genlmsg_end(msg, hdr);
18521
18522         rcu_read_lock();
18523         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18524                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18525         rcu_read_unlock();
18526
18527         return;
18528
18529 nla_put_failure:
18530         nlmsg_free(msg);
18531 }
18532
18533 static void nl80211_send_remain_on_chan_event(
18534         int cmd, struct cfg80211_registered_device *rdev,
18535         struct wireless_dev *wdev, u64 cookie,
18536         struct ieee80211_channel *chan,
18537         unsigned int duration, gfp_t gfp)
18538 {
18539         struct sk_buff *msg;
18540         void *hdr;
18541
18542         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18543         if (!msg)
18544                 return;
18545
18546         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18547         if (!hdr) {
18548                 nlmsg_free(msg);
18549                 return;
18550         }
18551
18552         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18553             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18554                                          wdev->netdev->ifindex)) ||
18555             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18556                               NL80211_ATTR_PAD) ||
18557             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18558             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18559                         NL80211_CHAN_NO_HT) ||
18560             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18561                               NL80211_ATTR_PAD))
18562                 goto nla_put_failure;
18563
18564         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18565             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18566                 goto nla_put_failure;
18567
18568         genlmsg_end(msg, hdr);
18569
18570         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18571                                 NL80211_MCGRP_MLME, gfp);
18572         return;
18573
18574  nla_put_failure:
18575         nlmsg_free(msg);
18576 }
18577
18578 void cfg80211_assoc_comeback(struct net_device *netdev,
18579                              const u8 *ap_addr, u32 timeout)
18580 {
18581         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18582         struct wiphy *wiphy = wdev->wiphy;
18583         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18584         struct sk_buff *msg;
18585         void *hdr;
18586
18587         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18588
18589         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18590         if (!msg)
18591                 return;
18592
18593         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18594         if (!hdr) {
18595                 nlmsg_free(msg);
18596                 return;
18597         }
18598
18599         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18600             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18601             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18602             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18603                 goto nla_put_failure;
18604
18605         genlmsg_end(msg, hdr);
18606
18607         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18608                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18609         return;
18610
18611  nla_put_failure:
18612         nlmsg_free(msg);
18613 }
18614 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18615
18616 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18617                                struct ieee80211_channel *chan,
18618                                unsigned int duration, gfp_t gfp)
18619 {
18620         struct wiphy *wiphy = wdev->wiphy;
18621         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18622
18623         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18624         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18625                                           rdev, wdev, cookie, chan,
18626                                           duration, gfp);
18627 }
18628 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18629
18630 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18631                                         struct ieee80211_channel *chan,
18632                                         gfp_t gfp)
18633 {
18634         struct wiphy *wiphy = wdev->wiphy;
18635         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18636
18637         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18638         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18639                                           rdev, wdev, cookie, chan, 0, gfp);
18640 }
18641 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18642
18643 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18644                                         struct ieee80211_channel *chan,
18645                                         gfp_t gfp)
18646 {
18647         struct wiphy *wiphy = wdev->wiphy;
18648         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18649
18650         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18651         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18652                                           rdev, wdev, cookie, chan, 0, gfp);
18653 }
18654 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18655
18656 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18657                       struct station_info *sinfo, gfp_t gfp)
18658 {
18659         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18660         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18661         struct sk_buff *msg;
18662
18663         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18664
18665         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18666         if (!msg)
18667                 return;
18668
18669         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18670                                  rdev, dev, mac_addr, sinfo) < 0) {
18671                 nlmsg_free(msg);
18672                 return;
18673         }
18674
18675         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18676                                 NL80211_MCGRP_MLME, gfp);
18677 }
18678 EXPORT_SYMBOL(cfg80211_new_sta);
18679
18680 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18681                             struct station_info *sinfo, gfp_t gfp)
18682 {
18683         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18684         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18685         struct sk_buff *msg;
18686         struct station_info empty_sinfo = {};
18687
18688         if (!sinfo)
18689                 sinfo = &empty_sinfo;
18690
18691         trace_cfg80211_del_sta(dev, mac_addr);
18692
18693         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18694         if (!msg) {
18695                 cfg80211_sinfo_release_content(sinfo);
18696                 return;
18697         }
18698
18699         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18700                                  rdev, dev, mac_addr, sinfo) < 0) {
18701                 nlmsg_free(msg);
18702                 return;
18703         }
18704
18705         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18706                                 NL80211_MCGRP_MLME, gfp);
18707 }
18708 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18709
18710 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18711                           enum nl80211_connect_failed_reason reason,
18712                           gfp_t gfp)
18713 {
18714         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18715         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18716         struct sk_buff *msg;
18717         void *hdr;
18718
18719         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18720         if (!msg)
