net/wireless/nl80211.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  * This is the new netlink-based wireless configuration interface.
   4  *
   5  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   6  * Copyright 2013-2014  Intel Mobile Communications GmbH
   7  * Copyright 2015-2017  Intel Deutschland GmbH
   8  * Copyright (C) 2018-2022 Intel Corporation
   9  */
  10
  11 #include <linux/if.h>
  12 #include <linux/module.h>
  13 #include <linux/err.h>
  14 #include <linux/slab.h>
  15 #include <linux/list.h>
  16 #include <linux/if_ether.h>
  17 #include <linux/ieee80211.h>
  18 #include <linux/nl80211.h>
  19 #include <linux/rtnetlink.h>
  20 #include <linux/netlink.h>
  21 #include <linux/nospec.h>
  22 #include <linux/etherdevice.h>
  23 #include <linux/if_vlan.h>
  24 #include <net/net_namespace.h>
  25 #include <net/genetlink.h>
  26 #include <net/cfg80211.h>
  27 #include <net/sock.h>
  28 #include <net/inet_connection_sock.h>
  29 #include "core.h"
  30 #include "nl80211.h"
  31 #include "reg.h"
  32 #include "rdev-ops.h"
  33
  34 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  35                                    struct genl_info *info,
  36                                    struct cfg80211_crypto_settings *settings,
  37                                    int cipher_limit);
  38
  39 /* the netlink family */
  40 static struct genl_family nl80211_fam;
  41
  42 /* multicast groups */
  43 enum nl80211_multicast_groups {
  44         NL80211_MCGRP_CONFIG,
  45         NL80211_MCGRP_SCAN,
  46         NL80211_MCGRP_REGULATORY,
  47         NL80211_MCGRP_MLME,
  48         NL80211_MCGRP_VENDOR,
  49         NL80211_MCGRP_NAN,
  50         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  51 };
  52
  53 static const struct genl_multicast_group nl80211_mcgrps[] = {
  54         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  55         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  56         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  57         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  58         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  59         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  60 #ifdef CONFIG_NL80211_TESTMODE
  61         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  62 #endif
  63 };
  64
  65 /* returns ERR_PTR values */
  66 static struct wireless_dev *
  67 __cfg80211_wdev_from_attrs(struct cfg80211_registered_device *rdev,
  68                            struct net *netns, struct nlattr **attrs)
  69 {
  70         struct wireless_dev *result = NULL;
  71         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  72         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  73         u64 wdev_id = 0;
  74         int wiphy_idx = -1;
  75         int ifidx = -1;
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         if (rdev) {
  88                 struct wireless_dev *wdev;
  89
  90                 lockdep_assert_held(&rdev->wiphy.mtx);
  91
  92                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  93                         if (have_ifidx && wdev->netdev &&
  94                             wdev->netdev->ifindex == ifidx) {
  95                                 result = wdev;
  96                                 break;
  97                         }
  98                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                 }
 103
 104                 return result ?: ERR_PTR(-ENODEV);
 105         }
 106
 107         ASSERT_RTNL();
 108
 109         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
 110                 struct wireless_dev *wdev;
 111
 112                 if (wiphy_net(&rdev->wiphy) != netns)
 113                         continue;
 114
 115                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
 116                         continue;
 117
 118                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
 119                         if (have_ifidx && wdev->netdev &&
 120                             wdev->netdev->ifindex == ifidx) {
 121                                 result = wdev;
 122                                 break;
 123                         }
 124                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 125                                 result = wdev;
 126                                 break;
 127                         }
 128                 }
 129
 130                 if (result)
 131                         break;
 132         }
 133
 134         if (result)
 135                 return result;
 136         return ERR_PTR(-ENODEV);
 137 }
 138
 139 static struct cfg80211_registered_device *
 140 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 141 {
 142         struct cfg80211_registered_device *rdev = NULL, *tmp;
 143         struct net_device *netdev;
 144
 145         ASSERT_RTNL();
 146
 147         if (!attrs[NL80211_ATTR_WIPHY] &&
 148             !attrs[NL80211_ATTR_IFINDEX] &&
 149             !attrs[NL80211_ATTR_WDEV])
 150                 return ERR_PTR(-EINVAL);
 151
 152         if (attrs[NL80211_ATTR_WIPHY])
 153                 rdev = cfg80211_rdev_by_wiphy_idx(
 154                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 155
 156         if (attrs[NL80211_ATTR_WDEV]) {
 157                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 158                 struct wireless_dev *wdev;
 159                 bool found = false;
 160
 161                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 162                 if (tmp) {
 163                         /* make sure wdev exists */
 164                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 165                                 if (wdev->identifier != (u32)wdev_id)
 166                                         continue;
 167                                 found = true;
 168                                 break;
 169                         }
 170
 171                         if (!found)
 172                                 tmp = NULL;
 173
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176                         rdev = tmp;
 177                 }
 178         }
 179
 180         if (attrs[NL80211_ATTR_IFINDEX]) {
 181                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 182
 183                 netdev = __dev_get_by_index(netns, ifindex);
 184                 if (netdev) {
 185                         if (netdev->ieee80211_ptr)
 186                                 tmp = wiphy_to_rdev(
 187                                         netdev->ieee80211_ptr->wiphy);
 188                         else
 189                                 tmp = NULL;
 190
 191                         /* not wireless device -- return error */
 192                         if (!tmp)
 193                                 return ERR_PTR(-EINVAL);
 194
 195                         /* mismatch -- return error */
 196                         if (rdev && tmp != rdev)
 197                                 return ERR_PTR(-EINVAL);
 198
 199                         rdev = tmp;
 200                 }
 201         }
 202
 203         if (!rdev)
 204                 return ERR_PTR(-ENODEV);
 205
 206         if (netns != wiphy_net(&rdev->wiphy))
 207                 return ERR_PTR(-ENODEV);
 208
 209         return rdev;
 210 }
 211
 212 /*
 213  * This function returns a pointer to the driver
 214  * that the genl_info item that is passed refers to.
 215  *
 216  * The result of this can be a PTR_ERR and hence must
 217  * be checked with IS_ERR() for errors.
 218  */
 219 static struct cfg80211_registered_device *
 220 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 221 {
 222         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 223 }
 224
 225 static int validate_beacon_head(const struct nlattr *attr,
 226                                 struct netlink_ext_ack *extack)
 227 {
 228         const u8 *data = nla_data(attr);
 229         unsigned int len = nla_len(attr);
 230         const struct element *elem;
 231         const struct ieee80211_mgmt *mgmt = (void *)data;
 232         unsigned int fixedlen, hdrlen;
 233         bool s1g_bcn;
 234
 235         if (len < offsetofend(typeof(*mgmt), frame_control))
 236                 goto err;
 237
 238         s1g_bcn = ieee80211_is_s1g_beacon(mgmt->frame_control);
 239         if (s1g_bcn) {
 240                 fixedlen = offsetof(struct ieee80211_ext,
 241                                     u.s1g_beacon.variable);
 242                 hdrlen = offsetof(struct ieee80211_ext, u.s1g_beacon);
 243         } else {
 244                 fixedlen = offsetof(struct ieee80211_mgmt,
 245                                     u.beacon.variable);
 246                 hdrlen = offsetof(struct ieee80211_mgmt, u.beacon);
 247         }
 248
 249         if (len < fixedlen)
 250                 goto err;
 251
 252         if (ieee80211_hdrlen(mgmt->frame_control) != hdrlen)
 253                 goto err;
 254
 255         data += fixedlen;
 256         len -= fixedlen;
 257
 258         for_each_element(elem, data, len) {
 259                 /* nothing */
 260         }
 261
 262         if (for_each_element_completed(elem, data, len))
 263                 return 0;
 264
 265 err:
 266         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed beacon head");
 267         return -EINVAL;
 268 }
 269
 270 static int validate_ie_attr(const struct nlattr *attr,
 271                             struct netlink_ext_ack *extack)
 272 {
 273         const u8 *data = nla_data(attr);
 274         unsigned int len = nla_len(attr);
 275         const struct element *elem;
 276
 277         for_each_element(elem, data, len) {
 278                 /* nothing */
 279         }
 280
 281         if (for_each_element_completed(elem, data, len))
 282                 return 0;
 283
 284         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 285         return -EINVAL;
 286 }
 287
 288 static int validate_he_capa(const struct nlattr *attr,
 289                             struct netlink_ext_ack *extack)
 290 {
 291         if (!ieee80211_he_capa_size_ok(nla_data(attr), nla_len(attr)))
 292                 return -EINVAL;
 293
 294         return 0;
 295 }
 296
 297 /* policy for the attributes */
 298 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR];
 299
 300 static const struct nla_policy
 301 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 302         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 303         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 304                                         .len = U8_MAX },
 305         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 306                                              .len = U8_MAX },
 307 };
 308
 309 static const struct nla_policy
 310 nl80211_pmsr_ftm_req_attr_policy[NL80211_PMSR_FTM_REQ_ATTR_MAX + 1] = {
 311         [NL80211_PMSR_FTM_REQ_ATTR_ASAP] = { .type = NLA_FLAG },
 312         [NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE] = { .type = NLA_U32 },
 313         [NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP] =
 314                 NLA_POLICY_MAX(NLA_U8, 15),
 315         [NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD] = { .type = NLA_U16 },
 316         [NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION] =
 317                 NLA_POLICY_MAX(NLA_U8, 15),
 318         [NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST] =
 319                 NLA_POLICY_MAX(NLA_U8, 31),
 320         [NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES] = { .type = NLA_U8 },
 321         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI] = { .type = NLA_FLAG },
 322         [NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC] = { .type = NLA_FLAG },
 323         [NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED] = { .type = NLA_FLAG },
 324         [NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED] = { .type = NLA_FLAG },
 325         [NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK] = { .type = NLA_FLAG },
 326 };
 327
 328 static const struct nla_policy
 329 nl80211_pmsr_req_data_policy[NL80211_PMSR_TYPE_MAX + 1] = {
 330         [NL80211_PMSR_TYPE_FTM] =
 331                 NLA_POLICY_NESTED(nl80211_pmsr_ftm_req_attr_policy),
 332 };
 333
 334 static const struct nla_policy
 335 nl80211_pmsr_req_attr_policy[NL80211_PMSR_REQ_ATTR_MAX + 1] = {
 336         [NL80211_PMSR_REQ_ATTR_DATA] =
 337                 NLA_POLICY_NESTED(nl80211_pmsr_req_data_policy),
 338         [NL80211_PMSR_REQ_ATTR_GET_AP_TSF] = { .type = NLA_FLAG },
 339 };
 340
 341 static const struct nla_policy
 342 nl80211_pmsr_peer_attr_policy[NL80211_PMSR_PEER_ATTR_MAX + 1] = {
 343         [NL80211_PMSR_PEER_ATTR_ADDR] = NLA_POLICY_ETH_ADDR,
 344         [NL80211_PMSR_PEER_ATTR_CHAN] = NLA_POLICY_NESTED(nl80211_policy),
 345         [NL80211_PMSR_PEER_ATTR_REQ] =
 346                 NLA_POLICY_NESTED(nl80211_pmsr_req_attr_policy),
 347         [NL80211_PMSR_PEER_ATTR_RESP] = { .type = NLA_REJECT },
 348 };
 349
 350 static const struct nla_policy
 351 nl80211_pmsr_attr_policy[NL80211_PMSR_ATTR_MAX + 1] = {
 352         [NL80211_PMSR_ATTR_MAX_PEERS] = { .type = NLA_REJECT },
 353         [NL80211_PMSR_ATTR_REPORT_AP_TSF] = { .type = NLA_REJECT },
 354         [NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR] = { .type = NLA_REJECT },
 355         [NL80211_PMSR_ATTR_TYPE_CAPA] = { .type = NLA_REJECT },
 356         [NL80211_PMSR_ATTR_PEERS] =
 357                 NLA_POLICY_NESTED_ARRAY(nl80211_pmsr_peer_attr_policy),
 358 };
 359
 360 static const struct nla_policy
 361 he_obss_pd_policy[NL80211_HE_OBSS_PD_ATTR_MAX + 1] = {
 362         [NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET] =
 363                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 364         [NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET] =
 365                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 366         [NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET] =
 367                 NLA_POLICY_RANGE(NLA_U8, 1, 20),
 368         [NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP] =
 369                 NLA_POLICY_EXACT_LEN(8),
 370         [NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP] =
 371                 NLA_POLICY_EXACT_LEN(8),
 372         [NL80211_HE_OBSS_PD_ATTR_SR_CTRL] = { .type = NLA_U8 },
 373 };
 374
 375 static const struct nla_policy
 376 he_bss_color_policy[NL80211_HE_BSS_COLOR_ATTR_MAX + 1] = {
 377         [NL80211_HE_BSS_COLOR_ATTR_COLOR] = NLA_POLICY_RANGE(NLA_U8, 1, 63),
 378         [NL80211_HE_BSS_COLOR_ATTR_DISABLED] = { .type = NLA_FLAG },
 379         [NL80211_HE_BSS_COLOR_ATTR_PARTIAL] = { .type = NLA_FLAG },
 380 };
 381
 382 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
 383         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
 384                                     .len = NL80211_MAX_SUPP_RATES },
 385         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
 386                                 .len = NL80211_MAX_SUPP_HT_RATES },
 387         [NL80211_TXRATE_VHT] = NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_txrate_vht)),
 388         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
 389         [NL80211_TXRATE_HE] = NLA_POLICY_EXACT_LEN(sizeof(struct nl80211_txrate_he)),
 390         [NL80211_TXRATE_HE_GI] =  NLA_POLICY_RANGE(NLA_U8,
 391                                                    NL80211_RATE_INFO_HE_GI_0_8,
 392                                                    NL80211_RATE_INFO_HE_GI_3_2),
 393         [NL80211_TXRATE_HE_LTF] = NLA_POLICY_RANGE(NLA_U8,
 394                                                    NL80211_RATE_INFO_HE_1XLTF,
 395                                                    NL80211_RATE_INFO_HE_4XLTF),
 396 };
 397
 398 static const struct nla_policy
 399 nl80211_tid_config_attr_policy[NL80211_TID_CONFIG_ATTR_MAX + 1] = {
 400         [NL80211_TID_CONFIG_ATTR_VIF_SUPP] = { .type = NLA_U64 },
 401         [NL80211_TID_CONFIG_ATTR_PEER_SUPP] = { .type = NLA_U64 },
 402         [NL80211_TID_CONFIG_ATTR_OVERRIDE] = { .type = NLA_FLAG },
 403         [NL80211_TID_CONFIG_ATTR_TIDS] = NLA_POLICY_RANGE(NLA_U16, 1, 0xff),
 404         [NL80211_TID_CONFIG_ATTR_NOACK] =
 405                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 406         [NL80211_TID_CONFIG_ATTR_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 407         [NL80211_TID_CONFIG_ATTR_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 408         [NL80211_TID_CONFIG_ATTR_AMPDU_CTRL] =
 409                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 410         [NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL] =
 411                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 412         [NL80211_TID_CONFIG_ATTR_AMSDU_CTRL] =
 413                         NLA_POLICY_MAX(NLA_U8, NL80211_TID_CONFIG_DISABLE),
 414         [NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE] =
 415                         NLA_POLICY_MAX(NLA_U8, NL80211_TX_RATE_FIXED),
 416         [NL80211_TID_CONFIG_ATTR_TX_RATE] =
 417                         NLA_POLICY_NESTED(nl80211_txattr_policy),
 418 };
 419
 420 static const struct nla_policy
 421 nl80211_fils_discovery_policy[NL80211_FILS_DISCOVERY_ATTR_MAX + 1] = {
 422         [NL80211_FILS_DISCOVERY_ATTR_INT_MIN] = NLA_POLICY_MAX(NLA_U32, 10000),
 423         [NL80211_FILS_DISCOVERY_ATTR_INT_MAX] = NLA_POLICY_MAX(NLA_U32, 10000),
 424         [NL80211_FILS_DISCOVERY_ATTR_TMPL] =
 425                         NLA_POLICY_RANGE(NLA_BINARY,
 426                                          NL80211_FILS_DISCOVERY_TMPL_MIN_LEN,
 427                                          IEEE80211_MAX_DATA_LEN),
 428 };
 429
 430 static const struct nla_policy
 431 nl80211_unsol_bcast_probe_resp_policy[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1] = {
 432         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] = NLA_POLICY_MAX(NLA_U32, 20),
 433         [NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL] = { .type = NLA_BINARY,
 434                                                        .len = IEEE80211_MAX_DATA_LEN }
 435 };
 436
 437 static const struct nla_policy
 438 sar_specs_policy[NL80211_SAR_ATTR_SPECS_MAX + 1] = {
 439         [NL80211_SAR_ATTR_SPECS_POWER] = { .type = NLA_S32 },
 440         [NL80211_SAR_ATTR_SPECS_RANGE_INDEX] = {.type = NLA_U32 },
 441 };
 442
 443 static const struct nla_policy
 444 sar_policy[NL80211_SAR_ATTR_MAX + 1] = {
 445         [NL80211_SAR_ATTR_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_SAR_TYPE),
 446         [NL80211_SAR_ATTR_SPECS] = NLA_POLICY_NESTED_ARRAY(sar_specs_policy),
 447 };
 448
 449 static const struct nla_policy
 450 nl80211_mbssid_config_policy[NL80211_MBSSID_CONFIG_ATTR_MAX + 1] = {
 451         [NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES] = NLA_POLICY_MIN(NLA_U8, 2),
 452         [NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY] =
 453                                                 NLA_POLICY_MIN(NLA_U8, 1),
 454         [NL80211_MBSSID_CONFIG_ATTR_INDEX] = { .type = NLA_U8 },
 455         [NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX] = { .type = NLA_U32 },
 456         [NL80211_MBSSID_CONFIG_ATTR_EMA] = { .type = NLA_FLAG },
 457 };
 458
 459 static const struct nla_policy
 460 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
 461         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
 462         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
 463 };
 464
 465 static struct netlink_range_validation nl80211_punct_bitmap_range = {
 466         .min = 0,
 467         .max = 0xffff,
 468 };
 469
 470 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 471         [0] = { .strict_start_type = NL80211_ATTR_HE_OBSS_PD },
 472         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 473         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 474                                       .len = 20-1 },
 475         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 476
 477         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 478         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 479         [NL80211_ATTR_WIPHY_EDMG_CHANNELS] = NLA_POLICY_RANGE(NLA_U8,
 480                                                 NL80211_EDMG_CHANNELS_MIN,
 481                                                 NL80211_EDMG_CHANNELS_MAX),
 482         [NL80211_ATTR_WIPHY_EDMG_BW_CONFIG] = NLA_POLICY_RANGE(NLA_U8,
 483                                                 NL80211_EDMG_BW_CONFIG_MIN,
 484                                                 NL80211_EDMG_BW_CONFIG_MAX),
 485
 486         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 487         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 488         [NL80211_ATTR_CENTER_FREQ1_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 489         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 490
 491         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 492         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 493         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 494         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 495         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 496         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 497
 498         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 499         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 500         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 501
 502         [NL80211_ATTR_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 503         [NL80211_ATTR_PREV_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 504
 505         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 506         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 507                                     .len = WLAN_MAX_KEY_LEN },
 508         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 7),
 509         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 510         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 511         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 512         [NL80211_ATTR_KEY_TYPE] =
 513                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 514
 515         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 516         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 517         [NL80211_ATTR_BEACON_HEAD] =
 518                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_beacon_head,
 519                                        IEEE80211_MAX_DATA_LEN),
 520         [NL80211_ATTR_BEACON_TAIL] =
 521                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 522                                        IEEE80211_MAX_DATA_LEN),
 523         [NL80211_ATTR_STA_AID] =
 524                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 525         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 526         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 527         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 528                                                .len = NL80211_MAX_SUPP_RATES },
 529         [NL80211_ATTR_STA_PLINK_ACTION] =
 530                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 531         [NL80211_ATTR_STA_TX_POWER_SETTING] =
 532                 NLA_POLICY_RANGE(NLA_U8,
 533                                  NL80211_TX_POWER_AUTOMATIC,
 534                                  NL80211_TX_POWER_FIXED),
 535         [NL80211_ATTR_STA_TX_POWER] = { .type = NLA_S16 },
 536         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 537         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 538         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 539                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 540         [NL80211_ATTR_MPATH_NEXT_HOP] = NLA_POLICY_ETH_ADDR_COMPAT,
 541
 542         /* allow 3 for NUL-termination, we used to declare this NLA_STRING */
 543         [NL80211_ATTR_REG_ALPHA2] = NLA_POLICY_RANGE(NLA_BINARY, 2, 3),
 544         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 545
 546         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 547         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 548         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 549         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 550                                            .len = NL80211_MAX_SUPP_RATES },
 551         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 552
 553         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 554         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 555
 556         [NL80211_ATTR_HT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_HT_CAPABILITY_LEN),
 557
 558         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 559         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 560                                                    validate_ie_attr,
 561                                                    IEEE80211_MAX_DATA_LEN),
 562         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 563         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 564
 565         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 566                                 .len = IEEE80211_MAX_SSID_LEN },
 567         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 568         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 569         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 570         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 571         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 572                                                   NL80211_MFP_NO,
 573                                                   NL80211_MFP_OPTIONAL),
 574         [NL80211_ATTR_STA_FLAGS2] =
 575                 NLA_POLICY_EXACT_LEN_WARN(sizeof(struct nl80211_sta_flag_update)),
 576         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 577         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 578         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 579         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 580         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 581         [NL80211_ATTR_STATUS_CODE] = { .type = NLA_U16 },
 582         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 583         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 584         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 585         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 586         [NL80211_ATTR_PMKID] = NLA_POLICY_EXACT_LEN_WARN(WLAN_PMKID_LEN),
 587         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 588         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 589         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 590         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 591                                  .len = IEEE80211_MAX_DATA_LEN },
 592         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 593         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 594                                                    NL80211_PS_DISABLED,
 595                                                    NL80211_PS_ENABLED),
 596         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 597         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 598         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 599         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 600         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 601         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 602         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 603         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 604         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 605         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 606         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 607         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 608         [NL80211_ATTR_STA_PLINK_STATE] =
 609                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 610         [NL80211_ATTR_MEASUREMENT_DURATION] = { .type = NLA_U16 },
 611         [NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY] = { .type = NLA_FLAG },
 612         [NL80211_ATTR_MESH_PEER_AID] =
 613                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 614         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 615         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 616         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 617         [NL80211_ATTR_HIDDEN_SSID] =
 618                 NLA_POLICY_RANGE(NLA_U32,
 619                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 620                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 621         [NL80211_ATTR_IE_PROBE_RESP] =
 622                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 623                                        IEEE80211_MAX_DATA_LEN),
 624         [NL80211_ATTR_IE_ASSOC_RESP] =
 625                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 626                                        IEEE80211_MAX_DATA_LEN),
 627         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 628         [NL80211_ATTR_STA_WME] = NLA_POLICY_NESTED(nl80211_sta_wme_policy),
 629         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 630         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 631         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 632         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 633         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 634         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 635         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 636         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 637         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 638         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 639                                       .len = IEEE80211_MAX_DATA_LEN },
 640         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 641         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 642         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 643                 .len = NL80211_HT_CAPABILITY_LEN
 644         },
 645         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 646         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 647         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 648         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 649         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 650
 651         /* need to include at least Auth Transaction and Status Code */
 652         [NL80211_ATTR_AUTH_DATA] = NLA_POLICY_MIN_LEN(4),
 653
 654         [NL80211_ATTR_VHT_CAPABILITY] = NLA_POLICY_EXACT_LEN_WARN(NL80211_VHT_CAPABILITY_LEN),
 655         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 656         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 657         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 658         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 659                 NLA_POLICY_RANGE(NLA_U32,
 660                                  NL80211_MESH_POWER_UNKNOWN + 1,
 661                                  NL80211_MESH_POWER_MAX),
 662         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 663         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 664         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 665         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 666         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 667         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 668         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 669                 .len = NL80211_VHT_CAPABILITY_LEN,
 670         },
 671         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 672         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 673                                   .len = IEEE80211_MAX_DATA_LEN },
 674         [NL80211_ATTR_CRIT_PROT_ID] = { .type = NLA_U16 },
 675         [NL80211_ATTR_MAX_CRIT_PROT_DURATION] =
 676                 NLA_POLICY_MAX(NLA_U16, NL80211_CRIT_PROTO_MAX_DURATION),
 677         [NL80211_ATTR_PEER_AID] =
 678                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 679         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 680         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 681         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 682         [NL80211_ATTR_CNTDWN_OFFS_BEACON] = { .type = NLA_BINARY },
 683         [NL80211_ATTR_CNTDWN_OFFS_PRESP] = { .type = NLA_BINARY },
 684         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = NLA_POLICY_MIN_LEN(2),
 685         /*
 686          * The value of the Length field of the Supported Operating
 687          * Classes element is between 2 and 253.
 688          */
 689         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] =
 690                 NLA_POLICY_RANGE(NLA_BINARY, 2, 253),
 691         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 692         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 693         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 694         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 695         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 696         [NL80211_ATTR_QOS_MAP] = NLA_POLICY_RANGE(NLA_BINARY,
 697                                                   IEEE80211_QOS_MAP_LEN_MIN,
 698                                                   IEEE80211_QOS_MAP_LEN_MAX),
 699         [NL80211_ATTR_MAC_HINT] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 700         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 701         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 702         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 703         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 704         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 705         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 706         [NL80211_ATTR_USER_PRIO] =
 707                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 708         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 709         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 710         [NL80211_ATTR_OPER_CLASS] = { .type = NLA_U8 },
 711         [NL80211_ATTR_MAC_MASK] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 712         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 713         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 714         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 715         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 716         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 717         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 718         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 719                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 720         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 721                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 722         },
 723         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 724         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 725         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 726         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 727         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 728                                     .len = FILS_MAX_KEK_LEN },
 729         [NL80211_ATTR_FILS_NONCES] = NLA_POLICY_EXACT_LEN_WARN(2 * FILS_NONCE_LEN),
 730         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 731         [NL80211_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 732         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 733         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 734                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 735         },
 736         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 737         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 738                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 739         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 740                                           .len = FILS_ERP_MAX_REALM_LEN },
 741         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 742         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 743                                         .len = FILS_ERP_MAX_RRK_LEN },
 744         [NL80211_ATTR_FILS_CACHE_ID] = NLA_POLICY_EXACT_LEN_WARN(2),
 745         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 746         [NL80211_ATTR_PMKR0_NAME] = NLA_POLICY_EXACT_LEN(WLAN_PMK_NAME_LEN),
 747         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 748         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 749
 750         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 751         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 752         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 753         [NL80211_ATTR_HE_CAPABILITY] =
 754                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_he_capa,
 755                                        NL80211_HE_MAX_CAPABILITY_LEN),
 756         [NL80211_ATTR_FTM_RESPONDER] =
 757                 NLA_POLICY_NESTED(nl80211_ftm_responder_policy),
 758         [NL80211_ATTR_TIMEOUT] = NLA_POLICY_MIN(NLA_U32, 1),
 759         [NL80211_ATTR_PEER_MEASUREMENTS] =
 760                 NLA_POLICY_NESTED(nl80211_pmsr_attr_policy),
 761         [NL80211_ATTR_AIRTIME_WEIGHT] = NLA_POLICY_MIN(NLA_U16, 1),
 762         [NL80211_ATTR_SAE_PASSWORD] = { .type = NLA_BINARY,
 763                                         .len = SAE_PASSWORD_MAX_LEN },
 764         [NL80211_ATTR_TWT_RESPONDER] = { .type = NLA_FLAG },
 765         [NL80211_ATTR_HE_OBSS_PD] = NLA_POLICY_NESTED(he_obss_pd_policy),
 766         [NL80211_ATTR_VLAN_ID] = NLA_POLICY_RANGE(NLA_U16, 1, VLAN_N_VID - 2),
 767         [NL80211_ATTR_HE_BSS_COLOR] = NLA_POLICY_NESTED(he_bss_color_policy),
 768         [NL80211_ATTR_TID_CONFIG] =
 769                 NLA_POLICY_NESTED_ARRAY(nl80211_tid_config_attr_policy),
 770         [NL80211_ATTR_CONTROL_PORT_NO_PREAUTH] = { .type = NLA_FLAG },
 771         [NL80211_ATTR_PMK_LIFETIME] = NLA_POLICY_MIN(NLA_U32, 1),
 772         [NL80211_ATTR_PMK_REAUTH_THRESHOLD] = NLA_POLICY_RANGE(NLA_U8, 1, 100),
 773         [NL80211_ATTR_RECEIVE_MULTICAST] = { .type = NLA_FLAG },
 774         [NL80211_ATTR_WIPHY_FREQ_OFFSET] = NLA_POLICY_RANGE(NLA_U32, 0, 999),
 775         [NL80211_ATTR_SCAN_FREQ_KHZ] = { .type = NLA_NESTED },
 776         [NL80211_ATTR_HE_6GHZ_CAPABILITY] =
 777                 NLA_POLICY_EXACT_LEN(sizeof(struct ieee80211_he_6ghz_capa)),
 778         [NL80211_ATTR_FILS_DISCOVERY] =
 779                 NLA_POLICY_NESTED(nl80211_fils_discovery_policy),
 780         [NL80211_ATTR_UNSOL_BCAST_PROBE_RESP] =
 781                 NLA_POLICY_NESTED(nl80211_unsol_bcast_probe_resp_policy),
 782         [NL80211_ATTR_S1G_CAPABILITY] =
 783                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 784         [NL80211_ATTR_S1G_CAPABILITY_MASK] =
 785                 NLA_POLICY_EXACT_LEN(IEEE80211_S1G_CAPABILITY_LEN),
 786         [NL80211_ATTR_SAE_PWE] =
 787                 NLA_POLICY_RANGE(NLA_U8, NL80211_SAE_PWE_HUNT_AND_PECK,
 788                                  NL80211_SAE_PWE_BOTH),
 789         [NL80211_ATTR_RECONNECT_REQUESTED] = { .type = NLA_REJECT },
 790         [NL80211_ATTR_SAR_SPEC] = NLA_POLICY_NESTED(sar_policy),
 791         [NL80211_ATTR_DISABLE_HE] = { .type = NLA_FLAG },
 792         [NL80211_ATTR_OBSS_COLOR_BITMAP] = { .type = NLA_U64 },
 793         [NL80211_ATTR_COLOR_CHANGE_COUNT] = { .type = NLA_U8 },
 794         [NL80211_ATTR_COLOR_CHANGE_COLOR] = { .type = NLA_U8 },
 795         [NL80211_ATTR_COLOR_CHANGE_ELEMS] = NLA_POLICY_NESTED(nl80211_policy),
 796         [NL80211_ATTR_MBSSID_CONFIG] =
 797                         NLA_POLICY_NESTED(nl80211_mbssid_config_policy),
 798         [NL80211_ATTR_MBSSID_ELEMS] = { .type = NLA_NESTED },
 799         [NL80211_ATTR_RADAR_BACKGROUND] = { .type = NLA_FLAG },
 800         [NL80211_ATTR_AP_SETTINGS_FLAGS] = { .type = NLA_U32 },
 801         [NL80211_ATTR_EHT_CAPABILITY] =
 802                 NLA_POLICY_RANGE(NLA_BINARY,
 803                                  NL80211_EHT_MIN_CAPABILITY_LEN,
 804                                  NL80211_EHT_MAX_CAPABILITY_LEN),
 805         [NL80211_ATTR_DISABLE_EHT] = { .type = NLA_FLAG },
 806         [NL80211_ATTR_MLO_LINKS] =
 807                 NLA_POLICY_NESTED_ARRAY(nl80211_policy),
 808         [NL80211_ATTR_MLO_LINK_ID] =
 809                 NLA_POLICY_RANGE(NLA_U8, 0, IEEE80211_MLD_MAX_NUM_LINKS),
 810         [NL80211_ATTR_MLD_ADDR] = NLA_POLICY_EXACT_LEN(ETH_ALEN),
 811         [NL80211_ATTR_MLO_SUPPORT] = { .type = NLA_FLAG },
 812         [NL80211_ATTR_MAX_NUM_AKM_SUITES] = { .type = NLA_REJECT },
 813         [NL80211_ATTR_PUNCT_BITMAP] =
 814                 NLA_POLICY_FULL_RANGE(NLA_U32, &nl80211_punct_bitmap_range),
 815
 816         [NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS] = { .type = NLA_U16 },
 817         [NL80211_ATTR_HW_TIMESTAMP_ENABLED] = { .type = NLA_FLAG },
 818         [NL80211_ATTR_EMA_RNR_ELEMS] = { .type = NLA_NESTED },
 819 };
 820
 821 /* policy for the key attributes */
 822 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 823         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 824         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 825         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 826         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 827         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 828         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 829         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 830         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 831         [NL80211_KEY_MODE] = NLA_POLICY_RANGE(NLA_U8, 0, NL80211_KEY_SET_TX),
 832 };
 833
 834 /* policy for the key default flags */
 835 static const struct nla_policy
 836 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 837         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 838         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 839 };
 840
 841 #ifdef CONFIG_PM
 842 /* policy for WoWLAN attributes */
 843 static const struct nla_policy
 844 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 845         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 846         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 847         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 848         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 849         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 850         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 851         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 852         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 853         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 854         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 855 };
 856
 857 static const struct nla_policy
 858 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 859         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 860         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 861         [NL80211_WOWLAN_TCP_DST_MAC] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 862         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 863         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 864         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 865         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 866                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 867         },
 868         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 869                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 870         },
 871         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 872         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = NLA_POLICY_MIN_LEN(1),
 873         [NL80211_WOWLAN_TCP_WAKE_MASK] = NLA_POLICY_MIN_LEN(1),
 874 };
 875 #endif /* CONFIG_PM */
 876
 877 /* policy for coalesce rule attributes */
 878 static const struct nla_policy
 879 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 880         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 881         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 882                 NLA_POLICY_RANGE(NLA_U32,
 883                                  NL80211_COALESCE_CONDITION_MATCH,
 884                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 885         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 886 };
 887
 888 /* policy for GTK rekey offload attributes */
 889 static const struct nla_policy
 890 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 891         [NL80211_REKEY_DATA_KEK] = {
 892                 .type = NLA_BINARY,
 893                 .len = NL80211_KEK_EXT_LEN
 894         },
 895         [NL80211_REKEY_DATA_KCK] = {
 896                 .type = NLA_BINARY,
 897                 .len = NL80211_KCK_EXT_LEN_32
 898         },
 899         [NL80211_REKEY_DATA_REPLAY_CTR] = NLA_POLICY_EXACT_LEN(NL80211_REPLAY_CTR_LEN),
 900         [NL80211_REKEY_DATA_AKM] = { .type = NLA_U32 },
 901 };
 902
 903 static const struct nla_policy
 904 nl80211_match_band_rssi_policy[NUM_NL80211_BANDS] = {
 905         [NL80211_BAND_2GHZ] = { .type = NLA_S32 },
 906         [NL80211_BAND_5GHZ] = { .type = NLA_S32 },
 907         [NL80211_BAND_6GHZ] = { .type = NLA_S32 },
 908         [NL80211_BAND_60GHZ] = { .type = NLA_S32 },
 909         [NL80211_BAND_LC]    = { .type = NLA_S32 },
 910 };
 911
 912 static const struct nla_policy
 913 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 914         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 915                                                  .len = IEEE80211_MAX_SSID_LEN },
 916         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 917         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 918         [NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI] =
 919                 NLA_POLICY_NESTED(nl80211_match_band_rssi_policy),
 920 };
 921
 922 static const struct nla_policy
 923 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 924         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 925         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 926 };
 927
 928 static const struct nla_policy
 929 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 930         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 931         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 932         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 933                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 934         },
 935 };
 936
 937 /* policy for NAN function attributes */
 938 static const struct nla_policy
 939 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 940         [NL80211_NAN_FUNC_TYPE] =
 941                 NLA_POLICY_MAX(NLA_U8, NL80211_NAN_FUNC_MAX_TYPE),
 942         [NL80211_NAN_FUNC_SERVICE_ID] = {
 943                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 944         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 945         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 946         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 947         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 948         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 949         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = NLA_POLICY_EXACT_LEN_WARN(ETH_ALEN),
 950         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 951         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 952         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 953                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 954         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 955         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 956         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 957         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 958         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 959 };
 960
 961 /* policy for Service Response Filter attributes */
 962 static const struct nla_policy
 963 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 964         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 965         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 966                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 967         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 968         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 969 };
 970
 971 /* policy for packet pattern attributes */
 972 static const struct nla_policy
 973 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 974         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 975         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 976         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 977 };
 978
 979 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 980                                      struct cfg80211_registered_device **rdev,
 981                                      struct wireless_dev **wdev,
 982                                      struct nlattr **attrbuf)
 983 {
 984         int err;
 985
 986         if (!cb->args[0]) {
 987                 struct nlattr **attrbuf_free = NULL;
 988
 989                 if (!attrbuf) {
 990                         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
 991                                           GFP_KERNEL);
 992                         if (!attrbuf)
 993                                 return -ENOMEM;
 994                         attrbuf_free = attrbuf;
 995                 }
 996
 997                 err = nlmsg_parse_deprecated(cb->nlh,
 998                                              GENL_HDRLEN + nl80211_fam.hdrsize,
 999                                              attrbuf, nl80211_fam.maxattr,
1000                                              nl80211_policy, NULL);
1001                 if (err) {
1002                         kfree(attrbuf_free);
1003                         return err;
1004                 }
1005
1006                 rtnl_lock();
1007                 *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(cb->skb->sk),
1008                                                    attrbuf);
1009                 kfree(attrbuf_free);
1010                 if (IS_ERR(*wdev)) {
1011                         rtnl_unlock();
1012                         return PTR_ERR(*wdev);
1013                 }
1014                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
1015                 mutex_lock(&(*rdev)->wiphy.mtx);
1016                 rtnl_unlock();
1017                 /* 0 is the first index - add 1 to parse only once */
1018                 cb->args[0] = (*rdev)->wiphy_idx + 1;
1019                 cb->args[1] = (*wdev)->identifier;
1020         } else {
1021                 /* subtract the 1 again here */
1022                 struct wiphy *wiphy;
1023                 struct wireless_dev *tmp;
1024
1025                 rtnl_lock();
1026                 wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
1027                 if (!wiphy) {
1028                         rtnl_unlock();
1029                         return -ENODEV;
1030                 }
1031                 *rdev = wiphy_to_rdev(wiphy);
1032                 *wdev = NULL;
1033
1034                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
1035                         if (tmp->identifier == cb->args[1]) {
1036                                 *wdev = tmp;
1037                                 break;
1038                         }
1039                 }
1040
1041                 if (!*wdev) {
1042                         rtnl_unlock();
1043                         return -ENODEV;
1044                 }
1045                 mutex_lock(&(*rdev)->wiphy.mtx);
1046                 rtnl_unlock();
1047         }
1048
1049         return 0;
1050 }
1051
1052 /* message building helper */
1053 void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
1054                      int flags, u8 cmd)
1055 {
1056         /* since there is no private header just add the generic one */
1057         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
1058 }
1059
1060 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
1061                                      const struct ieee80211_reg_rule *rule)
1062 {
1063         int j;
1064         struct nlattr *nl_wmm_rules =
1065                 nla_nest_start_noflag(msg, NL80211_FREQUENCY_ATTR_WMM);
1066
1067         if (!nl_wmm_rules)
1068                 goto nla_put_failure;
1069
1070         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
1071                 struct nlattr *nl_wmm_rule = nla_nest_start_noflag(msg, j);
1072
1073                 if (!nl_wmm_rule)
1074                         goto nla_put_failure;
1075
1076                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
1077                                 rule->wmm_rule.client[j].cw_min) ||
1078                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
1079                                 rule->wmm_rule.client[j].cw_max) ||
1080                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
1081                                rule->wmm_rule.client[j].aifsn) ||
1082                     nla_put_u16(msg, NL80211_WMMR_TXOP,
1083                                 rule->wmm_rule.client[j].cot))
1084                         goto nla_put_failure;
1085
1086                 nla_nest_end(msg, nl_wmm_rule);
1087         }
1088         nla_nest_end(msg, nl_wmm_rules);
1089
1090         return 0;
1091
1092 nla_put_failure:
1093         return -ENOBUFS;
1094 }
1095
1096 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
1097                                    struct ieee80211_channel *chan,
1098                                    bool large)
1099 {
1100         /* Some channels must be completely excluded from the
1101          * list to protect old user-space tools from breaking
1102          */
1103         if (!large && chan->flags &
1104             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
1105                 return 0;
1106         if (!large && chan->freq_offset)
1107                 return 0;
1108
1109         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
1110                         chan->center_freq))
1111                 goto nla_put_failure;
1112
1113         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_OFFSET, chan->freq_offset))
1114                 goto nla_put_failure;
1115
1116         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
1117             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
1118                 goto nla_put_failure;
1119         if (chan->flags & IEEE80211_CHAN_NO_IR) {
1120                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
1121                         goto nla_put_failure;
1122                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
1123                         goto nla_put_failure;
1124         }
1125         if (chan->flags & IEEE80211_CHAN_RADAR) {
1126                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
1127                         goto nla_put_failure;
1128                 if (large) {
1129                         u32 time;
1130
1131                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
1132
1133                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
1134                                         chan->dfs_state))
1135                                 goto nla_put_failure;
1136                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
1137                                         time))
1138                                 goto nla_put_failure;
1139                         if (nla_put_u32(msg,
1140                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
1141                                         chan->dfs_cac_ms))
1142                                 goto nla_put_failure;
1143                 }
1144         }
1145
1146         if (large) {
1147                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
1148                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
1149                         goto nla_put_failure;
1150                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
1151                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
1152                         goto nla_put_failure;
1153                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
1154                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
1155                         goto nla_put_failure;
1156                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
1157                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
1158                         goto nla_put_failure;
1159                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
1160                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
1161                         goto nla_put_failure;
1162                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
1163                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
1164                         goto nla_put_failure;
1165                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
1166                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
1167                         goto nla_put_failure;
1168                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
1169                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
1170                         goto nla_put_failure;
1171                 if ((chan->flags & IEEE80211_CHAN_NO_HE) &&
1172                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HE))
1173                         goto nla_put_failure;
1174                 if ((chan->flags & IEEE80211_CHAN_1MHZ) &&
1175                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_1MHZ))
1176                         goto nla_put_failure;
1177                 if ((chan->flags & IEEE80211_CHAN_2MHZ) &&
1178                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_2MHZ))
1179                         goto nla_put_failure;
1180                 if ((chan->flags & IEEE80211_CHAN_4MHZ) &&
1181                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_4MHZ))
1182                         goto nla_put_failure;
1183                 if ((chan->flags & IEEE80211_CHAN_8MHZ) &&
1184                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_8MHZ))
1185                         goto nla_put_failure;
1186                 if ((chan->flags & IEEE80211_CHAN_16MHZ) &&
1187                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_16MHZ))
1188                         goto nla_put_failure;
1189                 if ((chan->flags & IEEE80211_CHAN_NO_320MHZ) &&
1190                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_320MHZ))
1191                         goto nla_put_failure;
1192                 if ((chan->flags & IEEE80211_CHAN_NO_EHT) &&
1193                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_EHT))
1194                         goto nla_put_failure;
1195         }
1196
1197         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
1198                         DBM_TO_MBM(chan->max_power)))
1199                 goto nla_put_failure;
1200
1201         if (large) {
1202                 const struct ieee80211_reg_rule *rule =
1203                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
1204
1205                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
1206                         if (nl80211_msg_put_wmm_rules(msg, rule))
1207                                 goto nla_put_failure;
1208                 }
1209         }
1210
1211         return 0;
1212
1213  nla_put_failure:
1214         return -ENOBUFS;
1215 }
1216
1217 static bool nl80211_put_txq_stats(struct sk_buff *msg,
1218                                   struct cfg80211_txq_stats *txqstats,
1219                                   int attrtype)
1220 {
1221         struct nlattr *txqattr;
1222
1223 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
1224         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
1225             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
1226                 return false;                                             \
1227         } while (0)
1228
1229         txqattr = nla_nest_start_noflag(msg, attrtype);
1230         if (!txqattr)
1231                 return false;
1232
1233         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
1234         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
1235         PUT_TXQVAL_U32(FLOWS, flows);
1236         PUT_TXQVAL_U32(DROPS, drops);
1237         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
1238         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
1239         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
1240         PUT_TXQVAL_U32(COLLISIONS, collisions);
1241         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
1242         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
1243         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
1244         nla_nest_end(msg, txqattr);
1245
1246 #undef PUT_TXQVAL_U32
1247         return true;
1248 }
1249
1250 /* netlink command implementations */
1251
1252 /**
1253  * nl80211_link_id - return link ID
1254  * @attrs: attributes to look at
1255  *
1256  * Returns: the link ID or 0 if not given
1257  *
1258  * Note this function doesn't do any validation of the link
1259  * ID validity wrt. links that were actually added, so it must
1260  * be called only from ops with %NL80211_FLAG_MLO_VALID_LINK_ID
1261  * or if additional validation is done.