18721                 return;
18722
18723         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18724         if (!hdr) {
18725                 nlmsg_free(msg);
18726                 return;
18727         }
18728
18729         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18730             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18731             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18732                 goto nla_put_failure;
18733
18734         genlmsg_end(msg, hdr);
18735
18736         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18737                                 NL80211_MCGRP_MLME, gfp);
18738         return;
18739
18740  nla_put_failure:
18741         nlmsg_free(msg);
18742 }
18743 EXPORT_SYMBOL(cfg80211_conn_failed);
18744
18745 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18746                                        const u8 *addr, gfp_t gfp)
18747 {
18748         struct wireless_dev *wdev = dev->ieee80211_ptr;
18749         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18750         struct sk_buff *msg;
18751         void *hdr;
18752         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18753
18754         if (!nlportid)
18755                 return false;
18756
18757         msg = nlmsg_new(100, gfp);
18758         if (!msg)
18759                 return true;
18760
18761         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18762         if (!hdr) {
18763                 nlmsg_free(msg);
18764                 return true;
18765         }
18766
18767         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18768             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18769             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18770                 goto nla_put_failure;
18771
18772         genlmsg_end(msg, hdr);
18773         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18774         return true;
18775
18776  nla_put_failure:
18777         nlmsg_free(msg);
18778         return true;
18779 }
18780
18781 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18782                                 const u8 *addr, gfp_t gfp)
18783 {
18784         struct wireless_dev *wdev = dev->ieee80211_ptr;
18785         bool ret;
18786
18787         trace_cfg80211_rx_spurious_frame(dev, addr);
18788
18789         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18790                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18791                 trace_cfg80211_return_bool(false);
18792                 return false;
18793         }
18794         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18795                                          addr, gfp);
18796         trace_cfg80211_return_bool(ret);
18797         return ret;
18798 }
18799 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18800
18801 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18802                                         const u8 *addr, gfp_t gfp)
18803 {
18804         struct wireless_dev *wdev = dev->ieee80211_ptr;
18805         bool ret;
18806
18807         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18808
18809         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18810                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18811                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18812                 trace_cfg80211_return_bool(false);
18813                 return false;
18814         }
18815         ret = __nl80211_unexpected_frame(dev,
18816                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18817                                          addr, gfp);
18818         trace_cfg80211_return_bool(ret);
18819         return ret;
18820 }
18821 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18822
18823 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18824                       struct wireless_dev *wdev, u32 nlportid,
18825                       struct cfg80211_rx_info *info, gfp_t gfp)
18826 {
18827         struct net_device *netdev = wdev->netdev;
18828         struct sk_buff *msg;
18829         void *hdr;
18830
18831         msg = nlmsg_new(100 + info->len, gfp);
18832         if (!msg)
18833                 return -ENOMEM;
18834
18835         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18836         if (!hdr) {
18837                 nlmsg_free(msg);
18838                 return -ENOMEM;
18839         }
18840
18841         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18842             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18843                                         netdev->ifindex)) ||
18844             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18845                               NL80211_ATTR_PAD) ||
18846             (info->have_link_id &&
18847              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18848             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18849             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18850             (info->sig_dbm &&
18851              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18852             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18853             (info->flags &&
18854              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18855             (info->rx_tstamp && nla_put_u64_64bit(msg,
18856                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
18857                                                   info->rx_tstamp,
18858                                                   NL80211_ATTR_PAD)) ||
18859             (info->ack_tstamp && nla_put_u64_64bit(msg,
18860                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
18861                                                    info->ack_tstamp,
18862                                                    NL80211_ATTR_PAD)))
18863                 goto nla_put_failure;
18864
18865         genlmsg_end(msg, hdr);
18866
18867         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18868
18869  nla_put_failure:
18870         nlmsg_free(msg);
18871         return -ENOBUFS;
18872 }
18873
18874 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18875                                     struct cfg80211_tx_status *status,
18876                                     gfp_t gfp, enum nl80211_commands command)
18877 {
18878         struct wiphy *wiphy = wdev->wiphy;
18879         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18880         struct net_device *netdev = wdev->netdev;
18881         struct sk_buff *msg;
18882         void *hdr;
18883
18884         if (command == NL80211_CMD_FRAME_TX_STATUS)
18885                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18886                                               status->ack);
18887         else
18888                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18889                                                       status->ack);
18890
18891         msg = nlmsg_new(100 + status->len, gfp);
18892         if (!msg)
18893                 return;
18894
18895         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18896         if (!hdr) {
18897                 nlmsg_free(msg);
18898                 return;
18899         }
18900
18901         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18902             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18903                                    netdev->ifindex)) ||
18904             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18905                               NL80211_ATTR_PAD) ||
18906             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18907             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18908                               NL80211_ATTR_PAD) ||
18909             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18910             (status->tx_tstamp &&
18911              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18912                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
18913             (status->ack_tstamp &&
18914              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18915                                status->ack_tstamp, NL80211_ATTR_PAD)))
18916                 goto nla_put_failure;
18917
18918         genlmsg_end(msg, hdr);
18919
18920         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18921                                 NL80211_MCGRP_MLME, gfp);
18922         return;
18923
18924 nla_put_failure:
18925         nlmsg_free(msg);
18926 }
18927
18928 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18929                                      const u8 *buf, size_t len, bool ack,
18930                                      gfp_t gfp)
18931 {
18932         struct cfg80211_tx_status status = {
18933                 .cookie = cookie,
18934                 .buf = buf,
18935                 .len = len,
18936                 .ack = ack
18937         };
18938
18939         nl80211_frame_tx_status(wdev, &status, gfp,
18940                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18941 }
18942 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18943
18944 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18945                                  struct cfg80211_tx_status *status, gfp_t gfp)
18946 {
18947         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18948 }
18949 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18950
18951 static int __nl80211_rx_control_port(struct net_device *dev,
18952                                      struct sk_buff *skb,
18953                                      bool unencrypted,
18954                                      int link_id,
18955                                      gfp_t gfp)
18956 {
18957         struct wireless_dev *wdev = dev->ieee80211_ptr;
18958         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18959         struct ethhdr *ehdr = eth_hdr(skb);
18960         const u8 *addr = ehdr->h_source;
18961         u16 proto = be16_to_cpu(skb->protocol);
18962         struct sk_buff *msg;
18963         void *hdr;
18964         struct nlattr *frame;
18965
18966         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18967
18968         if (!nlportid)
18969                 return -ENOENT;
18970
18971         msg = nlmsg_new(100 + skb->len, gfp);
18972         if (!msg)
18973                 return -ENOMEM;
18974
18975         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18976         if (!hdr) {
18977                 nlmsg_free(msg);
18978                 return -ENOBUFS;
18979         }
18980
18981         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18982             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18983             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18984                               NL80211_ATTR_PAD) ||
18985             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18986             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18987             (link_id >= 0 &&
18988              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
18989             (unencrypted && nla_put_flag(msg,
18990                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18991                 goto nla_put_failure;
18992
18993         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18994         if (!frame)
18995                 goto nla_put_failure;
18996
18997         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18998         genlmsg_end(msg, hdr);
18999
19000         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19001
19002  nla_put_failure:
19003         nlmsg_free(msg);
19004         return -ENOBUFS;
19005 }
19006
19007 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
19008                               bool unencrypted, int link_id)
19009 {
19010         int ret;
19011
19012         trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
19013         ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
19014                                         GFP_ATOMIC);
19015         trace_cfg80211_return_bool(ret == 0);
19016         return ret == 0;
19017 }
19018 EXPORT_SYMBOL(cfg80211_rx_control_port);
19019
19020 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
19021                                             const char *mac, gfp_t gfp)
19022 {
19023         struct wireless_dev *wdev = dev->ieee80211_ptr;
19024         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19025         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19026         void **cb;
19027
19028         if (!msg)
19029                 return NULL;
19030
19031         cb = (void **)msg->cb;
19032
19033         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
19034         if (!cb[0]) {
19035                 nlmsg_free(msg);
19036                 return NULL;
19037         }
19038
19039         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19040             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19041                 goto nla_put_failure;
19042
19043         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19044                 goto nla_put_failure;
19045
19046         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
19047         if (!cb[1])
19048                 goto nla_put_failure;
19049
19050         cb[2] = rdev;
19051
19052         return msg;
19053  nla_put_failure:
19054         nlmsg_free(msg);
19055         return NULL;
19056 }
19057
19058 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
19059 {
19060         void **cb = (void **)msg->cb;
19061         struct cfg80211_registered_device *rdev = cb[2];
19062
19063         nla_nest_end(msg, cb[1]);
19064         genlmsg_end(msg, cb[0]);
19065
19066         memset(msg->cb, 0, sizeof(msg->cb));
19067
19068         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19069                                 NL80211_MCGRP_MLME, gfp);
19070 }
19071
19072 void cfg80211_cqm_rssi_notify(struct net_device *dev,
19073                               enum nl80211_cqm_rssi_threshold_event rssi_event,
19074                               s32 rssi_level, gfp_t gfp)
19075 {
19076         struct sk_buff *msg;
19077         struct wireless_dev *wdev = dev->ieee80211_ptr;
19078         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19079
19080         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
19081
19082         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
19083                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
19084                 return;
19085
19086         if (wdev->cqm_config) {
19087                 wdev->cqm_config->last_rssi_event_value = rssi_level;
19088
19089                 cfg80211_cqm_rssi_update(rdev, dev);
19090
19091                 if (rssi_level == 0)
19092                         rssi_level = wdev->cqm_config->last_rssi_event_value;
19093         }
19094
19095         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19096         if (!msg)
19097                 return;
19098
19099         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
19100                         rssi_event))
19101                 goto nla_put_failure;
19102
19103         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
19104                                       rssi_level))
19105                 goto nla_put_failure;
19106
19107         cfg80211_send_cqm(msg, gfp);
19108
19109         return;
19110
19111  nla_put_failure:
19112         nlmsg_free(msg);
19113 }
19114 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19115
19116 void cfg80211_cqm_txe_notify(struct net_device *dev,
19117                              const u8 *peer, u32 num_packets,
19118                              u32 rate, u32 intvl, gfp_t gfp)
19119 {
19120         struct sk_buff *msg;
19121
19122         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19123         if (!msg)