1262  */
1263 static unsigned int nl80211_link_id(struct nlattr **attrs)
1264 {
1265         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1266
1267         if (!linkid)
1268                 return 0;
1269
1270         return nla_get_u8(linkid);
1271 }
1272
1273 static int nl80211_link_id_or_invalid(struct nlattr **attrs)
1274 {
1275         struct nlattr *linkid = attrs[NL80211_ATTR_MLO_LINK_ID];
1276
1277         if (!linkid)
1278                 return -1;
1279
1280         return nla_get_u8(linkid);
1281 }
1282
1283 struct key_parse {
1284         struct key_params p;
1285         int idx;
1286         int type;
1287         bool def, defmgmt, defbeacon;
1288         bool def_uni, def_multi;
1289 };
1290
1291 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
1292                                  struct key_parse *k)
1293 {
1294         struct nlattr *tb[NL80211_KEY_MAX + 1];
1295         int err = nla_parse_nested_deprecated(tb, NL80211_KEY_MAX, key,
1296                                               nl80211_key_policy,
1297                                               info->extack);
1298         if (err)
1299                 return err;
1300
1301         k->def = !!tb[NL80211_KEY_DEFAULT];
1302         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
1303         k->defbeacon = !!tb[NL80211_KEY_DEFAULT_BEACON];
1304
1305         if (k->def) {
1306                 k->def_uni = true;
1307                 k->def_multi = true;
1308         }
1309         if (k->defmgmt || k->defbeacon)
1310                 k->def_multi = true;
1311
1312         if (tb[NL80211_KEY_IDX])
1313                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
1314
1315         if (tb[NL80211_KEY_DATA]) {
1316                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
1317                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
1318         }
1319
1320         if (tb[NL80211_KEY_SEQ]) {
1321                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
1322                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
1323         }
1324
1325         if (tb[NL80211_KEY_CIPHER])
1326                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
1327
1328         if (tb[NL80211_KEY_TYPE])
1329                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
1330
1331         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
1332                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1333
1334                 err = nla_parse_nested_deprecated(kdt,
1335                                                   NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1336                                                   tb[NL80211_KEY_DEFAULT_TYPES],
1337                                                   nl80211_key_default_policy,
1338                                                   info->extack);
1339                 if (err)
1340                         return err;
1341
1342                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1343                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1344         }
1345
1346         if (tb[NL80211_KEY_MODE])
1347                 k->p.mode = nla_get_u8(tb[NL80211_KEY_MODE]);
1348
1349         return 0;
1350 }
1351
1352 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
1353 {
1354         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
1355                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
1356                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
1357         }
1358
1359         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
1360                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
1361                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
1362         }
1363
1364         if (info->attrs[NL80211_ATTR_KEY_IDX])
1365                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
1366
1367         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
1368                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
1369
1370         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
1371         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
1372
1373         if (k->def) {
1374                 k->def_uni = true;
1375                 k->def_multi = true;
1376         }
1377         if (k->defmgmt)
1378                 k->def_multi = true;
1379
1380         if (info->attrs[NL80211_ATTR_KEY_TYPE])
1381                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
1382
1383         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
1384                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
1385                 int err = nla_parse_nested_deprecated(kdt,
1386                                                       NUM_NL80211_KEY_DEFAULT_TYPES - 1,
1387                                                       info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
1388                                                       nl80211_key_default_policy,
1389                                                       info->extack);
1390                 if (err)
1391                         return err;
1392
1393                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
1394                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
1395         }
1396
1397         return 0;
1398 }
1399
1400 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
1401 {
1402         int err;
1403
1404         memset(k, 0, sizeof(*k));
1405         k->idx = -1;
1406         k->type = -1;
1407
1408         if (info->attrs[NL80211_ATTR_KEY])
1409                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
1410         else
1411                 err = nl80211_parse_key_old(info, k);
1412
1413         if (err)
1414                 return err;
1415
1416         if ((k->def ? 1 : 0) + (k->defmgmt ? 1 : 0) +
1417             (k->defbeacon ? 1 : 0) > 1) {
1418                 GENL_SET_ERR_MSG(info,
1419                                  "key with multiple default flags is invalid");
1420                 return -EINVAL;
1421         }
1422
1423         if (k->defmgmt || k->defbeacon) {
1424                 if (k->def_uni || !k->def_multi) {
1425                         GENL_SET_ERR_MSG(info,
1426                                          "defmgmt/defbeacon key must be mcast");
1427                         return -EINVAL;
1428                 }
1429         }
1430
1431         if (k->idx != -1) {
1432                 if (k->defmgmt) {
1433                         if (k->idx < 4 || k->idx > 5) {
1434                                 GENL_SET_ERR_MSG(info,
1435                                                  "defmgmt key idx not 4 or 5");
1436                                 return -EINVAL;
1437                         }
1438                 } else if (k->defbeacon) {
1439                         if (k->idx < 6 || k->idx > 7) {
1440                                 GENL_SET_ERR_MSG(info,
1441                                                  "defbeacon key idx not 6 or 7");
1442                                 return -EINVAL;
1443                         }
1444                 } else if (k->def) {
1445                         if (k->idx < 0 || k->idx > 3) {
1446                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1447                                 return -EINVAL;
1448                         }
1449                 } else {
1450                         if (k->idx < 0 || k->idx > 7) {
1451                                 GENL_SET_ERR_MSG(info, "key idx not 0-7");
1452                                 return -EINVAL;
1453                         }
1454                 }
1455         }
1456
1457         return 0;
1458 }
1459
1460 static struct cfg80211_cached_keys *
1461 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1462                        struct genl_info *info, bool *no_ht)
1463 {
1464         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1465         struct key_parse parse;
1466         struct nlattr *key;
1467         struct cfg80211_cached_keys *result;
1468         int rem, err, def = 0;
1469         bool have_key = false;
1470
1471         nla_for_each_nested(key, keys, rem) {
1472                 have_key = true;
1473                 break;
1474         }
1475
1476         if (!have_key)
1477                 return NULL;
1478
1479         result = kzalloc(sizeof(*result), GFP_KERNEL);
1480         if (!result)
1481                 return ERR_PTR(-ENOMEM);
1482
1483         result->def = -1;
1484
1485         nla_for_each_nested(key, keys, rem) {
1486                 memset(&parse, 0, sizeof(parse));
1487                 parse.idx = -1;
1488
1489                 err = nl80211_parse_key_new(info, key, &parse);
1490                 if (err)
1491                         goto error;
1492                 err = -EINVAL;
1493                 if (!parse.p.key)
1494                         goto error;
1495                 if (parse.idx < 0 || parse.idx > 3) {
1496                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1497                         goto error;
1498                 }
1499                 if (parse.def) {
1500                         if (def) {
1501                                 GENL_SET_ERR_MSG(info,
1502                                                  "only one key can be default");
1503                                 goto error;
1504                         }
1505                         def = 1;
1506                         result->def = parse.idx;
1507                         if (!parse.def_uni || !parse.def_multi)
1508                                 goto error;
1509                 } else if (parse.defmgmt)
1510                         goto error;
1511                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1512                                                      parse.idx, false, NULL);
1513                 if (err)
1514                         goto error;
1515                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1516                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1517                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1518                         err = -EINVAL;
1519                         goto error;
1520                 }
1521                 result->params[parse.idx].cipher = parse.p.cipher;
1522                 result->params[parse.idx].key_len = parse.p.key_len;
1523                 result->params[parse.idx].key = result->data[parse.idx];
1524                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1525
1526                 /* must be WEP key if we got here */
1527                 if (no_ht)
1528                         *no_ht = true;
1529         }
1530
1531         if (result->def < 0) {
1532                 err = -EINVAL;
1533                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1534                 goto error;
1535         }
1536
1537         return result;
1538  error:
1539         kfree(result);
1540         return ERR_PTR(err);
1541 }
1542
1543 static int nl80211_key_allowed(struct wireless_dev *wdev)
1544 {
1545         ASSERT_WDEV_LOCK(wdev);
1546
1547         switch (wdev->iftype) {
1548         case NL80211_IFTYPE_AP:
1549         case NL80211_IFTYPE_AP_VLAN:
1550         case NL80211_IFTYPE_P2P_GO:
1551         case NL80211_IFTYPE_MESH_POINT:
1552                 break;
1553         case NL80211_IFTYPE_ADHOC:
1554                 if (wdev->u.ibss.current_bss)
1555                         return 0;
1556                 return -ENOLINK;
1557         case NL80211_IFTYPE_STATION:
1558         case NL80211_IFTYPE_P2P_CLIENT:
1559                 if (wdev->connected)
1560                         return 0;
1561                 return -ENOLINK;
1562         case NL80211_IFTYPE_NAN:
1563                 if (wiphy_ext_feature_isset(wdev->wiphy,
1564                                             NL80211_EXT_FEATURE_SECURE_NAN))
1565                         return 0;
1566                 return -EINVAL;
1567         case NL80211_IFTYPE_UNSPECIFIED:
1568         case NL80211_IFTYPE_OCB:
1569         case NL80211_IFTYPE_MONITOR:
1570         case NL80211_IFTYPE_P2P_DEVICE:
1571         case NL80211_IFTYPE_WDS:
1572         case NUM_NL80211_IFTYPES:
1573                 return -EINVAL;
1574         }
1575
1576         return 0;
1577 }
1578
1579 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1580                                                         u32 freq)
1581 {
1582         struct ieee80211_channel *chan;
1583
1584         chan = ieee80211_get_channel_khz(wiphy, freq);
1585         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1586                 return NULL;
1587         return chan;
1588 }
1589
1590 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1591 {
1592         struct nlattr *nl_modes = nla_nest_start_noflag(msg, attr);
1593         int i;
1594
1595         if (!nl_modes)
1596                 goto nla_put_failure;
1597
1598         i = 0;
1599         while (ifmodes) {
1600                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1601                         goto nla_put_failure;
1602                 ifmodes >>= 1;
1603                 i++;
1604         }
1605
1606         nla_nest_end(msg, nl_modes);
1607         return 0;
1608
1609 nla_put_failure:
1610         return -ENOBUFS;
1611 }
1612
1613 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1614                                           struct sk_buff *msg,
1615                                           bool large)
1616 {
1617         struct nlattr *nl_combis;
1618         int i, j;
1619
1620         nl_combis = nla_nest_start_noflag(msg,
1621                                           NL80211_ATTR_INTERFACE_COMBINATIONS);
1622         if (!nl_combis)
1623                 goto nla_put_failure;
1624
1625         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1626                 const struct ieee80211_iface_combination *c;
1627                 struct nlattr *nl_combi, *nl_limits;
1628
1629                 c = &wiphy->iface_combinations[i];
1630
1631                 nl_combi = nla_nest_start_noflag(msg, i + 1);
1632                 if (!nl_combi)
1633                         goto nla_put_failure;
1634
1635                 nl_limits = nla_nest_start_noflag(msg,
1636                                                   NL80211_IFACE_COMB_LIMITS);
1637                 if (!nl_limits)
1638                         goto nla_put_failure;
1639
1640                 for (j = 0; j < c->n_limits; j++) {
1641                         struct nlattr *nl_limit;
1642
1643                         nl_limit = nla_nest_start_noflag(msg, j + 1);
1644                         if (!nl_limit)
1645                                 goto nla_put_failure;
1646                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1647                                         c->limits[j].max))
1648                                 goto nla_put_failure;
1649                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1650                                                 c->limits[j].types))
1651                                 goto nla_put_failure;
1652                         nla_nest_end(msg, nl_limit);
1653                 }
1654
1655                 nla_nest_end(msg, nl_limits);
1656
1657                 if (c->beacon_int_infra_match &&
1658                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1659                         goto nla_put_failure;
1660                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1661                                 c->num_different_channels) ||
1662                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1663                                 c->max_interfaces))
1664                         goto nla_put_failure;
1665                 if (large &&
1666                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1667                                 c->radar_detect_widths) ||
1668                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1669                                 c->radar_detect_regions)))
1670                         goto nla_put_failure;
1671                 if (c->beacon_int_min_gcd &&
1672                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1673                                 c->beacon_int_min_gcd))
1674                         goto nla_put_failure;
1675
1676                 nla_nest_end(msg, nl_combi);
1677         }
1678
1679         nla_nest_end(msg, nl_combis);
1680
1681         return 0;
1682 nla_put_failure:
1683         return -ENOBUFS;
1684 }
1685
1686 #ifdef CONFIG_PM
1687 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1688                                         struct sk_buff *msg)
1689 {
1690         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1691         struct nlattr *nl_tcp;
1692
1693         if (!tcp)
1694                 return 0;
1695
1696         nl_tcp = nla_nest_start_noflag(msg,
1697                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1698         if (!nl_tcp)
1699                 return -ENOBUFS;
1700
1701         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1702                         tcp->data_payload_max))
1703                 return -ENOBUFS;
1704
1705         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1706                         tcp->data_payload_max))
1707                 return -ENOBUFS;
1708
1709         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1710                 return -ENOBUFS;
1711
1712         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1713                                 sizeof(*tcp->tok), tcp->tok))
1714                 return -ENOBUFS;
1715
1716         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1717                         tcp->data_interval_max))
1718                 return -ENOBUFS;
1719
1720         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1721                         tcp->wake_payload_max))
1722                 return -ENOBUFS;
1723
1724         nla_nest_end(msg, nl_tcp);
1725         return 0;
1726 }
1727
1728 static int nl80211_send_wowlan(struct sk_buff *msg,
1729                                struct cfg80211_registered_device *rdev,
1730                                bool large)
1731 {
1732         struct nlattr *nl_wowlan;
1733
1734         if (!rdev->wiphy.wowlan)
1735                 return 0;
1736
1737         nl_wowlan = nla_nest_start_noflag(msg,
1738                                           NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1739         if (!nl_wowlan)
1740                 return -ENOBUFS;
1741
1742         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1743              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1744             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1745              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1746             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1747              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1748             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1749              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1750             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1751              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1752             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1753              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1754             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1755              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1756             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1757              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1758                 return -ENOBUFS;
1759
1760         if (rdev->wiphy.wowlan->n_patterns) {
1761                 struct nl80211_pattern_support pat = {
1762                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1763                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1764                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1765                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1766                 };
1767
1768                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1769                             sizeof(pat), &pat))
1770                         return -ENOBUFS;
1771         }
1772
1773         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1774             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1775                         rdev->wiphy.wowlan->max_nd_match_sets))
1776                 return -ENOBUFS;
1777
1778         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1779                 return -ENOBUFS;
1780
1781         nla_nest_end(msg, nl_wowlan);
1782
1783         return 0;
1784 }
1785 #endif
1786
1787 static int nl80211_send_coalesce(struct sk_buff *msg,
1788                                  struct cfg80211_registered_device *rdev)
1789 {
1790         struct nl80211_coalesce_rule_support rule;
1791
1792         if (!rdev->wiphy.coalesce)
1793                 return 0;
1794
1795         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1796         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1797         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1798         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1799         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1800         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1801
1802         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1803                 return -ENOBUFS;
1804
1805         return 0;
1806 }
1807
1808 static int
1809 nl80211_send_iftype_data(struct sk_buff *msg,
1810                          const struct ieee80211_supported_band *sband,
1811                          const struct ieee80211_sband_iftype_data *iftdata)
1812 {
1813         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1814         const struct ieee80211_sta_eht_cap *eht_cap = &iftdata->eht_cap;
1815
1816         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1817                                 iftdata->types_mask))
1818                 return -ENOBUFS;
1819
1820         if (he_cap->has_he) {
1821                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1822                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1823                             he_cap->he_cap_elem.mac_cap_info) ||
1824                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1825                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1826                             he_cap->he_cap_elem.phy_cap_info) ||
1827                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1828                             sizeof(he_cap->he_mcs_nss_supp),
1829                             &he_cap->he_mcs_nss_supp) ||
1830                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1831                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1832                         return -ENOBUFS;
1833         }
1834
1835         if (eht_cap->has_eht && he_cap->has_he) {
1836                 u8 mcs_nss_size, ppe_thresh_size;
1837                 u16 ppe_thres_hdr;
1838                 bool is_ap;
1839
1840                 is_ap = iftdata->types_mask & BIT(NL80211_IFTYPE_AP) ||
1841                         iftdata->types_mask & BIT(NL80211_IFTYPE_P2P_GO);
1842
1843                 mcs_nss_size =
1844                         ieee80211_eht_mcs_nss_size(&he_cap->he_cap_elem,
1845                                                    &eht_cap->eht_cap_elem,
1846                                                    is_ap);
1847
1848                 ppe_thres_hdr = get_unaligned_le16(&eht_cap->eht_ppe_thres[0]);
1849                 ppe_thresh_size =
1850                         ieee80211_eht_ppe_size(ppe_thres_hdr,
1851                                                eht_cap->eht_cap_elem.phy_cap_info);
1852
1853                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MAC,
1854                             sizeof(eht_cap->eht_cap_elem.mac_cap_info),
1855                             eht_cap->eht_cap_elem.mac_cap_info) ||
1856                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PHY,
1857                             sizeof(eht_cap->eht_cap_elem.phy_cap_info),
1858                             eht_cap->eht_cap_elem.phy_cap_info) ||
1859                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_MCS_SET,
1860                             mcs_nss_size, &eht_cap->eht_mcs_nss_supp) ||
1861                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_EHT_CAP_PPE,
1862                             ppe_thresh_size, eht_cap->eht_ppe_thres))
1863                         return -ENOBUFS;
1864         }
1865
1866         if (sband->band == NL80211_BAND_6GHZ &&
1867             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_6GHZ_CAPA,
1868                     sizeof(iftdata->he_6ghz_capa),
1869                     &iftdata->he_6ghz_capa))
1870                 return -ENOBUFS;
1871
1872         if (iftdata->vendor_elems.data && iftdata->vendor_elems.len &&
1873             nla_put(msg, NL80211_BAND_IFTYPE_ATTR_VENDOR_ELEMS,
1874                     iftdata->vendor_elems.len, iftdata->vendor_elems.data))
1875                 return -ENOBUFS;
1876
1877         return 0;
1878 }
1879
1880 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1881                                       struct ieee80211_supported_band *sband,
1882                                       bool large)
1883 {
1884         struct nlattr *nl_rates, *nl_rate;
1885         struct ieee80211_rate *rate;
1886         int i;
1887
1888         /* add HT info */
1889         if (sband->ht_cap.ht_supported &&
1890             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1891                      sizeof(sband->ht_cap.mcs),
1892                      &sband->ht_cap.mcs) ||
1893              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1894                          sband->ht_cap.cap) ||
1895              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1896                         sband->ht_cap.ampdu_factor) ||
1897              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1898                         sband->ht_cap.ampdu_density)))
1899                 return -ENOBUFS;
1900
1901         /* add VHT info */
1902         if (sband->vht_cap.vht_supported &&
1903             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1904                      sizeof(sband->vht_cap.vht_mcs),
1905                      &sband->vht_cap.vht_mcs) ||
1906              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1907                          sband->vht_cap.cap)))
1908                 return -ENOBUFS;
1909
1910         if (large && sband->n_iftype_data) {
1911                 struct nlattr *nl_iftype_data =
1912                         nla_nest_start_noflag(msg,
1913                                               NL80211_BAND_ATTR_IFTYPE_DATA);
1914                 int err;
1915
1916                 if (!nl_iftype_data)
1917                         return -ENOBUFS;
1918
1919                 for (i = 0; i < sband->n_iftype_data; i++) {
1920                         struct nlattr *iftdata;
1921
1922                         iftdata = nla_nest_start_noflag(msg, i + 1);
1923                         if (!iftdata)
1924                                 return -ENOBUFS;
1925
1926                         err = nl80211_send_iftype_data(msg, sband,
1927                                                        &sband->iftype_data[i]);
1928                         if (err)
1929                                 return err;
1930
1931                         nla_nest_end(msg, iftdata);
1932                 }
1933
1934                 nla_nest_end(msg, nl_iftype_data);
1935         }
1936
1937         /* add EDMG info */
1938         if (large && sband->edmg_cap.channels &&
1939             (nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_CHANNELS,
1940                        sband->edmg_cap.channels) ||
1941             nla_put_u8(msg, NL80211_BAND_ATTR_EDMG_BW_CONFIG,
1942                        sband->edmg_cap.bw_config)))
1943
1944                 return -ENOBUFS;
1945
1946         /* add bitrates */
1947         nl_rates = nla_nest_start_noflag(msg, NL80211_BAND_ATTR_RATES);
1948         if (!nl_rates)
1949                 return -ENOBUFS;
1950
1951         for (i = 0; i < sband->n_bitrates; i++) {
1952                 nl_rate = nla_nest_start_noflag(msg, i);
1953                 if (!nl_rate)
1954                         return -ENOBUFS;
1955
1956                 rate = &sband->bitrates[i];
1957                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1958                                 rate->bitrate))
1959                         return -ENOBUFS;
1960                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1961                     nla_put_flag(msg,
1962                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1963                         return -ENOBUFS;
1964
1965                 nla_nest_end(msg, nl_rate);
1966         }
1967
1968         nla_nest_end(msg, nl_rates);
1969
1970         /* S1G capabilities */
1971         if (sband->band == NL80211_BAND_S1GHZ && sband->s1g_cap.s1g &&
1972             (nla_put(msg, NL80211_BAND_ATTR_S1G_CAPA,
1973                      sizeof(sband->s1g_cap.cap),
1974                      sband->s1g_cap.cap) ||
1975              nla_put(msg, NL80211_BAND_ATTR_S1G_MCS_NSS_SET,
1976                      sizeof(sband->s1g_cap.nss_mcs),
1977                      sband->s1g_cap.nss_mcs)))
1978                 return -ENOBUFS;
1979
1980         return 0;
1981 }
1982
1983 static int
1984 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1985                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1986 {
1987         u16 stypes;
1988         struct nlattr *nl_ftypes, *nl_ifs;
1989         enum nl80211_iftype ift;
1990         int i;
1991
1992         if (!mgmt_stypes)
1993                 return 0;
1994
1995         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_TX_FRAME_TYPES);
1996         if (!nl_ifs)
1997                 return -ENOBUFS;
1998
1999         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2000                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2001                 if (!nl_ftypes)
2002                         return -ENOBUFS;
2003                 i = 0;
2004                 stypes = mgmt_stypes[ift].tx;
2005                 while (stypes) {
2006                         if ((stypes & 1) &&
2007                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2008                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2009                                 return -ENOBUFS;
2010                         stypes >>= 1;
2011                         i++;
2012                 }
2013                 nla_nest_end(msg, nl_ftypes);
2014         }
2015
2016         nla_nest_end(msg, nl_ifs);
2017
2018         nl_ifs = nla_nest_start_noflag(msg, NL80211_ATTR_RX_FRAME_TYPES);
2019         if (!nl_ifs)
2020                 return -ENOBUFS;
2021
2022         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
2023                 nl_ftypes = nla_nest_start_noflag(msg, ift);
2024                 if (!nl_ftypes)
2025                         return -ENOBUFS;
2026                 i = 0;
2027                 stypes = mgmt_stypes[ift].rx;
2028                 while (stypes) {
2029                         if ((stypes & 1) &&
2030                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
2031                                         (i << 4) | IEEE80211_FTYPE_MGMT))
2032                                 return -ENOBUFS;
2033                         stypes >>= 1;
2034                         i++;
2035                 }
2036                 nla_nest_end(msg, nl_ftypes);
2037         }
2038         nla_nest_end(msg, nl_ifs);
2039
2040         return 0;
2041 }
2042
2043 #define CMD(op, n)                                                      \
2044          do {                                                           \
2045                 if (rdev->ops->op) {                                    \
2046                         i++;                                            \
2047                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
2048                                 goto nla_put_failure;                   \
2049                 }                                                       \
2050         } while (0)
2051
2052 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
2053                                         struct sk_buff *msg)
2054 {
2055         int i = 0;
2056
2057         /*
2058          * do *NOT* add anything into this function, new things need to be
2059          * advertised only to new versions of userspace that can deal with
2060          * the split (and they can't possibly care about new features...
2061          */
2062         CMD(add_virtual_intf, NEW_INTERFACE);
2063         CMD(change_virtual_intf, SET_INTERFACE);
2064         CMD(add_key, NEW_KEY);
2065         CMD(start_ap, START_AP);
2066         CMD(add_station, NEW_STATION);
2067         CMD(add_mpath, NEW_MPATH);
2068         CMD(update_mesh_config, SET_MESH_CONFIG);
2069         CMD(change_bss, SET_BSS);
2070         CMD(auth, AUTHENTICATE);
2071         CMD(assoc, ASSOCIATE);
2072         CMD(deauth, DEAUTHENTICATE);
2073         CMD(disassoc, DISASSOCIATE);
2074         CMD(join_ibss, JOIN_IBSS);
2075         CMD(join_mesh, JOIN_MESH);
2076         CMD(set_pmksa, SET_PMKSA);
2077         CMD(del_pmksa, DEL_PMKSA);
2078         CMD(flush_pmksa, FLUSH_PMKSA);
2079         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
2080                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
2081         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
2082         CMD(mgmt_tx, FRAME);
2083         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
2084         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
2085                 i++;
2086                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
2087                         goto nla_put_failure;
2088         }
2089         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
2090             rdev->ops->join_mesh) {
2091                 i++;
2092                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
2093                         goto nla_put_failure;
2094         }
2095         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
2096                 CMD(tdls_mgmt, TDLS_MGMT);
2097                 CMD(tdls_oper, TDLS_OPER);
2098         }
2099         if (rdev->wiphy.max_sched_scan_reqs)
2100                 CMD(sched_scan_start, START_SCHED_SCAN);
2101         CMD(probe_client, PROBE_CLIENT);
2102         CMD(set_noack_map, SET_NOACK_MAP);
2103         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
2104                 i++;
2105                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
2106                         goto nla_put_failure;
2107         }
2108         CMD(start_p2p_device, START_P2P_DEVICE);
2109         CMD(set_mcast_rate, SET_MCAST_RATE);
2110 #ifdef CONFIG_NL80211_TESTMODE
2111         CMD(testmode_cmd, TESTMODE);
2112 #endif
2113
2114         if (rdev->ops->connect || rdev->ops->auth) {
2115                 i++;
2116                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
2117                         goto nla_put_failure;
2118         }
2119
2120         if (rdev->ops->disconnect || rdev->ops->deauth) {
2121                 i++;
2122                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
2123                         goto nla_put_failure;
2124         }
2125
2126         return i;
2127  nla_put_failure:
2128         return -ENOBUFS;
2129 }
2130
2131 static int
2132 nl80211_send_pmsr_ftm_capa(const struct cfg80211_pmsr_capabilities *cap,
2133                            struct sk_buff *msg)
2134 {
2135         struct nlattr *ftm;
2136
2137         if (!cap->ftm.supported)
2138                 return 0;
2139
2140         ftm = nla_nest_start_noflag(msg, NL80211_PMSR_TYPE_FTM);
2141         if (!ftm)
2142                 return -ENOBUFS;
2143
2144         if (cap->ftm.asap && nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_ASAP))
2145                 return -ENOBUFS;
2146         if (cap->ftm.non_asap &&
2147             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_ASAP))
2148                 return -ENOBUFS;
2149         if (cap->ftm.request_lci &&
2150             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_LCI))
2151                 return -ENOBUFS;
2152         if (cap->ftm.request_civicloc &&
2153             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_REQ_CIVICLOC))
2154                 return -ENOBUFS;
2155         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_PREAMBLES,
2156                         cap->ftm.preambles))
2157                 return -ENOBUFS;
2158         if (nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_BANDWIDTHS,
2159                         cap->ftm.bandwidths))
2160                 return -ENOBUFS;
2161         if (cap->ftm.max_bursts_exponent >= 0 &&
2162             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_BURSTS_EXPONENT,
2163                         cap->ftm.max_bursts_exponent))
2164                 return -ENOBUFS;
2165         if (cap->ftm.max_ftms_per_burst &&
2166             nla_put_u32(msg, NL80211_PMSR_FTM_CAPA_ATTR_MAX_FTMS_PER_BURST,
2167                         cap->ftm.max_ftms_per_burst))
2168                 return -ENOBUFS;
2169         if (cap->ftm.trigger_based &&
2170             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_TRIGGER_BASED))
2171                 return -ENOBUFS;
2172         if (cap->ftm.non_trigger_based &&
2173             nla_put_flag(msg, NL80211_PMSR_FTM_CAPA_ATTR_NON_TRIGGER_BASED))
2174                 return -ENOBUFS;
2175
2176         nla_nest_end(msg, ftm);
2177         return 0;
2178 }
2179
2180 static int nl80211_send_pmsr_capa(struct cfg80211_registered_device *rdev,
2181                                   struct sk_buff *msg)
2182 {
2183         const struct cfg80211_pmsr_capabilities *cap = rdev->wiphy.pmsr_capa;
2184         struct nlattr *pmsr, *caps;
2185
2186         if (!cap)
2187                 return 0;
2188
2189         /*
2190          * we don't need to clean up anything here since the caller
2191          * will genlmsg_cancel() if we fail
2192          */
2193
2194         pmsr = nla_nest_start_noflag(msg, NL80211_ATTR_PEER_MEASUREMENTS);
2195         if (!pmsr)
2196                 return -ENOBUFS;
2197
2198         if (nla_put_u32(msg, NL80211_PMSR_ATTR_MAX_PEERS, cap->max_peers))
2199                 return -ENOBUFS;
2200
2201         if (cap->report_ap_tsf &&
2202             nla_put_flag(msg, NL80211_PMSR_ATTR_REPORT_AP_TSF))
2203                 return -ENOBUFS;
2204
2205         if (cap->randomize_mac_addr &&
2206             nla_put_flag(msg, NL80211_PMSR_ATTR_RANDOMIZE_MAC_ADDR))
2207                 return -ENOBUFS;
2208
2209         caps = nla_nest_start_noflag(msg, NL80211_PMSR_ATTR_TYPE_CAPA);
2210         if (!caps)
2211                 return -ENOBUFS;
2212
2213         if (nl80211_send_pmsr_ftm_capa(cap, msg))
2214                 return -ENOBUFS;
2215
2216         nla_nest_end(msg, caps);
2217         nla_nest_end(msg, pmsr);
2218
2219         return 0;
2220 }
2221
2222 static int
2223 nl80211_put_iftype_akm_suites(struct cfg80211_registered_device *rdev,
2224                               struct sk_buff *msg)
2225 {
2226         int i;
2227         struct nlattr *nested, *nested_akms;
2228         const struct wiphy_iftype_akm_suites *iftype_akms;
2229
2230         if (!rdev->wiphy.num_iftype_akm_suites ||
2231             !rdev->wiphy.iftype_akm_suites)
2232                 return 0;
2233
2234         nested = nla_nest_start(msg, NL80211_ATTR_IFTYPE_AKM_SUITES);
2235         if (!nested)
2236                 return -ENOBUFS;
2237
2238         for (i = 0; i < rdev->wiphy.num_iftype_akm_suites; i++) {
2239                 nested_akms = nla_nest_start(msg, i + 1);
2240                 if (!nested_akms)
2241                         return -ENOBUFS;
2242
2243                 iftype_akms = &rdev->wiphy.iftype_akm_suites[i];
2244
2245                 if (nl80211_put_iftypes(msg, NL80211_IFTYPE_AKM_ATTR_IFTYPES,
2246                                         iftype_akms->iftypes_mask))
2247                         return -ENOBUFS;
2248
2249                 if (nla_put(msg, NL80211_IFTYPE_AKM_ATTR_SUITES,
2250                             sizeof(u32) * iftype_akms->n_akm_suites,
2251                             iftype_akms->akm_suites)) {
2252                         return -ENOBUFS;
2253                 }
2254                 nla_nest_end(msg, nested_akms);
2255         }
2256
2257         nla_nest_end(msg, nested);
2258
2259         return 0;
2260 }
2261
2262 static int
2263 nl80211_put_tid_config_support(struct cfg80211_registered_device *rdev,
2264                                struct sk_buff *msg)
2265 {
2266         struct nlattr *supp;
2267
2268         if (!rdev->wiphy.tid_config_support.vif &&
2269             !rdev->wiphy.tid_config_support.peer)
2270                 return 0;
2271
2272         supp = nla_nest_start(msg, NL80211_ATTR_TID_CONFIG);
2273         if (!supp)
2274                 return -ENOSPC;
2275
2276         if (rdev->wiphy.tid_config_support.vif &&
2277             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_VIF_SUPP,
2278                               rdev->wiphy.tid_config_support.vif,
2279                               NL80211_TID_CONFIG_ATTR_PAD))
2280                 goto fail;
2281
2282         if (rdev->wiphy.tid_config_support.peer &&
2283             nla_put_u64_64bit(msg, NL80211_TID_CONFIG_ATTR_PEER_SUPP,
2284                               rdev->wiphy.tid_config_support.peer,
2285                               NL80211_TID_CONFIG_ATTR_PAD))
2286                 goto fail;
2287
2288         /* for now we just use the same value ... makes more sense */
2289         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_SHORT,
2290                        rdev->wiphy.tid_config_support.max_retry))
2291                 goto fail;
2292         if (nla_put_u8(msg, NL80211_TID_CONFIG_ATTR_RETRY_LONG,
2293                        rdev->wiphy.tid_config_support.max_retry))
2294                 goto fail;
2295
2296         nla_nest_end(msg, supp);
2297
2298         return 0;
2299 fail:
2300         nla_nest_cancel(msg, supp);
2301         return -ENOBUFS;
2302 }
2303
2304 static int
2305 nl80211_put_sar_specs(struct cfg80211_registered_device *rdev,
2306                       struct sk_buff *msg)
2307 {
2308         struct nlattr *sar_capa, *specs, *sub_freq_range;
2309         u8 num_freq_ranges;
2310         int i;
2311
2312         if (!rdev->wiphy.sar_capa)
2313                 return 0;
2314
2315         num_freq_ranges = rdev->wiphy.sar_capa->num_freq_ranges;
2316
2317         sar_capa = nla_nest_start(msg, NL80211_ATTR_SAR_SPEC);
2318         if (!sar_capa)
2319                 return -ENOSPC;
2320
2321         if (nla_put_u32(msg, NL80211_SAR_ATTR_TYPE, rdev->wiphy.sar_capa->type))
2322                 goto fail;
2323
2324         specs = nla_nest_start(msg, NL80211_SAR_ATTR_SPECS);
2325         if (!specs)
2326                 goto fail;
2327
2328         /* report supported freq_ranges */
2329         for (i = 0; i < num_freq_ranges; i++) {
2330                 sub_freq_range = nla_nest_start(msg, i + 1);
2331                 if (!sub_freq_range)
2332                         goto fail;
2333
2334                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_START_FREQ,
2335                                 rdev->wiphy.sar_capa->freq_ranges[i].start_freq))
2336                         goto fail;
2337
2338                 if (nla_put_u32(msg, NL80211_SAR_ATTR_SPECS_END_FREQ,
2339                                 rdev->wiphy.sar_capa->freq_ranges[i].end_freq))
2340                         goto fail;
2341
2342                 nla_nest_end(msg, sub_freq_range);
2343         }
2344
2345         nla_nest_end(msg, specs);
2346         nla_nest_end(msg, sar_capa);
2347
2348         return 0;
2349 fail:
2350         nla_nest_cancel(msg, sar_capa);
2351         return -ENOBUFS;
2352 }
2353
2354 static int nl80211_put_mbssid_support(struct wiphy *wiphy, struct sk_buff *msg)
2355 {
2356         struct nlattr *config;
2357
2358         if (!wiphy->mbssid_max_interfaces)
2359                 return 0;
2360
2361         config = nla_nest_start(msg, NL80211_ATTR_MBSSID_CONFIG);
2362         if (!config)
2363                 return -ENOBUFS;
2364
2365         if (nla_put_u8(msg, NL80211_MBSSID_CONFIG_ATTR_MAX_INTERFACES,
2366                        wiphy->mbssid_max_interfaces))
2367                 goto fail;
2368
2369         if (wiphy->ema_max_profile_periodicity &&
2370             nla_put_u8(msg,
2371                        NL80211_MBSSID_CONFIG_ATTR_MAX_EMA_PROFILE_PERIODICITY,
2372                        wiphy->ema_max_profile_periodicity))
2373                 goto fail;
2374
2375         nla_nest_end(msg, config);
2376         return 0;
2377
2378 fail:
2379         nla_nest_cancel(msg, config);
2380         return -ENOBUFS;
2381 }
2382
2383 struct nl80211_dump_wiphy_state {
2384         s64 filter_wiphy;
2385         long start;
2386         long split_start, band_start, chan_start, capa_start;
2387         bool split;
2388 };
2389
2390 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
2391                               enum nl80211_commands cmd,
2392                               struct sk_buff *msg, u32 portid, u32 seq,
2393                               int flags, struct nl80211_dump_wiphy_state *state)
2394 {
2395         void *hdr;
2396         struct nlattr *nl_bands, *nl_band;
2397         struct nlattr *nl_freqs, *nl_freq;
2398         struct nlattr *nl_cmds;
2399         enum nl80211_band band;
2400         struct ieee80211_channel *chan;
2401         int i;
2402         const struct ieee80211_txrx_stypes *mgmt_stypes =
2403                                 rdev->wiphy.mgmt_stypes;
2404         u32 features;
2405
2406         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2407         if (!hdr)
2408                 return -ENOBUFS;
2409
2410         if (WARN_ON(!state))
2411                 return -EINVAL;
2412
2413         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2414             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
2415                            wiphy_name(&rdev->wiphy)) ||
2416             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2417                         cfg80211_rdev_list_generation))
2418                 goto nla_put_failure;
2419
2420         if (cmd != NL80211_CMD_NEW_WIPHY)
2421                 goto finish;
2422
2423         switch (state->split_start) {
2424         case 0:
2425                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
2426                                rdev->wiphy.retry_short) ||
2427                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
2428                                rdev->wiphy.retry_long) ||
2429                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
2430                                 rdev->wiphy.frag_threshold) ||
2431                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
2432                                 rdev->wiphy.rts_threshold) ||
2433                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
2434                                rdev->wiphy.coverage_class) ||
2435                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
2436                                rdev->wiphy.max_scan_ssids) ||
2437                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
2438                                rdev->wiphy.max_sched_scan_ssids) ||
2439                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
2440                                 rdev->wiphy.max_scan_ie_len) ||
2441                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
2442                                 rdev->wiphy.max_sched_scan_ie_len) ||
2443                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
2444                                rdev->wiphy.max_match_sets))
2445                         goto nla_put_failure;
2446
2447                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
2448                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
2449                         goto nla_put_failure;
2450                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
2451                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
2452                         goto nla_put_failure;
2453                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
2454                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
2455                         goto nla_put_failure;
2456                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
2457                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
2458                         goto nla_put_failure;
2459                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
2460                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
2461                         goto nla_put_failure;
2462                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
2463                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
2464                         goto nla_put_failure;
2465                 state->split_start++;
2466                 if (state->split)
2467                         break;
2468                 fallthrough;
2469         case 1:
2470                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
2471                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
2472                             rdev->wiphy.cipher_suites))
2473                         goto nla_put_failure;
2474
2475                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
2476                                rdev->wiphy.max_num_pmkids))
2477                         goto nla_put_failure;
2478
2479                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
2480                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
2481                         goto nla_put_failure;
2482
2483                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
2484                                 rdev->wiphy.available_antennas_tx) ||
2485                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
2486                                 rdev->wiphy.available_antennas_rx))
2487                         goto nla_put_failure;
2488
2489                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
2490                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
2491                                 rdev->wiphy.probe_resp_offload))
2492                         goto nla_put_failure;
2493
2494                 if ((rdev->wiphy.available_antennas_tx ||
2495                      rdev->wiphy.available_antennas_rx) &&
2496                     rdev->ops->get_antenna) {
2497                         u32 tx_ant = 0, rx_ant = 0;
2498                         int res;
2499
2500                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
2501                         if (!res) {
2502                                 if (nla_put_u32(msg,
2503                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
2504                                                 tx_ant) ||
2505                                     nla_put_u32(msg,
2506                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
2507                                                 rx_ant))
2508                                         goto nla_put_failure;
2509                         }
2510                 }
2511
2512                 state->split_start++;
2513                 if (state->split)
2514                         break;
2515                 fallthrough;
2516         case 2:
2517                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
2518                                         rdev->wiphy.interface_modes))
2519                                 goto nla_put_failure;
2520                 state->split_start++;
2521                 if (state->split)
2522                         break;
2523                 fallthrough;
2524         case 3:
2525                 nl_bands = nla_nest_start_noflag(msg,
2526                                                  NL80211_ATTR_WIPHY_BANDS);
2527                 if (!nl_bands)
2528                         goto nla_put_failure;
2529
2530                 for (band = state->band_start;
2531                      band < (state->split ?