19124                 return;
19125
19126         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19127                 goto nla_put_failure;
19128
19129         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19130                 goto nla_put_failure;
19131
19132         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19133                 goto nla_put_failure;
19134
19135         cfg80211_send_cqm(msg, gfp);
19136         return;
19137
19138  nla_put_failure:
19139         nlmsg_free(msg);
19140 }
19141 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19142
19143 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19144                                  const u8 *peer, u32 num_packets, gfp_t gfp)
19145 {
19146         struct sk_buff *msg;
19147
19148         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19149
19150         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19151         if (!msg)
19152                 return;
19153
19154         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19155                 goto nla_put_failure;
19156
19157         cfg80211_send_cqm(msg, gfp);
19158         return;
19159
19160  nla_put_failure:
19161         nlmsg_free(msg);
19162 }
19163 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19164
19165 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19166 {
19167         struct sk_buff *msg;
19168
19169         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19170         if (!msg)
19171                 return;
19172
19173         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19174                 goto nla_put_failure;
19175
19176         cfg80211_send_cqm(msg, gfp);
19177         return;
19178
19179  nla_put_failure:
19180         nlmsg_free(msg);
19181 }
19182 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19183
19184 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19185                                      struct net_device *netdev, const u8 *bssid,
19186                                      const u8 *replay_ctr, gfp_t gfp)
19187 {
19188         struct sk_buff *msg;
19189         struct nlattr *rekey_attr;
19190         void *hdr;
19191
19192         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19193         if (!msg)
19194                 return;
19195
19196         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19197         if (!hdr) {
19198                 nlmsg_free(msg);
19199                 return;
19200         }
19201
19202         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19203             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19204             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19205                 goto nla_put_failure;
19206
19207         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19208         if (!rekey_attr)
19209                 goto nla_put_failure;
19210
19211         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19212                     NL80211_REPLAY_CTR_LEN, replay_ctr))
19213                 goto nla_put_failure;
19214
19215         nla_nest_end(msg, rekey_attr);
19216
19217         genlmsg_end(msg, hdr);
19218
19219         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19220                                 NL80211_MCGRP_MLME, gfp);
19221         return;
19222
19223  nla_put_failure:
19224         nlmsg_free(msg);
19225 }
19226
19227 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19228                                const u8 *replay_ctr, gfp_t gfp)
19229 {
19230         struct wireless_dev *wdev = dev->ieee80211_ptr;
19231         struct wiphy *wiphy = wdev->wiphy;
19232         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19233
19234         trace_cfg80211_gtk_rekey_notify(dev, bssid);
19235         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19236 }
19237 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19238
19239 static void
19240 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19241                                struct net_device *netdev, int index,
19242                                const u8 *bssid, bool preauth, gfp_t gfp)
19243 {
19244         struct sk_buff *msg;
19245         struct nlattr *attr;
19246         void *hdr;
19247
19248         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19249         if (!msg)
19250                 return;
19251
19252         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19253         if (!hdr) {
19254                 nlmsg_free(msg);
19255                 return;
19256         }
19257
19258         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19259             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19260                 goto nla_put_failure;
19261
19262         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19263         if (!attr)
19264                 goto nla_put_failure;
19265
19266         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19267             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19268             (preauth &&
19269              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19270                 goto nla_put_failure;
19271
19272         nla_nest_end(msg, attr);
19273
19274         genlmsg_end(msg, hdr);
19275
19276         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19277                                 NL80211_MCGRP_MLME, gfp);
19278         return;
19279
19280  nla_put_failure:
19281         nlmsg_free(msg);
19282 }
19283
19284 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19285                                      const u8 *bssid, bool preauth, gfp_t gfp)
19286 {
19287         struct wireless_dev *wdev = dev->ieee80211_ptr;
19288         struct wiphy *wiphy = wdev->wiphy;
19289         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19290
19291         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19292         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19293 }
19294 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19295
19296 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19297                                      struct net_device *netdev,
19298                                      unsigned int link_id,
19299                                      struct cfg80211_chan_def *chandef,
19300                                      gfp_t gfp,
19301                                      enum nl80211_commands notif,
19302                                      u8 count, bool quiet, u16 punct_bitmap)
19303 {
19304         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19305         struct sk_buff *msg;
19306         void *hdr;
19307
19308         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19309         if (!msg)
19310                 return;
19311
19312         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19313         if (!hdr) {
19314                 nlmsg_free(msg);
19315                 return;
19316         }
19317
19318         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19319                 goto nla_put_failure;
19320
19321         if (wdev->valid_links &&
19322             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19323                 goto nla_put_failure;
19324
19325         if (nl80211_send_chandef(msg, chandef))
19326                 goto nla_put_failure;
19327
19328         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19329                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19330                         goto nla_put_failure;
19331                 if (quiet &&
19332                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19333                         goto nla_put_failure;
19334         }
19335
19336         if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19337                 goto nla_put_failure;
19338
19339         genlmsg_end(msg, hdr);
19340
19341         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19342                                 NL80211_MCGRP_MLME, gfp);
19343         return;
19344
19345  nla_put_failure:
19346         nlmsg_free(msg);
19347 }
19348
19349 void cfg80211_ch_switch_notify(struct net_device *dev,
19350                                struct cfg80211_chan_def *chandef,
19351                                unsigned int link_id, u16 punct_bitmap)
19352 {
19353         struct wireless_dev *wdev = dev->ieee80211_ptr;
19354         struct wiphy *wiphy = wdev->wiphy;
19355         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19356
19357         ASSERT_WDEV_LOCK(wdev);
19358         WARN_INVALID_LINK_ID(wdev, link_id);
19359
19360         trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19361
19362         switch (wdev->iftype) {
19363         case NL80211_IFTYPE_STATION:
19364         case NL80211_IFTYPE_P2P_CLIENT:
19365                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19366                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19367                                                         chandef->chan);
19368                 break;
19369         case NL80211_IFTYPE_MESH_POINT:
19370                 wdev->u.mesh.chandef = *chandef;
19371                 wdev->u.mesh.preset_chandef = *chandef;
19372                 break;
19373         case NL80211_IFTYPE_AP:
19374         case NL80211_IFTYPE_P2P_GO:
19375                 wdev->links[link_id].ap.chandef = *chandef;
19376                 break;
19377         case NL80211_IFTYPE_ADHOC:
19378                 wdev->u.ibss.chandef = *chandef;
19379                 break;
19380         default:
19381                 WARN_ON(1);
19382                 break;
19383         }
19384
19385         cfg80211_sched_dfs_chan_update(rdev);
19386
19387         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19388                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19389                                  punct_bitmap);
19390 }
19391 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19392
19393 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19394                                        struct cfg80211_chan_def *chandef,
19395                                        unsigned int link_id, u8 count,
19396                                        bool quiet, u16 punct_bitmap)
19397 {
19398         struct wireless_dev *wdev = dev->ieee80211_ptr;
19399         struct wiphy *wiphy = wdev->wiphy;
19400         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19401
19402         ASSERT_WDEV_LOCK(wdev);
19403         WARN_INVALID_LINK_ID(wdev, link_id);
19404
19405         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19406                                                 punct_bitmap);
19407
19408
19409         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19410                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19411                                  count, quiet, punct_bitmap);
19412 }
19413 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19414
19415 int cfg80211_bss_color_notify(struct net_device *dev,
19416                               enum nl80211_commands cmd, u8 count,
19417                               u64 color_bitmap)
19418 {
19419         struct wireless_dev *wdev = dev->ieee80211_ptr;
19420         struct wiphy *wiphy = wdev->wiphy;
19421         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19422         struct sk_buff *msg;
19423         void *hdr;
19424
19425         ASSERT_WDEV_LOCK(wdev);
19426
19427         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19428
19429         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19430         if (!msg)
19431                 return -ENOMEM;
19432
19433         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19434         if (!hdr)
19435                 goto nla_put_failure;
19436
19437         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19438                 goto nla_put_failure;
19439
19440         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19441             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19442                 goto nla_put_failure;
19443
19444         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19445             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19446                               color_bitmap, NL80211_ATTR_PAD))
19447                 goto nla_put_failure;
19448
19449         genlmsg_end(msg, hdr);
19450
19451         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19452                                        msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19453
19454 nla_put_failure:
19455         nlmsg_free(msg);
19456         return -EINVAL;
19457 }
19458 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19459
19460 void
19461 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19462                      const struct cfg80211_chan_def *chandef,
19463                      enum nl80211_radar_event event,
19464                      struct net_device *netdev, gfp_t gfp)
19465 {
19466         struct sk_buff *msg;
19467         void *hdr;
19468
19469         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19470         if (!msg)
19471                 return;
19472
19473         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19474         if (!hdr) {
19475                 nlmsg_free(msg);
19476                 return;
19477         }
19478
19479         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19480                 goto nla_put_failure;
19481
19482         /* NOP and radar events don't need a netdev parameter */
19483         if (netdev) {
19484                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19485
19486                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19487                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19488                                       NL80211_ATTR_PAD))
19489                         goto nla_put_failure;
19490         }
19491
19492         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19493                 goto nla_put_failure;
19494
19495         if (nl80211_send_chandef(msg, chandef))
19496                 goto nla_put_failure;
19497
19498         genlmsg_end(msg, hdr);
19499
19500         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19501                                 NL80211_MCGRP_MLME, gfp);
19502         return;
19503
19504  nla_put_failure:
19505         nlmsg_free(msg);
19506 }
19507
19508 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19509                                        struct sta_opmode_info *sta_opmode,
19510                                        gfp_t gfp)
19511 {
19512         struct sk_buff *msg;
19513         struct wireless_dev *wdev = dev->ieee80211_ptr;
19514         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19515         void *hdr;
19516
19517         if (WARN_ON(!mac))
19518                 return;
19519
19520         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19521         if (!msg)
19522                 return;
19523
19524         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19525         if (!hdr) {
19526                 nlmsg_free(msg);
19527                 return;
19528         }
19529
19530         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19531                 goto nla_put_failure;
19532
19533         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19534                 goto nla_put_failure;
19535
19536         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19537                 goto nla_put_failure;
19538
19539         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19540             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19541                 goto nla_put_failure;
19542
19543         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19544             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19545                 goto nla_put_failure;
19546