2532                                 NUM_NL80211_BANDS :
2533                                 NL80211_BAND_60GHZ + 1);
2534                      band++) {
2535                         struct ieee80211_supported_band *sband;
2536
2537                         /* omit higher bands for ancient software */
2538                         if (band > NL80211_BAND_5GHZ && !state->split)
2539                                 break;
2540
2541                         sband = rdev->wiphy.bands[band];
2542
2543                         if (!sband)
2544                                 continue;
2545
2546                         nl_band = nla_nest_start_noflag(msg, band);
2547                         if (!nl_band)
2548                                 goto nla_put_failure;
2549
2550                         switch (state->chan_start) {
2551                         case 0:
2552                                 if (nl80211_send_band_rateinfo(msg, sband,
2553                                                                state->split))
2554                                         goto nla_put_failure;
2555                                 state->chan_start++;
2556                                 if (state->split)
2557                                         break;
2558                                 fallthrough;
2559                         default:
2560                                 /* add frequencies */
2561                                 nl_freqs = nla_nest_start_noflag(msg,
2562                                                                  NL80211_BAND_ATTR_FREQS);
2563                                 if (!nl_freqs)
2564                                         goto nla_put_failure;
2565
2566                                 for (i = state->chan_start - 1;
2567                                      i < sband->n_channels;
2568                                      i++) {
2569                                         nl_freq = nla_nest_start_noflag(msg,
2570                                                                         i);
2571                                         if (!nl_freq)
2572                                                 goto nla_put_failure;
2573
2574                                         chan = &sband->channels[i];
2575
2576                                         if (nl80211_msg_put_channel(
2577                                                         msg, &rdev->wiphy, chan,
2578                                                         state->split))
2579                                                 goto nla_put_failure;
2580
2581                                         nla_nest_end(msg, nl_freq);
2582                                         if (state->split)
2583                                                 break;
2584                                 }
2585                                 if (i < sband->n_channels)
2586                                         state->chan_start = i + 2;
2587                                 else
2588                                         state->chan_start = 0;
2589                                 nla_nest_end(msg, nl_freqs);
2590                         }
2591
2592                         nla_nest_end(msg, nl_band);
2593
2594                         if (state->split) {
2595                                 /* start again here */
2596                                 if (state->chan_start)
2597                                         band--;
2598                                 break;
2599                         }
2600                 }
2601                 nla_nest_end(msg, nl_bands);
2602
2603                 if (band < NUM_NL80211_BANDS)
2604                         state->band_start = band + 1;
2605                 else
2606                         state->band_start = 0;
2607
2608                 /* if bands & channels are done, continue outside */
2609                 if (state->band_start == 0 && state->chan_start == 0)
2610                         state->split_start++;
2611                 if (state->split)
2612                         break;
2613                 fallthrough;
2614         case 4:
2615                 nl_cmds = nla_nest_start_noflag(msg,
2616                                                 NL80211_ATTR_SUPPORTED_COMMANDS);
2617                 if (!nl_cmds)
2618                         goto nla_put_failure;
2619
2620                 i = nl80211_add_commands_unsplit(rdev, msg);
2621                 if (i < 0)
2622                         goto nla_put_failure;
2623                 if (state->split) {
2624                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
2625                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
2626                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
2627                                 CMD(channel_switch, CHANNEL_SWITCH);
2628                         CMD(set_qos_map, SET_QOS_MAP);
2629                         if (rdev->wiphy.features &
2630                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
2631                                 CMD(add_tx_ts, ADD_TX_TS);
2632                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
2633                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
2634                         CMD(update_ft_ies, UPDATE_FT_IES);
2635                         if (rdev->wiphy.sar_capa)
2636                                 CMD(set_sar_specs, SET_SAR_SPECS);
2637                 }
2638 #undef CMD
2639
2640                 nla_nest_end(msg, nl_cmds);
2641                 state->split_start++;
2642                 if (state->split)
2643                         break;
2644                 fallthrough;
2645         case 5:
2646                 if (rdev->ops->remain_on_channel &&
2647                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
2648                     nla_put_u32(msg,
2649                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
2650                                 rdev->wiphy.max_remain_on_channel_duration))
2651                         goto nla_put_failure;
2652
2653                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
2654                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
2655                         goto nla_put_failure;
2656
2657                 state->split_start++;
2658                 if (state->split)
2659                         break;
2660                 fallthrough;
2661         case 6:
2662 #ifdef CONFIG_PM
2663                 if (nl80211_send_wowlan(msg, rdev, state->split))
2664                         goto nla_put_failure;
2665                 state->split_start++;
2666                 if (state->split)
2667                         break;
2668 #else
2669                 state->split_start++;
2670 #endif
2671                 fallthrough;
2672         case 7:
2673                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
2674                                         rdev->wiphy.software_iftypes))
2675                         goto nla_put_failure;
2676
2677                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
2678                                                    state->split))
2679                         goto nla_put_failure;
2680
2681                 state->split_start++;
2682                 if (state->split)
2683                         break;
2684                 fallthrough;
2685         case 8:
2686                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
2687                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
2688                                 rdev->wiphy.ap_sme_capa))
2689                         goto nla_put_failure;
2690
2691                 features = rdev->wiphy.features;
2692                 /*
2693                  * We can only add the per-channel limit information if the
2694                  * dump is split, otherwise it makes it too big. Therefore
2695                  * only advertise it in that case.
2696                  */
2697                 if (state->split)
2698                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
2699                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
2700                         goto nla_put_failure;
2701
2702                 if (rdev->wiphy.ht_capa_mod_mask &&
2703                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
2704                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
2705                             rdev->wiphy.ht_capa_mod_mask))
2706                         goto nla_put_failure;
2707
2708                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
2709                     rdev->wiphy.max_acl_mac_addrs &&
2710                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
2711                                 rdev->wiphy.max_acl_mac_addrs))
2712                         goto nla_put_failure;
2713
2714                 /*
2715                  * Any information below this point is only available to
2716                  * applications that can deal with it being split. This
2717                  * helps ensure that newly added capabilities don't break
2718                  * older tools by overrunning their buffers.
2719                  *
2720                  * We still increment split_start so that in the split
2721                  * case we'll continue with more data in the next round,
2722                  * but break unconditionally so unsplit data stops here.
2723                  */
2724                 if (state->split)
2725                         state->split_start++;
2726                 else
2727                         state->split_start = 0;
2728                 break;
2729         case 9:
2730                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
2731                         goto nla_put_failure;
2732
2733                 if (nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
2734                                 rdev->wiphy.max_sched_scan_plans) ||
2735                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
2736                                 rdev->wiphy.max_sched_scan_plan_interval) ||
2737                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
2738                                 rdev->wiphy.max_sched_scan_plan_iterations))
2739                         goto nla_put_failure;
2740
2741                 if (rdev->wiphy.extended_capabilities &&
2742                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
2743                              rdev->wiphy.extended_capabilities_len,
2744                              rdev->wiphy.extended_capabilities) ||
2745                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2746                              rdev->wiphy.extended_capabilities_len,
2747                              rdev->wiphy.extended_capabilities_mask)))
2748                         goto nla_put_failure;
2749
2750                 if (rdev->wiphy.vht_capa_mod_mask &&
2751                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
2752                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
2753                             rdev->wiphy.vht_capa_mod_mask))
2754                         goto nla_put_failure;
2755
2756                 if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
2757                             rdev->wiphy.perm_addr))
2758                         goto nla_put_failure;
2759
2760                 if (!is_zero_ether_addr(rdev->wiphy.addr_mask) &&
2761                     nla_put(msg, NL80211_ATTR_MAC_MASK, ETH_ALEN,
2762                             rdev->wiphy.addr_mask))
2763                         goto nla_put_failure;
2764
2765                 if (rdev->wiphy.n_addresses > 1) {
2766                         void *attr;
2767
2768                         attr = nla_nest_start(msg, NL80211_ATTR_MAC_ADDRS);
2769                         if (!attr)
2770                                 goto nla_put_failure;
2771
2772                         for (i = 0; i < rdev->wiphy.n_addresses; i++)
2773                                 if (nla_put(msg, i + 1, ETH_ALEN,
2774                                             rdev->wiphy.addresses[i].addr))
2775                                         goto nla_put_failure;
2776
2777                         nla_nest_end(msg, attr);
2778                 }
2779
2780                 state->split_start++;
2781                 break;
2782         case 10:
2783                 if (nl80211_send_coalesce(msg, rdev))
2784                         goto nla_put_failure;
2785
2786                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
2787                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
2788                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
2789                         goto nla_put_failure;
2790
2791                 if (rdev->wiphy.max_ap_assoc_sta &&
2792                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
2793                                 rdev->wiphy.max_ap_assoc_sta))
2794                         goto nla_put_failure;
2795
2796                 state->split_start++;
2797                 break;
2798         case 11:
2799                 if (rdev->wiphy.n_vendor_commands) {
2800                         const struct nl80211_vendor_cmd_info *info;
2801                         struct nlattr *nested;
2802
2803                         nested = nla_nest_start_noflag(msg,
2804                                                        NL80211_ATTR_VENDOR_DATA);
2805                         if (!nested)
2806                                 goto nla_put_failure;
2807
2808                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
2809                                 info = &rdev->wiphy.vendor_commands[i].info;
2810                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2811                                         goto nla_put_failure;
2812                         }
2813                         nla_nest_end(msg, nested);
2814                 }
2815
2816                 if (rdev->wiphy.n_vendor_events) {
2817                         const struct nl80211_vendor_cmd_info *info;
2818                         struct nlattr *nested;
2819
2820                         nested = nla_nest_start_noflag(msg,
2821                                                        NL80211_ATTR_VENDOR_EVENTS);
2822                         if (!nested)
2823                                 goto nla_put_failure;
2824
2825                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2826                                 info = &rdev->wiphy.vendor_events[i];
2827                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2828                                         goto nla_put_failure;
2829                         }
2830                         nla_nest_end(msg, nested);
2831                 }
2832                 state->split_start++;
2833                 break;
2834         case 12:
2835                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2836                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2837                                rdev->wiphy.max_num_csa_counters))
2838                         goto nla_put_failure;
2839
2840                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2841                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2842                         goto nla_put_failure;
2843
2844                 if (rdev->wiphy.max_sched_scan_reqs &&
2845                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2846                                 rdev->wiphy.max_sched_scan_reqs))
2847                         goto nla_put_failure;
2848
2849                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2850                             sizeof(rdev->wiphy.ext_features),
2851                             rdev->wiphy.ext_features))
2852                         goto nla_put_failure;
2853
2854                 if (rdev->wiphy.bss_select_support) {
2855                         struct nlattr *nested;
2856                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2857
2858                         nested = nla_nest_start_noflag(msg,
2859                                                        NL80211_ATTR_BSS_SELECT);
2860                         if (!nested)
2861                                 goto nla_put_failure;
2862
2863                         i = 0;
2864                         while (bss_select_support) {
2865                                 if ((bss_select_support & 1) &&
2866                                     nla_put_flag(msg, i))
2867                                         goto nla_put_failure;
2868                                 i++;
2869                                 bss_select_support >>= 1;
2870                         }
2871                         nla_nest_end(msg, nested);
2872                 }
2873
2874                 state->split_start++;
2875                 break;
2876         case 13:
2877                 if (rdev->wiphy.num_iftype_ext_capab &&
2878                     rdev->wiphy.iftype_ext_capab) {
2879                         struct nlattr *nested_ext_capab, *nested;
2880
2881                         nested = nla_nest_start_noflag(msg,
2882                                                        NL80211_ATTR_IFTYPE_EXT_CAPA);
2883                         if (!nested)
2884                                 goto nla_put_failure;
2885
2886                         for (i = state->capa_start;
2887                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2888                                 const struct wiphy_iftype_ext_capab *capab;
2889
2890                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2891
2892                                 nested_ext_capab = nla_nest_start_noflag(msg,
2893                                                                          i);
2894                                 if (!nested_ext_capab ||
2895                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2896                                                 capab->iftype) ||
2897                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2898                                             capab->extended_capabilities_len,
2899                                             capab->extended_capabilities) ||
2900                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2901                                             capab->extended_capabilities_len,
2902                                             capab->extended_capabilities_mask))
2903                                         goto nla_put_failure;
2904
2905                                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO &&
2906                                     (nla_put_u16(msg,
2907                                                  NL80211_ATTR_EML_CAPABILITY,
2908                                                  capab->eml_capabilities) ||
2909                                      nla_put_u16(msg,
2910                                                  NL80211_ATTR_MLD_CAPA_AND_OPS,
2911                                                  capab->mld_capa_and_ops)))
2912                                         goto nla_put_failure;
2913
2914                                 nla_nest_end(msg, nested_ext_capab);
2915                                 if (state->split)
2916                                         break;
2917                         }
2918                         nla_nest_end(msg, nested);
2919                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2920                                 state->capa_start = i + 1;
2921                                 break;
2922                         }
2923                 }
2924
2925                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2926                                 rdev->wiphy.nan_supported_bands))
2927                         goto nla_put_failure;
2928
2929                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2930                                             NL80211_EXT_FEATURE_TXQS)) {
2931                         struct cfg80211_txq_stats txqstats = {};
2932                         int res;
2933
2934                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2935                         if (!res &&
2936                             !nl80211_put_txq_stats(msg, &txqstats,
2937                                                    NL80211_ATTR_TXQ_STATS))
2938                                 goto nla_put_failure;
2939
2940                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2941                                         rdev->wiphy.txq_limit))
2942                                 goto nla_put_failure;
2943                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2944                                         rdev->wiphy.txq_memory_limit))
2945                                 goto nla_put_failure;
2946                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2947                                         rdev->wiphy.txq_quantum))
2948                                 goto nla_put_failure;
2949                 }
2950
2951                 state->split_start++;
2952                 break;
2953         case 14:
2954                 if (nl80211_send_pmsr_capa(rdev, msg))
2955                         goto nla_put_failure;
2956
2957                 state->split_start++;
2958                 break;
2959         case 15:
2960                 if (rdev->wiphy.akm_suites &&
2961                     nla_put(msg, NL80211_ATTR_AKM_SUITES,
2962                             sizeof(u32) * rdev->wiphy.n_akm_suites,
2963                             rdev->wiphy.akm_suites))
2964                         goto nla_put_failure;
2965
2966                 if (nl80211_put_iftype_akm_suites(rdev, msg))
2967                         goto nla_put_failure;
2968
2969                 if (nl80211_put_tid_config_support(rdev, msg))
2970                         goto nla_put_failure;
2971                 state->split_start++;
2972                 break;
2973         case 16:
2974                 if (nl80211_put_sar_specs(rdev, msg))
2975                         goto nla_put_failure;
2976
2977                 if (nl80211_put_mbssid_support(&rdev->wiphy, msg))
2978                         goto nla_put_failure;
2979
2980                 if (nla_put_u16(msg, NL80211_ATTR_MAX_NUM_AKM_SUITES,
2981                                 rdev->wiphy.max_num_akm_suites))
2982                         goto nla_put_failure;
2983
2984                 if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO)
2985                         nla_put_flag(msg, NL80211_ATTR_MLO_SUPPORT);
2986
2987                 if (rdev->wiphy.hw_timestamp_max_peers &&
2988                     nla_put_u16(msg, NL80211_ATTR_MAX_HW_TIMESTAMP_PEERS,
2989                                 rdev->wiphy.hw_timestamp_max_peers))
2990                         goto nla_put_failure;
2991
2992                 /* done */
2993                 state->split_start = 0;
2994                 break;
2995         }
2996  finish:
2997         genlmsg_end(msg, hdr);
2998         return 0;
2999
3000  nla_put_failure:
3001         genlmsg_cancel(msg, hdr);
3002         return -EMSGSIZE;
3003 }
3004
3005 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
3006                                     struct netlink_callback *cb,
3007                                     struct nl80211_dump_wiphy_state *state)
3008 {
3009         struct nlattr **tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
3010         int ret;
3011
3012         if (!tb)
3013                 return -ENOMEM;
3014
3015         ret = nlmsg_parse_deprecated(cb->nlh,
3016                                      GENL_HDRLEN + nl80211_fam.hdrsize,
3017                                      tb, nl80211_fam.maxattr,
3018                                      nl80211_policy, NULL);
3019         /* ignore parse errors for backward compatibility */
3020         if (ret) {
3021                 ret = 0;
3022                 goto out;
3023         }
3024
3025         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
3026         if (tb[NL80211_ATTR_WIPHY])
3027                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
3028         if (tb[NL80211_ATTR_WDEV])
3029                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
3030         if (tb[NL80211_ATTR_IFINDEX]) {
3031                 struct net_device *netdev;
3032                 struct cfg80211_registered_device *rdev;
3033                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
3034
3035                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
3036                 if (!netdev) {
3037                         ret = -ENODEV;
3038                         goto out;
3039                 }
3040                 if (netdev->ieee80211_ptr) {
3041                         rdev = wiphy_to_rdev(
3042                                 netdev->ieee80211_ptr->wiphy);
3043                         state->filter_wiphy = rdev->wiphy_idx;
3044                 }
3045         }
3046
3047         ret = 0;
3048 out:
3049         kfree(tb);
3050         return ret;
3051 }
3052
3053 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
3054 {
3055         int idx = 0, ret;
3056         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
3057         struct cfg80211_registered_device *rdev;
3058
3059         rtnl_lock();
3060         if (!state) {
3061                 state = kzalloc(sizeof(*state), GFP_KERNEL);
3062                 if (!state) {
3063                         rtnl_unlock();
3064                         return -ENOMEM;
3065                 }
3066                 state->filter_wiphy = -1;
3067                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
3068                 if (ret) {
3069                         kfree(state);
3070                         rtnl_unlock();
3071                         return ret;
3072                 }
3073                 cb->args[0] = (long)state;
3074         }
3075
3076         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3077                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3078                         continue;
3079                 if (++idx <= state->start)
3080                         continue;
3081                 if (state->filter_wiphy != -1 &&
3082                     state->filter_wiphy != rdev->wiphy_idx)
3083                         continue;
3084                 /* attempt to fit multiple wiphy data chunks into the skb */
3085                 do {
3086                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
3087                                                  skb,
3088                                                  NETLINK_CB(cb->skb).portid,
3089                                                  cb->nlh->nlmsg_seq,
3090                                                  NLM_F_MULTI, state);
3091                         if (ret < 0) {
3092                                 /*
3093                                  * If sending the wiphy data didn't fit (ENOBUFS
3094                                  * or EMSGSIZE returned), this SKB is still
3095                                  * empty (so it's not too big because another
3096                                  * wiphy dataset is already in the skb) and
3097                                  * we've not tried to adjust the dump allocation
3098                                  * yet ... then adjust the alloc size to be
3099                                  * bigger, and return 1 but with the empty skb.
3100                                  * This results in an empty message being RX'ed
3101                                  * in userspace, but that is ignored.
3102                                  *
3103                                  * We can then retry with the larger buffer.
3104                                  */
3105                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
3106                                     !skb->len && !state->split &&
3107                                     cb->min_dump_alloc < 4096) {
3108                                         cb->min_dump_alloc = 4096;
3109                                         state->split_start = 0;
3110                                         rtnl_unlock();
3111                                         return 1;
3112                                 }
3113                                 idx--;
3114                                 break;
3115                         }
3116                 } while (state->split_start > 0);
3117                 break;
3118         }
3119         rtnl_unlock();
3120
3121         state->start = idx;
3122
3123         return skb->len;
3124 }
3125
3126 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
3127 {
3128         kfree((void *)cb->args[0]);
3129         return 0;
3130 }
3131
3132 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
3133 {
3134         struct sk_buff *msg;
3135         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3136         struct nl80211_dump_wiphy_state state = {};
3137
3138         msg = nlmsg_new(4096, GFP_KERNEL);
3139         if (!msg)
3140                 return -ENOMEM;
3141
3142         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
3143                                info->snd_portid, info->snd_seq, 0,
3144                                &state) < 0) {
3145                 nlmsg_free(msg);
3146                 return -ENOBUFS;
3147         }
3148
3149         return genlmsg_reply(msg, info);
3150 }
3151
3152 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
3153         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
3154         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
3155         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
3156         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
3157         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
3158 };
3159
3160 static int parse_txq_params(struct nlattr *tb[],
3161                             struct ieee80211_txq_params *txq_params)
3162 {
3163         u8 ac;
3164
3165         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
3166             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
3167             !tb[NL80211_TXQ_ATTR_AIFS])
3168                 return -EINVAL;
3169
3170         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
3171         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
3172         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
3173         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
3174         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
3175
3176         if (ac >= NL80211_NUM_ACS)
3177                 return -EINVAL;
3178         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
3179         return 0;
3180 }
3181
3182 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
3183 {
3184         /*
3185          * You can only set the channel explicitly for some interfaces,
3186          * most have their channel managed via their respective
3187          * "establish a connection" command (connect, join, ...)
3188          *
3189          * For AP/GO and mesh mode, the channel can be set with the
3190          * channel userspace API, but is only stored and passed to the
3191          * low-level driver when the AP starts or the mesh is joined.
3192          * This is for backward compatibility, userspace can also give
3193          * the channel in the start-ap or join-mesh commands instead.
3194          *
3195          * Monitors are special as they are normally slaved to
3196          * whatever else is going on, so they have their own special
3197          * operation to set the monitor channel if possible.
3198          */
3199         return !wdev ||
3200                 wdev->iftype == NL80211_IFTYPE_AP ||
3201                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
3202                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
3203                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
3204 }
3205
3206 static int nl80211_parse_punct_bitmap(struct cfg80211_registered_device *rdev,
3207                                       struct genl_info *info,
3208                                       const struct cfg80211_chan_def *chandef,
3209                                       u16 *punct_bitmap)
3210 {
3211         if (!wiphy_ext_feature_isset(&rdev->wiphy, NL80211_EXT_FEATURE_PUNCT))
3212                 return -EINVAL;
3213
3214         *punct_bitmap = nla_get_u32(info->attrs[NL80211_ATTR_PUNCT_BITMAP]);
3215         if (!cfg80211_valid_disable_subchannel_bitmap(punct_bitmap, chandef))
3216                 return -EINVAL;
3217
3218         return 0;
3219 }
3220
3221 int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
3222                           struct genl_info *info,
3223                           struct cfg80211_chan_def *chandef)
3224 {
3225         struct netlink_ext_ack *extack = info->extack;
3226         struct nlattr **attrs = info->attrs;
3227         u32 control_freq;
3228
3229         if (!attrs[NL80211_ATTR_WIPHY_FREQ]) {
3230                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3231                                     "Frequency is missing");
3232                 return -EINVAL;
3233         }
3234
3235         control_freq = MHZ_TO_KHZ(
3236                         nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
3237         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
3238                 control_freq +=
3239                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
3240
3241         memset(chandef, 0, sizeof(*chandef));
3242         chandef->chan = ieee80211_get_channel_khz(&rdev->wiphy, control_freq);
3243         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
3244         chandef->center_freq1 = KHZ_TO_MHZ(control_freq);
3245         chandef->freq1_offset = control_freq % 1000;
3246         chandef->center_freq2 = 0;
3247
3248         /* Primary channel not allowed */
3249         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
3250                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
3251                                     "Channel is disabled");
3252                 return -EINVAL;
3253         }
3254
3255         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
3256                 enum nl80211_channel_type chantype;
3257
3258                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
3259
3260                 switch (chantype) {
3261                 case NL80211_CHAN_NO_HT:
3262                 case NL80211_CHAN_HT20:
3263                 case NL80211_CHAN_HT40PLUS:
3264                 case NL80211_CHAN_HT40MINUS:
3265                         cfg80211_chandef_create(chandef, chandef->chan,
3266                                                 chantype);
3267                         /* user input for center_freq is incorrect */
3268                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
3269                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
3270                                 NL_SET_ERR_MSG_ATTR(extack,
3271                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
3272                                                     "bad center frequency 1");
3273                                 return -EINVAL;
3274                         }
3275                         /* center_freq2 must be zero */
3276                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
3277                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
3278                                 NL_SET_ERR_MSG_ATTR(extack,
3279                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
3280                                                     "center frequency 2 can't be used");
3281                                 return -EINVAL;
3282                         }
3283                         break;
3284                 default:
3285                         NL_SET_ERR_MSG_ATTR(extack,
3286                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
3287                                             "invalid channel type");
3288                         return -EINVAL;
3289                 }
3290         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
3291                 chandef->width =
3292                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
3293                 if (chandef->chan->band == NL80211_BAND_S1GHZ) {
3294                         /* User input error for channel width doesn't match channel  */
3295                         if (chandef->width != ieee80211_s1g_channel_width(chandef->chan)) {
3296                                 NL_SET_ERR_MSG_ATTR(extack,
3297                                                     attrs[NL80211_ATTR_CHANNEL_WIDTH],
3298                                                     "bad channel width");
3299                                 return -EINVAL;
3300                         }
3301                 }
3302                 if (attrs[NL80211_ATTR_CENTER_FREQ1]) {
3303                         chandef->center_freq1 =
3304                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
3305                         if (attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET])
3306                                 chandef->freq1_offset = nla_get_u32(
3307                                       attrs[NL80211_ATTR_CENTER_FREQ1_OFFSET]);
3308                         else
3309                                 chandef->freq1_offset = 0;
3310                 }
3311                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
3312                         chandef->center_freq2 =
3313                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
3314         }
3315
3316         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
3317                 chandef->edmg.channels =
3318                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
3319
3320                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
3321                         chandef->edmg.bw_config =
3322                      nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
3323         } else {
3324                 chandef->edmg.bw_config = 0;
3325                 chandef->edmg.channels = 0;
3326         }
3327
3328         if (!cfg80211_chandef_valid(chandef)) {
3329                 NL_SET_ERR_MSG(extack, "invalid channel definition");
3330                 return -EINVAL;
3331         }
3332
3333         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
3334                                      IEEE80211_CHAN_DISABLED)) {
3335                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
3336                 return -EINVAL;
3337         }
3338
3339         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
3340              chandef->width == NL80211_CHAN_WIDTH_10) &&
3341             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
3342                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
3343                 return -EINVAL;
3344         }
3345
3346         return 0;
3347 }
3348
3349 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
3350                                  struct net_device *dev,
3351                                  struct genl_info *info,
3352                                  int _link_id)
3353 {
3354         struct cfg80211_chan_def chandef;
3355         int result;
3356         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
3357         struct wireless_dev *wdev = NULL;
3358         int link_id = _link_id;
3359
3360         if (dev)
3361                 wdev = dev->ieee80211_ptr;
3362         if (!nl80211_can_set_dev_channel(wdev))
3363                 return -EOPNOTSUPP;
3364         if (wdev)
3365                 iftype = wdev->iftype;
3366
3367         if (link_id < 0) {
3368                 if (wdev && wdev->valid_links)
3369                         return -EINVAL;
3370                 link_id = 0;
3371         }
3372
3373         result = nl80211_parse_chandef(rdev, info, &chandef);
3374         if (result)
3375                 return result;
3376
3377         switch (iftype) {
3378         case NL80211_IFTYPE_AP:
3379         case NL80211_IFTYPE_P2P_GO:
3380                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
3381                                                    iftype))
3382                         return -EINVAL;
3383                 if (wdev->links[link_id].ap.beacon_interval) {
3384                         struct ieee80211_channel *cur_chan;
3385
3386                         if (!dev || !rdev->ops->set_ap_chanwidth ||
3387                             !(rdev->wiphy.features &
3388                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE))
3389                                 return -EBUSY;
3390
3391                         /* Only allow dynamic channel width changes */
3392                         cur_chan = wdev->links[link_id].ap.chandef.chan;
3393                         if (chandef.chan != cur_chan)
3394                                 return -EBUSY;
3395
3396                         result = rdev_set_ap_chanwidth(rdev, dev, link_id,
3397                                                        &chandef);
3398                         if (result)
3399                                 return result;
3400                         wdev->links[link_id].ap.chandef = chandef;
3401                 } else {
3402                         wdev->u.ap.preset_chandef = chandef;
3403                 }
3404                 return 0;
3405         case NL80211_IFTYPE_MESH_POINT:
3406                 return cfg80211_set_mesh_channel(rdev, wdev, &chandef);
3407         case NL80211_IFTYPE_MONITOR:
3408                 return cfg80211_set_monitor_channel(rdev, &chandef);
3409         default:
3410                 break;
3411         }
3412
3413         return -EINVAL;
3414 }
3415
3416 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
3417 {
3418         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3419         int link_id = nl80211_link_id_or_invalid(info->attrs);
3420         struct net_device *netdev = info->user_ptr[1];
3421         int ret;
3422
3423         wdev_lock(netdev->ieee80211_ptr);
3424         ret = __nl80211_set_channel(rdev, netdev, info, link_id);
3425         wdev_unlock(netdev->ieee80211_ptr);
3426
3427         return ret;
3428 }
3429
3430 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
3431 {
3432         struct cfg80211_registered_device *rdev = NULL;
3433         struct net_device *netdev = NULL;
3434         struct wireless_dev *wdev;
3435         int result = 0, rem_txq_params = 0;
3436         struct nlattr *nl_txq_params;
3437         u32 changed;
3438         u8 retry_short = 0, retry_long = 0;
3439         u32 frag_threshold = 0, rts_threshold = 0;
3440         u8 coverage_class = 0;
3441         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
3442
3443         rtnl_lock();
3444         /*
3445          * Try to find the wiphy and netdev. Normally this
3446          * function shouldn't need the netdev, but this is
3447          * done for backward compatibility -- previously
3448          * setting the channel was done per wiphy, but now
3449          * it is per netdev. Previous userland like hostapd
3450          * also passed a netdev to set_wiphy, so that it is
3451          * possible to let that go to the right netdev!
3452          */
3453
3454         if (info->attrs[NL80211_ATTR_IFINDEX]) {
3455                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
3456
3457                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
3458                 if (netdev && netdev->ieee80211_ptr)
3459                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
3460                 else
3461                         netdev = NULL;
3462         }
3463
3464         if (!netdev) {
3465                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
3466                                                   info->attrs);
3467                 if (IS_ERR(rdev)) {
3468                         rtnl_unlock();
3469                         return PTR_ERR(rdev);
3470                 }
3471                 wdev = NULL;
3472                 netdev = NULL;
3473                 result = 0;
3474         } else
3475                 wdev = netdev->ieee80211_ptr;
3476
3477         wiphy_lock(&rdev->wiphy);
3478
3479         /*
3480          * end workaround code, by now the rdev is available
3481          * and locked, and wdev may or may not be NULL.
3482          */
3483
3484         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
3485                 result = cfg80211_dev_rename(
3486                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
3487         rtnl_unlock();
3488
3489         if (result)
3490                 goto out;
3491
3492         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
3493                 struct ieee80211_txq_params txq_params;
3494                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
3495
3496                 if (!rdev->ops->set_txq_params) {
3497                         result = -EOPNOTSUPP;
3498                         goto out;
3499                 }
3500
3501                 if (!netdev) {
3502                         result = -EINVAL;
3503                         goto out;
3504                 }
3505
3506                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3507                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
3508                         result = -EINVAL;
3509                         goto out;
3510                 }
3511
3512                 if (!netif_running(netdev)) {
3513                         result = -ENETDOWN;
3514                         goto out;
3515                 }
3516
3517                 nla_for_each_nested(nl_txq_params,
3518                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
3519                                     rem_txq_params) {
3520                         result = nla_parse_nested_deprecated(tb,
3521                                                              NL80211_TXQ_ATTR_MAX,
3522                                                              nl_txq_params,
3523                                                              txq_params_policy,
3524                                                              info->extack);
3525                         if (result)
3526                                 goto out;
3527                         result = parse_txq_params(tb, &txq_params);
3528                         if (result)
3529                                 goto out;
3530
3531                         txq_params.link_id =
3532                                 nl80211_link_id_or_invalid(info->attrs);
3533
3534                         wdev_lock(netdev->ieee80211_ptr);
3535                         if (txq_params.link_id >= 0 &&
3536                             !(netdev->ieee80211_ptr->valid_links &
3537                               BIT(txq_params.link_id)))
3538                                 result = -ENOLINK;
3539                         else if (txq_params.link_id >= 0 &&
3540                                  !netdev->ieee80211_ptr->valid_links)
3541                                 result = -EINVAL;
3542                         else
3543                                 result = rdev_set_txq_params(rdev, netdev,
3544                                                              &txq_params);
3545                         wdev_unlock(netdev->ieee80211_ptr);
3546                         if (result)
3547                                 goto out;
3548                 }
3549         }
3550
3551         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
3552                 int link_id = nl80211_link_id_or_invalid(info->attrs);
3553
3554                 if (wdev) {
3555                         wdev_lock(wdev);
3556                         result = __nl80211_set_channel(
3557                                 rdev,
3558                                 nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
3559                                 info, link_id);
3560                         wdev_unlock(wdev);
3561                 } else {
3562                         result = __nl80211_set_channel(rdev, netdev, info, link_id);
3563                 }
3564
3565                 if (result)
3566                         goto out;
3567         }
3568
3569         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
3570                 struct wireless_dev *txp_wdev = wdev;
3571                 enum nl80211_tx_power_setting type;
3572                 int idx, mbm = 0;
3573
3574                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
3575                         txp_wdev = NULL;
3576
3577                 if (!rdev->ops->set_tx_power) {
3578                         result = -EOPNOTSUPP;
3579                         goto out;
3580                 }
3581
3582                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
3583                 type = nla_get_u32(info->attrs[idx]);
3584
3585                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
3586                     (type != NL80211_TX_POWER_AUTOMATIC)) {
3587                         result = -EINVAL;
3588                         goto out;
3589                 }
3590
3591                 if (type != NL80211_TX_POWER_AUTOMATIC) {
3592                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
3593                         mbm = nla_get_u32(info->attrs[idx]);
3594                 }
3595
3596                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
3597                 if (result)
3598                         goto out;
3599         }
3600
3601         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
3602             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
3603                 u32 tx_ant, rx_ant;
3604
3605                 if ((!rdev->wiphy.available_antennas_tx &&
3606                      !rdev->wiphy.available_antennas_rx) ||
3607                     !rdev->ops->set_antenna) {
3608                         result = -EOPNOTSUPP;
3609                         goto out;
3610                 }
3611
3612                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
3613                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
3614
3615                 /* reject antenna configurations which don't match the
3616                  * available antenna masks, except for the "all" mask */
3617                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
3618                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx))) {
3619                         result = -EINVAL;
3620                         goto out;
3621                 }
3622
3623                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
3624                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
3625
3626                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
3627                 if (result)
3628                         goto out;
3629         }
3630
3631         changed = 0;
3632
3633         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
3634                 retry_short = nla_get_u8(
3635                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
3636
3637                 changed |= WIPHY_PARAM_RETRY_SHORT;
3638         }
3639
3640         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
3641                 retry_long = nla_get_u8(
3642                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
3643
3644                 changed |= WIPHY_PARAM_RETRY_LONG;
3645         }
3646
3647         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
3648                 frag_threshold = nla_get_u32(
3649                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
3650                 if (frag_threshold < 256) {
3651                         result = -EINVAL;
3652                         goto out;
3653                 }
3654
3655                 if (frag_threshold != (u32) -1) {
3656                         /*
3657                          * Fragments (apart from the last one) are required to
3658                          * have even length. Make the fragmentation code
3659                          * simpler by stripping LSB should someone try to use
3660                          * odd threshold value.
3661                          */
3662                         frag_threshold &= ~0x1;
3663                 }
3664                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
3665         }
3666
3667         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
3668                 rts_threshold = nla_get_u32(
3669                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
3670                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
3671         }
3672
3673         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
3674                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3675                         result = -EINVAL;
3676                         goto out;
3677                 }
3678
3679                 coverage_class = nla_get_u8(
3680                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
3681                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
3682         }
3683
3684         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
3685                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION)) {
3686                         result = -EOPNOTSUPP;
3687                         goto out;
3688                 }
3689
3690                 changed |= WIPHY_PARAM_DYN_ACK;
3691         }
3692
3693         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
3694                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3695                                              NL80211_EXT_FEATURE_TXQS)) {
3696                         result = -EOPNOTSUPP;
3697                         goto out;
3698                 }
3699                 txq_limit = nla_get_u32(
3700                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
3701                 changed |= WIPHY_PARAM_TXQ_LIMIT;
3702         }
3703
3704         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
3705                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3706                                              NL80211_EXT_FEATURE_TXQS)) {
3707                         result = -EOPNOTSUPP;
3708                         goto out;
3709                 }
3710                 txq_memory_limit = nla_get_u32(
3711                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
3712                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
3713         }
3714
3715         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
3716                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
3717                                              NL80211_EXT_FEATURE_TXQS)) {
3718                         result = -EOPNOTSUPP;
3719                         goto out;
3720                 }
3721                 txq_quantum = nla_get_u32(
3722                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
3723                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
3724         }
3725
3726         if (changed) {
3727                 u8 old_retry_short, old_retry_long;
3728                 u32 old_frag_threshold, old_rts_threshold;
3729                 u8 old_coverage_class;
3730                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
3731
3732                 if (!rdev->ops->set_wiphy_params) {
3733                         result = -EOPNOTSUPP;
3734                         goto out;
3735                 }
3736
3737                 old_retry_short = rdev->wiphy.retry_short;
3738                 old_retry_long = rdev->wiphy.retry_long;
3739                 old_frag_threshold = rdev->wiphy.frag_threshold;
3740                 old_rts_threshold = rdev->wiphy.rts_threshold;
3741                 old_coverage_class = rdev->wiphy.coverage_class;
3742                 old_txq_limit = rdev->wiphy.txq_limit;
3743                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
3744                 old_txq_quantum = rdev->wiphy.txq_quantum;
3745
3746                 if (changed & WIPHY_PARAM_RETRY_SHORT)
3747                         rdev->wiphy.retry_short = retry_short;
3748                 if (changed & WIPHY_PARAM_RETRY_LONG)
3749                         rdev->wiphy.retry_long = retry_long;
3750                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
3751                         rdev->wiphy.frag_threshold = frag_threshold;
3752                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
3753                         rdev->wiphy.rts_threshold = rts_threshold;
3754                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
3755                         rdev->wiphy.coverage_class = coverage_class;
3756                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
3757                         rdev->wiphy.txq_limit = txq_limit;
3758                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
3759                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
3760                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
3761                         rdev->wiphy.txq_quantum = txq_quantum;
3762
3763                 result = rdev_set_wiphy_params(rdev, changed);
3764                 if (result) {
3765                         rdev->wiphy.retry_short = old_retry_short;
3766                         rdev->wiphy.retry_long = old_retry_long;
3767                         rdev->wiphy.frag_threshold = old_frag_threshold;
3768                         rdev->wiphy.rts_threshold = old_rts_threshold;
3769                         rdev->wiphy.coverage_class = old_coverage_class;
3770                         rdev->wiphy.txq_limit = old_txq_limit;
3771                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
3772                         rdev->wiphy.txq_quantum = old_txq_quantum;
3773                         goto out;
3774                 }
3775         }
3776
3777         result = 0;
3778
3779 out:
3780         wiphy_unlock(&rdev->wiphy);
3781         return result;
3782 }
3783
3784 int nl80211_send_chandef(struct sk_buff *msg, const struct cfg80211_chan_def *chandef)
3785 {
3786         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
3787                 return -EINVAL;
3788
3789         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
3790                         chandef->chan->center_freq))
3791                 return -ENOBUFS;
3792         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
3793                         chandef->chan->freq_offset))
3794                 return -ENOBUFS;
3795         switch (chandef->width) {
3796         case NL80211_CHAN_WIDTH_20_NOHT:
3797         case NL80211_CHAN_WIDTH_20:
3798         case NL80211_CHAN_WIDTH_40:
3799                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
3800                                 cfg80211_get_chandef_type(chandef)))
3801                         return -ENOBUFS;
3802                 break;
3803         default:
3804                 break;
3805         }
3806         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
3807                 return -ENOBUFS;
3808         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
3809                 return -ENOBUFS;
3810         if (chandef->center_freq2 &&
3811             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
3812                 return -ENOBUFS;
3813         return 0;
3814 }
3815 EXPORT_SYMBOL(nl80211_send_chandef);
3816
3817 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
3818                               struct cfg80211_registered_device *rdev,
3819                               struct wireless_dev *wdev,
3820                               enum nl80211_commands cmd)
3821 {
3822         struct net_device *dev = wdev->netdev;
3823         void *hdr;
3824
3825         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
3826                 cmd != NL80211_CMD_DEL_INTERFACE &&
3827                 cmd != NL80211_CMD_SET_INTERFACE);
3828
3829         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
3830         if (!hdr)
3831                 return -1;
3832
3833         if (dev &&
3834             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3835              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
3836                 goto nla_put_failure;
3837
3838         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
3839             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
3840             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
3841                               NL80211_ATTR_PAD) ||
3842             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
3843             nla_put_u32(msg, NL80211_ATTR_GENERATION,
3844                         rdev->devlist_generation ^
3845                         (cfg80211_rdev_list_generation << 2)) ||
3846             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
3847                 goto nla_put_failure;
3848
3849         if (rdev->ops->get_channel && !wdev->valid_links) {
3850                 struct cfg80211_chan_def chandef = {};
3851                 int ret;
3852
3853                 ret = rdev_get_channel(rdev, wdev, 0, &chandef);
3854                 if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3855                         goto nla_put_failure;
3856         }
3857
3858         if (rdev->ops->get_tx_power) {
3859                 int dbm, ret;
3860
3861                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
3862                 if (ret == 0 &&
3863                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
3864                                 DBM_TO_MBM(dbm)))
3865                         goto nla_put_failure;
3866         }
3867
3868         wdev_lock(wdev);
3869         switch (wdev->iftype) {
3870         case NL80211_IFTYPE_AP:
3871         case NL80211_IFTYPE_P2P_GO:
3872                 if (wdev->u.ap.ssid_len &&
3873                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
3874                             wdev->u.ap.ssid))
3875                         goto nla_put_failure_locked;
3876                 break;
3877         case NL80211_IFTYPE_STATION:
3878         case NL80211_IFTYPE_P2P_CLIENT:
3879                 if (wdev->u.client.ssid_len &&
3880                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.client.ssid_len,
3881                             wdev->u.client.ssid))
3882                         goto nla_put_failure_locked;
3883                 break;
3884         case NL80211_IFTYPE_ADHOC:
3885                 if (wdev->u.ibss.ssid_len &&
3886                     nla_put(msg, NL80211_ATTR_SSID, wdev->u.ibss.ssid_len,
3887                             wdev->u.ibss.ssid))
3888                         goto nla_put_failure_locked;
3889                 break;
3890         default:
3891                 /* nothing */
3892                 break;
3893         }
3894         wdev_unlock(wdev);
3895
3896         if (rdev->ops->get_txq_stats) {
3897                 struct cfg80211_txq_stats txqstats = {};
3898                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
3899
3900                 if (ret == 0 &&
3901                     !nl80211_put_txq_stats(msg, &txqstats,
3902                                            NL80211_ATTR_TXQ_STATS))
3903                         goto nla_put_failure;
3904         }
3905
3906         if (wdev->valid_links) {
3907                 unsigned int link_id;
3908                 struct nlattr *links = nla_nest_start(msg,
3909                                                       NL80211_ATTR_MLO_LINKS);
3910
3911                 if (!links)
3912                         goto nla_put_failure;
3913
3914                 for_each_valid_link(wdev, link_id) {
3915                         struct nlattr *link = nla_nest_start(msg, link_id + 1);
3916                         struct cfg80211_chan_def chandef = {};
3917                         int ret;
3918
3919                         if (!link)
3920                                 goto nla_put_failure;
3921
3922                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
3923                                 goto nla_put_failure;
3924                         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
3925                                     wdev->links[link_id].addr))
3926                                 goto nla_put_failure;
3927
3928                         ret = rdev_get_channel(rdev, wdev, link_id, &chandef);
3929                         if (ret == 0 && nl80211_send_chandef(msg, &chandef))
3930                                 goto nla_put_failure;
3931
3932                         nla_nest_end(msg, link);
3933                 }
3934
3935                 nla_nest_end(msg, links);
3936         }
3937
3938         genlmsg_end(msg, hdr);
3939         return 0;
3940
3941  nla_put_failure_locked:
3942         wdev_unlock(wdev);
3943  nla_put_failure:
3944         genlmsg_cancel(msg, hdr);
3945         return -EMSGSIZE;
3946 }
3947
3948 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
3949 {
3950         int wp_idx = 0;
3951         int if_idx = 0;
3952         int wp_start = cb->args[0];
3953         int if_start = cb->args[1];
3954         int filter_wiphy = -1;
3955         struct cfg80211_registered_device *rdev;
3956         struct wireless_dev *wdev;
3957         int ret;
3958
3959         rtnl_lock();
3960         if (!cb->args[2]) {
3961                 struct nl80211_dump_wiphy_state state = {
3962                         .filter_wiphy = -1,
3963                 };
3964
3965                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
3966                 if (ret)
3967                         goto out_unlock;
3968
3969                 filter_wiphy = state.filter_wiphy;
3970
3971                 /*
3972                  * if filtering, set cb->args[2] to +1 since 0 is the default
3973                  * value needed to determine that parsing is necessary.