19547         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19548             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19549                 goto nla_put_failure;
19550
19551         genlmsg_end(msg, hdr);
19552
19553         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19554                                 NL80211_MCGRP_MLME, gfp);
19555
19556         return;
19557
19558 nla_put_failure:
19559         nlmsg_free(msg);
19560 }
19561 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19562
19563 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19564                            u64 cookie, bool acked, s32 ack_signal,
19565                            bool is_valid_ack_signal, gfp_t gfp)
19566 {
19567         struct wireless_dev *wdev = dev->ieee80211_ptr;
19568         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19569         struct sk_buff *msg;
19570         void *hdr;
19571
19572         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19573
19574         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19575
19576         if (!msg)
19577                 return;
19578
19579         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19580         if (!hdr) {
19581                 nlmsg_free(msg);
19582                 return;
19583         }
19584
19585         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19586             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19587             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19588             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19589                               NL80211_ATTR_PAD) ||
19590             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19591             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19592                                                 ack_signal)))
19593                 goto nla_put_failure;
19594
19595         genlmsg_end(msg, hdr);
19596
19597         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19598                                 NL80211_MCGRP_MLME, gfp);
19599         return;
19600
19601  nla_put_failure:
19602         nlmsg_free(msg);
19603 }
19604 EXPORT_SYMBOL(cfg80211_probe_status);
19605
19606 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19607                                      size_t len, int freq, int sig_dbm)
19608 {
19609         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19610         struct sk_buff *msg;
19611         void *hdr;
19612         struct cfg80211_beacon_registration *reg;
19613
19614         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19615
19616         spin_lock_bh(&rdev->beacon_registrations_lock);
19617         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19618                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19619                 if (!msg) {
19620                         spin_unlock_bh(&rdev->beacon_registrations_lock);
19621                         return;
19622                 }
19623
19624                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19625                 if (!hdr)
19626                         goto nla_put_failure;
19627
19628                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19629                     (freq &&
19630                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19631                                   KHZ_TO_MHZ(freq)) ||
19632                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19633                                   freq % 1000))) ||
19634                     (sig_dbm &&
19635                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19636                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19637                         goto nla_put_failure;
19638
19639                 genlmsg_end(msg, hdr);
19640
19641                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19642         }
19643         spin_unlock_bh(&rdev->beacon_registrations_lock);
19644         return;
19645
19646  nla_put_failure:
19647         spin_unlock_bh(&rdev->beacon_registrations_lock);
19648         nlmsg_free(msg);
19649 }
19650 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19651
19652 #ifdef CONFIG_PM
19653 static int cfg80211_net_detect_results(struct sk_buff *msg,
19654                                        struct cfg80211_wowlan_wakeup *wakeup)
19655 {
19656         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19657         struct nlattr *nl_results, *nl_match, *nl_freqs;
19658         int i, j;
19659
19660         nl_results = nla_nest_start_noflag(msg,
19661                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19662         if (!nl_results)
19663                 return -EMSGSIZE;
19664
19665         for (i = 0; i < nd->n_matches; i++) {
19666                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19667
19668                 nl_match = nla_nest_start_noflag(msg, i);
19669                 if (!nl_match)
19670                         break;
19671
19672                 /* The SSID attribute is optional in nl80211, but for
19673                  * simplicity reasons it's always present in the
19674                  * cfg80211 structure.  If a driver can't pass the
19675                  * SSID, that needs to be changed.  A zero length SSID
19676                  * is still a valid SSID (wildcard), so it cannot be
19677                  * used for this purpose.
19678                  */
19679                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19680                             match->ssid.ssid)) {
19681                         nla_nest_cancel(msg, nl_match);
19682                         goto out;
19683                 }
19684
19685                 if (match->n_channels) {
19686                         nl_freqs = nla_nest_start_noflag(msg,
19687                                                          NL80211_ATTR_SCAN_FREQUENCIES);
19688                         if (!nl_freqs) {
19689                                 nla_nest_cancel(msg, nl_match);
19690                                 goto out;
19691                         }
19692
19693                         for (j = 0; j < match->n_channels; j++) {
19694                                 if (nla_put_u32(msg, j, match->channels[j])) {
19695                                         nla_nest_cancel(msg, nl_freqs);
19696                                         nla_nest_cancel(msg, nl_match);
19697                                         goto out;
19698                                 }
19699                         }
19700
19701                         nla_nest_end(msg, nl_freqs);
19702                 }
19703
19704                 nla_nest_end(msg, nl_match);
19705         }
19706
19707 out:
19708         nla_nest_end(msg, nl_results);
19709         return 0;
19710 }
19711
19712 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19713                                    struct cfg80211_wowlan_wakeup *wakeup,
19714                                    gfp_t gfp)
19715 {
19716         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19717         struct sk_buff *msg;
19718         void *hdr;
19719         int size = 200;
19720
19721         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19722
19723         if (wakeup)
19724                 size += wakeup->packet_present_len;
19725
19726         msg = nlmsg_new(size, gfp);
19727         if (!msg)
19728                 return;
19729
19730         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19731         if (!hdr)
19732                 goto free_msg;
19733
19734         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19735             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19736                               NL80211_ATTR_PAD))
19737                 goto free_msg;
19738
19739         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19740                                         wdev->netdev->ifindex))
19741                 goto free_msg;
19742