3974                  */
3975                 if (filter_wiphy >= 0)
3976                         cb->args[2] = filter_wiphy + 1;
3977                 else
3978                         cb->args[2] = -1;
3979         } else if (cb->args[2] > 0) {
3980                 filter_wiphy = cb->args[2] - 1;
3981         }
3982
3983         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
3984                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
3985                         continue;
3986                 if (wp_idx < wp_start) {
3987                         wp_idx++;
3988                         continue;
3989                 }
3990
3991                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
3992                         continue;
3993
3994                 if_idx = 0;
3995
3996                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
3997                         if (if_idx < if_start) {
3998                                 if_idx++;
3999                                 continue;
4000                         }
4001                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
4002                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
4003                                                rdev, wdev,
4004                                                NL80211_CMD_NEW_INTERFACE) < 0) {
4005                                 goto out;
4006                         }
4007                         if_idx++;
4008                 }
4009
4010                 wp_idx++;
4011         }
4012  out:
4013         cb->args[0] = wp_idx;
4014         cb->args[1] = if_idx;
4015
4016         ret = skb->len;
4017  out_unlock:
4018         rtnl_unlock();
4019
4020         return ret;
4021 }
4022
4023 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
4024 {
4025         struct sk_buff *msg;
4026         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4027         struct wireless_dev *wdev = info->user_ptr[1];
4028
4029         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4030         if (!msg)
4031                 return -ENOMEM;
4032
4033         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4034                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4035                 nlmsg_free(msg);
4036                 return -ENOBUFS;
4037         }
4038
4039         return genlmsg_reply(msg, info);
4040 }
4041
4042 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
4043         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
4044         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
4045         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
4046         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
4047         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
4048         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
4049 };
4050
4051 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
4052 {
4053         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
4054         int flag;
4055
4056         *mntrflags = 0;
4057
4058         if (!nla)
4059                 return -EINVAL;
4060
4061         if (nla_parse_nested_deprecated(flags, NL80211_MNTR_FLAG_MAX, nla, mntr_flags_policy, NULL))
4062                 return -EINVAL;
4063
4064         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
4065                 if (flags[flag])
4066                         *mntrflags |= (1<<flag);
4067
4068         *mntrflags |= MONITOR_FLAG_CHANGED;
4069
4070         return 0;
4071 }
4072
4073 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
4074                                      enum nl80211_iftype type,
4075                                      struct genl_info *info,
4076                                      struct vif_params *params)
4077 {
4078         bool change = false;
4079         int err;
4080
4081         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
4082                 if (type != NL80211_IFTYPE_MONITOR)
4083                         return -EINVAL;
4084
4085                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
4086                                           &params->flags);
4087                 if (err)
4088                         return err;
4089
4090                 change = true;
4091         }
4092
4093         if (params->flags & MONITOR_FLAG_ACTIVE &&
4094             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
4095                 return -EOPNOTSUPP;
4096
4097         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
4098                 const u8 *mumimo_groups;
4099                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4100
4101                 if (type != NL80211_IFTYPE_MONITOR)
4102                         return -EINVAL;
4103
4104                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4105                         return -EOPNOTSUPP;
4106
4107                 mumimo_groups =
4108                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
4109
4110                 /* bits 0 and 63 are reserved and must be zero */
4111                 if ((mumimo_groups[0] & BIT(0)) ||
4112                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
4113                         return -EINVAL;
4114
4115                 params->vht_mumimo_groups = mumimo_groups;
4116                 change = true;
4117         }
4118
4119         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
4120                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
4121
4122                 if (type != NL80211_IFTYPE_MONITOR)
4123                         return -EINVAL;
4124
4125                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
4126                         return -EOPNOTSUPP;
4127
4128                 params->vht_mumimo_follow_addr =
4129                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
4130                 change = true;
4131         }
4132
4133         return change ? 1 : 0;
4134 }
4135
4136 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
4137                                struct net_device *netdev, u8 use_4addr,
4138                                enum nl80211_iftype iftype)
4139 {
4140         if (!use_4addr) {
4141                 if (netdev && netif_is_bridge_port(netdev))
4142                         return -EBUSY;
4143                 return 0;
4144         }
4145
4146         switch (iftype) {
4147         case NL80211_IFTYPE_AP_VLAN:
4148                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
4149                         return 0;
4150                 break;
4151         case NL80211_IFTYPE_STATION:
4152                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
4153                         return 0;
4154                 break;
4155         default:
4156                 break;
4157         }
4158
4159         return -EOPNOTSUPP;
4160 }
4161
4162 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
4163 {
4164         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4165         struct vif_params params;
4166         int err;
4167         enum nl80211_iftype otype, ntype;
4168         struct net_device *dev = info->user_ptr[1];
4169         bool change = false;
4170
4171         memset(&params, 0, sizeof(params));
4172
4173         otype = ntype = dev->ieee80211_ptr->iftype;
4174
4175         if (info->attrs[NL80211_ATTR_IFTYPE]) {
4176                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4177                 if (otype != ntype)
4178                         change = true;
4179         }
4180
4181         if (info->attrs[NL80211_ATTR_MESH_ID]) {
4182                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4183
4184                 if (ntype != NL80211_IFTYPE_MESH_POINT)
4185                         return -EINVAL;
4186                 if (netif_running(dev))
4187                         return -EBUSY;
4188
4189                 wdev_lock(wdev);
4190                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4191                              IEEE80211_MAX_MESH_ID_LEN);
4192                 wdev->u.mesh.id_up_len =
4193                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4194                 memcpy(wdev->u.mesh.id,
4195                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4196                        wdev->u.mesh.id_up_len);
4197                 wdev_unlock(wdev);
4198         }
4199
4200         if (info->attrs[NL80211_ATTR_4ADDR]) {
4201                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4202                 change = true;
4203                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
4204                 if (err)
4205                         return err;
4206         } else {
4207                 params.use_4addr = -1;
4208         }
4209
4210         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
4211         if (err < 0)
4212                 return err;
4213         if (err > 0)
4214                 change = true;
4215
4216         if (change)
4217                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
4218         else
4219                 err = 0;
4220
4221         if (!err && params.use_4addr != -1)
4222                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
4223
4224         if (change && !err) {
4225                 struct wireless_dev *wdev = dev->ieee80211_ptr;
4226
4227                 nl80211_notify_iface(rdev, wdev, NL80211_CMD_SET_INTERFACE);
4228         }
4229
4230         return err;
4231 }
4232
4233 static int _nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4234 {
4235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4236         struct vif_params params;
4237         struct wireless_dev *wdev;
4238         struct sk_buff *msg;
4239         int err;
4240         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
4241
4242         memset(&params, 0, sizeof(params));
4243
4244         if (!info->attrs[NL80211_ATTR_IFNAME])
4245                 return -EINVAL;
4246
4247         if (info->attrs[NL80211_ATTR_IFTYPE])
4248                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
4249
4250         if (!rdev->ops->add_virtual_intf)
4251                 return -EOPNOTSUPP;
4252
4253         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
4254              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
4255             info->attrs[NL80211_ATTR_MAC]) {
4256                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
4257                            ETH_ALEN);
4258                 if (!is_valid_ether_addr(params.macaddr))
4259                         return -EADDRNOTAVAIL;
4260         }
4261
4262         if (info->attrs[NL80211_ATTR_4ADDR]) {
4263                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
4264                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
4265                 if (err)
4266                         return err;
4267         }
4268
4269         if (!cfg80211_iftype_allowed(&rdev->wiphy, type, params.use_4addr, 0))
4270                 return -EOPNOTSUPP;
4271
4272         err = nl80211_parse_mon_options(rdev, type, info, &params);
4273         if (err < 0)
4274                 return err;
4275
4276         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4277         if (!msg)
4278                 return -ENOMEM;
4279
4280         wdev = rdev_add_virtual_intf(rdev,
4281                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
4282                                 NET_NAME_USER, type, &params);
4283         if (WARN_ON(!wdev)) {
4284                 nlmsg_free(msg);
4285                 return -EPROTO;
4286         } else if (IS_ERR(wdev)) {
4287                 nlmsg_free(msg);
4288                 return PTR_ERR(wdev);
4289         }
4290
4291         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4292                 wdev->owner_nlportid = info->snd_portid;
4293
4294         switch (type) {
4295         case NL80211_IFTYPE_MESH_POINT:
4296                 if (!info->attrs[NL80211_ATTR_MESH_ID])
4297                         break;
4298                 wdev_lock(wdev);
4299                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
4300                              IEEE80211_MAX_MESH_ID_LEN);
4301                 wdev->u.mesh.id_up_len =
4302                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
4303                 memcpy(wdev->u.mesh.id,
4304                        nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
4305                        wdev->u.mesh.id_up_len);
4306                 wdev_unlock(wdev);
4307                 break;
4308         case NL80211_IFTYPE_NAN:
4309         case NL80211_IFTYPE_P2P_DEVICE:
4310                 /*
4311                  * P2P Device and NAN do not have a netdev, so don't go
4312                  * through the netdev notifier and must be added here
4313                  */
4314                 cfg80211_init_wdev(wdev);
4315                 cfg80211_register_wdev(rdev, wdev);
4316                 break;
4317         default:
4318                 break;
4319         }
4320
4321         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
4322                                rdev, wdev, NL80211_CMD_NEW_INTERFACE) < 0) {
4323                 nlmsg_free(msg);
4324                 return -ENOBUFS;
4325         }
4326
4327         return genlmsg_reply(msg, info);
4328 }
4329
4330 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
4331 {
4332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4333         int ret;
4334
4335         /* to avoid failing a new interface creation due to pending removal */
4336         cfg80211_destroy_ifaces(rdev);
4337
4338         wiphy_lock(&rdev->wiphy);
4339         ret = _nl80211_new_interface(skb, info);
4340         wiphy_unlock(&rdev->wiphy);
4341
4342         return ret;
4343 }
4344
4345 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
4346 {
4347         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4348         struct wireless_dev *wdev = info->user_ptr[1];
4349
4350         if (!rdev->ops->del_virtual_intf)
4351                 return -EOPNOTSUPP;
4352
4353         /*
4354          * We hold RTNL, so this is safe, without RTNL opencount cannot
4355          * reach 0, and thus the rdev cannot be deleted.
4356          *
4357          * We need to do it for the dev_close(), since that will call
4358          * the netdev notifiers, and we need to acquire the mutex there
4359          * but don't know if we get there from here or from some other
4360          * place (e.g. "ip link set ... down").
4361          */
4362         mutex_unlock(&rdev->wiphy.mtx);
4363
4364         /*
4365          * If we remove a wireless device without a netdev then clear
4366          * user_ptr[1] so that nl80211_post_doit won't dereference it
4367          * to check if it needs to do dev_put(). Otherwise it crashes
4368          * since the wdev has been freed, unlike with a netdev where
4369          * we need the dev_put() for the netdev to really be freed.
4370          */
4371         if (!wdev->netdev)
4372                 info->user_ptr[1] = NULL;
4373         else
4374                 dev_close(wdev->netdev);
4375
4376         mutex_lock(&rdev->wiphy.mtx);
4377
4378         return cfg80211_remove_virtual_intf(rdev, wdev);
4379 }
4380
4381 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
4382 {
4383         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4384         struct net_device *dev = info->user_ptr[1];
4385         u16 noack_map;
4386
4387         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
4388                 return -EINVAL;
4389
4390         if (!rdev->ops->set_noack_map)
4391                 return -EOPNOTSUPP;
4392
4393         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
4394
4395         return rdev_set_noack_map(rdev, dev, noack_map);
4396 }
4397
4398 static int nl80211_validate_key_link_id(struct genl_info *info,
4399                                         struct wireless_dev *wdev,
4400                                         int link_id, bool pairwise)
4401 {
4402         if (pairwise) {
4403                 if (link_id != -1) {
4404                         GENL_SET_ERR_MSG(info,
4405                                          "link ID not allowed for pairwise key");
4406                         return -EINVAL;
4407                 }
4408
4409                 return 0;
4410         }
4411
4412         if (wdev->valid_links) {
4413                 if (link_id == -1) {
4414                         GENL_SET_ERR_MSG(info,
4415                                          "link ID must for MLO group key");
4416                         return -EINVAL;
4417                 }
4418                 if (!(wdev->valid_links & BIT(link_id))) {
4419                         GENL_SET_ERR_MSG(info, "invalid link ID for MLO group key");
4420                         return -EINVAL;
4421                 }
4422         } else if (link_id != -1) {
4423                 GENL_SET_ERR_MSG(info, "link ID not allowed for non-MLO group key");
4424                 return -EINVAL;
4425         }
4426
4427         return 0;
4428 }
4429
4430 struct get_key_cookie {
4431         struct sk_buff *msg;
4432         int error;
4433         int idx;
4434 };
4435
4436 static void get_key_callback(void *c, struct key_params *params)
4437 {
4438         struct nlattr *key;
4439         struct get_key_cookie *cookie = c;
4440
4441         if ((params->key &&
4442              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
4443                      params->key_len, params->key)) ||
4444             (params->seq &&
4445              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
4446                      params->seq_len, params->seq)) ||
4447             (params->cipher &&
4448              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
4449                          params->cipher)))
4450                 goto nla_put_failure;
4451
4452         key = nla_nest_start_noflag(cookie->msg, NL80211_ATTR_KEY);
4453         if (!key)
4454                 goto nla_put_failure;
4455
4456         if ((params->key &&
4457              nla_put(cookie->msg, NL80211_KEY_DATA,
4458                      params->key_len, params->key)) ||
4459             (params->seq &&
4460              nla_put(cookie->msg, NL80211_KEY_SEQ,
4461                      params->seq_len, params->seq)) ||
4462             (params->cipher &&
4463              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
4464                          params->cipher)))
4465                 goto nla_put_failure;
4466
4467         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
4468                 goto nla_put_failure;
4469
4470         nla_nest_end(cookie->msg, key);
4471
4472         return;
4473  nla_put_failure:
4474         cookie->error = 1;
4475 }
4476
4477 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
4478 {
4479         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4480         int err;
4481         struct net_device *dev = info->user_ptr[1];
4482         u8 key_idx = 0;
4483         const u8 *mac_addr = NULL;
4484         bool pairwise;
4485         struct get_key_cookie cookie = {
4486                 .error = 0,
4487         };
4488         void *hdr;
4489         struct sk_buff *msg;
4490         bool bigtk_support = false;
4491         int link_id = nl80211_link_id_or_invalid(info->attrs);
4492         struct wireless_dev *wdev = dev->ieee80211_ptr;
4493
4494         if (wiphy_ext_feature_isset(&rdev->wiphy,
4495                                     NL80211_EXT_FEATURE_BEACON_PROTECTION))
4496                 bigtk_support = true;
4497
4498         if ((wdev->iftype == NL80211_IFTYPE_STATION ||
4499              wdev->iftype == NL80211_IFTYPE_P2P_CLIENT) &&
4500             wiphy_ext_feature_isset(&rdev->wiphy,
4501                                     NL80211_EXT_FEATURE_BEACON_PROTECTION_CLIENT))
4502                 bigtk_support = true;
4503
4504         if (info->attrs[NL80211_ATTR_KEY_IDX]) {
4505                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
4506
4507                 if (key_idx >= 6 && key_idx <= 7 && !bigtk_support) {
4508                         GENL_SET_ERR_MSG(info, "BIGTK not supported");
4509                         return -EINVAL;
4510                 }
4511         }
4512
4513         if (info->attrs[NL80211_ATTR_MAC])
4514                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4515
4516         pairwise = !!mac_addr;
4517         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
4518                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
4519
4520                 if (kt != NL80211_KEYTYPE_GROUP &&
4521                     kt != NL80211_KEYTYPE_PAIRWISE)
4522                         return -EINVAL;
4523                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
4524         }
4525
4526         if (!rdev->ops->get_key)
4527                 return -EOPNOTSUPP;
4528
4529         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4530                 return -ENOENT;
4531
4532         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4533         if (!msg)
4534                 return -ENOMEM;
4535
4536         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
4537                              NL80211_CMD_NEW_KEY);
4538         if (!hdr)
4539                 goto nla_put_failure;
4540
4541         cookie.msg = msg;
4542         cookie.idx = key_idx;
4543
4544         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4545             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
4546                 goto nla_put_failure;
4547         if (mac_addr &&
4548             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
4549                 goto nla_put_failure;
4550
4551         err = nl80211_validate_key_link_id(info, wdev, link_id, pairwise);
4552         if (err)
4553                 goto free_msg;
4554
4555         err = rdev_get_key(rdev, dev, link_id, key_idx, pairwise, mac_addr,
4556                            &cookie, get_key_callback);
4557
4558         if (err)
4559                 goto free_msg;
4560
4561         if (cookie.error)
4562                 goto nla_put_failure;
4563
4564         genlmsg_end(msg, hdr);
4565         return genlmsg_reply(msg, info);
4566
4567  nla_put_failure:
4568         err = -ENOBUFS;
4569  free_msg:
4570         nlmsg_free(msg);
4571         return err;
4572 }
4573
4574 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
4575 {
4576         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4577         struct key_parse key;
4578         int err;
4579         struct net_device *dev = info->user_ptr[1];
4580         int link_id = nl80211_link_id_or_invalid(info->attrs);
4581         struct wireless_dev *wdev = dev->ieee80211_ptr;
4582
4583         err = nl80211_parse_key(info, &key);
4584         if (err)
4585                 return err;
4586
4587         if (key.idx < 0)
4588                 return -EINVAL;
4589
4590         /* Only support setting default key and
4591          * Extended Key ID action NL80211_KEY_SET_TX.
4592          */
4593         if (!key.def && !key.defmgmt && !key.defbeacon &&
4594             !(key.p.mode == NL80211_KEY_SET_TX))
4595                 return -EINVAL;
4596
4597         wdev_lock(wdev);
4598
4599         if (key.def) {
4600                 if (!rdev->ops->set_default_key) {
4601                         err = -EOPNOTSUPP;
4602                         goto out;
4603                 }
4604
4605                 err = nl80211_key_allowed(wdev);
4606                 if (err)
4607                         goto out;
4608
4609                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4610                 if (err)
4611                         goto out;
4612
4613                 err = rdev_set_default_key(rdev, dev, link_id, key.idx,
4614                                            key.def_uni, key.def_multi);
4615
4616                 if (err)
4617                         goto out;
4618
4619 #ifdef CONFIG_CFG80211_WEXT
4620                 wdev->wext.default_key = key.idx;
4621 #endif
4622         } else if (key.defmgmt) {
4623                 if (key.def_uni || !key.def_multi) {
4624                         err = -EINVAL;
4625                         goto out;
4626                 }
4627
4628                 if (!rdev->ops->set_default_mgmt_key) {
4629                         err = -EOPNOTSUPP;
4630                         goto out;
4631                 }
4632
4633                 err = nl80211_key_allowed(wdev);
4634                 if (err)
4635                         goto out;
4636
4637                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4638                 if (err)
4639                         goto out;
4640
4641                 err = rdev_set_default_mgmt_key(rdev, dev, link_id, key.idx);
4642                 if (err)
4643                         goto out;
4644
4645 #ifdef CONFIG_CFG80211_WEXT
4646                 wdev->wext.default_mgmt_key = key.idx;
4647 #endif
4648         } else if (key.defbeacon) {
4649                 if (key.def_uni || !key.def_multi) {
4650                         err = -EINVAL;
4651                         goto out;
4652                 }
4653
4654                 if (!rdev->ops->set_default_beacon_key) {
4655                         err = -EOPNOTSUPP;
4656                         goto out;
4657                 }
4658
4659                 err = nl80211_key_allowed(wdev);
4660                 if (err)
4661                         goto out;
4662
4663                 err = nl80211_validate_key_link_id(info, wdev, link_id, false);
4664                 if (err)
4665                         goto out;
4666
4667                 err = rdev_set_default_beacon_key(rdev, dev, link_id, key.idx);
4668                 if (err)
4669                         goto out;
4670         } else if (key.p.mode == NL80211_KEY_SET_TX &&
4671                    wiphy_ext_feature_isset(&rdev->wiphy,
4672                                            NL80211_EXT_FEATURE_EXT_KEY_ID)) {
4673                 u8 *mac_addr = NULL;
4674
4675                 if (info->attrs[NL80211_ATTR_MAC])
4676                         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4677
4678                 if (!mac_addr || key.idx < 0 || key.idx > 1) {
4679                         err = -EINVAL;
4680                         goto out;
4681                 }
4682
4683                 err = nl80211_validate_key_link_id(info, wdev, link_id, true);
4684                 if (err)
4685                         goto out;
4686
4687                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4688                                    NL80211_KEYTYPE_PAIRWISE,
4689                                    mac_addr, &key.p);
4690         } else {
4691                 err = -EINVAL;
4692         }
4693  out:
4694         wdev_unlock(wdev);
4695
4696         return err;
4697 }
4698
4699 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
4700 {
4701         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4702         int err;
4703         struct net_device *dev = info->user_ptr[1];
4704         struct key_parse key;
4705         const u8 *mac_addr = NULL;
4706         int link_id = nl80211_link_id_or_invalid(info->attrs);
4707         struct wireless_dev *wdev = dev->ieee80211_ptr;
4708
4709         err = nl80211_parse_key(info, &key);
4710         if (err)
4711                 return err;
4712
4713         if (!key.p.key) {
4714                 GENL_SET_ERR_MSG(info, "no key");
4715                 return -EINVAL;
4716         }
4717
4718         if (info->attrs[NL80211_ATTR_MAC])
4719                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4720
4721         if (key.type == -1) {
4722                 if (mac_addr)
4723                         key.type = NL80211_KEYTYPE_PAIRWISE;
4724                 else
4725                         key.type = NL80211_KEYTYPE_GROUP;
4726         }
4727
4728         /* for now */
4729         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4730             key.type != NL80211_KEYTYPE_GROUP) {
4731                 GENL_SET_ERR_MSG(info, "key type not pairwise or group");
4732                 return -EINVAL;
4733         }
4734
4735         if (key.type == NL80211_KEYTYPE_GROUP &&
4736             info->attrs[NL80211_ATTR_VLAN_ID])
4737                 key.p.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
4738
4739         if (!rdev->ops->add_key)
4740                 return -EOPNOTSUPP;
4741
4742         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
4743                                            key.type == NL80211_KEYTYPE_PAIRWISE,
4744                                            mac_addr)) {
4745                 GENL_SET_ERR_MSG(info, "key setting validation failed");
4746                 return -EINVAL;
4747         }
4748
4749         wdev_lock(wdev);
4750         err = nl80211_key_allowed(wdev);
4751         if (err)
4752                 GENL_SET_ERR_MSG(info, "key not allowed");
4753
4754         if (!err)
4755                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4756                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4757
4758         if (!err) {
4759                 err = rdev_add_key(rdev, dev, link_id, key.idx,
4760                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4761                                     mac_addr, &key.p);
4762                 if (err)
4763                         GENL_SET_ERR_MSG(info, "key addition failed");
4764         }
4765         wdev_unlock(wdev);
4766
4767         return err;
4768 }
4769
4770 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
4771 {
4772         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4773         int err;
4774         struct net_device *dev = info->user_ptr[1];
4775         u8 *mac_addr = NULL;
4776         struct key_parse key;
4777         int link_id = nl80211_link_id_or_invalid(info->attrs);
4778         struct wireless_dev *wdev = dev->ieee80211_ptr;
4779
4780         err = nl80211_parse_key(info, &key);
4781         if (err)
4782                 return err;
4783
4784         if (info->attrs[NL80211_ATTR_MAC])
4785                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4786
4787         if (key.type == -1) {
4788                 if (mac_addr)
4789                         key.type = NL80211_KEYTYPE_PAIRWISE;
4790                 else
4791                         key.type = NL80211_KEYTYPE_GROUP;
4792         }
4793
4794         /* for now */
4795         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
4796             key.type != NL80211_KEYTYPE_GROUP)
4797                 return -EINVAL;
4798
4799         if (!cfg80211_valid_key_idx(rdev, key.idx,
4800                                     key.type == NL80211_KEYTYPE_PAIRWISE))
4801                 return -EINVAL;
4802
4803         if (!rdev->ops->del_key)
4804                 return -EOPNOTSUPP;
4805
4806         wdev_lock(wdev);
4807         err = nl80211_key_allowed(wdev);
4808
4809         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
4810             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
4811                 err = -ENOENT;
4812
4813         if (!err)
4814                 err = nl80211_validate_key_link_id(info, wdev, link_id,
4815                                 key.type == NL80211_KEYTYPE_PAIRWISE);
4816
4817         if (!err)
4818                 err = rdev_del_key(rdev, dev, link_id, key.idx,
4819                                    key.type == NL80211_KEYTYPE_PAIRWISE,
4820                                    mac_addr);
4821
4822 #ifdef CONFIG_CFG80211_WEXT
4823         if (!err) {
4824                 if (key.idx == wdev->wext.default_key)
4825                         wdev->wext.default_key = -1;
4826                 else if (key.idx == wdev->wext.default_mgmt_key)
4827                         wdev->wext.default_mgmt_key = -1;
4828         }
4829 #endif
4830         wdev_unlock(wdev);
4831
4832         return err;
4833 }
4834
4835 /* This function returns an error or the number of nested attributes */
4836 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
4837 {
4838         struct nlattr *attr;
4839         int n_entries = 0, tmp;
4840
4841         nla_for_each_nested(attr, nl_attr, tmp) {
4842                 if (nla_len(attr) != ETH_ALEN)
4843                         return -EINVAL;
4844
4845                 n_entries++;
4846         }
4847
4848         return n_entries;
4849 }
4850
4851 /*
4852  * This function parses ACL information and allocates memory for ACL data.
4853  * On successful return, the calling function is responsible to free the
4854  * ACL buffer returned by this function.
4855  */
4856 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
4857                                                 struct genl_info *info)
4858 {
4859         enum nl80211_acl_policy acl_policy;
4860         struct nlattr *attr;
4861         struct cfg80211_acl_data *acl;
4862         int i = 0, n_entries, tmp;
4863
4864         if (!wiphy->max_acl_mac_addrs)
4865                 return ERR_PTR(-EOPNOTSUPP);
4866
4867         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
4868                 return ERR_PTR(-EINVAL);
4869
4870         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
4871         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
4872             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
4873                 return ERR_PTR(-EINVAL);
4874
4875         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
4876                 return ERR_PTR(-EINVAL);
4877
4878         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
4879         if (n_entries < 0)
4880                 return ERR_PTR(n_entries);
4881
4882         if (n_entries > wiphy->max_acl_mac_addrs)
4883                 return ERR_PTR(-ENOTSUPP);
4884
4885         acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL);
4886         if (!acl)
4887                 return ERR_PTR(-ENOMEM);
4888
4889         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
4890                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
4891                 i++;
4892         }
4893
4894         acl->n_acl_entries = n_entries;
4895         acl->acl_policy = acl_policy;
4896
4897         return acl;
4898 }
4899
4900 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
4901 {
4902         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4903         struct net_device *dev = info->user_ptr[1];
4904         struct cfg80211_acl_data *acl;
4905         int err;
4906
4907         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4908             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4909                 return -EOPNOTSUPP;
4910
4911         if (!dev->ieee80211_ptr->links[0].ap.beacon_interval)
4912                 return -EINVAL;
4913
4914         acl = parse_acl_data(&rdev->wiphy, info);
4915         if (IS_ERR(acl))
4916                 return PTR_ERR(acl);
4917
4918         err = rdev_set_mac_acl(rdev, dev, acl);
4919
4920         kfree(acl);
4921
4922         return err;
4923 }
4924
4925 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
4926                            u8 *rates, u8 rates_len)
4927 {
4928         u8 i;
4929         u32 mask = 0;
4930
4931         for (i = 0; i < rates_len; i++) {
4932                 int rate = (rates[i] & 0x7f) * 5;
4933                 int ridx;
4934
4935                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
4936                         struct ieee80211_rate *srate =
4937                                 &sband->bitrates[ridx];
4938                         if (rate == srate->bitrate) {
4939                                 mask |= 1 << ridx;
4940                                 break;
4941                         }
4942                 }
4943                 if (ridx == sband->n_bitrates)
4944                         return 0; /* rate not found */
4945         }
4946
4947         return mask;
4948 }
4949
4950 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
4951                                u8 *rates, u8 rates_len,
4952                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
4953 {
4954         u8 i;
4955
4956         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
4957
4958         for (i = 0; i < rates_len; i++) {
4959                 int ridx, rbit;
4960
4961                 ridx = rates[i] / 8;
4962                 rbit = BIT(rates[i] % 8);
4963
4964                 /* check validity */
4965                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
4966                         return false;
4967
4968                 /* check availability */
4969                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
4970                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
4971                         mcs[ridx] |= rbit;
4972                 else
4973                         return false;
4974         }
4975
4976         return true;
4977 }
4978
4979 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
4980 {
4981         u16 mcs_mask = 0;
4982
4983         switch (vht_mcs_map) {
4984         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
4985                 break;
4986         case IEEE80211_VHT_MCS_SUPPORT_0_7:
4987                 mcs_mask = 0x00FF;
4988                 break;
4989         case IEEE80211_VHT_MCS_SUPPORT_0_8:
4990                 mcs_mask = 0x01FF;
4991                 break;
4992         case IEEE80211_VHT_MCS_SUPPORT_0_9:
4993                 mcs_mask = 0x03FF;
4994                 break;
4995         default:
4996                 break;
4997         }
4998
4999         return mcs_mask;
5000 }
5001
5002 static void vht_build_mcs_mask(u16 vht_mcs_map,
5003                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
5004 {
5005         u8 nss;
5006
5007         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
5008                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
5009                 vht_mcs_map >>= 2;
5010         }
5011 }
5012
5013 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
5014                              struct nl80211_txrate_vht *txrate,
5015                              u16 mcs[NL80211_VHT_NSS_MAX])
5016 {
5017         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5018         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
5019         u8 i;
5020
5021         if (!sband->vht_cap.vht_supported)
5022                 return false;
5023
5024         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
5025
5026         /* Build vht_mcs_mask from VHT capabilities */
5027         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5028
5029         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5030                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5031                         mcs[i] = txrate->mcs[i];
5032                 else
5033                         return false;
5034         }
5035
5036         return true;
5037 }
5038
5039 static u16 he_mcs_map_to_mcs_mask(u8 he_mcs_map)
5040 {
5041         switch (he_mcs_map) {
5042         case IEEE80211_HE_MCS_NOT_SUPPORTED:
5043                 return 0;
5044         case IEEE80211_HE_MCS_SUPPORT_0_7:
5045                 return 0x00FF;
5046         case IEEE80211_HE_MCS_SUPPORT_0_9:
5047                 return 0x03FF;
5048         case IEEE80211_HE_MCS_SUPPORT_0_11:
5049                 return 0xFFF;
5050         default:
5051                 break;
5052         }
5053         return 0;
5054 }
5055
5056 static void he_build_mcs_mask(u16 he_mcs_map,
5057                               u16 he_mcs_mask[NL80211_HE_NSS_MAX])
5058 {
5059         u8 nss;
5060
5061         for (nss = 0; nss < NL80211_HE_NSS_MAX; nss++) {
5062                 he_mcs_mask[nss] = he_mcs_map_to_mcs_mask(he_mcs_map & 0x03);
5063                 he_mcs_map >>= 2;
5064         }
5065 }
5066
5067 static u16 he_get_txmcsmap(struct genl_info *info, unsigned int link_id,
5068                            const struct ieee80211_sta_he_cap *he_cap)
5069 {
5070         struct net_device *dev = info->user_ptr[1];
5071         struct wireless_dev *wdev = dev->ieee80211_ptr;
5072         struct cfg80211_chan_def *chandef;
5073         __le16 tx_mcs;
5074
5075         chandef = wdev_chandef(wdev, link_id);
5076         if (!chandef) {
5077                 /*
5078                  * This is probably broken, but we never maintained
5079                  * a chandef in these cases, so it always was.
5080                  */
5081                 return le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
5082         }
5083
5084         switch (chandef->width) {
5085         case NL80211_CHAN_WIDTH_80P80:
5086                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80p80;
5087                 break;
5088         case NL80211_CHAN_WIDTH_160:
5089                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_160;
5090                 break;
5091         default:
5092                 tx_mcs = he_cap->he_mcs_nss_supp.tx_mcs_80;
5093                 break;
5094         }
5095
5096         return le16_to_cpu(tx_mcs);
5097 }
5098
5099 static bool he_set_mcs_mask(struct genl_info *info,
5100                             struct wireless_dev *wdev,
5101                             struct ieee80211_supported_band *sband,
5102                             struct nl80211_txrate_he *txrate,
5103                             u16 mcs[NL80211_HE_NSS_MAX],
5104                             unsigned int link_id)
5105 {
5106         const struct ieee80211_sta_he_cap *he_cap;
5107         u16 tx_mcs_mask[NL80211_HE_NSS_MAX] = {};
5108         u16 tx_mcs_map = 0;
5109         u8 i;
5110
5111         he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5112         if (!he_cap)
5113                 return false;
5114
5115         memset(mcs, 0, sizeof(u16) * NL80211_HE_NSS_MAX);
5116
5117         tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5118
5119         /* Build he_mcs_mask from HE capabilities */
5120         he_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
5121
5122         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5123                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
5124                         mcs[i] = txrate->mcs[i];
5125                 else
5126                         return false;
5127         }
5128
5129         return true;
5130 }
5131
5132 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
5133                                          struct nlattr *attrs[],
5134                                          enum nl80211_attrs attr,
5135                                          struct cfg80211_bitrate_mask *mask,
5136                                          struct net_device *dev,
5137                                          bool default_all_enabled,
5138                                          unsigned int link_id)
5139 {
5140         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
5141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5142         struct wireless_dev *wdev = dev->ieee80211_ptr;
5143         int rem, i;
5144         struct nlattr *tx_rates;
5145         struct ieee80211_supported_band *sband;
5146         u16 vht_tx_mcs_map, he_tx_mcs_map;
5147
5148         memset(mask, 0, sizeof(*mask));
5149         /* Default to all rates enabled */
5150         for (i = 0; i < NUM_NL80211_BANDS; i++) {
5151                 const struct ieee80211_sta_he_cap *he_cap;
5152
5153                 if (!default_all_enabled)
5154                         break;
5155
5156                 sband = rdev->wiphy.bands[i];
5157
5158                 if (!sband)
5159                         continue;
5160
5161                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
5162                 memcpy(mask->control[i].ht_mcs,
5163                        sband->ht_cap.mcs.rx_mask,
5164                        sizeof(mask->control[i].ht_mcs));
5165
5166                 if (sband->vht_cap.vht_supported) {
5167                         vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
5168                         vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
5169                 }
5170
5171                 he_cap = ieee80211_get_he_iftype_cap(sband, wdev->iftype);
5172                 if (!he_cap)
5173                         continue;
5174
5175                 he_tx_mcs_map = he_get_txmcsmap(info, link_id, he_cap);
5176                 he_build_mcs_mask(he_tx_mcs_map, mask->control[i].he_mcs);
5177
5178                 mask->control[i].he_gi = 0xFF;
5179                 mask->control[i].he_ltf = 0xFF;
5180         }
5181
5182         /* if no rates are given set it back to the defaults */
5183         if (!attrs[attr])
5184                 goto out;
5185
5186         /* The nested attribute uses enum nl80211_band as the index. This maps
5187          * directly to the enum nl80211_band values used in cfg80211.
5188          */
5189         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
5190         nla_for_each_nested(tx_rates, attrs[attr], rem) {
5191                 enum nl80211_band band = nla_type(tx_rates);
5192                 int err;
5193
5194                 if (band < 0 || band >= NUM_NL80211_BANDS)
5195                         return -EINVAL;
5196                 sband = rdev->wiphy.bands[band];
5197                 if (sband == NULL)
5198                         return -EINVAL;
5199                 err = nla_parse_nested_deprecated(tb, NL80211_TXRATE_MAX,
5200                                                   tx_rates,
5201                                                   nl80211_txattr_policy,
5202                                                   info->extack);
5203                 if (err)
5204                         return err;
5205                 if (tb[NL80211_TXRATE_LEGACY]) {
5206                         mask->control[band].legacy = rateset_to_mask(
5207                                 sband,
5208                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
5209                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
5210                         if ((mask->control[band].legacy == 0) &&
5211                             nla_len(tb[NL80211_TXRATE_LEGACY]))
5212                                 return -EINVAL;
5213                 }
5214                 if (tb[NL80211_TXRATE_HT]) {
5215                         if (!ht_rateset_to_mask(
5216                                         sband,
5217                                         nla_data(tb[NL80211_TXRATE_HT]),
5218                                         nla_len(tb[NL80211_TXRATE_HT]),
5219                                         mask->control[band].ht_mcs))
5220                                 return -EINVAL;
5221                 }
5222
5223                 if (tb[NL80211_TXRATE_VHT]) {
5224                         if (!vht_set_mcs_mask(
5225                                         sband,
5226                                         nla_data(tb[NL80211_TXRATE_VHT]),
5227                                         mask->control[band].vht_mcs))
5228                                 return -EINVAL;
5229                 }
5230
5231                 if (tb[NL80211_TXRATE_GI]) {
5232                         mask->control[band].gi =
5233                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
5234                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
5235                                 return -EINVAL;
5236                 }
5237                 if (tb[NL80211_TXRATE_HE] &&
5238                     !he_set_mcs_mask(info, wdev, sband,
5239                                      nla_data(tb[NL80211_TXRATE_HE]),
5240                                      mask->control[band].he_mcs,
5241                                      link_id))
5242                         return -EINVAL;
5243
5244                 if (tb[NL80211_TXRATE_HE_GI])
5245                         mask->control[band].he_gi =
5246                                 nla_get_u8(tb[NL80211_TXRATE_HE_GI]);
5247                 if (tb[NL80211_TXRATE_HE_LTF])
5248                         mask->control[band].he_ltf =
5249                                 nla_get_u8(tb[NL80211_TXRATE_HE_LTF]);
5250
5251                 if (mask->control[band].legacy == 0) {
5252                         /* don't allow empty legacy rates if HT, VHT or HE
5253                          * are not even supported.