19743         if (wakeup) {
19744                 struct nlattr *reasons;
19745
19746                 reasons = nla_nest_start_noflag(msg,
19747                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
19748                 if (!reasons)
19749                         goto free_msg;
19750
19751                 if (wakeup->disconnect &&
19752                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19753                         goto free_msg;
19754                 if (wakeup->magic_pkt &&
19755                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19756                         goto free_msg;
19757                 if (wakeup->gtk_rekey_failure &&
19758                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19759                         goto free_msg;
19760                 if (wakeup->eap_identity_req &&
19761                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19762                         goto free_msg;
19763                 if (wakeup->four_way_handshake &&
19764                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19765                         goto free_msg;
19766                 if (wakeup->rfkill_release &&
19767                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19768                         goto free_msg;
19769
19770                 if (wakeup->pattern_idx >= 0 &&
19771                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19772                                 wakeup->pattern_idx))
19773                         goto free_msg;
19774
19775                 if (wakeup->tcp_match &&
19776                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19777                         goto free_msg;
19778
19779                 if (wakeup->tcp_connlost &&
19780                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19781                         goto free_msg;
19782
19783                 if (wakeup->tcp_nomoretokens &&
19784                     nla_put_flag(msg,
19785                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19786                         goto free_msg;
19787
19788                 if (wakeup->packet) {
19789                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19790                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19791
19792                         if (!wakeup->packet_80211) {
19793                                 pkt_attr =
19794                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19795                                 len_attr =
19796                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19797                         }
19798
19799                         if (wakeup->packet_len &&
19800                             nla_put_u32(msg, len_attr, wakeup->packet_len))
19801                                 goto free_msg;
19802
19803                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19804                                     wakeup->packet))
19805                                 goto free_msg;
19806                 }
19807
19808                 if (wakeup->net_detect &&
19809                     cfg80211_net_detect_results(msg, wakeup))
19810                                 goto free_msg;
19811
19812                 nla_nest_end(msg, reasons);
19813         }
19814
19815         genlmsg_end(msg, hdr);
19816
19817         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19818                                 NL80211_MCGRP_MLME, gfp);
19819         return;
19820
19821  free_msg:
19822         nlmsg_free(msg);
19823 }
19824 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19825 #endif
19826
19827 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19828                                 enum nl80211_tdls_operation oper,
19829                                 u16 reason_code, gfp_t gfp)
19830 {
19831         struct wireless_dev *wdev = dev->ieee80211_ptr;
19832         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19833         struct sk_buff *msg;
19834         void *hdr;
19835
19836         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19837                                          reason_code);
19838
19839         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19840         if (!msg)
19841                 return;
19842
19843         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19844         if (!hdr) {
19845                 nlmsg_free(msg);
19846                 return;
19847         }
19848
19849         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19850             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19851             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19852             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19853             (reason_code > 0 &&
19854              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19855                 goto nla_put_failure;
19856
19857         genlmsg_end(msg, hdr);
19858
19859         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19860                                 NL80211_MCGRP_MLME, gfp);
19861         return;
19862
19863  nla_put_failure:
19864         nlmsg_free(msg);
19865 }
19866 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19867
19868 static int nl80211_netlink_notify(struct notifier_block * nb,
19869                                   unsigned long state,
19870                                   void *_notify)
19871 {
19872         struct netlink_notify *notify = _notify;
19873         struct cfg80211_registered_device *rdev;
19874         struct wireless_dev *wdev;
19875         struct cfg80211_beacon_registration *reg, *tmp;
19876
19877         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19878                 return NOTIFY_DONE;
19879
19880         rcu_read_lock();
19881
19882         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19883                 struct cfg80211_sched_scan_request *sched_scan_req;
19884
19885                 list_for_each_entry_rcu(sched_scan_req,
19886                                         &rdev->sched_scan_req_list,
19887                                         list) {
19888                         if (sched_scan_req->owner_nlportid == notify->portid) {
19889                                 sched_scan_req->nl_owner_dead = true;
19890                                 wiphy_work_queue(&rdev->wiphy,
19891                                                  &rdev->sched_scan_stop_wk);
19892                         }
19893                 }
19894
19895                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19896                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
19897
19898                         if (wdev->owner_nlportid == notify->portid) {
19899                                 wdev->nl_owner_dead = true;
19900                                 schedule_work(&rdev->destroy_work);
19901                         } else if (wdev->conn_owner_nlportid == notify->portid) {
19902                                 schedule_work(&wdev->disconnect_wk);
19903                         }
19904
19905                         cfg80211_release_pmsr(wdev, notify->portid);
19906                 }
19907
19908                 spin_lock_bh(&rdev->beacon_registrations_lock);
19909                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19910                                          list) {
19911                         if (reg->nlportid == notify->portid) {
19912                                 list_del(&reg->list);
19913                                 kfree(reg);
19914                                 break;
19915                         }
19916                 }
19917                 spin_unlock_bh(&rdev->beacon_registrations_lock);
19918         }
19919
19920         rcu_read_unlock();
19921
19922         /*
19923          * It is possible that the user space process that is controlling the
19924          * indoor setting disappeared, so notify the regulatory core.
19925          */
19926         regulatory_netlink_notify(notify->portid);
19927         return NOTIFY_OK;
19928 }
19929
19930 static struct notifier_block nl80211_netlink_notifier = {
19931         .notifier_call = nl80211_netlink_notify,
19932 };
19933
19934 void cfg80211_ft_event(struct net_device *netdev,
19935                        struct cfg80211_ft_event_params *ft_event)
19936 {
19937         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19938         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19939         struct sk_buff *msg;
19940         void *hdr;
19941
19942         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19943
19944         if (!ft_event->target_ap)
19945                 return;
19946
19947         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19948                         GFP_KERNEL);
19949         if (!msg)
19950                 return;
19951
19952         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19953         if (!hdr)
19954                 goto out;
19955
19956         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19957             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19958             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19959                 goto out;
19960
19961         if (ft_event->ies &&
19962             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19963                 goto out;
19964         if (ft_event->ric_ies &&
19965             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19966                     ft_event->ric_ies))
19967                 goto out;
19968
19969         genlmsg_end(msg, hdr);
19970
19971         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19972                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19973         return;
19974  out:
19975         nlmsg_free(msg);
19976 }
19977 EXPORT_SYMBOL(cfg80211_ft_event);
19978
19979 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19980 {
19981         struct cfg80211_registered_device *rdev;
19982         struct sk_buff *msg;
19983         void *hdr;
19984         u32 nlportid;
19985
19986         rdev = wiphy_to_rdev(wdev->wiphy);
19987         if (!rdev->crit_proto_nlportid)
19988                 return;
19989
19990         nlportid = rdev->crit_proto_nlportid;
19991         rdev->crit_proto_nlportid = 0;
19992
19993         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19994         if (!msg)
19995                 return;
19996
19997         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19998         if (!hdr)
19999                 goto nla_put_failure;
20000
20001         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20002             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20003                               NL80211_ATTR_PAD))
20004                 goto nla_put_failure;
20005
20006         genlmsg_end(msg, hdr);
20007
20008         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
20009         return;
20010
20011  nla_put_failure:
20012         nlmsg_free(msg);
20013 }
20014 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
20015
20016 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
20017 {
20018         struct wiphy *wiphy = wdev->wiphy;
20019         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20020         struct sk_buff *msg;
20021         void *hdr;
20022
20023         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
20024         if (!msg)
20025                 return;
20026
20027         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
20028         if (!hdr)
20029                 goto out;
20030
20031         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20032             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
20033             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
20034                               NL80211_ATTR_PAD) ||
20035             (wdev->valid_links &&
20036              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
20037                 goto out;
20038
20039         genlmsg_end(msg, hdr);
20040
20041         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
20042                                 NL80211_MCGRP_MLME, GFP_KERNEL);
20043         return;
20044  out:
20045         nlmsg_free(msg);
20046 }
20047
20048 int cfg80211_external_auth_request(struct net_device *dev,
20049                                    struct cfg80211_external_auth_params *params,
20050                                    gfp_t gfp)
20051 {
20052         struct wireless_dev *wdev = dev->ieee80211_ptr;
20053         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
20054         struct sk_buff *msg;
20055         void *hdr;
20056
20057         if (!wdev->conn_owner_nlportid)
20058                 return -EINVAL;
20059
20060         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20061         if (!msg)
20062                 return -ENOMEM;
20063
20064         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
20065         if (!hdr)
20066                 goto nla_put_failure;
20067
20068         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20069             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
20070             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
20071             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
20072                         params->action) ||
20073             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
20074             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
20075                     params->ssid.ssid) ||
20076             (!is_zero_ether_addr(params->mld_addr) &&
20077              nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
20078                 goto nla_put_failure;
20079
20080         genlmsg_end(msg, hdr);
20081         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
20082                         wdev->conn_owner_nlportid);
20083         return 0;
20084
20085  nla_put_failure:
20086         nlmsg_free(msg);
20087         return -ENOBUFS;
20088 }
20089 EXPORT_SYMBOL(cfg80211_external_auth_request);
20090
20091 void cfg80211_update_owe_info_event(struct net_device *netdev,
20092                                     struct cfg80211_update_owe_info *owe_info,
20093                                     gfp_t gfp)
20094 {
20095         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
20096         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
20097         struct sk_buff *msg;
20098         void *hdr;
20099
20100         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
20101
20102         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
20103         if (!msg)
20104                 return;
20105
20106         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
20107         if (!hdr)
20108                 goto nla_put_failure;
20109
20110         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
20111             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
20112             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
20113                 goto nla_put_failure;
20114
20115         if (!owe_info->ie_len ||
20116             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20117                 goto nla_put_failure;
20118
20119         if (owe_info->assoc_link_id != -1) {
20120                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20121                                owe_info->assoc_link_id))
20122                         goto nla_put_failure;
20123
20124                 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20125                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20126                             owe_info->peer_mld_addr))
20127                         goto nla_put_failure;
20128         }
20129
20130         genlmsg_end(msg, hdr);
20131
20132         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20133                                 NL80211_MCGRP_MLME, gfp);
20134         return;
20135
20136 nla_put_failure:
20137         genlmsg_cancel(msg, hdr);
20138         nlmsg_free(msg);
20139 }
20140 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20141
20142 /* initialisation/exit functions */
20143
20144 int __init nl80211_init(void)
20145 {
20146         int err;
20147
20148         err = genl_register_family(&nl80211_fam);
20149         if (err)
20150                 return err;
20151
20152         err = netlink_register_notifier(&nl80211_netlink_notifier);
20153         if (err)
20154                 goto err_out;
20155
20156         return 0;
20157  err_out:
20158         genl_unregister_family(&nl80211_fam);
20159         return err;
20160 }
20161
20162 void nl80211_exit(void)
20163 {
20164         netlink_unregister_notifier(&nl80211_netlink_notifier);
20165         genl_unregister_family(&nl80211_fam);
20166 }