5254                          */
5255                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
5256                               rdev->wiphy.bands[band]->vht_cap.vht_supported ||
5257                               ieee80211_get_he_iftype_cap(sband, wdev->iftype)))
5258                                 return -EINVAL;
5259
5260                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
5261                                 if (mask->control[band].ht_mcs[i])
5262                                         goto out;
5263
5264                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
5265                                 if (mask->control[band].vht_mcs[i])
5266                                         goto out;
5267
5268                         for (i = 0; i < NL80211_HE_NSS_MAX; i++)
5269                                 if (mask->control[band].he_mcs[i])
5270                                         goto out;
5271
5272                         /* legacy and mcs rates may not be both empty */
5273                         return -EINVAL;
5274                 }
5275         }
5276
5277 out:
5278         return 0;
5279 }
5280
5281 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
5282                                    enum nl80211_band band,
5283                                    struct cfg80211_bitrate_mask *beacon_rate)
5284 {
5285         u32 count_ht, count_vht, count_he, i;
5286         u32 rate = beacon_rate->control[band].legacy;
5287
5288         /* Allow only one rate */
5289         if (hweight32(rate) > 1)
5290                 return -EINVAL;
5291
5292         count_ht = 0;
5293         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
5294                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
5295                         return -EINVAL;
5296                 } else if (beacon_rate->control[band].ht_mcs[i]) {
5297                         count_ht++;
5298                         if (count_ht > 1)
5299                                 return -EINVAL;
5300                 }
5301                 if (count_ht && rate)
5302                         return -EINVAL;
5303         }
5304
5305         count_vht = 0;
5306         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
5307                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
5308                         return -EINVAL;
5309                 } else if (beacon_rate->control[band].vht_mcs[i]) {
5310                         count_vht++;
5311                         if (count_vht > 1)
5312                                 return -EINVAL;
5313                 }
5314                 if (count_vht && rate)
5315                         return -EINVAL;
5316         }
5317
5318         count_he = 0;
5319         for (i = 0; i < NL80211_HE_NSS_MAX; i++) {
5320                 if (hweight16(beacon_rate->control[band].he_mcs[i]) > 1) {
5321                         return -EINVAL;
5322                 } else if (beacon_rate->control[band].he_mcs[i]) {
5323                         count_he++;
5324                         if (count_he > 1)
5325                                 return -EINVAL;
5326                 }
5327                 if (count_he && rate)
5328                         return -EINVAL;
5329         }
5330
5331         if ((count_ht && count_vht && count_he) ||
5332             (!rate && !count_ht && !count_vht && !count_he))
5333                 return -EINVAL;
5334
5335         if (rate &&
5336             !wiphy_ext_feature_isset(&rdev->wiphy,
5337                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
5338                 return -EINVAL;
5339         if (count_ht &&
5340             !wiphy_ext_feature_isset(&rdev->wiphy,
5341                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
5342                 return -EINVAL;
5343         if (count_vht &&
5344             !wiphy_ext_feature_isset(&rdev->wiphy,
5345                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
5346                 return -EINVAL;
5347         if (count_he &&
5348             !wiphy_ext_feature_isset(&rdev->wiphy,
5349                                      NL80211_EXT_FEATURE_BEACON_RATE_HE))
5350                 return -EINVAL;
5351
5352         return 0;
5353 }
5354
5355 static int nl80211_parse_mbssid_config(struct wiphy *wiphy,
5356                                        struct net_device *dev,
5357                                        struct nlattr *attrs,
5358                                        struct cfg80211_mbssid_config *config,
5359                                        u8 num_elems)
5360 {
5361         struct nlattr *tb[NL80211_MBSSID_CONFIG_ATTR_MAX + 1];
5362
5363         if (!wiphy->mbssid_max_interfaces)
5364                 return -EOPNOTSUPP;
5365
5366         if (nla_parse_nested(tb, NL80211_MBSSID_CONFIG_ATTR_MAX, attrs, NULL,
5367                              NULL) ||
5368             !tb[NL80211_MBSSID_CONFIG_ATTR_INDEX])
5369                 return -EINVAL;
5370
5371         config->ema = nla_get_flag(tb[NL80211_MBSSID_CONFIG_ATTR_EMA]);
5372         if (config->ema) {
5373                 if (!wiphy->ema_max_profile_periodicity)
5374                         return -EOPNOTSUPP;
5375
5376                 if (num_elems > wiphy->ema_max_profile_periodicity)
5377                         return -EINVAL;
5378         }
5379
5380         config->index = nla_get_u8(tb[NL80211_MBSSID_CONFIG_ATTR_INDEX]);
5381         if (config->index >= wiphy->mbssid_max_interfaces ||
5382             (!config->index && !num_elems))
5383                 return -EINVAL;
5384
5385         if (tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]) {
5386                 u32 tx_ifindex =
5387                         nla_get_u32(tb[NL80211_MBSSID_CONFIG_ATTR_TX_IFINDEX]);
5388
5389                 if ((!config->index && tx_ifindex != dev->ifindex) ||
5390                     (config->index && tx_ifindex == dev->ifindex))
5391                         return -EINVAL;
5392
5393                 if (tx_ifindex != dev->ifindex) {
5394                         struct net_device *tx_netdev =
5395                                 dev_get_by_index(wiphy_net(wiphy), tx_ifindex);
5396
5397                         if (!tx_netdev || !tx_netdev->ieee80211_ptr ||
5398                             tx_netdev->ieee80211_ptr->wiphy != wiphy ||
5399                             tx_netdev->ieee80211_ptr->iftype !=
5400                                                         NL80211_IFTYPE_AP) {
5401                                 dev_put(tx_netdev);
5402                                 return -EINVAL;
5403                         }
5404
5405                         config->tx_wdev = tx_netdev->ieee80211_ptr;
5406                 } else {
5407                         config->tx_wdev = dev->ieee80211_ptr;
5408                 }
5409         } else if (!config->index) {
5410                 config->tx_wdev = dev->ieee80211_ptr;
5411         } else {
5412                 return -EINVAL;
5413         }
5414
5415         return 0;
5416 }
5417
5418 static struct cfg80211_mbssid_elems *
5419 nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs)
5420 {
5421         struct nlattr *nl_elems;
5422         struct cfg80211_mbssid_elems *elems;
5423         int rem_elems;
5424         u8 i = 0, num_elems = 0;
5425
5426         if (!wiphy->mbssid_max_interfaces)
5427                 return ERR_PTR(-EINVAL);
5428
5429         nla_for_each_nested(nl_elems, attrs, rem_elems)
5430                 num_elems++;
5431
5432         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5433         if (!elems)
5434                 return ERR_PTR(-ENOMEM);
5435
5436         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5437                 elems->elem[i].data = nla_data(nl_elems);
5438                 elems->elem[i].len = nla_len(nl_elems);
5439                 i++;
5440         }
5441         elems->cnt = num_elems;
5442         return elems;
5443 }
5444
5445 static struct cfg80211_rnr_elems *
5446 nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
5447                         struct netlink_ext_ack *extack)
5448 {
5449         struct nlattr *nl_elems;
5450         struct cfg80211_rnr_elems *elems;
5451         int rem_elems;
5452         u8 i = 0, num_elems = 0;
5453
5454         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5455                 int ret;
5456
5457                 ret = validate_ie_attr(nl_elems, extack);
5458                 if (ret)
5459                         return ERR_PTR(ret);
5460
5461                 num_elems++;
5462         }
5463
5464         elems = kzalloc(struct_size(elems, elem, num_elems), GFP_KERNEL);
5465         if (!elems)
5466                 return ERR_PTR(-ENOMEM);
5467
5468         nla_for_each_nested(nl_elems, attrs, rem_elems) {
5469                 elems->elem[i].data = nla_data(nl_elems);
5470                 elems->elem[i].len = nla_len(nl_elems);
5471                 i++;
5472         }
5473         elems->cnt = num_elems;
5474         return elems;
5475 }
5476
5477 static int nl80211_parse_he_bss_color(struct nlattr *attrs,
5478                                       struct cfg80211_he_bss_color *he_bss_color)
5479 {
5480         struct nlattr *tb[NL80211_HE_BSS_COLOR_ATTR_MAX + 1];
5481         int err;
5482
5483         err = nla_parse_nested(tb, NL80211_HE_BSS_COLOR_ATTR_MAX, attrs,
5484                                he_bss_color_policy, NULL);
5485         if (err)
5486                 return err;
5487
5488         if (!tb[NL80211_HE_BSS_COLOR_ATTR_COLOR])
5489                 return -EINVAL;
5490
5491         he_bss_color->color =
5492                 nla_get_u8(tb[NL80211_HE_BSS_COLOR_ATTR_COLOR]);
5493         he_bss_color->enabled =
5494                 !nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_DISABLED]);
5495         he_bss_color->partial =
5496                 nla_get_flag(tb[NL80211_HE_BSS_COLOR_ATTR_PARTIAL]);
5497
5498         return 0;
5499 }
5500
5501 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
5502                                 struct nlattr *attrs[],
5503                                 struct cfg80211_beacon_data *bcn,
5504                                 struct netlink_ext_ack *extack)
5505 {
5506         bool haveinfo = false;
5507         int err;
5508
5509         memset(bcn, 0, sizeof(*bcn));
5510
5511         bcn->link_id = nl80211_link_id(attrs);
5512
5513         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
5514                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
5515                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
5516                 if (!bcn->head_len)
5517                         return -EINVAL;
5518                 haveinfo = true;
5519         }
5520
5521         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
5522                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
5523                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
5524                 haveinfo = true;
5525         }
5526
5527         if (!haveinfo)
5528                 return -EINVAL;
5529
5530         if (attrs[NL80211_ATTR_IE]) {
5531                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
5532                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
5533         }
5534
5535         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
5536                 bcn->proberesp_ies =
5537                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5538                 bcn->proberesp_ies_len =
5539                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
5540         }
5541
5542         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
5543                 bcn->assocresp_ies =
5544                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5545                 bcn->assocresp_ies_len =
5546                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
5547         }
5548
5549         if (attrs[NL80211_ATTR_PROBE_RESP]) {
5550                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
5551                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
5552         }
5553
5554         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
5555                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
5556
5557                 err = nla_parse_nested_deprecated(tb,
5558                                                   NL80211_FTM_RESP_ATTR_MAX,
5559                                                   attrs[NL80211_ATTR_FTM_RESPONDER],
5560                                                   NULL, NULL);
5561                 if (err)
5562                         return err;
5563
5564                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
5565                     wiphy_ext_feature_isset(&rdev->wiphy,
5566                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
5567                         bcn->ftm_responder = 1;
5568                 else
5569                         return -EOPNOTSUPP;
5570
5571                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
5572                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
5573                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
5574                 }
5575
5576                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
5577                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5578                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
5579                 }
5580         } else {
5581                 bcn->ftm_responder = -1;
5582         }
5583
5584         if (attrs[NL80211_ATTR_HE_BSS_COLOR]) {
5585                 err = nl80211_parse_he_bss_color(attrs[NL80211_ATTR_HE_BSS_COLOR],
5586                                                  &bcn->he_bss_color);
5587                 if (err)
5588                         return err;
5589                 bcn->he_bss_color_valid = true;
5590         }
5591
5592         if (attrs[NL80211_ATTR_MBSSID_ELEMS]) {
5593                 struct cfg80211_mbssid_elems *mbssid =
5594                         nl80211_parse_mbssid_elems(&rdev->wiphy,
5595                                                    attrs[NL80211_ATTR_MBSSID_ELEMS]);
5596
5597                 if (IS_ERR(mbssid))
5598                         return PTR_ERR(mbssid);
5599
5600                 bcn->mbssid_ies = mbssid;
5601
5602                 if (bcn->mbssid_ies && attrs[NL80211_ATTR_EMA_RNR_ELEMS]) {
5603                         struct cfg80211_rnr_elems *rnr =
5604                                 nl80211_parse_rnr_elems(&rdev->wiphy,
5605                                                         attrs[NL80211_ATTR_EMA_RNR_ELEMS],
5606                                                         extack);
5607
5608                         if (IS_ERR(rnr))
5609                                 return PTR_ERR(rnr);
5610
5611                         if (rnr && rnr->cnt < bcn->mbssid_ies->cnt)
5612                                 return -EINVAL;
5613
5614                         bcn->rnr_ies = rnr;
5615                 }
5616         }
5617
5618         return 0;
5619 }
5620
5621 static int nl80211_parse_he_obss_pd(struct nlattr *attrs,
5622                                     struct ieee80211_he_obss_pd *he_obss_pd)
5623 {
5624         struct nlattr *tb[NL80211_HE_OBSS_PD_ATTR_MAX + 1];
5625         int err;
5626
5627         err = nla_parse_nested(tb, NL80211_HE_OBSS_PD_ATTR_MAX, attrs,
5628                                he_obss_pd_policy, NULL);
5629         if (err)
5630                 return err;
5631
5632         if (!tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL])
5633                 return -EINVAL;
5634
5635         he_obss_pd->sr_ctrl = nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_SR_CTRL]);
5636
5637         if (tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET])
5638                 he_obss_pd->min_offset =
5639                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MIN_OFFSET]);
5640         if (tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET])
5641                 he_obss_pd->max_offset =
5642                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_MAX_OFFSET]);
5643         if (tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET])
5644                 he_obss_pd->non_srg_max_offset =
5645                         nla_get_u8(tb[NL80211_HE_OBSS_PD_ATTR_NON_SRG_MAX_OFFSET]);
5646
5647         if (he_obss_pd->min_offset > he_obss_pd->max_offset)
5648                 return -EINVAL;
5649
5650         if (tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP])
5651                 memcpy(he_obss_pd->bss_color_bitmap,
5652                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_BSS_COLOR_BITMAP]),
5653                        sizeof(he_obss_pd->bss_color_bitmap));
5654
5655         if (tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP])
5656                 memcpy(he_obss_pd->partial_bssid_bitmap,
5657                        nla_data(tb[NL80211_HE_OBSS_PD_ATTR_PARTIAL_BSSID_BITMAP]),
5658                        sizeof(he_obss_pd->partial_bssid_bitmap));
5659
5660         he_obss_pd->enable = true;
5661
5662         return 0;
5663 }
5664
5665 static int nl80211_parse_fils_discovery(struct cfg80211_registered_device *rdev,
5666                                         struct nlattr *attrs,
5667                                         struct cfg80211_ap_settings *params)
5668 {
5669         struct nlattr *tb[NL80211_FILS_DISCOVERY_ATTR_MAX + 1];
5670         int ret;
5671         struct cfg80211_fils_discovery *fd = &params->fils_discovery;
5672
5673         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5674                                      NL80211_EXT_FEATURE_FILS_DISCOVERY))
5675                 return -EINVAL;
5676
5677         ret = nla_parse_nested(tb, NL80211_FILS_DISCOVERY_ATTR_MAX, attrs,
5678                                NULL, NULL);
5679         if (ret)
5680                 return ret;
5681
5682         if (!tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN] ||
5683             !tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX] ||
5684             !tb[NL80211_FILS_DISCOVERY_ATTR_TMPL])
5685                 return -EINVAL;
5686
5687         fd->tmpl_len = nla_len(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5688         fd->tmpl = nla_data(tb[NL80211_FILS_DISCOVERY_ATTR_TMPL]);
5689         fd->min_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MIN]);
5690         fd->max_interval = nla_get_u32(tb[NL80211_FILS_DISCOVERY_ATTR_INT_MAX]);
5691
5692         return 0;
5693 }
5694
5695 static int
5696 nl80211_parse_unsol_bcast_probe_resp(struct cfg80211_registered_device *rdev,
5697                                      struct nlattr *attrs,
5698                                      struct cfg80211_ap_settings *params)
5699 {
5700         struct nlattr *tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX + 1];
5701         int ret;
5702         struct cfg80211_unsol_bcast_probe_resp *presp =
5703                                         &params->unsol_bcast_probe_resp;
5704
5705         if (!wiphy_ext_feature_isset(&rdev->wiphy,
5706                                      NL80211_EXT_FEATURE_UNSOL_BCAST_PROBE_RESP))
5707                 return -EINVAL;
5708
5709         ret = nla_parse_nested(tb, NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_MAX,
5710                                attrs, NULL, NULL);
5711         if (ret)
5712                 return ret;
5713
5714         if (!tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT] ||
5715             !tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL])
5716                 return -EINVAL;
5717
5718         presp->tmpl = nla_data(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5719         presp->tmpl_len = nla_len(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_TMPL]);
5720         presp->interval = nla_get_u32(tb[NL80211_UNSOL_BCAST_PROBE_RESP_ATTR_INT]);
5721         return 0;
5722 }
5723
5724 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
5725                                             const struct element *rates)
5726 {
5727         int i;
5728
5729         if (!rates)
5730                 return;
5731
5732         for (i = 0; i < rates->datalen; i++) {
5733                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
5734                         params->ht_required = true;
5735                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
5736                         params->vht_required = true;
5737                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_HE_PHY)
5738                         params->he_required = true;
5739                 if (rates->data[i] == BSS_MEMBERSHIP_SELECTOR_SAE_H2E)
5740                         params->sae_h2e_required = true;
5741         }
5742 }
5743
5744 /*
5745  * Since the nl80211 API didn't include, from the beginning, attributes about
5746  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
5747  * benefit of drivers that rebuild IEs in the firmware.
5748  */
5749 static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
5750 {
5751         const struct cfg80211_beacon_data *bcn = &params->beacon;
5752         size_t ies_len = bcn->tail_len;
5753         const u8 *ies = bcn->tail;
5754         const struct element *rates;
5755         const struct element *cap;
5756
5757         rates = cfg80211_find_elem(WLAN_EID_SUPP_RATES, ies, ies_len);
5758         nl80211_check_ap_rate_selectors(params, rates);
5759
5760         rates = cfg80211_find_elem(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
5761         nl80211_check_ap_rate_selectors(params, rates);
5762
5763         cap = cfg80211_find_elem(WLAN_EID_HT_CAPABILITY, ies, ies_len);
5764         if (cap && cap->datalen >= sizeof(*params->ht_cap))
5765                 params->ht_cap = (void *)cap->data;
5766         cap = cfg80211_find_elem(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
5767         if (cap && cap->datalen >= sizeof(*params->vht_cap))
5768                 params->vht_cap = (void *)cap->data;
5769         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
5770         if (cap && cap->datalen >= sizeof(*params->he_cap) + 1)
5771                 params->he_cap = (void *)(cap->data + 1);
5772         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_HE_OPERATION, ies, ies_len);
5773         if (cap && cap->datalen >= sizeof(*params->he_oper) + 1)
5774                 params->he_oper = (void *)(cap->data + 1);
5775         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_CAPABILITY, ies, ies_len);
5776         if (cap) {
5777                 if (!cap->datalen)
5778                         return -EINVAL;
5779                 params->eht_cap = (void *)(cap->data + 1);
5780                 if (!ieee80211_eht_capa_size_ok((const u8 *)params->he_cap,
5781                                                 (const u8 *)params->eht_cap,
5782                                                 cap->datalen - 1, true))
5783                         return -EINVAL;
5784         }
5785         cap = cfg80211_find_ext_elem(WLAN_EID_EXT_EHT_OPERATION, ies, ies_len);
5786         if (cap) {
5787                 if (!cap->datalen)
5788                         return -EINVAL;
5789                 params->eht_oper = (void *)(cap->data + 1);
5790                 if (!ieee80211_eht_oper_size_ok((const u8 *)params->eht_oper,
5791                                                 cap->datalen - 1))
5792                         return -EINVAL;
5793         }
5794         return 0;
5795 }
5796
5797 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
5798                                    struct cfg80211_ap_settings *params)
5799 {
5800         struct wireless_dev *wdev;
5801
5802         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
5803                 if (wdev->iftype != NL80211_IFTYPE_AP &&
5804                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
5805                         continue;
5806
5807                 if (!wdev->u.ap.preset_chandef.chan)
5808                         continue;
5809
5810                 params->chandef = wdev->u.ap.preset_chandef;
5811                 return true;
5812         }
5813
5814         return false;
5815 }
5816
5817 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
5818                                     enum nl80211_auth_type auth_type,
5819                                     enum nl80211_commands cmd)
5820 {
5821         if (auth_type > NL80211_AUTHTYPE_MAX)
5822                 return false;
5823
5824         switch (cmd) {
5825         case NL80211_CMD_AUTHENTICATE:
5826                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5827                     auth_type == NL80211_AUTHTYPE_SAE)
5828                         return false;
5829                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5830                                              NL80211_EXT_FEATURE_FILS_STA) &&
5831                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5832                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5833                      auth_type == NL80211_AUTHTYPE_FILS_PK))
5834                         return false;
5835                 return true;
5836         case NL80211_CMD_CONNECT:
5837                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
5838                     !wiphy_ext_feature_isset(&rdev->wiphy,
5839                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
5840                     auth_type == NL80211_AUTHTYPE_SAE)
5841                         return false;
5842
5843                 /* FILS with SK PFS or PK not supported yet */
5844                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5845                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5846                         return false;
5847                 if (!wiphy_ext_feature_isset(
5848                             &rdev->wiphy,
5849                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
5850                     auth_type == NL80211_AUTHTYPE_FILS_SK)
5851                         return false;
5852                 return true;
5853         case NL80211_CMD_START_AP:
5854                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
5855                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP) &&
5856                     auth_type == NL80211_AUTHTYPE_SAE)
5857                         return false;
5858                 /* FILS not supported yet */
5859                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
5860                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
5861                     auth_type == NL80211_AUTHTYPE_FILS_PK)
5862                         return false;
5863                 return true;
5864         default:
5865                 return false;
5866         }
5867 }
5868
5869 static void nl80211_send_ap_started(struct wireless_dev *wdev,
5870                                     unsigned int link_id)
5871 {
5872         struct wiphy *wiphy = wdev->wiphy;
5873         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
5874         struct sk_buff *msg;
5875         void *hdr;
5876
5877         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5878         if (!msg)
5879                 return;
5880
5881         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_START_AP);
5882         if (!hdr)
5883                 goto out;
5884
5885         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
5886             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
5887             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
5888                               NL80211_ATTR_PAD) ||
5889             (wdev->u.ap.ssid_len &&
5890              nla_put(msg, NL80211_ATTR_SSID, wdev->u.ap.ssid_len,
5891                      wdev->u.ap.ssid)) ||
5892             (wdev->valid_links &&
5893              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
5894                 goto out;
5895
5896         genlmsg_end(msg, hdr);
5897
5898         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
5899                                 NL80211_MCGRP_MLME, GFP_KERNEL);
5900         return;
5901 out:
5902         nlmsg_free(msg);
5903 }
5904
5905 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
5906 {
5907         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5908         unsigned int link_id = nl80211_link_id(info->attrs);
5909         struct net_device *dev = info->user_ptr[1];
5910         struct wireless_dev *wdev = dev->ieee80211_ptr;
5911         struct cfg80211_ap_settings *params;
5912         int err;
5913
5914         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5915             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5916                 return -EOPNOTSUPP;
5917
5918         if (!rdev->ops->start_ap)
5919                 return -EOPNOTSUPP;
5920
5921         if (wdev->links[link_id].ap.beacon_interval)
5922                 return -EALREADY;
5923
5924         /* these are required for START_AP */
5925         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
5926             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
5927             !info->attrs[NL80211_ATTR_BEACON_HEAD])
5928                 return -EINVAL;
5929
5930         params = kzalloc(sizeof(*params), GFP_KERNEL);
5931         if (!params)
5932                 return -ENOMEM;
5933
5934         err = nl80211_parse_beacon(rdev, info->attrs, &params->beacon,
5935                                    info->extack);
5936         if (err)
5937                 goto out;
5938
5939         params->beacon_interval =
5940                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
5941         params->dtim_period =
5942                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
5943
5944         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
5945                                            params->beacon_interval);
5946         if (err)
5947                 goto out;
5948
5949         /*
5950          * In theory, some of these attributes should be required here
5951          * but since they were not used when the command was originally
5952          * added, keep them optional for old user space programs to let
5953          * them continue to work with drivers that do not need the
5954          * additional information -- drivers must check!
5955          */
5956         if (info->attrs[NL80211_ATTR_SSID]) {
5957                 params->ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
5958                 params->ssid_len =
5959                         nla_len(info->attrs[NL80211_ATTR_SSID]);
5960                 if (params->ssid_len == 0) {
5961                         err = -EINVAL;
5962                         goto out;
5963                 }
5964
5965                 if (wdev->u.ap.ssid_len &&
5966                     (wdev->u.ap.ssid_len != params->ssid_len ||
5967                      memcmp(wdev->u.ap.ssid, params->ssid, params->ssid_len))) {
5968                         /* require identical SSID for MLO */
5969                         err = -EINVAL;
5970                         goto out;
5971                 }
5972         } else if (wdev->valid_links) {
5973                 /* require SSID for MLO */
5974                 err = -EINVAL;
5975                 goto out;
5976         }
5977
5978         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
5979                 params->hidden_ssid = nla_get_u32(
5980                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
5981
5982         params->privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
5983
5984         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
5985                 params->auth_type = nla_get_u32(
5986                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
5987                 if (!nl80211_valid_auth_type(rdev, params->auth_type,
5988                                              NL80211_CMD_START_AP)) {
5989                         err = -EINVAL;
5990                         goto out;
5991                 }
5992         } else
5993                 params->auth_type = NL80211_AUTHTYPE_AUTOMATIC;
5994
5995         err = nl80211_crypto_settings(rdev, info, &params->crypto,
5996                                       NL80211_MAX_NR_CIPHER_SUITES);
5997         if (err)
5998                 goto out;
5999
6000         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
6001                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER)) {
6002                         err = -EOPNOTSUPP;
6003                         goto out;
6004                 }
6005                 params->inactivity_timeout = nla_get_u16(
6006                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
6007         }
6008
6009         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
6010                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6011                         err = -EINVAL;
6012                         goto out;
6013                 }
6014                 params->p2p_ctwindow =
6015                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
6016                 if (params->p2p_ctwindow != 0 &&
6017                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN)) {
6018                         err = -EINVAL;
6019                         goto out;
6020                 }
6021         }
6022
6023         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
6024                 u8 tmp;
6025
6026                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6027                         err = -EINVAL;
6028                         goto out;
6029                 }
6030                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
6031                 params->p2p_opp_ps = tmp;
6032                 if (params->p2p_opp_ps != 0 &&
6033                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS)) {
6034                         err = -EINVAL;
6035                         goto out;
6036                 }
6037         }
6038
6039         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
6040                 err = nl80211_parse_chandef(rdev, info, &params->chandef);
6041                 if (err)
6042                         goto out;
6043         } else if (wdev->valid_links) {
6044                 /* with MLD need to specify the channel configuration */
6045                 err = -EINVAL;
6046                 goto out;
6047         } else if (wdev->u.ap.preset_chandef.chan) {
6048                 params->chandef = wdev->u.ap.preset_chandef;
6049         } else if (!nl80211_get_ap_channel(rdev, params)) {
6050                 err = -EINVAL;
6051                 goto out;
6052         }
6053
6054         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
6055                 err = nl80211_parse_punct_bitmap(rdev, info,
6056                                                  &params->chandef,
6057                                                  &params->punct_bitmap);
6058                 if (err)
6059                         goto out;
6060         }
6061
6062         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params->chandef,
6063                                            wdev->iftype)) {
6064                 err = -EINVAL;
6065                 goto out;
6066         }
6067
6068         wdev_lock(wdev);
6069
6070         if (info->attrs[NL80211_ATTR_TX_RATES]) {
6071                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
6072                                                     NL80211_ATTR_TX_RATES,
6073                                                     &params->beacon_rate,
6074                                                     dev, false, link_id);
6075                 if (err)
6076                         goto out_unlock;
6077
6078                 err = validate_beacon_tx_rate(rdev, params->chandef.chan->band,
6079                                               &params->beacon_rate);
6080                 if (err)
6081                         goto out_unlock;
6082         }
6083
6084         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
6085                 params->smps_mode =
6086                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
6087                 switch (params->smps_mode) {
6088                 case NL80211_SMPS_OFF:
6089                         break;
6090                 case NL80211_SMPS_STATIC:
6091                         if (!(rdev->wiphy.features &
6092                               NL80211_FEATURE_STATIC_SMPS)) {
6093                                 err = -EINVAL;
6094                                 goto out_unlock;
6095                         }
6096                         break;
6097                 case NL80211_SMPS_DYNAMIC:
6098                         if (!(rdev->wiphy.features &
6099                               NL80211_FEATURE_DYNAMIC_SMPS)) {
6100                                 err = -EINVAL;
6101                                 goto out_unlock;
6102                         }
6103                         break;
6104                 default:
6105                         err = -EINVAL;
6106                         goto out_unlock;
6107                 }
6108         } else {
6109                 params->smps_mode = NL80211_SMPS_OFF;
6110         }
6111
6112         params->pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
6113         if (params->pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
6114                 err = -EOPNOTSUPP;
6115                 goto out_unlock;
6116         }
6117
6118         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
6119                 params->acl = parse_acl_data(&rdev->wiphy, info);
6120                 if (IS_ERR(params->acl)) {
6121                         err = PTR_ERR(params->acl);
6122                         params->acl = NULL;
6123                         goto out_unlock;
6124                 }
6125         }
6126
6127         params->twt_responder =
6128                     nla_get_flag(info->attrs[NL80211_ATTR_TWT_RESPONDER]);
6129
6130         if (info->attrs[NL80211_ATTR_HE_OBSS_PD]) {
6131                 err = nl80211_parse_he_obss_pd(
6132                                         info->attrs[NL80211_ATTR_HE_OBSS_PD],
6133                                         &params->he_obss_pd);
6134                 if (err)
6135                         goto out_unlock;
6136         }
6137
6138         if (info->attrs[NL80211_ATTR_FILS_DISCOVERY]) {
6139                 err = nl80211_parse_fils_discovery(rdev,
6140                                                    info->attrs[NL80211_ATTR_FILS_DISCOVERY],
6141                                                    params);
6142                 if (err)
6143                         goto out_unlock;
6144         }
6145
6146         if (info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP]) {
6147                 err = nl80211_parse_unsol_bcast_probe_resp(
6148                         rdev, info->attrs[NL80211_ATTR_UNSOL_BCAST_PROBE_RESP],
6149                         params);
6150                 if (err)
6151                         goto out_unlock;
6152         }
6153
6154         if (info->attrs[NL80211_ATTR_MBSSID_CONFIG]) {
6155                 err = nl80211_parse_mbssid_config(&rdev->wiphy, dev,
6156                                                   info->attrs[NL80211_ATTR_MBSSID_CONFIG],
6157                                                   &params->mbssid_config,
6158                                                   params->beacon.mbssid_ies ?
6159                                                         params->beacon.mbssid_ies->cnt :
6160                                                         0);
6161                 if (err)
6162                         goto out_unlock;
6163         }
6164
6165         if (!params->mbssid_config.ema && params->beacon.rnr_ies) {
6166                 err = -EINVAL;
6167                 goto out_unlock;
6168         }
6169
6170         err = nl80211_calculate_ap_params(params);
6171         if (err)
6172                 goto out_unlock;
6173
6174         if (info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS])
6175                 params->flags = nla_get_u32(
6176                         info->attrs[NL80211_ATTR_AP_SETTINGS_FLAGS]);
6177         else if (info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])
6178                 params->flags |= NL80211_AP_SETTINGS_EXTERNAL_AUTH_SUPPORT;
6179
6180         if (wdev->conn_owner_nlportid &&
6181             info->attrs[NL80211_ATTR_SOCKET_OWNER] &&
6182             wdev->conn_owner_nlportid != info->snd_portid) {
6183                 err = -EINVAL;
6184                 goto out_unlock;
6185         }
6186
6187         /* FIXME: validate MLO/link-id against driver capabilities */
6188
6189         err = rdev_start_ap(rdev, dev, params);
6190         if (!err) {
6191                 wdev->links[link_id].ap.beacon_interval = params->beacon_interval;
6192                 wdev->links[link_id].ap.chandef = params->chandef;
6193                 wdev->u.ap.ssid_len = params->ssid_len;
6194                 memcpy(wdev->u.ap.ssid, params->ssid,
6195                        params->ssid_len);
6196
6197                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
6198                         wdev->conn_owner_nlportid = info->snd_portid;
6199
6200                 nl80211_send_ap_started(wdev, link_id);
6201         }
6202 out_unlock:
6203         wdev_unlock(wdev);
6204 out:
6205         kfree(params->acl);
6206         kfree(params->beacon.mbssid_ies);
6207         if (params->mbssid_config.tx_wdev &&
6208             params->mbssid_config.tx_wdev->netdev &&
6209             params->mbssid_config.tx_wdev->netdev != dev)
6210                 dev_put(params->mbssid_config.tx_wdev->netdev);
6211         kfree(params->beacon.rnr_ies);
6212         kfree(params);
6213
6214         return err;
6215 }
6216
6217 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
6218 {
6219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6220         unsigned int link_id = nl80211_link_id(info->attrs);
6221         struct net_device *dev = info->user_ptr[1];
6222         struct wireless_dev *wdev = dev->ieee80211_ptr;
6223         struct cfg80211_beacon_data params;
6224         int err;
6225
6226         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6227             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
6228                 return -EOPNOTSUPP;
6229
6230         if (!rdev->ops->change_beacon)
6231                 return -EOPNOTSUPP;
6232
6233         if (!wdev->links[link_id].ap.beacon_interval)
6234                 return -EINVAL;
6235
6236         err = nl80211_parse_beacon(rdev, info->attrs, &params, info->extack);
6237         if (err)
6238                 goto out;
6239
6240         wdev_lock(wdev);
6241         err = rdev_change_beacon(rdev, dev, &params);
6242         wdev_unlock(wdev);
6243
6244 out:
6245         kfree(params.mbssid_ies);
6246         kfree(params.rnr_ies);
6247         return err;
6248 }
6249
6250 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
6251 {
6252         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6253         unsigned int link_id = nl80211_link_id(info->attrs);
6254         struct net_device *dev = info->user_ptr[1];
6255
6256         return cfg80211_stop_ap(rdev, dev, link_id, false);
6257 }
6258
6259 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
6260         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
6261         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
6262         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
6263         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
6264         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
6265         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
6266 };
6267
6268 static int parse_station_flags(struct genl_info *info,
6269                                enum nl80211_iftype iftype,
6270                                struct station_parameters *params)
6271 {
6272         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
6273         struct nlattr *nla;
6274         int flag;
6275
6276         /*
6277          * Try parsing the new attribute first so userspace
6278          * can specify both for older kernels.
6279          */
6280         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
6281         if (nla) {
6282                 struct nl80211_sta_flag_update *sta_flags;
6283
6284                 sta_flags = nla_data(nla);
6285                 params->sta_flags_mask = sta_flags->mask;
6286                 params->sta_flags_set = sta_flags->set;
6287                 params->sta_flags_set &= params->sta_flags_mask;
6288                 if ((params->sta_flags_mask |
6289                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
6290                         return -EINVAL;
6291                 return 0;
6292         }
6293
6294         /* if present, parse the old attribute */
6295
6296         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
6297         if (!nla)
6298                 return 0;
6299
6300         if (nla_parse_nested_deprecated(flags, NL80211_STA_FLAG_MAX, nla, sta_flags_policy, info->extack))
6301                 return -EINVAL;
6302
6303         /*
6304          * Only allow certain flags for interface types so that
6305          * other attributes are silently ignored. Remember that
6306          * this is backward compatibility code with old userspace
6307          * and shouldn't be hit in other cases anyway.
6308          */
6309         switch (iftype) {
6310         case NL80211_IFTYPE_AP:
6311         case NL80211_IFTYPE_AP_VLAN:
6312         case NL80211_IFTYPE_P2P_GO:
6313                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6314                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6315                                          BIT(NL80211_STA_FLAG_WME) |
6316                                          BIT(NL80211_STA_FLAG_MFP);
6317                 break;
6318         case NL80211_IFTYPE_P2P_CLIENT:
6319         case NL80211_IFTYPE_STATION:
6320                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
6321                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
6322                 break;
6323         case NL80211_IFTYPE_MESH_POINT:
6324                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6325                                          BIT(NL80211_STA_FLAG_MFP) |
6326                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
6327                 break;
6328         default:
6329                 return -EINVAL;
6330         }
6331
6332         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
6333                 if (flags[flag]) {
6334                         params->sta_flags_set |= (1<<flag);
6335
6336                         /* no longer support new API additions in old API */
6337                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
6338                                 return -EINVAL;
6339                 }
6340         }
6341
6342         return 0;
6343 }
6344
6345 bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info, int attr)
6346 {
6347         struct nlattr *rate;
6348         u32 bitrate;
6349         u16 bitrate_compat;
6350         enum nl80211_rate_info rate_flg;
6351
6352         rate = nla_nest_start_noflag(msg, attr);
6353         if (!rate)
6354                 return false;
6355
6356         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
6357         bitrate = cfg80211_calculate_bitrate(info);
6358         /* report 16-bit bitrate only if we can */
6359         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
6360         if (bitrate > 0 &&
6361             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
6362                 return false;
6363         if (bitrate_compat > 0 &&
6364             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
6365                 return false;
6366
6367         switch (info->bw) {
6368         case RATE_INFO_BW_5:
6369                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
6370                 break;
6371         case RATE_INFO_BW_10:
6372                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
6373                 break;
6374         default:
6375                 WARN_ON(1);
6376                 fallthrough;
6377         case RATE_INFO_BW_20:
6378                 rate_flg = 0;
6379                 break;
6380         case RATE_INFO_BW_40:
6381                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
6382                 break;
6383         case RATE_INFO_BW_80:
6384                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
6385                 break;
6386         case RATE_INFO_BW_160:
6387                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
6388                 break;
6389         case RATE_INFO_BW_HE_RU:
6390                 rate_flg = 0;
6391                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
6392                 break;
6393         case RATE_INFO_BW_320:
6394                 rate_flg = NL80211_RATE_INFO_320_MHZ_WIDTH;
6395                 break;
6396         case RATE_INFO_BW_EHT_RU:
6397                 rate_flg = 0;
6398                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_EHT_MCS));
6399                 break;
6400         }
6401
6402         if (rate_flg && nla_put_flag(msg, rate_flg))
6403                 return false;
6404
6405         if (info->flags & RATE_INFO_FLAGS_MCS) {
6406                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
6407                         return false;
6408                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6409                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6410                         return false;
6411         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
6412                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
6413                         return false;
6414                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
6415                         return false;
6416                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
6417                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
6418                         return false;
6419         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
6420                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
6421                         return false;
6422                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
6423                         return false;
6424                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
6425                         return false;
6426                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
6427                         return false;
6428                 if (info->bw == RATE_INFO_BW_HE_RU &&
6429                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
6430                                info->he_ru_alloc))
6431                         return false;
6432         } else if (info->flags & RATE_INFO_FLAGS_EHT_MCS) {
6433                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_MCS, info->mcs))
6434                         return false;
6435                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_NSS, info->nss))
6436                         return false;
6437                 if (nla_put_u8(msg, NL80211_RATE_INFO_EHT_GI, info->eht_gi))
6438                         return false;
6439                 if (info->bw == RATE_INFO_BW_EHT_RU &&
6440                     nla_put_u8(msg, NL80211_RATE_INFO_EHT_RU_ALLOC,
6441                                info->eht_ru_alloc))
6442                         return false;
6443         }
6444
6445         nla_nest_end(msg, rate);
6446         return true;
6447 }
6448
6449 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
6450                                int id)
6451 {
6452         void *attr;
6453         int i = 0;
6454
6455         if (!mask)
6456                 return true;
6457
6458         attr = nla_nest_start_noflag(msg, id);
6459         if (!attr)
6460                 return false;
6461
6462         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
6463                 if (!(mask & BIT(i)))
6464                         continue;
6465
6466                 if (nla_put_u8(msg, i, signal[i]))
6467                         return false;
6468         }
6469
6470         nla_nest_end(msg, attr);
6471
6472         return true;
6473 }
6474
6475 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
6476                                 u32 seq, int flags,
6477                                 struct cfg80211_registered_device *rdev,
6478                                 struct net_device *dev,
6479                                 const u8 *mac_addr, struct station_info *sinfo)
6480 {
6481         void *hdr;
6482         struct nlattr *sinfoattr, *bss_param;
6483
6484         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
6485         if (!hdr) {
6486                 cfg80211_sinfo_release_content(sinfo);
6487                 return -1;
6488         }
6489
6490         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6491             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
6492             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
6493                 goto nla_put_failure;
6494
6495         sinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_STA_INFO);
6496         if (!sinfoattr)
6497                 goto nla_put_failure;
6498
6499 #define PUT_SINFO(attr, memb, type) do {                                \
6500         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
6501         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6502             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
6503                              sinfo->memb))                              \
6504                 goto nla_put_failure;                                   \
6505         } while (0)
6506 #define PUT_SINFO_U64(attr, memb) do {                                  \
6507         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
6508             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
6509                               sinfo->memb, NL80211_STA_INFO_PAD))       \
6510                 goto nla_put_failure;                                   \
6511         } while (0)
6512
6513         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
6514         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
6515         PUT_SINFO_U64(ASSOC_AT_BOOTTIME, assoc_at);
6516
6517         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
6518                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
6519             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
6520                         (u32)sinfo->rx_bytes))
6521                 goto nla_put_failure;
6522
6523         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
6524                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
6525             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
6526                         (u32)sinfo->tx_bytes))
6527                 goto nla_put_failure;
6528
6529         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
6530         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
6531         PUT_SINFO(LLID, llid, u16);
6532         PUT_SINFO(PLID, plid, u16);
6533         PUT_SINFO(PLINK_STATE, plink_state, u8);
6534         PUT_SINFO_U64(RX_DURATION, rx_duration);
6535         PUT_SINFO_U64(TX_DURATION, tx_duration);
6536
6537         if (wiphy_ext_feature_isset(&rdev->wiphy,
6538                                     NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
6539                 PUT_SINFO(AIRTIME_WEIGHT, airtime_weight, u16);
6540
6541         switch (rdev->wiphy.signal_type) {
6542         case CFG80211_SIGNAL_TYPE_MBM:
6543                 PUT_SINFO(SIGNAL, signal, u8);
6544                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
6545                 break;
6546         default:
6547                 break;
6548         }
6549         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
6550                 if (!nl80211_put_signal(msg, sinfo->chains,
6551                                         sinfo->chain_signal,
6552                                         NL80211_STA_INFO_CHAIN_SIGNAL))
6553                         goto nla_put_failure;
6554         }
6555         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
6556                 if (!nl80211_put_signal(msg, sinfo->chains,
6557                                         sinfo->chain_signal_avg,
6558                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
6559                         goto nla_put_failure;
6560         }
6561         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
6562                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
6563                                           NL80211_STA_INFO_TX_BITRATE))
6564                         goto nla_put_failure;
6565         }
6566         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
6567                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
6568                                           NL80211_STA_INFO_RX_BITRATE))
6569                         goto nla_put_failure;
6570         }
6571
6572         PUT_SINFO(RX_PACKETS, rx_packets, u32);
6573         PUT_SINFO(TX_PACKETS, tx_packets, u32);
6574         PUT_SINFO(TX_RETRIES, tx_retries, u32);
6575         PUT_SINFO(TX_FAILED, tx_failed, u32);
6576         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
6577         PUT_SINFO(AIRTIME_LINK_METRIC, airtime_link_metric, u32);
6578         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
6579         PUT_SINFO(LOCAL_PM, local_pm, u32);
6580         PUT_SINFO(PEER_PM, peer_pm, u32);
6581         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
6582         PUT_SINFO(CONNECTED_TO_GATE, connected_to_gate, u8);
6583         PUT_SINFO(CONNECTED_TO_AS, connected_to_as, u8);
6584
6585         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
6586                 bss_param = nla_nest_start_noflag(msg,
6587                                                   NL80211_STA_INFO_BSS_PARAM);
6588                 if (!bss_param)
6589                         goto nla_put_failure;
6590
6591                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
6592                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
6593                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
6594                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
6595                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
6596                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
6597                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
6598                                sinfo->bss_param.dtim_period) ||
6599                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
6600                                 sinfo->bss_param.beacon_interval))
6601                         goto nla_put_failure;
6602
6603                 nla_nest_end(msg, bss_param);
6604         }
6605         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
6606             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
6607                     sizeof(struct nl80211_sta_flag_update),
6608                     &sinfo->sta_flags))
6609                 goto nla_put_failure;
6610
6611         PUT_SINFO_U64(T_OFFSET, t_offset);
6612         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
6613         PUT_SINFO_U64(BEACON_RX, rx_beacon);
6614         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
6615         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
6616         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
6617         if (wiphy_ext_feature_isset(&rdev->wiphy,
6618                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
6619                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
6620                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
6621         }
6622
6623 #undef PUT_SINFO
6624 #undef PUT_SINFO_U64
6625
6626         if (sinfo->pertid) {
6627                 struct nlattr *tidsattr;
6628                 int tid;
6629
6630                 tidsattr = nla_nest_start_noflag(msg,
6631                                                  NL80211_STA_INFO_TID_STATS);
6632                 if (!tidsattr)
6633                         goto nla_put_failure;
6634
6635                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
6636                         struct cfg80211_tid_stats *tidstats;
6637                         struct nlattr *tidattr;
6638
6639                         tidstats = &sinfo->pertid[tid];
6640
6641                         if (!tidstats->filled)
6642                                 continue;
6643
6644                         tidattr = nla_nest_start_noflag(msg, tid + 1);
6645                         if (!tidattr)
6646                                 goto nla_put_failure;
6647
6648 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
6649         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
6650             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
6651                               tidstats->memb, NL80211_TID_STATS_PAD))   \
6652                 goto nla_put_failure;                                   \
6653         } while (0)
6654
6655                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
6656                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
6657                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
6658                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
6659
6660 #undef PUT_TIDVAL_U64
6661                         if ((tidstats->filled &
6662                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
6663                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
6664                                                    NL80211_TID_STATS_TXQ_STATS))
6665                                 goto nla_put_failure;
6666
6667                         nla_nest_end(msg, tidattr);
6668                 }
6669
6670                 nla_nest_end(msg, tidsattr);
6671         }
6672
6673         nla_nest_end(msg, sinfoattr);
6674
6675         if (sinfo->assoc_req_ies_len &&
6676             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
6677                     sinfo->assoc_req_ies))
6678                 goto nla_put_failure;
6679
6680         if (sinfo->assoc_resp_ies_len &&
6681             nla_put(msg, NL80211_ATTR_RESP_IE, sinfo->assoc_resp_ies_len,
6682                     sinfo->assoc_resp_ies))
6683                 goto nla_put_failure;
6684
6685         if (sinfo->mlo_params_valid) {
6686                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
6687                                sinfo->assoc_link_id))
6688                         goto nla_put_failure;
6689
6690                 if (!is_zero_ether_addr(sinfo->mld_addr) &&
6691                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
6692                             sinfo->mld_addr))
6693                         goto nla_put_failure;
6694         }
6695
6696         cfg80211_sinfo_release_content(sinfo);
6697         genlmsg_end(msg, hdr);
6698         return 0;
6699
6700  nla_put_failure:
6701         cfg80211_sinfo_release_content(sinfo);
6702         genlmsg_cancel(msg, hdr);
6703         return -EMSGSIZE;
6704 }
6705
6706 static int nl80211_dump_station(struct sk_buff *skb,
6707                                 struct netlink_callback *cb)
6708 {
6709         struct station_info sinfo;
6710         struct cfg80211_registered_device *rdev;
6711         struct wireless_dev *wdev;
6712         u8 mac_addr[ETH_ALEN];
6713         int sta_idx = cb->args[2];
6714         int err;
6715
6716         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
6717         if (err)
6718                 return err;
6719         /* nl80211_prepare_wdev_dump acquired it in the successful case */
6720         __acquire(&rdev->wiphy.mtx);
6721
6722         if (!wdev->netdev) {
6723                 err = -EINVAL;
6724                 goto out_err;
6725         }
6726
6727         if (!rdev->ops->dump_station) {
6728                 err = -EOPNOTSUPP;
6729                 goto out_err;
6730         }
6731
6732         while (1) {
6733                 memset(&sinfo, 0, sizeof(sinfo));
6734                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
6735                                         mac_addr, &sinfo);
6736                 if (err == -ENOENT)
6737                         break;
6738                 if (err)
6739                         goto out_err;
6740
6741                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
6742                                 NETLINK_CB(cb->skb).portid,
6743                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
6744                                 rdev, wdev->netdev, mac_addr,
6745                                 &sinfo) < 0)
6746                         goto out;
6747
6748                 sta_idx++;
6749         }
6750
6751  out:
6752         cb->args[2] = sta_idx;
6753         err = skb->len;
6754  out_err:
6755         wiphy_unlock(&rdev->wiphy);
6756
6757         return err;
6758 }
6759
6760 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
6761 {
6762         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6763         struct net_device *dev = info->user_ptr[1];
6764         struct station_info sinfo;
6765         struct sk_buff *msg;
6766         u8 *mac_addr = NULL;
6767         int err;
6768
6769         memset(&sinfo, 0, sizeof(sinfo));
6770
6771         if (!info->attrs[NL80211_ATTR_MAC])
6772                 return -EINVAL;
6773
6774         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
6775
6776         if (!rdev->ops->get_station)
6777                 return -EOPNOTSUPP;
6778
6779         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
6780         if (err)
6781                 return err;
6782
6783         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6784         if (!msg) {
6785                 cfg80211_sinfo_release_content(&sinfo);
6786                 return -ENOMEM;
6787         }
6788
6789         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
6790                                  info->snd_portid, info->snd_seq, 0,
6791                                  rdev, dev, mac_addr, &sinfo) < 0) {
6792                 nlmsg_free(msg);
6793                 return -ENOBUFS;
6794         }
6795
6796         return genlmsg_reply(msg, info);
6797 }
6798
6799 int cfg80211_check_station_change(struct wiphy *wiphy,
6800                                   struct station_parameters *params,
6801                                   enum cfg80211_station_type statype)
6802 {
6803         if (params->listen_interval != -1 &&
6804             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6805                 return -EINVAL;
6806
6807         if (params->support_p2p_ps != -1 &&
6808             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6809                 return -EINVAL;
6810
6811         if (params->aid &&
6812             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
6813             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
6814                 return -EINVAL;
6815
6816         /* When you run into this, adjust the code below for the new flag */
6817         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
6818
6819         switch (statype) {
6820         case CFG80211_STA_MESH_PEER_KERNEL:
6821         case CFG80211_STA_MESH_PEER_USER:
6822                 /*
6823                  * No ignoring the TDLS flag here -- the userspace mesh
6824                  * code doesn't have the bug of including TDLS in the
6825                  * mask everywhere.
6826                  */
6827                 if (params->sta_flags_mask &
6828                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6829                                   BIT(NL80211_STA_FLAG_MFP) |
6830                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
6831                         return -EINVAL;
6832                 break;
6833         case CFG80211_STA_TDLS_PEER_SETUP:
6834         case CFG80211_STA_TDLS_PEER_ACTIVE:
6835                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
6836                         return -EINVAL;
6837                 /* ignore since it can't change */
6838                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6839                 break;
6840         default:
6841                 /* disallow mesh-specific things */
6842                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
6843                         return -EINVAL;
6844                 if (params->local_pm)
6845                         return -EINVAL;
6846                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6847                         return -EINVAL;
6848         }
6849
6850         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6851             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
6852                 /* TDLS can't be set, ... */
6853                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
6854                         return -EINVAL;
6855                 /*
6856                  * ... but don't bother the driver with it. This works around
6857                  * a hostapd/wpa_supplicant issue -- it always includes the
6858                  * TLDS_PEER flag in the mask even for AP mode.
6859                  */
6860                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
6861         }
6862
6863         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
6864             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6865                 /* reject other things that can't change */
6866                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
6867                         return -EINVAL;
6868                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
6869                         return -EINVAL;
6870                 if (params->link_sta_params.supported_rates)
6871                         return -EINVAL;
6872                 if (params->ext_capab || params->link_sta_params.ht_capa ||
6873                     params->link_sta_params.vht_capa ||
6874                     params->link_sta_params.he_capa ||
6875                     params->link_sta_params.eht_capa)
6876                         return -EINVAL;
6877         }
6878
6879         if (statype != CFG80211_STA_AP_CLIENT &&
6880             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
6881                 if (params->vlan)
6882                         return -EINVAL;
6883         }
6884
6885         switch (statype) {
6886         case CFG80211_STA_AP_MLME_CLIENT:
6887                 /* Use this only for authorizing/unauthorizing a station */
6888                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
6889                         return -EOPNOTSUPP;
6890                 break;
6891         case CFG80211_STA_AP_CLIENT:
6892         case CFG80211_STA_AP_CLIENT_UNASSOC:
6893                 /* accept only the listed bits */
6894                 if (params->sta_flags_mask &
6895                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6896                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6897                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
6898                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
6899                                   BIT(NL80211_STA_FLAG_WME) |
6900                                   BIT(NL80211_STA_FLAG_MFP)))
6901                         return -EINVAL;
6902
6903                 /* but authenticated/associated only if driver handles it */
6904                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
6905                     params->sta_flags_mask &
6906                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
6907                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
6908                         return -EINVAL;
6909                 break;
6910         case CFG80211_STA_IBSS:
6911         case CFG80211_STA_AP_STA:
6912                 /* reject any changes other than AUTHORIZED */
6913                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
6914                         return -EINVAL;
6915                 break;
6916         case CFG80211_STA_TDLS_PEER_SETUP:
6917                 /* reject any changes other than AUTHORIZED or WME */
6918                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
6919                                                BIT(NL80211_STA_FLAG_WME)))
6920                         return -EINVAL;
6921                 /* force (at least) rates when authorizing */
6922                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
6923                     !params->link_sta_params.supported_rates)
6924                         return -EINVAL;
6925                 break;
6926         case CFG80211_STA_TDLS_PEER_ACTIVE:
6927                 /* reject any changes */
6928                 return -EINVAL;
6929         case CFG80211_STA_MESH_PEER_KERNEL:
6930                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
6931                         return -EINVAL;
6932                 break;
6933         case CFG80211_STA_MESH_PEER_USER:
6934                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
6935                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
6936                         return -EINVAL;
6937                 break;
6938         }
6939
6940         /*
6941          * Older kernel versions ignored this attribute entirely, so don't
6942          * reject attempts to update it but mark it as unused instead so the
6943          * driver won't look at the data.
6944          */
6945         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
6946             statype != CFG80211_STA_TDLS_PEER_SETUP)
6947                 params->link_sta_params.opmode_notif_used = false;
6948
6949         return 0;
6950 }
6951 EXPORT_SYMBOL(cfg80211_check_station_change);
6952
6953 /*
6954  * Get vlan interface making sure it is running and on the right wiphy.
6955  */
6956 static struct net_device *get_vlan(struct genl_info *info,
6957                                    struct cfg80211_registered_device *rdev)
6958 {
6959         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
6960         struct net_device *v;
6961         int ret;
6962
6963         if (!vlanattr)
6964                 return NULL;
6965
6966         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
6967         if (!v)
6968                 return ERR_PTR(-ENODEV);
6969
6970         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
6971                 ret = -EINVAL;
6972                 goto error;
6973         }
6974
6975         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
6976             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
6977             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
6978                 ret = -EINVAL;
6979                 goto error;
6980         }
6981
6982         if (!netif_running(v)) {
6983                 ret = -ENETDOWN;
6984                 goto error;
6985         }
6986
6987         return v;
6988  error:
6989         dev_put(v);
6990         return ERR_PTR(ret);
6991 }
6992
6993 static int nl80211_parse_sta_wme(struct genl_info *info,
6994                                  struct station_parameters *params)
6995 {
6996         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
6997         struct nlattr *nla;
6998         int err;
6999
7000         /* parse WME attributes if present */
7001         if (!info->attrs[NL80211_ATTR_STA_WME])
7002                 return 0;
7003
7004         nla = info->attrs[NL80211_ATTR_STA_WME];
7005         err = nla_parse_nested_deprecated(tb, NL80211_STA_WME_MAX, nla,
7006                                           nl80211_sta_wme_policy,
7007                                           info->extack);
7008         if (err)
7009                 return err;
7010
7011         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
7012                 params->uapsd_queues = nla_get_u8(
7013                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
7014         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
7015                 return -EINVAL;
7016
7017         if (tb[NL80211_STA_WME_MAX_SP])
7018                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
7019
7020         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
7021                 return -EINVAL;
7022
7023         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
7024
7025         return 0;
7026 }
7027
7028 static int nl80211_parse_sta_channel_info(struct genl_info *info,
7029                                       struct station_parameters *params)
7030 {
7031         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
7032                 params->supported_channels =
7033                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7034                 params->supported_channels_len =
7035                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
7036                 /*
7037                  * Need to include at least one (first channel, number of
7038                  * channels) tuple for each subband (checked in policy),
7039                  * and must have proper tuples for the rest of the data as well.
7040                  */
7041                 if (params->supported_channels_len % 2)
7042                         return -EINVAL;
7043         }
7044
7045         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
7046                 params->supported_oper_classes =
7047                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7048                 params->supported_oper_classes_len =
7049                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
7050         }
7051         return 0;
7052 }
7053
7054 static int nl80211_set_station_tdls(struct genl_info *info,
7055                                     struct station_parameters *params)
7056 {
7057         int err;
7058         /* Dummy STA entry gets updated once the peer capabilities are known */
7059         if (info->attrs[NL80211_ATTR_PEER_AID])
7060                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7061         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7062                 params->link_sta_params.ht_capa =
7063                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7064         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7065                 params->link_sta_params.vht_capa =
7066                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7067         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7068                 params->link_sta_params.he_capa =
7069                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7070                 params->link_sta_params.he_capa_len =
7071                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7072
7073                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7074                         params->link_sta_params.eht_capa =
7075                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7076                         params->link_sta_params.eht_capa_len =
7077                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7078
7079                         if (!ieee80211_eht_capa_size_ok((const u8 *)params->link_sta_params.he_capa,
7080                                                         (const u8 *)params->link_sta_params.eht_capa,
7081                                                         params->link_sta_params.eht_capa_len,
7082                                                         false))
7083                                 return -EINVAL;
7084                 }
7085         }
7086
7087         err = nl80211_parse_sta_channel_info(info, params);
7088         if (err)
7089                 return err;
7090
7091         return nl80211_parse_sta_wme(info, params);
7092 }
7093
7094 static int nl80211_parse_sta_txpower_setting(struct genl_info *info,
7095                                              struct sta_txpwr *txpwr,
7096                                              bool *txpwr_set)
7097 {
7098         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7099         int idx;
7100
7101         if (info->attrs[NL80211_ATTR_STA_TX_POWER_SETTING]) {
7102                 if (!rdev->ops->set_tx_power ||
7103                     !wiphy_ext_feature_isset(&rdev->wiphy,
7104                                          NL80211_EXT_FEATURE_STA_TX_PWR))
7105                         return -EOPNOTSUPP;
7106
7107                 idx = NL80211_ATTR_STA_TX_POWER_SETTING;
7108                 txpwr->type = nla_get_u8(info->attrs[idx]);
7109
7110                 if (txpwr->type == NL80211_TX_POWER_LIMITED) {
7111                         idx = NL80211_ATTR_STA_TX_POWER;
7112
7113                         if (info->attrs[idx])
7114                                 txpwr->power = nla_get_s16(info->attrs[idx]);
7115                         else
7116                                 return -EINVAL;
7117                 }
7118
7119                 *txpwr_set = true;
7120         } else {
7121                 *txpwr_set = false;
7122         }
7123
7124         return 0;
7125 }
7126
7127 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
7128 {
7129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7130         struct net_device *dev = info->user_ptr[1];
7131         struct station_parameters params;
7132         u8 *mac_addr;
7133         int err;
7134
7135         memset(&params, 0, sizeof(params));
7136
7137         if (!rdev->ops->change_station)
7138                 return -EOPNOTSUPP;
7139
7140         /*
7141          * AID and listen_interval properties can be set only for unassociated
7142          * station. Include these parameters here and will check them in
7143          * cfg80211_check_station_change().
7144          */
7145         if (info->attrs[NL80211_ATTR_STA_AID])
7146                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7147
7148         if (info->attrs[NL80211_ATTR_VLAN_ID])
7149                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7150
7151         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7152                 params.listen_interval =
7153                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7154         else
7155                 params.listen_interval = -1;
7156
7157         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
7158                 params.support_p2p_ps =
7159                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7160         else
7161                 params.support_p2p_ps = -1;
7162
7163         if (!info->attrs[NL80211_ATTR_MAC])
7164                 return -EINVAL;
7165
7166         params.link_sta_params.link_id =
7167                 nl80211_link_id_or_invalid(info->attrs);
7168
7169         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7170                 /* If MLD_ADDR attribute is set then this is an MLD station
7171                  * and the MLD_ADDR attribute holds the MLD address and the
7172                  * MAC attribute holds for the LINK address.
7173                  * In that case, the link_id is also expected to be valid.
7174                  */
7175                 if (params.link_sta_params.link_id < 0)
7176                         return -EINVAL;
7177
7178                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7179                 params.link_sta_params.mld_mac = mac_addr;
7180                 params.link_sta_params.link_mac =
7181                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7182                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7183                         return -EINVAL;
7184         } else {
7185                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7186         }
7187
7188
7189         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
7190                 params.link_sta_params.supported_rates =
7191                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7192                 params.link_sta_params.supported_rates_len =
7193                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7194         }
7195
7196         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7197                 params.capability =
7198                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7199                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7200         }
7201
7202         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7203                 params.ext_capab =
7204                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7205                 params.ext_capab_len =
7206                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7207         }
7208
7209         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7210                 return -EINVAL;
7211
7212         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7213                 params.plink_action =
7214                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7215
7216         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
7217                 params.plink_state =
7218                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
7219                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
7220                         params.peer_aid = nla_get_u16(
7221                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
7222                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
7223         }
7224
7225         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
7226                 params.local_pm = nla_get_u32(
7227                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
7228
7229         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7230                 params.link_sta_params.opmode_notif_used = true;
7231                 params.link_sta_params.opmode_notif =
7232                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7233         }
7234
7235         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7236                 params.link_sta_params.he_6ghz_capa =
7237                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7238
7239         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7240                 params.airtime_weight =
7241                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7242
7243         if (params.airtime_weight &&
7244             !wiphy_ext_feature_isset(&rdev->wiphy,
7245                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7246                 return -EOPNOTSUPP;
7247
7248         err = nl80211_parse_sta_txpower_setting(info,
7249                                                 &params.link_sta_params.txpwr,
7250                                                 &params.link_sta_params.txpwr_set);
7251         if (err)
7252                 return err;
7253
7254         /* Include parameters for TDLS peer (will check later) */
7255         err = nl80211_set_station_tdls(info, &params);
7256         if (err)
7257                 return err;
7258
7259         params.vlan = get_vlan(info, rdev);
7260         if (IS_ERR(params.vlan))
7261                 return PTR_ERR(params.vlan);
7262
7263         switch (dev->ieee80211_ptr->iftype) {
7264         case NL80211_IFTYPE_AP:
7265         case NL80211_IFTYPE_AP_VLAN:
7266         case NL80211_IFTYPE_P2P_GO:
7267         case NL80211_IFTYPE_P2P_CLIENT:
7268         case NL80211_IFTYPE_STATION:
7269         case NL80211_IFTYPE_ADHOC:
7270         case NL80211_IFTYPE_MESH_POINT:
7271                 break;
7272         default:
7273                 err = -EOPNOTSUPP;
7274                 goto out_put_vlan;
7275         }
7276
7277         /* driver will call cfg80211_check_station_change() */
7278         wdev_lock(dev->ieee80211_ptr);
7279         err = rdev_change_station(rdev, dev, mac_addr, &params);
7280         wdev_unlock(dev->ieee80211_ptr);
7281
7282  out_put_vlan:
7283         dev_put(params.vlan);
7284
7285         return err;
7286 }
7287
7288 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
7289 {
7290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7291         int err;
7292         struct net_device *dev = info->user_ptr[1];
7293         struct wireless_dev *wdev = dev->ieee80211_ptr;
7294         struct station_parameters params;
7295         u8 *mac_addr = NULL;
7296         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
7297                          BIT(NL80211_STA_FLAG_ASSOCIATED);
7298
7299         memset(&params, 0, sizeof(params));
7300
7301         if (!rdev->ops->add_station)
7302                 return -EOPNOTSUPP;
7303
7304         if (!info->attrs[NL80211_ATTR_MAC])
7305                 return -EINVAL;
7306
7307         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
7308                 return -EINVAL;
7309
7310         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
7311                 return -EINVAL;
7312
7313         if (!info->attrs[NL80211_ATTR_STA_AID] &&
7314             !info->attrs[NL80211_ATTR_PEER_AID])
7315                 return -EINVAL;
7316
7317         params.link_sta_params.link_id =
7318                 nl80211_link_id_or_invalid(info->attrs);
7319
7320         if (info->attrs[NL80211_ATTR_MLD_ADDR]) {
7321                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
7322                 params.link_sta_params.mld_mac = mac_addr;
7323                 params.link_sta_params.link_mac =
7324                         nla_data(info->attrs[NL80211_ATTR_MAC]);
7325                 if (!is_valid_ether_addr(params.link_sta_params.link_mac))
7326                         return -EINVAL;
7327         } else {
7328                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
7329         }
7330
7331         params.link_sta_params.supported_rates =
7332                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7333         params.link_sta_params.supported_rates_len =
7334                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
7335         params.listen_interval =
7336                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
7337
7338         if (info->attrs[NL80211_ATTR_VLAN_ID])
7339                 params.vlan_id = nla_get_u16(info->attrs[NL80211_ATTR_VLAN_ID]);
7340
7341         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
7342                 params.support_p2p_ps =
7343                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
7344         } else {
7345                 /*
7346                  * if not specified, assume it's supported for P2P GO interface,
7347                  * and is NOT supported for AP interface
7348                  */
7349                 params.support_p2p_ps =
7350                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
7351         }
7352
7353         if (info->attrs[NL80211_ATTR_PEER_AID])
7354                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
7355         else
7356                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
7357
7358         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
7359                 params.capability =
7360                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
7361                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
7362         }
7363
7364         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
7365                 params.ext_capab =
7366                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7367                 params.ext_capab_len =
7368                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
7369         }
7370
7371         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
7372                 params.link_sta_params.ht_capa =
7373                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
7374
7375         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
7376                 params.link_sta_params.vht_capa =
7377                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
7378
7379         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
7380                 params.link_sta_params.he_capa =
7381                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7382                 params.link_sta_params.he_capa_len =
7383                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
7384
7385                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
7386                         params.link_sta_params.eht_capa =
7387                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7388                         params.link_sta_params.eht_capa_len =
7389                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
7390
7391                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.link_sta_params.he_capa,
7392                                                         (const u8 *)params.link_sta_params.eht_capa,
7393                                                         params.link_sta_params.eht_capa_len,
7394                                                         false))
7395                                 return -EINVAL;
7396                 }
7397         }
7398
7399         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
7400                 params.link_sta_params.he_6ghz_capa =
7401                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
7402
7403         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
7404                 params.link_sta_params.opmode_notif_used = true;
7405                 params.link_sta_params.opmode_notif =
7406                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
7407         }
7408
7409         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
7410                 params.plink_action =
7411                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
7412
7413         if (info->attrs[NL80211_ATTR_AIRTIME_WEIGHT])
7414                 params.airtime_weight =
7415                         nla_get_u16(info->attrs[NL80211_ATTR_AIRTIME_WEIGHT]);
7416
7417         if (params.airtime_weight &&
7418             !wiphy_ext_feature_isset(&rdev->wiphy,
7419                                      NL80211_EXT_FEATURE_AIRTIME_FAIRNESS))
7420                 return -EOPNOTSUPP;
7421
7422         err = nl80211_parse_sta_txpower_setting(info,
7423                                                 &params.link_sta_params.txpwr,
7424                                                 &params.link_sta_params.txpwr_set);
7425         if (err)
7426                 return err;
7427
7428         err = nl80211_parse_sta_channel_info(info, &params);
7429         if (err)
7430                 return err;
7431
7432         err = nl80211_parse_sta_wme(info, &params);
7433         if (err)
7434                 return err;
7435
7436         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
7437                 return -EINVAL;
7438
7439         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
7440          * as userspace might just pass through the capabilities from the IEs
7441          * directly, rather than enforcing this restriction and returning an
7442          * error in this case.
7443          */
7444         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
7445                 params.link_sta_params.ht_capa = NULL;
7446                 params.link_sta_params.vht_capa = NULL;
7447
7448                 /* HE and EHT require WME */
7449                 if (params.link_sta_params.he_capa_len ||
7450                     params.link_sta_params.he_6ghz_capa ||
7451                     params.link_sta_params.eht_capa_len)
7452                         return -EINVAL;
7453         }
7454
7455         /* Ensure that HT/VHT capabilities are not set for 6 GHz HE STA */
7456         if (params.link_sta_params.he_6ghz_capa &&
7457             (params.link_sta_params.ht_capa || params.link_sta_params.vht_capa))
7458                 return -EINVAL;
7459
7460         /* When you run into this, adjust the code below for the new flag */
7461         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
7462
7463         switch (dev->ieee80211_ptr->iftype) {
7464         case NL80211_IFTYPE_AP:
7465         case NL80211_IFTYPE_AP_VLAN:
7466         case NL80211_IFTYPE_P2P_GO:
7467                 /* ignore WME attributes if iface/sta is not capable */
7468                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
7469                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
7470                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7471
7472                 /* TDLS peers cannot be added */
7473                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7474                     info->attrs[NL80211_ATTR_PEER_AID])
7475                         return -EINVAL;
7476                 /* but don't bother the driver with it */
7477                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
7478
7479                 /* allow authenticated/associated only if driver handles it */
7480                 if (!(rdev->wiphy.features &
7481                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
7482                     params.sta_flags_mask & auth_assoc)
7483                         return -EINVAL;
7484
7485                 /* Older userspace, or userspace wanting to be compatible with
7486                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
7487                  * and assoc flags in the mask, but assumes the station will be
7488                  * added as associated anyway since this was the required driver
7489                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
7490                  * introduced.
7491                  * In order to not bother drivers with this quirk in the API
7492                  * set the flags in both the mask and set for new stations in
7493                  * this case.
7494                  */
7495                 if (!(params.sta_flags_mask & auth_assoc)) {
7496                         params.sta_flags_mask |= auth_assoc;
7497                         params.sta_flags_set |= auth_assoc;
7498                 }
7499
7500                 /* must be last in here for error handling */
7501                 params.vlan = get_vlan(info, rdev);
7502                 if (IS_ERR(params.vlan))
7503                         return PTR_ERR(params.vlan);
7504                 break;
7505         case NL80211_IFTYPE_MESH_POINT:
7506                 /* ignore uAPSD data */
7507                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7508
7509                 /* associated is disallowed */
7510                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
7511                         return -EINVAL;
7512                 /* TDLS peers cannot be added */
7513                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
7514                     info->attrs[NL80211_ATTR_PEER_AID])
7515                         return -EINVAL;
7516                 break;
7517         case NL80211_IFTYPE_STATION:
7518         case NL80211_IFTYPE_P2P_CLIENT:
7519                 /* ignore uAPSD data */
7520                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
7521
7522                 /* these are disallowed */
7523                 if (params.sta_flags_mask &
7524                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
7525                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
7526                         return -EINVAL;
7527                 /* Only TDLS peers can be added */
7528                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
7529                         return -EINVAL;
7530                 /* Can only add if TDLS ... */
7531                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
7532                         return -EOPNOTSUPP;
7533                 /* ... with external setup is supported */
7534                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
7535                         return -EOPNOTSUPP;
7536                 /*
7537                  * Older wpa_supplicant versions always mark the TDLS peer
7538                  * as authorized, but it shouldn't yet be.
7539                  */
7540                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
7541                 break;
7542         default:
7543                 return -EOPNOTSUPP;
7544         }
7545
7546         /* be aware of params.vlan when changing code here */
7547
7548         wdev_lock(dev->ieee80211_ptr);
7549         if (wdev->valid_links) {
7550                 if (params.link_sta_params.link_id < 0) {
7551                         err = -EINVAL;
7552                         goto out;
7553                 }
7554                 if (!(wdev->valid_links & BIT(params.link_sta_params.link_id))) {
7555                         err = -ENOLINK;
7556                         goto out;
7557                 }
7558         } else {
7559                 if (params.link_sta_params.link_id >= 0) {
7560                         err = -EINVAL;
7561                         goto out;
7562                 }
7563         }
7564         err = rdev_add_station(rdev, dev, mac_addr, &params);
7565 out:
7566         wdev_unlock(dev->ieee80211_ptr);
7567         dev_put(params.vlan);
7568         return err;
7569 }
7570
7571 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
7572 {
7573         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7574         struct net_device *dev = info->user_ptr[1];
7575         struct station_del_parameters params;
7576         int ret;
7577
7578         memset(&params, 0, sizeof(params));
7579
7580         if (info->attrs[NL80211_ATTR_MAC])
7581                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
7582
7583         switch (dev->ieee80211_ptr->iftype) {
7584         case NL80211_IFTYPE_AP:
7585         case NL80211_IFTYPE_AP_VLAN:
7586         case NL80211_IFTYPE_MESH_POINT:
7587         case NL80211_IFTYPE_P2P_GO:
7588                 /* always accept these */
7589                 break;
7590         case NL80211_IFTYPE_ADHOC:
7591                 /* conditionally accept */
7592                 if (wiphy_ext_feature_isset(&rdev->wiphy,
7593                                             NL80211_EXT_FEATURE_DEL_IBSS_STA))
7594                         break;
7595                 return -EINVAL;
7596         default:
7597                 return -EINVAL;
7598         }
7599
7600         if (!rdev->ops->del_station)
7601                 return -EOPNOTSUPP;
7602
7603         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
7604                 params.subtype =
7605                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
7606                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
7607                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
7608                         return -EINVAL;
7609         } else {
7610                 /* Default to Deauthentication frame */
7611                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
7612         }
7613
7614         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
7615                 params.reason_code =
7616                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
7617                 if (params.reason_code == 0)
7618                         return -EINVAL; /* 0 is reserved */
7619         } else {
7620                 /* Default to reason code 2 */
7621                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
7622         }
7623
7624         wdev_lock(dev->ieee80211_ptr);
7625         ret = rdev_del_station(rdev, dev, &params);
7626         wdev_unlock(dev->ieee80211_ptr);
7627
7628         return ret;
7629 }
7630
7631 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
7632                                 int flags, struct net_device *dev,
7633                                 u8 *dst, u8 *next_hop,
7634                                 struct mpath_info *pinfo)
7635 {
7636         void *hdr;
7637         struct nlattr *pinfoattr;
7638
7639         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
7640         if (!hdr)
7641                 return -1;
7642
7643         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
7644             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
7645             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
7646             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
7647                 goto nla_put_failure;
7648
7649         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MPATH_INFO);
7650         if (!pinfoattr)
7651                 goto nla_put_failure;
7652         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
7653             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
7654                         pinfo->frame_qlen))
7655                 goto nla_put_failure;
7656         if (((pinfo->filled & MPATH_INFO_SN) &&
7657              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
7658             ((pinfo->filled & MPATH_INFO_METRIC) &&
7659              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
7660                          pinfo->metric)) ||
7661             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
7662              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
7663                          pinfo->exptime)) ||
7664             ((pinfo->filled & MPATH_INFO_FLAGS) &&
7665              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
7666                         pinfo->flags)) ||
7667             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
7668              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
7669                          pinfo->discovery_timeout)) ||
7670             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
7671              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
7672                         pinfo->discovery_retries)) ||
7673             ((pinfo->filled & MPATH_INFO_HOP_COUNT) &&
7674              nla_put_u8(msg, NL80211_MPATH_INFO_HOP_COUNT,
7675                         pinfo->hop_count)) ||
7676             ((pinfo->filled & MPATH_INFO_PATH_CHANGE) &&
7677              nla_put_u32(msg, NL80211_MPATH_INFO_PATH_CHANGE,
7678                          pinfo->path_change_count)))
7679                 goto nla_put_failure;
7680
7681         nla_nest_end(msg, pinfoattr);
7682
7683         genlmsg_end(msg, hdr);
7684         return 0;
7685
7686  nla_put_failure:
7687         genlmsg_cancel(msg, hdr);
7688         return -EMSGSIZE;
7689 }
7690
7691 static int nl80211_dump_mpath(struct sk_buff *skb,
7692                               struct netlink_callback *cb)
7693 {
7694         struct mpath_info pinfo;
7695         struct cfg80211_registered_device *rdev;
7696         struct wireless_dev *wdev;
7697         u8 dst[ETH_ALEN];
7698         u8 next_hop[ETH_ALEN];
7699         int path_idx = cb->args[2];
7700         int err;
7701
7702         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7703         if (err)
7704                 return err;
7705         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7706         __acquire(&rdev->wiphy.mtx);
7707
7708         if (!rdev->ops->dump_mpath) {
7709                 err = -EOPNOTSUPP;
7710                 goto out_err;
7711         }
7712
7713         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7714                 err = -EOPNOTSUPP;
7715                 goto out_err;
7716         }
7717
7718         while (1) {
7719                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
7720                                       next_hop, &pinfo);
7721                 if (err == -ENOENT)
7722                         break;
7723                 if (err)
7724                         goto out_err;
7725
7726                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7727                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7728                                        wdev->netdev, dst, next_hop,
7729                                        &pinfo) < 0)
7730                         goto out;
7731
7732                 path_idx++;
7733         }
7734
7735  out:
7736         cb->args[2] = path_idx;
7737         err = skb->len;
7738  out_err:
7739         wiphy_unlock(&rdev->wiphy);
7740         return err;
7741 }
7742
7743 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
7744 {
7745         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7746         int err;
7747         struct net_device *dev = info->user_ptr[1];
7748         struct mpath_info pinfo;
7749         struct sk_buff *msg;
7750         u8 *dst = NULL;
7751         u8 next_hop[ETH_ALEN];
7752
7753         memset(&pinfo, 0, sizeof(pinfo));
7754
7755         if (!info->attrs[NL80211_ATTR_MAC])
7756                 return -EINVAL;
7757
7758         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7759
7760         if (!rdev->ops->get_mpath)
7761                 return -EOPNOTSUPP;
7762
7763         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7764                 return -EOPNOTSUPP;
7765
7766         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
7767         if (err)
7768                 return err;
7769
7770         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7771         if (!msg)
7772                 return -ENOMEM;
7773
7774         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7775                                  dev, dst, next_hop, &pinfo) < 0) {
7776                 nlmsg_free(msg);
7777                 return -ENOBUFS;
7778         }
7779
7780         return genlmsg_reply(msg, info);
7781 }
7782
7783 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
7784 {
7785         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7786         struct net_device *dev = info->user_ptr[1];
7787         u8 *dst = NULL;
7788         u8 *next_hop = NULL;
7789
7790         if (!info->attrs[NL80211_ATTR_MAC])
7791                 return -EINVAL;
7792
7793         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7794                 return -EINVAL;
7795
7796         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7797         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7798
7799         if (!rdev->ops->change_mpath)
7800                 return -EOPNOTSUPP;
7801
7802         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7803                 return -EOPNOTSUPP;
7804
7805         return rdev_change_mpath(rdev, dev, dst, next_hop);
7806 }
7807
7808 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
7809 {
7810         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7811         struct net_device *dev = info->user_ptr[1];
7812         u8 *dst = NULL;
7813         u8 *next_hop = NULL;
7814
7815         if (!info->attrs[NL80211_ATTR_MAC])
7816                 return -EINVAL;
7817
7818         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
7819                 return -EINVAL;
7820
7821         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7822         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
7823
7824         if (!rdev->ops->add_mpath)
7825                 return -EOPNOTSUPP;
7826
7827         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7828                 return -EOPNOTSUPP;
7829
7830         return rdev_add_mpath(rdev, dev, dst, next_hop);
7831 }
7832
7833 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
7834 {
7835         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7836         struct net_device *dev = info->user_ptr[1];
7837         u8 *dst = NULL;
7838
7839         if (info->attrs[NL80211_ATTR_MAC])
7840                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7841
7842         if (!rdev->ops->del_mpath)
7843                 return -EOPNOTSUPP;
7844
7845         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7846                 return -EOPNOTSUPP;
7847
7848         return rdev_del_mpath(rdev, dev, dst);
7849 }
7850
7851 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
7852 {
7853         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7854         int err;
7855         struct net_device *dev = info->user_ptr[1];
7856         struct mpath_info pinfo;
7857         struct sk_buff *msg;
7858         u8 *dst = NULL;
7859         u8 mpp[ETH_ALEN];
7860
7861         memset(&pinfo, 0, sizeof(pinfo));
7862
7863         if (!info->attrs[NL80211_ATTR_MAC])
7864                 return -EINVAL;
7865
7866         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
7867
7868         if (!rdev->ops->get_mpp)
7869                 return -EOPNOTSUPP;
7870
7871         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
7872                 return -EOPNOTSUPP;
7873
7874         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
7875         if (err)
7876                 return err;
7877
7878         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
7879         if (!msg)
7880                 return -ENOMEM;
7881
7882         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
7883                                dev, dst, mpp, &pinfo) < 0) {
7884                 nlmsg_free(msg);
7885                 return -ENOBUFS;
7886         }
7887
7888         return genlmsg_reply(msg, info);
7889 }
7890
7891 static int nl80211_dump_mpp(struct sk_buff *skb,
7892                             struct netlink_callback *cb)
7893 {
7894         struct mpath_info pinfo;
7895         struct cfg80211_registered_device *rdev;
7896         struct wireless_dev *wdev;
7897         u8 dst[ETH_ALEN];
7898         u8 mpp[ETH_ALEN];
7899         int path_idx = cb->args[2];
7900         int err;
7901
7902         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
7903         if (err)
7904                 return err;
7905         /* nl80211_prepare_wdev_dump acquired it in the successful case */
7906         __acquire(&rdev->wiphy.mtx);
7907
7908         if (!rdev->ops->dump_mpp) {
7909                 err = -EOPNOTSUPP;
7910                 goto out_err;
7911         }
7912
7913         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
7914                 err = -EOPNOTSUPP;
7915                 goto out_err;
7916         }
7917
7918         while (1) {
7919                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
7920                                     mpp, &pinfo);
7921                 if (err == -ENOENT)
7922                         break;
7923                 if (err)
7924                         goto out_err;
7925
7926                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
7927                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
7928                                        wdev->netdev, dst, mpp,
7929                                        &pinfo) < 0)
7930                         goto out;
7931
7932                 path_idx++;
7933         }
7934
7935  out:
7936         cb->args[2] = path_idx;
7937         err = skb->len;
7938  out_err:
7939         wiphy_unlock(&rdev->wiphy);
7940         return err;
7941 }
7942
7943 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
7944 {
7945         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7946         struct net_device *dev = info->user_ptr[1];
7947         struct wireless_dev *wdev = dev->ieee80211_ptr;
7948         struct bss_parameters params;
7949         int err;
7950
7951         memset(&params, 0, sizeof(params));
7952         params.link_id = nl80211_link_id_or_invalid(info->attrs);
7953         /* default to not changing parameters */
7954         params.use_cts_prot = -1;
7955         params.use_short_preamble = -1;
7956         params.use_short_slot_time = -1;
7957         params.ap_isolate = -1;
7958         params.ht_opmode = -1;
7959         params.p2p_ctwindow = -1;
7960         params.p2p_opp_ps = -1;
7961
7962         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
7963                 params.use_cts_prot =
7964                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
7965         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
7966                 params.use_short_preamble =
7967                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
7968         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
7969                 params.use_short_slot_time =
7970                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
7971         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
7972                 params.basic_rates =
7973                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7974                 params.basic_rates_len =
7975                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
7976         }
7977         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
7978                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
7979         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
7980                 params.ht_opmode =
7981                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
7982
7983         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
7984                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7985                         return -EINVAL;
7986                 params.p2p_ctwindow =
7987                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
7988                 if (params.p2p_ctwindow != 0 &&
7989                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
7990                         return -EINVAL;
7991         }
7992
7993         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
7994                 u8 tmp;
7995
7996                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
7997                         return -EINVAL;
7998                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
7999                 params.p2p_opp_ps = tmp;
8000                 if (params.p2p_opp_ps &&
8001                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
8002                         return -EINVAL;
8003         }
8004
8005         if (!rdev->ops->change_bss)
8006                 return -EOPNOTSUPP;
8007
8008         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
8009             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
8010                 return -EOPNOTSUPP;
8011
8012         wdev_lock(wdev);
8013         err = rdev_change_bss(rdev, dev, &params);
8014         wdev_unlock(wdev);
8015
8016         return err;
8017 }
8018
8019 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
8020 {
8021         char *data = NULL;
8022         bool is_indoor;
8023         enum nl80211_user_reg_hint_type user_reg_hint_type;
8024         u32 owner_nlportid;
8025
8026         /*
8027          * You should only get this when cfg80211 hasn't yet initialized
8028          * completely when built-in to the kernel right between the time
8029          * window between nl80211_init() and regulatory_init(), if that is
8030          * even possible.
8031          */
8032         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
8033                 return -EINPROGRESS;
8034
8035         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
8036                 user_reg_hint_type =
8037                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
8038         else
8039                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
8040
8041         switch (user_reg_hint_type) {
8042         case NL80211_USER_REG_HINT_USER:
8043         case NL80211_USER_REG_HINT_CELL_BASE:
8044                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8045                         return -EINVAL;
8046
8047                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8048                 return regulatory_hint_user(data, user_reg_hint_type);
8049         case NL80211_USER_REG_HINT_INDOOR:
8050                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8051                         owner_nlportid = info->snd_portid;
8052                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
8053                 } else {
8054                         owner_nlportid = 0;
8055                         is_indoor = true;
8056                 }
8057
8058                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
8059         default:
8060                 return -EINVAL;
8061         }
8062 }
8063
8064 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
8065 {
8066         return reg_reload_regdb();
8067 }
8068
8069 static int nl80211_get_mesh_config(struct sk_buff *skb,
8070                                    struct genl_info *info)
8071 {
8072         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8073         struct net_device *dev = info->user_ptr[1];
8074         struct wireless_dev *wdev = dev->ieee80211_ptr;
8075         struct mesh_config cur_params;
8076         int err = 0;
8077         void *hdr;
8078         struct nlattr *pinfoattr;
8079         struct sk_buff *msg;
8080
8081         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8082                 return -EOPNOTSUPP;
8083
8084         if (!rdev->ops->get_mesh_config)
8085                 return -EOPNOTSUPP;
8086
8087         wdev_lock(wdev);
8088         /* If not connected, get default parameters */
8089         if (!wdev->u.mesh.id_len)
8090                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
8091         else
8092                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
8093         wdev_unlock(wdev);
8094
8095         if (err)
8096                 return err;
8097
8098         /* Draw up a netlink message to send back */
8099         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8100         if (!msg)
8101                 return -ENOMEM;
8102         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8103                              NL80211_CMD_GET_MESH_CONFIG);
8104         if (!hdr)
8105                 goto out;
8106         pinfoattr = nla_nest_start_noflag(msg, NL80211_ATTR_MESH_CONFIG);
8107         if (!pinfoattr)
8108                 goto nla_put_failure;
8109         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
8110             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
8111                         cur_params.dot11MeshRetryTimeout) ||
8112             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
8113                         cur_params.dot11MeshConfirmTimeout) ||
8114             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
8115                         cur_params.dot11MeshHoldingTimeout) ||
8116             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
8117                         cur_params.dot11MeshMaxPeerLinks) ||
8118             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
8119                        cur_params.dot11MeshMaxRetries) ||
8120             nla_put_u8(msg, NL80211_MESHCONF_TTL,
8121                        cur_params.dot11MeshTTL) ||
8122             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
8123                        cur_params.element_ttl) ||
8124             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8125                        cur_params.auto_open_plinks) ||
8126             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8127                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
8128             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8129                        cur_params.dot11MeshHWMPmaxPREQretries) ||
8130             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
8131                         cur_params.path_refresh_time) ||
8132             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8133                         cur_params.min_discovery_timeout) ||
8134             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8135                         cur_params.dot11MeshHWMPactivePathTimeout) ||
8136             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8137                         cur_params.dot11MeshHWMPpreqMinInterval) ||
8138             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8139                         cur_params.dot11MeshHWMPperrMinInterval) ||
8140             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8141                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
8142             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
8143                        cur_params.dot11MeshHWMPRootMode) ||
8144             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8145                         cur_params.dot11MeshHWMPRannInterval) ||
8146             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8147                        cur_params.dot11MeshGateAnnouncementProtocol) ||
8148             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
8149                        cur_params.dot11MeshForwarding) ||
8150             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
8151                         cur_params.rssi_threshold) ||
8152             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
8153                         cur_params.ht_opmode) ||
8154             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8155                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
8156             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8157                         cur_params.dot11MeshHWMProotInterval) ||
8158             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8159                         cur_params.dot11MeshHWMPconfirmationInterval) ||
8160             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
8161                         cur_params.power_mode) ||
8162             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
8163                         cur_params.dot11MeshAwakeWindowDuration) ||
8164             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
8165                         cur_params.plink_timeout) ||
8166             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_GATE,
8167                        cur_params.dot11MeshConnectedToMeshGate) ||
8168             nla_put_u8(msg, NL80211_MESHCONF_NOLEARN,
8169                        cur_params.dot11MeshNolearn) ||
8170             nla_put_u8(msg, NL80211_MESHCONF_CONNECTED_TO_AS,
8171                        cur_params.dot11MeshConnectedToAuthServer))
8172                 goto nla_put_failure;
8173         nla_nest_end(msg, pinfoattr);
8174         genlmsg_end(msg, hdr);
8175         return genlmsg_reply(msg, info);
8176
8177  nla_put_failure:
8178  out:
8179         nlmsg_free(msg);
8180         return -ENOBUFS;
8181 }
8182
8183 static const struct nla_policy
8184 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
8185         [NL80211_MESHCONF_RETRY_TIMEOUT] =
8186                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8187         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
8188                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8189         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
8190                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
8191         [NL80211_MESHCONF_MAX_PEER_LINKS] =
8192                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
8193         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
8194         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8195         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
8196         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
8197         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
8198                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
8199         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
8200         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
8201         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
8202         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
8203         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
8204                 NLA_POLICY_MIN(NLA_U16, 1),
8205         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
8206                 NLA_POLICY_MIN(NLA_U16, 1),
8207         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
8208                 NLA_POLICY_MIN(NLA_U16, 1),
8209         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
8210         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
8211                 NLA_POLICY_MIN(NLA_U16, 1),
8212         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
8213         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
8214         [NL80211_MESHCONF_RSSI_THRESHOLD] =
8215                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
8216         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
8217         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
8218         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
8219                 NLA_POLICY_MIN(NLA_U16, 1),
8220         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
8221                 NLA_POLICY_MIN(NLA_U16, 1),
8222         [NL80211_MESHCONF_POWER_MODE] =
8223                 NLA_POLICY_RANGE(NLA_U32,
8224                                  NL80211_MESH_POWER_ACTIVE,
8225                                  NL80211_MESH_POWER_MAX),
8226         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
8227         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
8228         [NL80211_MESHCONF_CONNECTED_TO_GATE] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8229         [NL80211_MESHCONF_NOLEARN] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8230         [NL80211_MESHCONF_CONNECTED_TO_AS] = NLA_POLICY_RANGE(NLA_U8, 0, 1),
8231 };
8232
8233 static const struct nla_policy
8234         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
8235         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
8236         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
8237         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
8238         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
8239         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
8240         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
8241         [NL80211_MESH_SETUP_IE] =
8242                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
8243                                        IEEE80211_MAX_DATA_LEN),
8244         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
8245 };
8246
8247 static int nl80211_parse_mesh_config(struct genl_info *info,
8248                                      struct mesh_config *cfg,
8249                                      u32 *mask_out)
8250 {
8251         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
8252         u32 mask = 0;
8253         u16 ht_opmode;
8254
8255 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
8256 do {                                                                    \
8257         if (tb[attr]) {                                                 \
8258                 cfg->param = fn(tb[attr]);                              \
8259                 mask |= BIT((attr) - 1);                                \
8260         }                                                               \
8261 } while (0)
8262
8263         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
8264                 return -EINVAL;
8265         if (nla_parse_nested_deprecated(tb, NL80211_MESHCONF_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_CONFIG], nl80211_meshconf_params_policy, info->extack))
8266                 return -EINVAL;
8267
8268         /* This makes sure that there aren't more than 32 mesh config
8269          * parameters (otherwise our bitfield scheme would not work.) */
8270         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
8271
8272         /* Fill in the params struct */
8273         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
8274                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
8275         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
8276                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
8277                                   nla_get_u16);
8278         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
8279                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
8280                                   nla_get_u16);
8281         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
8282                                   NL80211_MESHCONF_MAX_PEER_LINKS,
8283                                   nla_get_u16);
8284         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
8285                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
8286         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
8287                                   NL80211_MESHCONF_TTL, nla_get_u8);
8288         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
8289                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
8290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
8291                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
8292                                   nla_get_u8);
8293         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
8294                                   mask,
8295                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
8296                                   nla_get_u32);
8297         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
8298                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
8299                                   nla_get_u8);
8300         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
8301                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
8302                                   nla_get_u32);
8303         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
8304             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
8305                 return -EINVAL;
8306         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
8307                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
8308                                   nla_get_u16);
8309         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
8310                                   mask,
8311                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
8312                                   nla_get_u32);
8313         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
8314             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
8315              cfg->dot11MeshHWMPactivePathTimeout > 65535))
8316                 return -EINVAL;
8317         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
8318                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
8319                                   nla_get_u16);
8320         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
8321                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
8322                                   nla_get_u16);
8323         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8324                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
8325                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
8326                                   nla_get_u16);
8327         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
8328                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
8329         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
8330                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
8331                                   nla_get_u16);
8332         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
8333                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
8334                                   nla_get_u8);
8335         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
8336                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
8337         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
8338                                   NL80211_MESHCONF_RSSI_THRESHOLD,
8339                                   nla_get_s32);
8340         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToMeshGate, mask,
8341                                   NL80211_MESHCONF_CONNECTED_TO_GATE,
8342                                   nla_get_u8);
8343         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConnectedToAuthServer, mask,
8344                                   NL80211_MESHCONF_CONNECTED_TO_AS,
8345                                   nla_get_u8);
8346         /*
8347          * Check HT operation mode based on
8348          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
8349          */
8350         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
8351                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
8352
8353                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
8354                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
8355                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
8356                         return -EINVAL;
8357
8358                 /* NON_HT_STA bit is reserved, but some programs set it */
8359                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
8360
8361                 cfg->ht_opmode = ht_opmode;
8362                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
8363         }
8364         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
8365                                   dot11MeshHWMPactivePathToRootTimeout, mask,
8366                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
8367                                   nla_get_u32);
8368         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
8369             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
8370              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
8371                 return -EINVAL;
8372         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
8373                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
8374                                   nla_get_u16);
8375         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
8376                                   mask,
8377                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
8378                                   nla_get_u16);
8379         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
8380                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
8381         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
8382                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
8383         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
8384                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
8385         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNolearn, mask,
8386                                   NL80211_MESHCONF_NOLEARN, nla_get_u8);
8387         if (mask_out)
8388                 *mask_out = mask;
8389
8390         return 0;
8391
8392 #undef FILL_IN_MESH_PARAM_IF_SET
8393 }
8394
8395 static int nl80211_parse_mesh_setup(struct genl_info *info,
8396                                      struct mesh_setup *setup)
8397 {
8398         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8399         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
8400
8401         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
8402                 return -EINVAL;
8403         if (nla_parse_nested_deprecated(tb, NL80211_MESH_SETUP_ATTR_MAX, info->attrs[NL80211_ATTR_MESH_SETUP], nl80211_mesh_setup_params_policy, info->extack))
8404                 return -EINVAL;
8405
8406         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
8407                 setup->sync_method =
8408                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
8409                  IEEE80211_SYNC_METHOD_VENDOR :
8410                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
8411
8412         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
8413                 setup->path_sel_proto =
8414                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
8415                  IEEE80211_PATH_PROTOCOL_VENDOR :
8416                  IEEE80211_PATH_PROTOCOL_HWMP;
8417
8418         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
8419                 setup->path_metric =
8420                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
8421                  IEEE80211_PATH_METRIC_VENDOR :
8422                  IEEE80211_PATH_METRIC_AIRTIME;
8423
8424         if (tb[NL80211_MESH_SETUP_IE]) {
8425                 struct nlattr *ieattr =
8426                         tb[NL80211_MESH_SETUP_IE];
8427                 setup->ie = nla_data(ieattr);
8428                 setup->ie_len = nla_len(ieattr);
8429         }
8430         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
8431             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
8432                 return -EINVAL;
8433         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
8434         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
8435         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
8436         if (setup->is_secure)
8437                 setup->user_mpm = true;
8438
8439         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
8440                 if (!setup->user_mpm)
8441                         return -EINVAL;
8442                 setup->auth_id =
8443                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
8444         }
8445
8446         return 0;
8447 }
8448
8449 static int nl80211_update_mesh_config(struct sk_buff *skb,
8450                                       struct genl_info *info)
8451 {
8452         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8453         struct net_device *dev = info->user_ptr[1];
8454         struct wireless_dev *wdev = dev->ieee80211_ptr;
8455         struct mesh_config cfg;
8456         u32 mask;
8457         int err;
8458
8459         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
8460                 return -EOPNOTSUPP;
8461
8462         if (!rdev->ops->update_mesh_config)
8463                 return -EOPNOTSUPP;
8464
8465         err = nl80211_parse_mesh_config(info, &cfg, &mask);
8466         if (err)
8467                 return err;
8468
8469         wdev_lock(wdev);
8470         if (!wdev->u.mesh.id_len)
8471                 err = -ENOLINK;
8472
8473         if (!err)
8474                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
8475
8476         wdev_unlock(wdev);
8477
8478         return err;
8479 }
8480
8481 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
8482                               struct sk_buff *msg)
8483 {
8484         struct nlattr *nl_reg_rules;
8485         unsigned int i;
8486
8487         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
8488             (regdom->dfs_region &&
8489              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
8490                 goto nla_put_failure;
8491
8492         nl_reg_rules = nla_nest_start_noflag(msg, NL80211_ATTR_REG_RULES);
8493         if (!nl_reg_rules)
8494                 goto nla_put_failure;
8495
8496         for (i = 0; i < regdom->n_reg_rules; i++) {
8497                 struct nlattr *nl_reg_rule;
8498                 const struct ieee80211_reg_rule *reg_rule;
8499                 const struct ieee80211_freq_range *freq_range;
8500                 const struct ieee80211_power_rule *power_rule;
8501                 unsigned int max_bandwidth_khz;
8502
8503                 reg_rule = &regdom->reg_rules[i];
8504                 freq_range = &reg_rule->freq_range;
8505                 power_rule = &reg_rule->power_rule;
8506
8507                 nl_reg_rule = nla_nest_start_noflag(msg, i);
8508                 if (!nl_reg_rule)
8509                         goto nla_put_failure;
8510
8511                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
8512                 if (!max_bandwidth_khz)
8513                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
8514                                                                   reg_rule);
8515
8516                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
8517                                 reg_rule->flags) ||
8518                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
8519                                 freq_range->start_freq_khz) ||
8520                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
8521                                 freq_range->end_freq_khz) ||
8522                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
8523                                 max_bandwidth_khz) ||
8524                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
8525                                 power_rule->max_antenna_gain) ||
8526                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
8527                                 power_rule->max_eirp) ||
8528                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
8529                                 reg_rule->dfs_cac_ms))
8530                         goto nla_put_failure;
8531
8532                 nla_nest_end(msg, nl_reg_rule);
8533         }
8534
8535         nla_nest_end(msg, nl_reg_rules);
8536         return 0;
8537
8538 nla_put_failure:
8539         return -EMSGSIZE;
8540 }
8541
8542 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
8543 {
8544         const struct ieee80211_regdomain *regdom = NULL;
8545         struct cfg80211_registered_device *rdev;
8546         struct wiphy *wiphy = NULL;
8547         struct sk_buff *msg;
8548         int err = -EMSGSIZE;
8549         void *hdr;
8550
8551         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
8552         if (!msg)
8553                 return -ENOBUFS;
8554
8555         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
8556                              NL80211_CMD_GET_REG);
8557         if (!hdr)
8558                 goto put_failure;
8559
8560         rtnl_lock();
8561
8562         if (info->attrs[NL80211_ATTR_WIPHY]) {
8563                 bool self_managed;
8564
8565                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
8566                 if (IS_ERR(rdev)) {
8567                         err = PTR_ERR(rdev);
8568                         goto nla_put_failure;
8569                 }
8570
8571                 wiphy = &rdev->wiphy;
8572                 self_managed = wiphy->regulatory_flags &
8573                                REGULATORY_WIPHY_SELF_MANAGED;
8574
8575                 rcu_read_lock();
8576
8577                 regdom = get_wiphy_regdom(wiphy);
8578
8579                 /* a self-managed-reg device must have a private regdom */
8580                 if (WARN_ON(!regdom && self_managed)) {
8581                         err = -EINVAL;
8582                         goto nla_put_failure_rcu;
8583                 }
8584
8585                 if (regdom &&
8586                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8587                         goto nla_put_failure_rcu;
8588         } else {
8589                 rcu_read_lock();
8590         }
8591
8592         if (!wiphy && reg_last_request_cell_base() &&
8593             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8594                         NL80211_USER_REG_HINT_CELL_BASE))
8595                 goto nla_put_failure_rcu;
8596
8597         if (!regdom)
8598                 regdom = rcu_dereference(cfg80211_regdomain);
8599
8600         if (nl80211_put_regdom(regdom, msg))
8601                 goto nla_put_failure_rcu;
8602
8603         rcu_read_unlock();
8604
8605         genlmsg_end(msg, hdr);
8606         rtnl_unlock();
8607         return genlmsg_reply(msg, info);
8608
8609 nla_put_failure_rcu:
8610         rcu_read_unlock();
8611 nla_put_failure:
8612         rtnl_unlock();
8613 put_failure:
8614         nlmsg_free(msg);
8615         return err;
8616 }
8617
8618 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
8619                                u32 seq, int flags, struct wiphy *wiphy,
8620                                const struct ieee80211_regdomain *regdom)
8621 {
8622         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8623                                    NL80211_CMD_GET_REG);
8624
8625         if (!hdr)
8626                 return -1;
8627
8628         genl_dump_check_consistent(cb, hdr);
8629
8630         if (nl80211_put_regdom(regdom, msg))
8631                 goto nla_put_failure;
8632
8633         if (!wiphy && reg_last_request_cell_base() &&
8634             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
8635                         NL80211_USER_REG_HINT_CELL_BASE))
8636                 goto nla_put_failure;
8637
8638         if (wiphy &&
8639             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
8640                 goto nla_put_failure;
8641
8642         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
8643             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
8644                 goto nla_put_failure;
8645
8646         genlmsg_end(msg, hdr);
8647         return 0;
8648
8649 nla_put_failure:
8650         genlmsg_cancel(msg, hdr);
8651         return -EMSGSIZE;
8652 }
8653
8654 static int nl80211_get_reg_dump(struct sk_buff *skb,
8655                                 struct netlink_callback *cb)
8656 {
8657         const struct ieee80211_regdomain *regdom = NULL;
8658         struct cfg80211_registered_device *rdev;
8659         int err, reg_idx, start = cb->args[2];
8660
8661         rcu_read_lock();
8662
8663         if (cfg80211_regdomain && start == 0) {
8664                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8665                                           NLM_F_MULTI, NULL,
8666                                           rcu_dereference(cfg80211_regdomain));
8667                 if (err < 0)
8668                         goto out_err;
8669         }
8670
8671         /* the global regdom is idx 0 */
8672         reg_idx = 1;
8673         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
8674                 regdom = get_wiphy_regdom(&rdev->wiphy);
8675                 if (!regdom)
8676                         continue;
8677
8678                 if (++reg_idx <= start)
8679                         continue;
8680
8681                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
8682                                           NLM_F_MULTI, &rdev->wiphy, regdom);
8683                 if (err < 0) {
8684                         reg_idx--;
8685                         break;
8686                 }
8687         }
8688
8689         cb->args[2] = reg_idx;
8690         err = skb->len;
8691 out_err:
8692         rcu_read_unlock();
8693         return err;
8694 }
8695
8696 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
8697 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
8698         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
8699         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
8700         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
8701         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
8702         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
8703         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
8704         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
8705 };
8706
8707 static int parse_reg_rule(struct nlattr *tb[],
8708         struct ieee80211_reg_rule *reg_rule)
8709 {
8710         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
8711         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
8712
8713         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
8714                 return -EINVAL;
8715         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
8716                 return -EINVAL;
8717         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
8718                 return -EINVAL;
8719         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
8720                 return -EINVAL;
8721         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
8722                 return -EINVAL;
8723
8724         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
8725
8726         freq_range->start_freq_khz =
8727                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
8728         freq_range->end_freq_khz =
8729                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
8730         freq_range->max_bandwidth_khz =
8731                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
8732
8733         power_rule->max_eirp =
8734                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
8735
8736         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
8737                 power_rule->max_antenna_gain =
8738                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
8739
8740         if (tb[NL80211_ATTR_DFS_CAC_TIME])
8741                 reg_rule->dfs_cac_ms =
8742                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
8743
8744         return 0;
8745 }
8746
8747 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
8748 {
8749         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
8750         struct nlattr *nl_reg_rule;
8751         char *alpha2;
8752         int rem_reg_rules, r;
8753         u32 num_rules = 0, rule_idx = 0;
8754         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
8755         struct ieee80211_regdomain *rd;
8756
8757         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
8758                 return -EINVAL;
8759
8760         if (!info->attrs[NL80211_ATTR_REG_RULES])
8761                 return -EINVAL;
8762
8763         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
8764
8765         if (info->attrs[NL80211_ATTR_DFS_REGION])
8766                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
8767
8768         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8769                             rem_reg_rules) {
8770                 num_rules++;
8771                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
8772                         return -EINVAL;
8773         }
8774
8775         rtnl_lock();
8776         if (!reg_is_valid_request(alpha2)) {
8777                 r = -EINVAL;
8778                 goto out;
8779         }
8780
8781         rd = kzalloc(struct_size(rd, reg_rules, num_rules), GFP_KERNEL);
8782         if (!rd) {
8783                 r = -ENOMEM;
8784                 goto out;
8785         }
8786
8787         rd->n_reg_rules = num_rules;
8788         rd->alpha2[0] = alpha2[0];
8789         rd->alpha2[1] = alpha2[1];
8790
8791         /*
8792          * Disable DFS master mode if the DFS region was
8793          * not supported or known on this kernel.
8794          */
8795         if (reg_supported_dfs_region(dfs_region))
8796                 rd->dfs_region = dfs_region;
8797
8798         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
8799                             rem_reg_rules) {
8800                 r = nla_parse_nested_deprecated(tb, NL80211_REG_RULE_ATTR_MAX,
8801                                                 nl_reg_rule, reg_rule_policy,
8802                                                 info->extack);
8803                 if (r)
8804                         goto bad_reg;
8805                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
8806                 if (r)
8807                         goto bad_reg;
8808
8809                 rule_idx++;
8810
8811                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
8812                         r = -EINVAL;
8813                         goto bad_reg;
8814                 }
8815         }
8816
8817         r = set_regdom(rd, REGD_SOURCE_CRDA);
8818         /* set_regdom takes ownership of rd */
8819         rd = NULL;
8820  bad_reg:
8821         kfree(rd);
8822  out:
8823         rtnl_unlock();
8824         return r;
8825 }
8826 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
8827
8828 static int validate_scan_freqs(struct nlattr *freqs)
8829 {
8830         struct nlattr *attr1, *attr2;
8831         int n_channels = 0, tmp1, tmp2;
8832
8833         nla_for_each_nested(attr1, freqs, tmp1)
8834                 if (nla_len(attr1) != sizeof(u32))
8835                         return 0;
8836
8837         nla_for_each_nested(attr1, freqs, tmp1) {
8838                 n_channels++;
8839                 /*
8840                  * Some hardware has a limited channel list for
8841                  * scanning, and it is pretty much nonsensical
8842                  * to scan for a channel twice, so disallow that
8843                  * and don't require drivers to check that the
8844                  * channel list they get isn't longer than what
8845                  * they can scan, as long as they can scan all
8846                  * the channels they registered at once.
8847                  */
8848                 nla_for_each_nested(attr2, freqs, tmp2)
8849                         if (attr1 != attr2 &&
8850                             nla_get_u32(attr1) == nla_get_u32(attr2))
8851                                 return 0;
8852         }
8853
8854         return n_channels;
8855 }
8856
8857 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
8858 {
8859         return b < NUM_NL80211_BANDS && wiphy->bands[b];
8860 }
8861
8862 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
8863                             struct cfg80211_bss_selection *bss_select)
8864 {
8865         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
8866         struct nlattr *nest;
8867         int err;
8868         bool found = false;
8869         int i;
8870
8871         /* only process one nested attribute */
8872         nest = nla_data(nla);
8873         if (!nla_ok(nest, nla_len(nest)))
8874                 return -EINVAL;
8875
8876         err = nla_parse_nested_deprecated(attr, NL80211_BSS_SELECT_ATTR_MAX,
8877                                           nest, nl80211_bss_select_policy,
8878                                           NULL);
8879         if (err)
8880                 return err;
8881
8882         /* only one attribute may be given */
8883         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
8884                 if (attr[i]) {
8885                         if (found)
8886                                 return -EINVAL;
8887                         found = true;
8888                 }
8889         }
8890
8891         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
8892
8893         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
8894                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
8895
8896         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
8897                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
8898                 bss_select->param.band_pref =
8899                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
8900                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
8901                         return -EINVAL;
8902         }
8903
8904         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
8905                 struct nl80211_bss_select_rssi_adjust *adj_param;
8906
8907                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
8908                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
8909                 bss_select->param.adjust.band = adj_param->band;
8910                 bss_select->param.adjust.delta = adj_param->delta;
8911                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
8912                         return -EINVAL;
8913         }
8914
8915         /* user-space did not provide behaviour attribute */
8916         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
8917                 return -EINVAL;
8918
8919         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
8920                 return -EINVAL;
8921
8922         return 0;
8923 }
8924
8925 int nl80211_parse_random_mac(struct nlattr **attrs,
8926                              u8 *mac_addr, u8 *mac_addr_mask)
8927 {
8928         int i;
8929
8930         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
8931                 eth_zero_addr(mac_addr);
8932                 eth_zero_addr(mac_addr_mask);
8933                 mac_addr[0] = 0x2;
8934                 mac_addr_mask[0] = 0x3;
8935
8936                 return 0;
8937         }
8938
8939         /* need both or none */
8940         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
8941                 return -EINVAL;
8942
8943         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
8944         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
8945
8946         /* don't allow or configure an mcast address */
8947         if (!is_multicast_ether_addr(mac_addr_mask) ||
8948             is_multicast_ether_addr(mac_addr))
8949                 return -EINVAL;
8950
8951         /*
8952          * allow users to pass a MAC address that has bits set outside
8953          * of the mask, but don't bother drivers with having to deal
8954          * with such bits
8955          */
8956         for (i = 0; i < ETH_ALEN; i++)
8957                 mac_addr[i] &= mac_addr_mask[i];
8958
8959         return 0;
8960 }
8961
8962 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev,
8963                                               struct ieee80211_channel *chan)
8964 {
8965         unsigned int link_id;
8966         bool all_ok = true;
8967
8968         ASSERT_WDEV_LOCK(wdev);
8969
8970         if (!cfg80211_beaconing_iface_active(wdev))
8971                 return true;
8972
8973         /*
8974          * FIXME: check if we have a free HW resource/link for chan
8975          *
8976          * This, as well as the FIXME below, requires knowing the link
8977          * capabilities of the hardware.
8978          */
8979
8980         /* we cannot leave radar channels */
8981         for_each_valid_link(wdev, link_id) {
8982                 struct cfg80211_chan_def *chandef;
8983
8984                 chandef = wdev_chandef(wdev, link_id);
8985                 if (!chandef || !chandef->chan)
8986                         continue;
8987
8988                 /*
8989                  * FIXME: don't require all_ok, but rather check only the
8990                  *        correct HW resource/link onto which 'chan' falls,
8991                  *        as only that link leaves the channel for doing
8992                  *        the off-channel operation.
8993                  */
8994
8995                 if (chandef->chan->flags & IEEE80211_CHAN_RADAR)
8996                         all_ok = false;
8997         }
8998
8999         if (all_ok)
9000                 return true;
9001
9002         return regulatory_pre_cac_allowed(wdev->wiphy);
9003 }
9004
9005 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
9006                                     enum nl80211_ext_feature_index feat)
9007 {
9008         if (!(flags & flag))
9009                 return true;
9010         if (wiphy_ext_feature_isset(wiphy, feat))
9011                 return true;
9012         return false;
9013 }
9014
9015 static int
9016 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
9017                          void *request, struct nlattr **attrs,
9018                          bool is_sched_scan)
9019 {
9020         u8 *mac_addr, *mac_addr_mask;
9021         u32 *flags;
9022         enum nl80211_feature_flags randomness_flag;
9023
9024         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
9025                 return 0;
9026
9027         if (is_sched_scan) {
9028                 struct cfg80211_sched_scan_request *req = request;
9029
9030                 randomness_flag = wdev ?
9031                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
9032                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
9033                 flags = &req->flags;
9034                 mac_addr = req->mac_addr;
9035                 mac_addr_mask = req->mac_addr_mask;
9036         } else {
9037                 struct cfg80211_scan_request *req = request;
9038
9039                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
9040                 flags = &req->flags;
9041                 mac_addr = req->mac_addr;
9042                 mac_addr_mask = req->mac_addr_mask;
9043         }
9044
9045         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
9046
9047         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
9048              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
9049             !nl80211_check_scan_feat(wiphy, *flags,
9050                                      NL80211_SCAN_FLAG_LOW_SPAN,
9051                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
9052             !nl80211_check_scan_feat(wiphy, *flags,
9053                                      NL80211_SCAN_FLAG_LOW_POWER,
9054                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
9055             !nl80211_check_scan_feat(wiphy, *flags,
9056                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
9057                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
9058             !nl80211_check_scan_feat(wiphy, *flags,
9059                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
9060                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
9061             !nl80211_check_scan_feat(wiphy, *flags,
9062                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
9063                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
9064             !nl80211_check_scan_feat(wiphy, *flags,
9065                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
9066                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
9067             !nl80211_check_scan_feat(wiphy, *flags,
9068                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
9069                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
9070             !nl80211_check_scan_feat(wiphy, *flags,
9071                                      NL80211_SCAN_FLAG_RANDOM_SN,
9072                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
9073             !nl80211_check_scan_feat(wiphy, *flags,
9074                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
9075                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
9076                 return -EOPNOTSUPP;
9077
9078         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
9079                 int err;
9080
9081                 if (!(wiphy->features & randomness_flag) ||
9082                     (wdev && wdev->connected))
9083                         return -EOPNOTSUPP;
9084
9085                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
9086                 if (err)
9087                         return err;
9088         }
9089
9090         return 0;
9091 }
9092
9093 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
9094 {
9095         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9096         struct wireless_dev *wdev = info->user_ptr[1];
9097         struct cfg80211_scan_request *request;
9098         struct nlattr *scan_freqs = NULL;
9099         bool scan_freqs_khz = false;
9100         struct nlattr *attr;
9101         struct wiphy *wiphy;
9102         int err, tmp, n_ssids = 0, n_channels, i;
9103         size_t ie_len, size;
9104
9105         wiphy = &rdev->wiphy;
9106
9107         if (wdev->iftype == NL80211_IFTYPE_NAN)
9108                 return -EOPNOTSUPP;
9109
9110         if (!rdev->ops->scan)
9111                 return -EOPNOTSUPP;
9112
9113         if (rdev->scan_req || rdev->scan_msg)
9114                 return -EBUSY;
9115
9116         if (info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ]) {
9117                 if (!wiphy_ext_feature_isset(wiphy,
9118                                              NL80211_EXT_FEATURE_SCAN_FREQ_KHZ))
9119                         return -EOPNOTSUPP;
9120                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQ_KHZ];
9121                 scan_freqs_khz = true;
9122         } else if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES])
9123                 scan_freqs = info->attrs[NL80211_ATTR_SCAN_FREQUENCIES];
9124
9125         if (scan_freqs) {
9126                 n_channels = validate_scan_freqs(scan_freqs);
9127                 if (!n_channels)
9128                         return -EINVAL;
9129         } else {
9130                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9131         }
9132
9133         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
9134                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
9135                         n_ssids++;
9136
9137         if (n_ssids > wiphy->max_scan_ssids)
9138                 return -EINVAL;
9139
9140         if (info->attrs[NL80211_ATTR_IE])
9141                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9142         else
9143                 ie_len = 0;
9144
9145         if (ie_len > wiphy->max_scan_ie_len)
9146                 return -EINVAL;
9147
9148         size = struct_size(request, channels, n_channels);
9149         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9150         size = size_add(size, ie_len);
9151         request = kzalloc(size, GFP_KERNEL);
9152         if (!request)
9153                 return -ENOMEM;
9154
9155         if (n_ssids)
9156                 request->ssids = (void *)&request->channels[n_channels];
9157         request->n_ssids = n_ssids;
9158         if (ie_len) {
9159                 if (n_ssids)
9160                         request->ie = (void *)(request->ssids + n_ssids);
9161                 else
9162                         request->ie = (void *)(request->channels + n_channels);
9163         }
9164
9165         i = 0;
9166         if (scan_freqs) {
9167                 /* user specified, bail out if channel not found */
9168                 nla_for_each_nested(attr, scan_freqs, tmp) {
9169                         struct ieee80211_channel *chan;
9170                         int freq = nla_get_u32(attr);
9171
9172                         if (!scan_freqs_khz)
9173                                 freq = MHZ_TO_KHZ(freq);
9174
9175                         chan = ieee80211_get_channel_khz(wiphy, freq);
9176                         if (!chan) {
9177                                 err = -EINVAL;
9178                                 goto out_free;
9179                         }
9180
9181                         /* ignore disabled channels */
9182                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9183                                 continue;
9184
9185                         request->channels[i] = chan;
9186                         i++;
9187                 }
9188         } else {
9189                 enum nl80211_band band;
9190
9191                 /* all channels */
9192                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9193                         int j;
9194
9195                         if (!wiphy->bands[band])
9196                                 continue;
9197                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9198                                 struct ieee80211_channel *chan;
9199
9200                                 chan = &wiphy->bands[band]->channels[j];
9201
9202                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9203                                         continue;
9204
9205                                 request->channels[i] = chan;
9206                                 i++;
9207                         }
9208                 }
9209         }
9210
9211         if (!i) {
9212                 err = -EINVAL;
9213                 goto out_free;
9214         }
9215
9216         request->n_channels = i;
9217
9218         wdev_lock(wdev);
9219         for (i = 0; i < request->n_channels; i++) {
9220                 struct ieee80211_channel *chan = request->channels[i];
9221
9222                 /* if we can go off-channel to the target channel we're good */
9223                 if (cfg80211_off_channel_oper_allowed(wdev, chan))
9224                         continue;
9225
9226                 if (!cfg80211_wdev_on_sub_chan(wdev, chan, true)) {
9227                         wdev_unlock(wdev);
9228                         err = -EBUSY;
9229                         goto out_free;
9230                 }
9231         }
9232         wdev_unlock(wdev);
9233
9234         i = 0;
9235         if (n_ssids) {
9236                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
9237                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9238                                 err = -EINVAL;
9239                                 goto out_free;
9240                         }
9241                         request->ssids[i].ssid_len = nla_len(attr);
9242                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
9243                         i++;
9244                 }
9245         }
9246
9247         if (info->attrs[NL80211_ATTR_IE]) {
9248                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9249                 memcpy((void *)request->ie,
9250                        nla_data(info->attrs[NL80211_ATTR_IE]),
9251                        request->ie_len);
9252         }
9253
9254         for (i = 0; i < NUM_NL80211_BANDS; i++)
9255                 if (wiphy->bands[i])
9256                         request->rates[i] =
9257                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
9258
9259         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
9260                 nla_for_each_nested(attr,
9261                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
9262                                     tmp) {
9263                         enum nl80211_band band = nla_type(attr);
9264
9265                         if (band < 0 || band >= NUM_NL80211_BANDS) {
9266                                 err = -EINVAL;
9267                                 goto out_free;
9268                         }
9269
9270                         if (!wiphy->bands[band])
9271                                 continue;
9272
9273                         err = ieee80211_get_ratemask(wiphy->bands[band],
9274                                                      nla_data(attr),
9275                                                      nla_len(attr),
9276                                                      &request->rates[band]);
9277                         if (err)
9278                                 goto out_free;
9279                 }
9280         }
9281
9282         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
9283                 request->duration =
9284                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
9285                 request->duration_mandatory =
9286                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
9287         }
9288
9289         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
9290                                        false);
9291         if (err)
9292                 goto out_free;
9293
9294         request->no_cck =
9295                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9296
9297         /* Initial implementation used NL80211_ATTR_MAC to set the specific
9298          * BSSID to scan for. This was problematic because that same attribute
9299          * was already used for another purpose (local random MAC address). The
9300          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
9301          * compatibility with older userspace components, also use the
9302          * NL80211_ATTR_MAC value here if it can be determined to be used for
9303          * the specific BSSID use case instead of the random MAC address
9304          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
9305          */
9306         if (info->attrs[NL80211_ATTR_BSSID])
9307                 memcpy(request->bssid,
9308                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
9309         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
9310                  info->attrs[NL80211_ATTR_MAC])
9311                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
9312                        ETH_ALEN);
9313         else
9314                 eth_broadcast_addr(request->bssid);
9315
9316         request->wdev = wdev;
9317         request->wiphy = &rdev->wiphy;
9318         request->scan_start = jiffies;
9319
9320         rdev->scan_req = request;
9321         err = cfg80211_scan(rdev);
9322
9323         if (err)
9324                 goto out_free;
9325
9326         nl80211_send_scan_start(rdev, wdev);
9327         dev_hold(wdev->netdev);
9328
9329         return 0;
9330
9331  out_free:
9332         rdev->scan_req = NULL;
9333         kfree(request);
9334
9335         return err;
9336 }
9337
9338 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
9339 {
9340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9341         struct wireless_dev *wdev = info->user_ptr[1];
9342
9343         if (!rdev->ops->abort_scan)
9344                 return -EOPNOTSUPP;
9345
9346         if (rdev->scan_msg)
9347                 return 0;
9348
9349         if (!rdev->scan_req)
9350                 return -ENOENT;
9351
9352         rdev_abort_scan(rdev, wdev);
9353         return 0;
9354 }
9355
9356 static int
9357 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
9358                                struct cfg80211_sched_scan_request *request,
9359                                struct nlattr **attrs)
9360 {
9361         int tmp, err, i = 0;
9362         struct nlattr *attr;
9363
9364         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9365                 u32 interval;
9366
9367                 /*
9368                  * If scan plans are not specified,
9369                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
9370                  * case one scan plan will be set with the specified scan
9371                  * interval and infinite number of iterations.
9372                  */
9373                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
9374                 if (!interval)
9375                         return -EINVAL;
9376
9377                 request->scan_plans[0].interval =
9378                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
9379                 if (!request->scan_plans[0].interval)
9380                         return -EINVAL;
9381
9382                 if (request->scan_plans[0].interval >
9383                     wiphy->max_sched_scan_plan_interval)
9384                         request->scan_plans[0].interval =
9385                                 wiphy->max_sched_scan_plan_interval;
9386
9387                 return 0;
9388         }
9389
9390         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
9391                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
9392
9393                 if (WARN_ON(i >= n_plans))
9394                         return -EINVAL;
9395
9396                 err = nla_parse_nested_deprecated(plan,
9397                                                   NL80211_SCHED_SCAN_PLAN_MAX,
9398                                                   attr, nl80211_plan_policy,
9399                                                   NULL);
9400                 if (err)
9401                         return err;
9402
9403                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
9404                         return -EINVAL;
9405
9406                 request->scan_plans[i].interval =
9407                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
9408                 if (!request->scan_plans[i].interval ||
9409                     request->scan_plans[i].interval >
9410                     wiphy->max_sched_scan_plan_interval)
9411                         return -EINVAL;
9412
9413                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
9414                         request->scan_plans[i].iterations =
9415                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
9416                         if (!request->scan_plans[i].iterations ||
9417                             (request->scan_plans[i].iterations >
9418                              wiphy->max_sched_scan_plan_iterations))
9419                                 return -EINVAL;
9420                 } else if (i < n_plans - 1) {
9421                         /*
9422                          * All scan plans but the last one must specify
9423                          * a finite number of iterations
9424                          */
9425                         return -EINVAL;
9426                 }
9427
9428                 i++;
9429         }
9430
9431         /*
9432          * The last scan plan must not specify the number of
9433          * iterations, it is supposed to run infinitely
9434          */
9435         if (request->scan_plans[n_plans - 1].iterations)
9436                 return  -EINVAL;
9437
9438         return 0;
9439 }
9440
9441 static int
9442 nl80211_parse_sched_scan_per_band_rssi(struct wiphy *wiphy,
9443                                        struct cfg80211_match_set *match_sets,
9444                                        struct nlattr *tb_band_rssi,
9445                                        s32 rssi_thold)
9446 {
9447         struct nlattr *attr;
9448         int i, tmp, ret = 0;
9449
9450         if (!wiphy_ext_feature_isset(wiphy,
9451                     NL80211_EXT_FEATURE_SCHED_SCAN_BAND_SPECIFIC_RSSI_THOLD)) {
9452                 if (tb_band_rssi)
9453                         ret = -EOPNOTSUPP;
9454                 else
9455                         for (i = 0; i < NUM_NL80211_BANDS; i++)
9456                                 match_sets->per_band_rssi_thold[i] =
9457                                         NL80211_SCAN_RSSI_THOLD_OFF;
9458                 return ret;
9459         }
9460
9461         for (i = 0; i < NUM_NL80211_BANDS; i++)
9462                 match_sets->per_band_rssi_thold[i] = rssi_thold;
9463
9464         nla_for_each_nested(attr, tb_band_rssi, tmp) {
9465                 enum nl80211_band band = nla_type(attr);
9466
9467                 if (band < 0 || band >= NUM_NL80211_BANDS)
9468                         return -EINVAL;
9469
9470                 match_sets->per_band_rssi_thold[band] = nla_get_s32(attr);
9471         }
9472
9473         return 0;
9474 }
9475
9476 static struct cfg80211_sched_scan_request *
9477 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
9478                          struct nlattr **attrs, int max_match_sets)
9479 {
9480         struct cfg80211_sched_scan_request *request;
9481         struct nlattr *attr;
9482         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
9483         enum nl80211_band band;
9484         size_t ie_len, size;
9485         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
9486         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
9487
9488         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9489                 n_channels = validate_scan_freqs(
9490                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
9491                 if (!n_channels)
9492                         return ERR_PTR(-EINVAL);
9493         } else {
9494                 n_channels = ieee80211_get_num_supported_channels(wiphy);
9495         }
9496
9497         if (attrs[NL80211_ATTR_SCAN_SSIDS])
9498                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9499                                     tmp)
9500                         n_ssids++;
9501
9502         if (n_ssids > wiphy->max_sched_scan_ssids)
9503                 return ERR_PTR(-EINVAL);
9504
9505         /*
9506          * First, count the number of 'real' matchsets. Due to an issue with
9507          * the old implementation, matchsets containing only the RSSI attribute
9508          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
9509          * RSSI for all matchsets, rather than their own matchset for reporting
9510          * all APs with a strong RSSI. This is needed to be compatible with
9511          * older userspace that treated a matchset with only the RSSI as the
9512          * global RSSI for all other matchsets - if there are other matchsets.
9513          */
9514         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9515                 nla_for_each_nested(attr,
9516                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9517                                     tmp) {
9518                         struct nlattr *rssi;
9519
9520                         err = nla_parse_nested_deprecated(tb,
9521                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9522                                                           attr,
9523                                                           nl80211_match_policy,
9524                                                           NULL);
9525                         if (err)
9526                                 return ERR_PTR(err);
9527
9528                         /* SSID and BSSID are mutually exclusive */
9529                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
9530                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
9531                                 return ERR_PTR(-EINVAL);
9532
9533                         /* add other standalone attributes here */
9534                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
9535                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
9536                                 n_match_sets++;
9537                                 continue;
9538                         }
9539                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9540                         if (rssi)
9541                                 default_match_rssi = nla_get_s32(rssi);
9542                 }
9543         }
9544
9545         /* However, if there's no other matchset, add the RSSI one */
9546         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
9547                 n_match_sets = 1;
9548
9549         if (n_match_sets > max_match_sets)
9550                 return ERR_PTR(-EINVAL);
9551
9552         if (attrs[NL80211_ATTR_IE])
9553                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
9554         else
9555                 ie_len = 0;
9556
9557         if (ie_len > wiphy->max_sched_scan_ie_len)
9558                 return ERR_PTR(-EINVAL);
9559
9560         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
9561                 /*
9562                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
9563                  * each scan plan already specifies its own interval
9564                  */
9565                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9566                         return ERR_PTR(-EINVAL);
9567
9568                 nla_for_each_nested(attr,
9569                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
9570                         n_plans++;
9571         } else {
9572                 /*
9573                  * The scan interval attribute is kept for backward
9574                  * compatibility. If no scan plans are specified and sched scan
9575                  * interval is specified, one scan plan will be set with this
9576                  * scan interval and infinite number of iterations.
9577                  */
9578                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
9579                         return ERR_PTR(-EINVAL);
9580
9581                 n_plans = 1;
9582         }
9583
9584         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
9585                 return ERR_PTR(-EINVAL);
9586
9587         if (!wiphy_ext_feature_isset(
9588                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
9589             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
9590              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
9591                 return ERR_PTR(-EINVAL);
9592
9593         size = struct_size(request, channels, n_channels);
9594         size = size_add(size, array_size(sizeof(*request->ssids), n_ssids));
9595         size = size_add(size, array_size(sizeof(*request->match_sets),
9596                                          n_match_sets));
9597         size = size_add(size, array_size(sizeof(*request->scan_plans),
9598                                          n_plans));
9599         size = size_add(size, ie_len);
9600         request = kzalloc(size, GFP_KERNEL);
9601         if (!request)
9602                 return ERR_PTR(-ENOMEM);
9603
9604         if (n_ssids)
9605                 request->ssids = (void *)&request->channels[n_channels];
9606         request->n_ssids = n_ssids;
9607         if (ie_len) {
9608                 if (n_ssids)
9609                         request->ie = (void *)(request->ssids + n_ssids);
9610                 else
9611                         request->ie = (void *)(request->channels + n_channels);
9612         }
9613
9614         if (n_match_sets) {
9615                 if (request->ie)
9616                         request->match_sets = (void *)(request->ie + ie_len);
9617                 else if (n_ssids)
9618                         request->match_sets =
9619                                 (void *)(request->ssids + n_ssids);
9620                 else
9621                         request->match_sets =
9622                                 (void *)(request->channels + n_channels);
9623         }
9624         request->n_match_sets = n_match_sets;
9625
9626         if (n_match_sets)
9627                 request->scan_plans = (void *)(request->match_sets +
9628                                                n_match_sets);
9629         else if (request->ie)
9630                 request->scan_plans = (void *)(request->ie + ie_len);
9631         else if (n_ssids)
9632                 request->scan_plans = (void *)(request->ssids + n_ssids);
9633         else
9634                 request->scan_plans = (void *)(request->channels + n_channels);
9635
9636         request->n_scan_plans = n_plans;
9637
9638         i = 0;
9639         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
9640                 /* user specified, bail out if channel not found */
9641                 nla_for_each_nested(attr,
9642                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
9643                                     tmp) {
9644                         struct ieee80211_channel *chan;
9645
9646                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
9647
9648                         if (!chan) {
9649                                 err = -EINVAL;
9650                                 goto out_free;
9651                         }
9652
9653                         /* ignore disabled channels */
9654                         if (chan->flags & IEEE80211_CHAN_DISABLED)
9655                                 continue;
9656
9657                         request->channels[i] = chan;
9658                         i++;
9659                 }
9660         } else {
9661                 /* all channels */
9662                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
9663                         int j;
9664
9665                         if (!wiphy->bands[band])
9666                                 continue;
9667                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
9668                                 struct ieee80211_channel *chan;
9669
9670                                 chan = &wiphy->bands[band]->channels[j];
9671
9672                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
9673                                         continue;
9674
9675                                 request->channels[i] = chan;
9676                                 i++;
9677                         }
9678                 }
9679         }
9680
9681         if (!i) {
9682                 err = -EINVAL;
9683                 goto out_free;
9684         }
9685
9686         request->n_channels = i;
9687
9688         i = 0;
9689         if (n_ssids) {
9690                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
9691                                     tmp) {
9692                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
9693                                 err = -EINVAL;
9694                                 goto out_free;
9695                         }
9696                         request->ssids[i].ssid_len = nla_len(attr);
9697                         memcpy(request->ssids[i].ssid, nla_data(attr),
9698                                nla_len(attr));
9699                         i++;
9700                 }
9701         }
9702
9703         i = 0;
9704         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
9705                 nla_for_each_nested(attr,
9706                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
9707                                     tmp) {
9708                         struct nlattr *ssid, *bssid, *rssi;
9709
9710                         err = nla_parse_nested_deprecated(tb,
9711                                                           NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
9712                                                           attr,
9713                                                           nl80211_match_policy,
9714                                                           NULL);
9715                         if (err)
9716                                 goto out_free;
9717                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
9718                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
9719
9720                         if (!ssid && !bssid) {
9721                                 i++;
9722                                 continue;
9723                         }
9724
9725                         if (WARN_ON(i >= n_match_sets)) {
9726                                 /* this indicates a programming error,
9727                                  * the loop above should have verified
9728                                  * things properly
9729                                  */
9730                                 err = -EINVAL;
9731                                 goto out_free;
9732                         }
9733
9734                         if (ssid) {
9735                                 memcpy(request->match_sets[i].ssid.ssid,
9736                                        nla_data(ssid), nla_len(ssid));
9737                                 request->match_sets[i].ssid.ssid_len =
9738                                         nla_len(ssid);
9739                         }
9740                         if (bssid)
9741                                 memcpy(request->match_sets[i].bssid,
9742                                        nla_data(bssid), ETH_ALEN);
9743
9744                         /* special attribute - old implementation w/a */
9745                         request->match_sets[i].rssi_thold = default_match_rssi;
9746                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
9747                         if (rssi)
9748                                 request->match_sets[i].rssi_thold =
9749                                         nla_get_s32(rssi);
9750
9751                         /* Parse per band RSSI attribute */
9752                         err = nl80211_parse_sched_scan_per_band_rssi(wiphy,
9753                                 &request->match_sets[i],
9754                                 tb[NL80211_SCHED_SCAN_MATCH_PER_BAND_RSSI],
9755                                 request->match_sets[i].rssi_thold);
9756                         if (err)
9757                                 goto out_free;
9758
9759                         i++;
9760                 }
9761
9762                 /* there was no other matchset, so the RSSI one is alone */
9763                 if (i == 0 && n_match_sets)
9764                         request->match_sets[0].rssi_thold = default_match_rssi;
9765
9766                 request->min_rssi_thold = INT_MAX;
9767                 for (i = 0; i < n_match_sets; i++)
9768                         request->min_rssi_thold =
9769                                 min(request->match_sets[i].rssi_thold,
9770                                     request->min_rssi_thold);
9771         } else {
9772                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
9773         }
9774
9775         if (ie_len) {
9776                 request->ie_len = ie_len;
9777                 memcpy((void *)request->ie,
9778                        nla_data(attrs[NL80211_ATTR_IE]),
9779                        request->ie_len);
9780         }
9781
9782         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
9783         if (err)
9784                 goto out_free;
9785
9786         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
9787                 request->delay =
9788                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
9789
9790         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
9791                 request->relative_rssi = nla_get_s8(
9792                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
9793                 request->relative_rssi_set = true;
9794         }
9795
9796         if (request->relative_rssi_set &&
9797             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
9798                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
9799
9800                 rssi_adjust = nla_data(
9801                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
9802                 request->rssi_adjust.band = rssi_adjust->band;
9803                 request->rssi_adjust.delta = rssi_adjust->delta;
9804                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
9805                         err = -EINVAL;
9806                         goto out_free;
9807                 }
9808         }
9809
9810         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
9811         if (err)
9812                 goto out_free;
9813
9814         request->scan_start = jiffies;
9815
9816         return request;
9817
9818 out_free:
9819         kfree(request);
9820         return ERR_PTR(err);
9821 }
9822
9823 static int nl80211_start_sched_scan(struct sk_buff *skb,
9824                                     struct genl_info *info)
9825 {
9826         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9827         struct net_device *dev = info->user_ptr[1];
9828         struct wireless_dev *wdev = dev->ieee80211_ptr;
9829         struct cfg80211_sched_scan_request *sched_scan_req;
9830         bool want_multi;
9831         int err;
9832
9833         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
9834                 return -EOPNOTSUPP;
9835
9836         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
9837         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
9838         if (err)
9839                 return err;
9840
9841         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
9842                                                   info->attrs,
9843                                                   rdev->wiphy.max_match_sets);
9844
9845         err = PTR_ERR_OR_ZERO(sched_scan_req);
9846         if (err)
9847                 goto out_err;
9848
9849         /* leave request id zero for legacy request
9850          * or if driver does not support multi-scheduled scan
9851          */
9852         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1)
9853                 sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
9854
9855         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
9856         if (err)
9857                 goto out_free;
9858
9859         sched_scan_req->dev = dev;
9860         sched_scan_req->wiphy = &rdev->wiphy;
9861
9862         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
9863                 sched_scan_req->owner_nlportid = info->snd_portid;
9864
9865         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
9866
9867         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
9868         return 0;
9869
9870 out_free:
9871         kfree(sched_scan_req);
9872 out_err:
9873         return err;
9874 }
9875
9876 static int nl80211_stop_sched_scan(struct sk_buff *skb,
9877                                    struct genl_info *info)
9878 {
9879         struct cfg80211_sched_scan_request *req;
9880         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9881         u64 cookie;
9882
9883         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
9884                 return -EOPNOTSUPP;
9885
9886         if (info->attrs[NL80211_ATTR_COOKIE]) {
9887                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9888                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
9889         }
9890
9891         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
9892                                      struct cfg80211_sched_scan_request,
9893                                      list);
9894         if (!req || req->reqid ||
9895             (req->owner_nlportid &&
9896              req->owner_nlportid != info->snd_portid))
9897                 return -ENOENT;
9898
9899         return cfg80211_stop_sched_scan_req(rdev, req, false);
9900 }
9901
9902 static int nl80211_start_radar_detection(struct sk_buff *skb,
9903                                          struct genl_info *info)
9904 {
9905         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9906         struct net_device *dev = info->user_ptr[1];
9907         struct wireless_dev *wdev = dev->ieee80211_ptr;
9908         struct wiphy *wiphy = wdev->wiphy;
9909         struct cfg80211_chan_def chandef;
9910         enum nl80211_dfs_regions dfs_region;
9911         unsigned int cac_time_ms;
9912         int err = -EINVAL;
9913
9914         flush_delayed_work(&rdev->dfs_update_channels_wk);
9915
9916         wiphy_lock(wiphy);
9917
9918         dfs_region = reg_get_dfs_region(wiphy);
9919         if (dfs_region == NL80211_DFS_UNSET)
9920                 goto unlock;
9921
9922         err = nl80211_parse_chandef(rdev, info, &chandef);
9923         if (err)
9924                 goto unlock;
9925
9926         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
9927         if (err < 0)
9928                 goto unlock;
9929
9930         if (err == 0) {
9931                 err = -EINVAL;
9932                 goto unlock;
9933         }
9934
9935         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef)) {
9936                 err = -EINVAL;
9937                 goto unlock;
9938         }
9939
9940         if (nla_get_flag(info->attrs[NL80211_ATTR_RADAR_BACKGROUND])) {
9941                 err = cfg80211_start_background_radar_detection(rdev, wdev,
9942                                                                 &chandef);
9943                 goto unlock;
9944         }
9945
9946         if (netif_carrier_ok(dev)) {
9947                 err = -EBUSY;
9948                 goto unlock;
9949         }
9950
9951         if (wdev->cac_started) {
9952                 err = -EBUSY;
9953                 goto unlock;
9954         }
9955
9956         /* CAC start is offloaded to HW and can't be started manually */
9957         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD)) {
9958                 err = -EOPNOTSUPP;
9959                 goto unlock;
9960         }
9961
9962         if (!rdev->ops->start_radar_detection) {
9963                 err = -EOPNOTSUPP;
9964                 goto unlock;
9965         }
9966
9967         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
9968         if (WARN_ON(!cac_time_ms))
9969                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
9970
9971         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
9972         if (!err) {
9973                 wdev->links[0].ap.chandef = chandef;
9974                 wdev->cac_started = true;
9975                 wdev->cac_start_time = jiffies;
9976                 wdev->cac_time_ms = cac_time_ms;
9977         }
9978 unlock:
9979         wiphy_unlock(wiphy);
9980
9981         return err;
9982 }
9983
9984 static int nl80211_notify_radar_detection(struct sk_buff *skb,
9985                                           struct genl_info *info)
9986 {
9987         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9988         struct net_device *dev = info->user_ptr[1];
9989         struct wireless_dev *wdev = dev->ieee80211_ptr;
9990         struct wiphy *wiphy = wdev->wiphy;
9991         struct cfg80211_chan_def chandef;
9992         enum nl80211_dfs_regions dfs_region;
9993         int err;
9994
9995         dfs_region = reg_get_dfs_region(wiphy);
9996         if (dfs_region == NL80211_DFS_UNSET) {
9997                 GENL_SET_ERR_MSG(info,
9998                                  "DFS Region is not set. Unexpected Radar indication");
9999                 return -EINVAL;
10000         }
10001
10002         err = nl80211_parse_chandef(rdev, info, &chandef);
10003         if (err) {
10004                 GENL_SET_ERR_MSG(info, "Unable to extract chandef info");
10005                 return err;
10006         }
10007
10008         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
10009         if (err < 0) {
10010                 GENL_SET_ERR_MSG(info, "chandef is invalid");
10011                 return err;
10012         }
10013
10014         if (err == 0) {
10015                 GENL_SET_ERR_MSG(info,
10016                                  "Unexpected Radar indication for chandef/iftype");
10017                 return -EINVAL;
10018         }
10019
10020         /* Do not process this notification if radar is already detected
10021          * by kernel on this channel, and return success.
10022          */
10023         if (chandef.chan->dfs_state == NL80211_DFS_UNAVAILABLE)
10024                 return 0;
10025
10026         cfg80211_set_dfs_state(wiphy, &chandef, NL80211_DFS_UNAVAILABLE);
10027
10028         cfg80211_sched_dfs_chan_update(rdev);
10029
10030         rdev->radar_chandef = chandef;
10031
10032         /* Propagate this notification to other radios as well */
10033         queue_work(cfg80211_wq, &rdev->propagate_radar_detect_wk);
10034
10035         return 0;
10036 }
10037
10038 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
10039 {
10040         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10041         unsigned int link_id = nl80211_link_id(info->attrs);
10042         struct net_device *dev = info->user_ptr[1];
10043         struct wireless_dev *wdev = dev->ieee80211_ptr;
10044         struct cfg80211_csa_settings params;
10045         struct nlattr **csa_attrs = NULL;
10046         int err;
10047         bool need_new_beacon = false;
10048         bool need_handle_dfs_flag = true;
10049         int len, i;
10050         u32 cs_count;
10051
10052         if (!rdev->ops->channel_switch ||
10053             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
10054                 return -EOPNOTSUPP;
10055
10056         switch (dev->ieee80211_ptr->iftype) {
10057         case NL80211_IFTYPE_AP:
10058         case NL80211_IFTYPE_P2P_GO:
10059                 need_new_beacon = true;
10060                 /* For all modes except AP the handle_dfs flag needs to be
10061                  * supplied to tell the kernel that userspace will handle radar
10062                  * events when they happen. Otherwise a switch to a channel
10063                  * requiring DFS will be rejected.
10064                  */
10065                 need_handle_dfs_flag = false;
10066
10067                 /* useless if AP is not running */
10068                 if (!wdev->links[link_id].ap.beacon_interval)
10069                         return -ENOTCONN;
10070                 break;
10071         case NL80211_IFTYPE_ADHOC:
10072                 if (!wdev->u.ibss.ssid_len)
10073                         return -ENOTCONN;
10074                 break;
10075         case NL80211_IFTYPE_MESH_POINT:
10076                 if (!wdev->u.mesh.id_len)
10077                         return -ENOTCONN;
10078                 break;
10079         default:
10080                 return -EOPNOTSUPP;
10081         }
10082
10083         memset(&params, 0, sizeof(params));
10084         params.beacon_csa.ftm_responder = -1;
10085
10086         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
10087             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
10088                 return -EINVAL;
10089
10090         /* only important for AP, IBSS and mesh create IEs internally */
10091         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
10092                 return -EINVAL;
10093
10094         /* Even though the attribute is u32, the specification says
10095          * u8, so let's make sure we don't overflow.
10096          */
10097         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
10098         if (cs_count > 255)
10099                 return -EINVAL;
10100
10101         params.count = cs_count;
10102
10103         if (!need_new_beacon)
10104                 goto skip_beacons;
10105
10106         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after,
10107                                    info->extack);
10108         if (err)
10109                 goto free;
10110
10111         csa_attrs = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*csa_attrs),
10112                             GFP_KERNEL);
10113         if (!csa_attrs) {
10114                 err = -ENOMEM;
10115                 goto free;
10116         }
10117
10118         err = nla_parse_nested_deprecated(csa_attrs, NL80211_ATTR_MAX,
10119                                           info->attrs[NL80211_ATTR_CSA_IES],
10120                                           nl80211_policy, info->extack);
10121         if (err)
10122                 goto free;
10123
10124         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa,
10125                                    info->extack);
10126         if (err)
10127                 goto free;
10128
10129         if (!csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
10130                 err = -EINVAL;
10131                 goto free;
10132         }
10133
10134         len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10135         if (!len || (len % sizeof(u16))) {
10136                 err = -EINVAL;
10137                 goto free;
10138         }
10139
10140         params.n_counter_offsets_beacon = len / sizeof(u16);
10141         if (rdev->wiphy.max_num_csa_counters &&
10142             (params.n_counter_offsets_beacon >
10143              rdev->wiphy.max_num_csa_counters)) {
10144                 err = -EINVAL;
10145                 goto free;
10146         }
10147
10148         params.counter_offsets_beacon =
10149                 nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
10150
10151         /* sanity checks - counters should fit and be the same */
10152         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
10153                 u16 offset = params.counter_offsets_beacon[i];
10154
10155                 if (offset >= params.beacon_csa.tail_len) {
10156                         err = -EINVAL;
10157                         goto free;
10158                 }
10159
10160                 if (params.beacon_csa.tail[offset] != params.count) {
10161                         err = -EINVAL;
10162                         goto free;
10163                 }
10164         }
10165
10166         if (csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
10167                 len = nla_len(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10168                 if (!len || (len % sizeof(u16))) {
10169                         err = -EINVAL;
10170                         goto free;
10171                 }
10172
10173                 params.n_counter_offsets_presp = len / sizeof(u16);
10174                 if (rdev->wiphy.max_num_csa_counters &&
10175                     (params.n_counter_offsets_presp >
10176                      rdev->wiphy.max_num_csa_counters)) {
10177                         err = -EINVAL;
10178                         goto free;
10179                 }
10180
10181                 params.counter_offsets_presp =
10182                         nla_data(csa_attrs[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
10183
10184                 /* sanity checks - counters should fit and be the same */
10185                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
10186                         u16 offset = params.counter_offsets_presp[i];
10187
10188                         if (offset >= params.beacon_csa.probe_resp_len) {
10189                                 err = -EINVAL;
10190                                 goto free;
10191                         }
10192
10193                         if (params.beacon_csa.probe_resp[offset] !=
10194                             params.count) {
10195                                 err = -EINVAL;
10196                                 goto free;
10197                         }
10198                 }
10199         }
10200
10201 skip_beacons:
10202         err = nl80211_parse_chandef(rdev, info, &params.chandef);
10203         if (err)
10204                 goto free;
10205
10206         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
10207                                            wdev->iftype)) {
10208                 err = -EINVAL;
10209                 goto free;
10210         }
10211
10212         err = cfg80211_chandef_dfs_required(wdev->wiphy,
10213                                             &params.chandef,
10214                                             wdev->iftype);
10215         if (err < 0)
10216                 goto free;
10217
10218         if (err > 0) {
10219                 params.radar_required = true;
10220                 if (need_handle_dfs_flag &&
10221                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
10222                         err = -EINVAL;
10223                         goto free;
10224                 }
10225         }
10226
10227         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
10228                 params.block_tx = true;
10229
10230         if (info->attrs[NL80211_ATTR_PUNCT_BITMAP]) {
10231                 err = nl80211_parse_punct_bitmap(rdev, info,
10232                                                  &params.chandef,
10233                                                  &params.punct_bitmap);
10234                 if (err)
10235                         goto free;
10236         }
10237
10238         wdev_lock(wdev);
10239         err = rdev_channel_switch(rdev, dev, &params);
10240         wdev_unlock(wdev);
10241
10242 free:
10243         kfree(params.beacon_after.mbssid_ies);
10244         kfree(params.beacon_csa.mbssid_ies);
10245         kfree(params.beacon_after.rnr_ies);
10246         kfree(params.beacon_csa.rnr_ies);
10247         kfree(csa_attrs);
10248         return err;
10249 }
10250
10251 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
10252                             u32 seq, int flags,
10253                             struct cfg80211_registered_device *rdev,
10254                             struct wireless_dev *wdev,
10255                             struct cfg80211_internal_bss *intbss)
10256 {
10257         struct cfg80211_bss *res = &intbss->pub;
10258         const struct cfg80211_bss_ies *ies;
10259         unsigned int link_id;
10260         void *hdr;
10261         struct nlattr *bss;
10262
10263         ASSERT_WDEV_LOCK(wdev);
10264
10265         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
10266                              NL80211_CMD_NEW_SCAN_RESULTS);
10267         if (!hdr)
10268                 return -1;
10269
10270         genl_dump_check_consistent(cb, hdr);
10271
10272         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
10273                 goto nla_put_failure;
10274         if (wdev->netdev &&
10275             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
10276                 goto nla_put_failure;
10277         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
10278                               NL80211_ATTR_PAD))
10279                 goto nla_put_failure;
10280
10281         bss = nla_nest_start_noflag(msg, NL80211_ATTR_BSS);
10282         if (!bss)
10283                 goto nla_put_failure;
10284         if ((!is_zero_ether_addr(res->bssid) &&
10285              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
10286                 goto nla_put_failure;
10287
10288         rcu_read_lock();
10289         /* indicate whether we have probe response data or not */
10290         if (rcu_access_pointer(res->proberesp_ies) &&
10291             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
10292                 goto fail_unlock_rcu;
10293
10294         /* this pointer prefers to be pointed to probe response data
10295          * but is always valid
10296          */
10297         ies = rcu_dereference(res->ies);
10298         if (ies) {
10299                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
10300                                       NL80211_BSS_PAD))
10301                         goto fail_unlock_rcu;
10302                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
10303                                         ies->len, ies->data))
10304                         goto fail_unlock_rcu;
10305         }
10306
10307         /* and this pointer is always (unless driver didn't know) beacon data */
10308         ies = rcu_dereference(res->beacon_ies);
10309         if (ies && ies->from_beacon) {
10310                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
10311                                       NL80211_BSS_PAD))
10312                         goto fail_unlock_rcu;
10313                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
10314                                         ies->len, ies->data))
10315                         goto fail_unlock_rcu;
10316         }
10317         rcu_read_unlock();
10318
10319         if (res->beacon_interval &&
10320             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
10321                 goto nla_put_failure;
10322         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
10323             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
10324             nla_put_u32(msg, NL80211_BSS_FREQUENCY_OFFSET,
10325                         res->channel->freq_offset) ||
10326             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
10327             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
10328                         jiffies_to_msecs(jiffies - intbss->ts)))
10329                 goto nla_put_failure;
10330
10331         if (intbss->parent_tsf &&
10332             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
10333                                intbss->parent_tsf, NL80211_BSS_PAD) ||
10334              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
10335                      intbss->parent_bssid)))
10336                 goto nla_put_failure;
10337
10338         if (intbss->ts_boottime &&
10339             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
10340                               intbss->ts_boottime, NL80211_BSS_PAD))
10341                 goto nla_put_failure;
10342
10343         if (!nl80211_put_signal(msg, intbss->pub.chains,
10344                                 intbss->pub.chain_signal,
10345                                 NL80211_BSS_CHAIN_SIGNAL))
10346                 goto nla_put_failure;
10347
10348         switch (rdev->wiphy.signal_type) {
10349         case CFG80211_SIGNAL_TYPE_MBM:
10350                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
10351                         goto nla_put_failure;
10352                 break;
10353         case CFG80211_SIGNAL_TYPE_UNSPEC:
10354                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
10355                         goto nla_put_failure;
10356                 break;
10357         default:
10358                 break;
10359         }
10360
10361         switch (wdev->iftype) {
10362         case NL80211_IFTYPE_P2P_CLIENT:
10363         case NL80211_IFTYPE_STATION:
10364                 for_each_valid_link(wdev, link_id) {
10365                         if (intbss == wdev->links[link_id].client.current_bss &&
10366                             (nla_put_u32(msg, NL80211_BSS_STATUS,
10367                                          NL80211_BSS_STATUS_ASSOCIATED) ||
10368                              (wdev->valid_links &&
10369                               (nla_put_u8(msg, NL80211_BSS_MLO_LINK_ID,
10370                                           link_id) ||
10371                                nla_put(msg, NL80211_BSS_MLD_ADDR, ETH_ALEN,
10372                                        wdev->u.client.connected_addr)))))
10373                                 goto nla_put_failure;
10374                 }
10375                 break;
10376         case NL80211_IFTYPE_ADHOC:
10377                 if (intbss == wdev->u.ibss.current_bss &&
10378                     nla_put_u32(msg, NL80211_BSS_STATUS,
10379                                 NL80211_BSS_STATUS_IBSS_JOINED))
10380                         goto nla_put_failure;
10381                 break;
10382         default:
10383                 break;
10384         }
10385
10386         nla_nest_end(msg, bss);
10387
10388         genlmsg_end(msg, hdr);
10389         return 0;
10390
10391  fail_unlock_rcu:
10392         rcu_read_unlock();
10393  nla_put_failure:
10394         genlmsg_cancel(msg, hdr);
10395         return -EMSGSIZE;
10396 }
10397
10398 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
10399 {
10400         struct cfg80211_registered_device *rdev;
10401         struct cfg80211_internal_bss *scan;
10402         struct wireless_dev *wdev;
10403         int start = cb->args[2], idx = 0;
10404         int err;
10405
10406         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, NULL);
10407         if (err)
10408                 return err;
10409         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10410         __acquire(&rdev->wiphy.mtx);
10411
10412         wdev_lock(wdev);
10413         spin_lock_bh(&rdev->bss_lock);
10414
10415         /*
10416          * dump_scan will be called multiple times to break up the scan results
10417          * into multiple messages.  It is unlikely that any more bss-es will be
10418          * expired after the first call, so only call only call this on the
10419          * first dump_scan invocation.
10420          */
10421         if (start == 0)
10422                 cfg80211_bss_expire(rdev);
10423
10424         cb->seq = rdev->bss_generation;
10425
10426         list_for_each_entry(scan, &rdev->bss_list, list) {
10427                 if (++idx <= start)
10428                         continue;
10429                 if (nl80211_send_bss(skb, cb,
10430                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10431                                 rdev, wdev, scan) < 0) {
10432                         idx--;
10433                         break;
10434                 }
10435         }
10436
10437         spin_unlock_bh(&rdev->bss_lock);
10438         wdev_unlock(wdev);
10439
10440         cb->args[2] = idx;
10441         wiphy_unlock(&rdev->wiphy);
10442
10443         return skb->len;
10444 }
10445
10446 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
10447                                int flags, struct net_device *dev,
10448                                bool allow_radio_stats,
10449                                struct survey_info *survey)
10450 {
10451         void *hdr;
10452         struct nlattr *infoattr;
10453
10454         /* skip radio stats if userspace didn't request them */
10455         if (!survey->channel && !allow_radio_stats)
10456                 return 0;
10457
10458         hdr = nl80211hdr_put(msg, portid, seq, flags,
10459                              NL80211_CMD_NEW_SURVEY_RESULTS);
10460         if (!hdr)
10461                 return -ENOMEM;
10462
10463         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
10464                 goto nla_put_failure;
10465
10466         infoattr = nla_nest_start_noflag(msg, NL80211_ATTR_SURVEY_INFO);
10467         if (!infoattr)
10468                 goto nla_put_failure;
10469
10470         if (survey->channel &&
10471             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
10472                         survey->channel->center_freq))
10473                 goto nla_put_failure;
10474
10475         if (survey->channel && survey->channel->freq_offset &&
10476             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY_OFFSET,
10477                         survey->channel->freq_offset))
10478                 goto nla_put_failure;
10479
10480         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
10481             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
10482                 goto nla_put_failure;
10483         if ((survey->filled & SURVEY_INFO_IN_USE) &&
10484             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
10485                 goto nla_put_failure;
10486         if ((survey->filled & SURVEY_INFO_TIME) &&
10487             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
10488                         survey->time, NL80211_SURVEY_INFO_PAD))
10489                 goto nla_put_failure;
10490         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
10491             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
10492                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
10493                 goto nla_put_failure;
10494         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
10495             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
10496                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
10497                 goto nla_put_failure;
10498         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
10499             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
10500                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
10501                 goto nla_put_failure;
10502         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
10503             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
10504                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
10505                 goto nla_put_failure;
10506         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
10507             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
10508                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
10509                 goto nla_put_failure;
10510         if ((survey->filled & SURVEY_INFO_TIME_BSS_RX) &&
10511             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BSS_RX,
10512                               survey->time_bss_rx, NL80211_SURVEY_INFO_PAD))
10513                 goto nla_put_failure;
10514
10515         nla_nest_end(msg, infoattr);
10516
10517         genlmsg_end(msg, hdr);
10518         return 0;
10519
10520  nla_put_failure:
10521         genlmsg_cancel(msg, hdr);
10522         return -EMSGSIZE;
10523 }
10524
10525 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
10526 {
10527         struct nlattr **attrbuf;
10528         struct survey_info survey;
10529         struct cfg80211_registered_device *rdev;
10530         struct wireless_dev *wdev;
10531         int survey_idx = cb->args[2];
10532         int res;
10533         bool radio_stats;
10534
10535         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
10536         if (!attrbuf)
10537                 return -ENOMEM;
10538
10539         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev, attrbuf);
10540         if (res) {
10541                 kfree(attrbuf);
10542                 return res;
10543         }
10544         /* nl80211_prepare_wdev_dump acquired it in the successful case */
10545         __acquire(&rdev->wiphy.mtx);
10546
10547         /* prepare_wdev_dump parsed the attributes */
10548         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
10549
10550         if (!wdev->netdev) {
10551                 res = -EINVAL;
10552                 goto out_err;
10553         }
10554
10555         if (!rdev->ops->dump_survey) {
10556                 res = -EOPNOTSUPP;
10557                 goto out_err;
10558         }
10559
10560         while (1) {
10561                 wdev_lock(wdev);
10562                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
10563                 wdev_unlock(wdev);
10564                 if (res == -ENOENT)
10565                         break;
10566                 if (res)
10567                         goto out_err;
10568
10569                 /* don't send disabled channels, but do send non-channel data */
10570                 if (survey.channel &&
10571                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
10572                         survey_idx++;
10573                         continue;
10574                 }
10575
10576                 if (nl80211_send_survey(skb,
10577                                 NETLINK_CB(cb->skb).portid,
10578                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
10579                                 wdev->netdev, radio_stats, &survey) < 0)
10580                         goto out;
10581                 survey_idx++;
10582         }
10583
10584  out:
10585         cb->args[2] = survey_idx;
10586         res = skb->len;
10587  out_err:
10588         kfree(attrbuf);
10589         wiphy_unlock(&rdev->wiphy);
10590         return res;
10591 }
10592
10593 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
10594 {
10595         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
10596                                   NL80211_WPA_VERSION_2 |
10597                                   NL80211_WPA_VERSION_3));
10598 }
10599
10600 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
10601 {
10602         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10603         struct net_device *dev = info->user_ptr[1];
10604         struct ieee80211_channel *chan;
10605         const u8 *bssid, *ssid;
10606         int err, ssid_len;
10607         enum nl80211_auth_type auth_type;
10608         struct key_parse key;
10609         bool local_state_change;
10610         struct cfg80211_auth_request req = {};
10611         u32 freq;
10612
10613         if (!info->attrs[NL80211_ATTR_MAC])
10614                 return -EINVAL;
10615
10616         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
10617                 return -EINVAL;
10618
10619         if (!info->attrs[NL80211_ATTR_SSID])
10620                 return -EINVAL;
10621
10622         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
10623                 return -EINVAL;
10624
10625         err = nl80211_parse_key(info, &key);
10626         if (err)
10627                 return err;
10628
10629         if (key.idx >= 0) {
10630                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
10631                         return -EINVAL;
10632                 if (!key.p.key || !key.p.key_len)
10633                         return -EINVAL;
10634                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
10635                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
10636                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
10637                      key.p.key_len != WLAN_KEY_LEN_WEP104))
10638                         return -EINVAL;
10639                 if (key.idx > 3)
10640                         return -EINVAL;
10641         } else {
10642                 key.p.key_len = 0;
10643                 key.p.key = NULL;
10644         }
10645
10646         if (key.idx >= 0) {
10647                 int i;
10648                 bool ok = false;
10649
10650                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
10651                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
10652                                 ok = true;
10653                                 break;
10654                         }
10655                 }
10656                 if (!ok)
10657                         return -EINVAL;
10658         }
10659
10660         if (!rdev->ops->auth)
10661                 return -EOPNOTSUPP;
10662
10663         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10664             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10665                 return -EOPNOTSUPP;
10666
10667         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
10668         freq = MHZ_TO_KHZ(nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ]));
10669         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10670                 freq +=
10671                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10672
10673         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10674         if (!chan)
10675                 return -EINVAL;
10676
10677         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10678         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10679
10680         if (info->attrs[NL80211_ATTR_IE]) {
10681                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10682                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10683         }
10684
10685         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
10686         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
10687                 return -EINVAL;
10688
10689         if ((auth_type == NL80211_AUTHTYPE_SAE ||
10690              auth_type == NL80211_AUTHTYPE_FILS_SK ||
10691              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
10692              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
10693             !info->attrs[NL80211_ATTR_AUTH_DATA])
10694                 return -EINVAL;
10695
10696         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
10697                 if (auth_type != NL80211_AUTHTYPE_SAE &&
10698                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
10699                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
10700                     auth_type != NL80211_AUTHTYPE_FILS_PK)
10701                         return -EINVAL;
10702                 req.auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
10703                 req.auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
10704         }
10705
10706         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
10707
10708         /*
10709          * Since we no longer track auth state, ignore
10710          * requests to only change local state.
10711          */
10712         if (local_state_change)
10713                 return 0;
10714
10715         req.auth_type = auth_type;
10716         req.key = key.p.key;
10717         req.key_len = key.p.key_len;
10718         req.key_idx = key.idx;
10719         req.link_id = nl80211_link_id_or_invalid(info->attrs);
10720         if (req.link_id >= 0) {
10721                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
10722                         return -EINVAL;
10723                 if (!info->attrs[NL80211_ATTR_MLD_ADDR])
10724                         return -EINVAL;
10725                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
10726                 if (!is_valid_ether_addr(req.ap_mld_addr))
10727                         return -EINVAL;
10728         }
10729
10730         req.bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid, ssid, ssid_len,
10731                                    IEEE80211_BSS_TYPE_ESS,
10732                                    IEEE80211_PRIVACY_ANY);
10733         if (!req.bss)
10734                 return -ENOENT;
10735
10736         wdev_lock(dev->ieee80211_ptr);
10737         err = cfg80211_mlme_auth(rdev, dev, &req);
10738         wdev_unlock(dev->ieee80211_ptr);
10739
10740         cfg80211_put_bss(&rdev->wiphy, req.bss);
10741
10742         return err;
10743 }
10744
10745 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
10746                                      struct genl_info *info)
10747 {
10748         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
10749                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
10750                 return -EINVAL;
10751         }
10752
10753         if (!rdev->ops->tx_control_port ||
10754             !wiphy_ext_feature_isset(&rdev->wiphy,
10755                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
10756                 return -EOPNOTSUPP;
10757
10758         return 0;
10759 }
10760
10761 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
10762                                    struct genl_info *info,
10763                                    struct cfg80211_crypto_settings *settings,
10764                                    int cipher_limit)
10765 {
10766         memset(settings, 0, sizeof(*settings));
10767
10768         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
10769
10770         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
10771                 u16 proto;
10772
10773                 proto = nla_get_u16(
10774                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
10775                 settings->control_port_ethertype = cpu_to_be16(proto);
10776                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
10777                     proto != ETH_P_PAE)
10778                         return -EINVAL;
10779                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
10780                         settings->control_port_no_encrypt = true;
10781         } else
10782                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
10783
10784         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10785                 int r = validate_pae_over_nl80211(rdev, info);
10786
10787                 if (r < 0)
10788                         return r;
10789
10790                 settings->control_port_over_nl80211 = true;
10791
10792                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_PREAUTH])
10793                         settings->control_port_no_preauth = true;
10794         }
10795
10796         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
10797                 void *data;
10798                 int len, i;
10799
10800                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10801                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
10802                 settings->n_ciphers_pairwise = len / sizeof(u32);
10803
10804                 if (len % sizeof(u32))
10805                         return -EINVAL;
10806
10807                 if (settings->n_ciphers_pairwise > cipher_limit)
10808                         return -EINVAL;
10809
10810                 memcpy(settings->ciphers_pairwise, data, len);
10811
10812                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
10813                         if (!cfg80211_supported_cipher_suite(
10814                                         &rdev->wiphy,
10815                                         settings->ciphers_pairwise[i]))
10816                                 return -EINVAL;
10817         }
10818
10819         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
10820                 settings->cipher_group =
10821                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
10822                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
10823                                                      settings->cipher_group))
10824                         return -EINVAL;
10825         }
10826
10827         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
10828                 settings->wpa_versions =
10829                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
10830                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
10831                         return -EINVAL;
10832         }
10833
10834         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
10835                 void *data;
10836                 int len;
10837
10838                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
10839                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
10840                 settings->n_akm_suites = len / sizeof(u32);
10841
10842                 if (len % sizeof(u32))
10843                         return -EINVAL;
10844
10845                 if (settings->n_akm_suites > rdev->wiphy.max_num_akm_suites)
10846                         return -EINVAL;
10847
10848                 memcpy(settings->akm_suites, data, len);
10849         }
10850
10851         if (info->attrs[NL80211_ATTR_PMK]) {
10852                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
10853                         return -EINVAL;
10854                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10855                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK) &&
10856                     !wiphy_ext_feature_isset(&rdev->wiphy,
10857                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_AP_PSK))
10858                         return -EINVAL;
10859                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
10860         }
10861
10862         if (info->attrs[NL80211_ATTR_SAE_PASSWORD]) {
10863                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
10864                                              NL80211_EXT_FEATURE_SAE_OFFLOAD) &&
10865                     !wiphy_ext_feature_isset(&rdev->wiphy,
10866                                              NL80211_EXT_FEATURE_SAE_OFFLOAD_AP))
10867                         return -EINVAL;
10868                 settings->sae_pwd =
10869                         nla_data(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10870                 settings->sae_pwd_len =
10871                         nla_len(info->attrs[NL80211_ATTR_SAE_PASSWORD]);
10872         }
10873
10874         if (info->attrs[NL80211_ATTR_SAE_PWE])
10875                 settings->sae_pwe =
10876                         nla_get_u8(info->attrs[NL80211_ATTR_SAE_PWE]);
10877         else
10878                 settings->sae_pwe = NL80211_SAE_PWE_UNSPECIFIED;
10879
10880         return 0;
10881 }
10882
10883 static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
10884                                               const u8 *ssid, int ssid_len,
10885                                               struct nlattr **attrs)
10886 {
10887         struct ieee80211_channel *chan;
10888         struct cfg80211_bss *bss;
10889         const u8 *bssid;
10890         u32 freq;
10891
10892         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
10893                 return ERR_PTR(-EINVAL);
10894
10895         bssid = nla_data(attrs[NL80211_ATTR_MAC]);
10896
10897         freq = MHZ_TO_KHZ(nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]));
10898         if (attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
10899                 freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
10900
10901         chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
10902         if (!chan)
10903                 return ERR_PTR(-EINVAL);
10904
10905         bss = cfg80211_get_bss(&rdev->wiphy, chan, bssid,
10906                                ssid, ssid_len,
10907                                IEEE80211_BSS_TYPE_ESS,
10908                                IEEE80211_PRIVACY_ANY);
10909         if (!bss)
10910                 return ERR_PTR(-ENOENT);
10911
10912         return bss;
10913 }
10914
10915 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
10916 {
10917         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10918         struct net_device *dev = info->user_ptr[1];
10919         struct cfg80211_assoc_request req = {};
10920         struct nlattr **attrs = NULL;
10921         const u8 *ap_addr, *ssid;
10922         unsigned int link_id;
10923         int err, ssid_len;
10924
10925         if (dev->ieee80211_ptr->conn_owner_nlportid &&
10926             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
10927                 return -EPERM;
10928
10929         if (!info->attrs[NL80211_ATTR_SSID])
10930                 return -EINVAL;
10931
10932         if (!rdev->ops->assoc)
10933                 return -EOPNOTSUPP;
10934
10935         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
10936             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
10937                 return -EOPNOTSUPP;
10938
10939         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
10940         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
10941
10942         if (info->attrs[NL80211_ATTR_IE]) {
10943                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
10944                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
10945
10946                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
10947                                            req.ie, req.ie_len)) {
10948                         GENL_SET_ERR_MSG(info,
10949                                          "non-inheritance makes no sense");
10950                         return -EINVAL;
10951                 }
10952         }
10953
10954         if (info->attrs[NL80211_ATTR_USE_MFP]) {
10955                 enum nl80211_mfp mfp =
10956                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
10957                 if (mfp == NL80211_MFP_REQUIRED)
10958                         req.use_mfp = true;
10959                 else if (mfp != NL80211_MFP_NO)
10960                         return -EINVAL;
10961         }
10962
10963         if (info->attrs[NL80211_ATTR_PREV_BSSID])
10964                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
10965
10966         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
10967                 req.flags |= ASSOC_REQ_DISABLE_HT;
10968
10969         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10970                 memcpy(&req.ht_capa_mask,
10971                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
10972                        sizeof(req.ht_capa_mask));
10973
10974         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
10975                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
10976                         return -EINVAL;
10977                 memcpy(&req.ht_capa,
10978                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
10979                        sizeof(req.ht_capa));
10980         }
10981
10982         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
10983                 req.flags |= ASSOC_REQ_DISABLE_VHT;
10984
10985         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
10986                 req.flags |= ASSOC_REQ_DISABLE_HE;
10987
10988         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
10989                 req.flags |= ASSOC_REQ_DISABLE_EHT;
10990
10991         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10992                 memcpy(&req.vht_capa_mask,
10993                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
10994                        sizeof(req.vht_capa_mask));
10995
10996         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
10997                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
10998                         return -EINVAL;
10999                 memcpy(&req.vht_capa,
11000                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11001                        sizeof(req.vht_capa));
11002         }
11003
11004         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11005                 if (!((rdev->wiphy.features &
11006                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11007                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11008                     !wiphy_ext_feature_isset(&rdev->wiphy,
11009                                              NL80211_EXT_FEATURE_RRM))
11010                         return -EINVAL;
11011                 req.flags |= ASSOC_REQ_USE_RRM;
11012         }
11013
11014         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
11015                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
11016                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
11017                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
11018                         return -EINVAL;
11019                 req.fils_nonces =
11020                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
11021         }
11022
11023         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]) {
11024                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY])
11025                         return -EINVAL;
11026                 memcpy(&req.s1g_capa_mask,
11027                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK]),
11028                        sizeof(req.s1g_capa_mask));
11029         }
11030
11031         if (info->attrs[NL80211_ATTR_S1G_CAPABILITY]) {
11032                 if (!info->attrs[NL80211_ATTR_S1G_CAPABILITY_MASK])
11033                         return -EINVAL;
11034                 memcpy(&req.s1g_capa,
11035                        nla_data(info->attrs[NL80211_ATTR_S1G_CAPABILITY]),
11036                        sizeof(req.s1g_capa));
11037         }
11038
11039         req.link_id = nl80211_link_id_or_invalid(info->attrs);
11040
11041         if (info->attrs[NL80211_ATTR_MLO_LINKS]) {
11042                 unsigned int attrsize = NUM_NL80211_ATTR * sizeof(*attrs);
11043                 struct nlattr *link;
11044                 int rem = 0;
11045
11046                 if (req.link_id < 0)
11047                         return -EINVAL;
11048
11049                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_MLO))
11050                         return -EINVAL;
11051
11052                 if (info->attrs[NL80211_ATTR_MAC] ||
11053                     info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
11054                     !info->attrs[NL80211_ATTR_MLD_ADDR])
11055                         return -EINVAL;
11056
11057                 req.ap_mld_addr = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
11058                 ap_addr = req.ap_mld_addr;
11059
11060                 attrs = kzalloc(attrsize, GFP_KERNEL);
11061                 if (!attrs)
11062                         return -ENOMEM;
11063
11064                 nla_for_each_nested(link,
11065                                     info->attrs[NL80211_ATTR_MLO_LINKS],
11066                                     rem) {
11067                         memset(attrs, 0, attrsize);
11068
11069                         nla_parse_nested(attrs, NL80211_ATTR_MAX,
11070                                          link, NULL, NULL);
11071
11072                         if (!attrs[NL80211_ATTR_MLO_LINK_ID]) {
11073                                 err = -EINVAL;
11074                                 goto free;
11075                         }
11076
11077                         link_id = nla_get_u8(attrs[NL80211_ATTR_MLO_LINK_ID]);
11078                         /* cannot use the same link ID again */
11079                         if (req.links[link_id].bss) {
11080                                 err = -EINVAL;
11081                                 goto free;
11082                         }
11083                         req.links[link_id].bss =
11084                                 nl80211_assoc_bss(rdev, ssid, ssid_len, attrs);
11085                         if (IS_ERR(req.links[link_id].bss)) {
11086                                 err = PTR_ERR(req.links[link_id].bss);
11087                                 req.links[link_id].bss = NULL;
11088                                 goto free;
11089                         }
11090
11091                         if (attrs[NL80211_ATTR_IE]) {
11092                                 req.links[link_id].elems =
11093                                         nla_data(attrs[NL80211_ATTR_IE]);
11094                                 req.links[link_id].elems_len =
11095                                         nla_len(attrs[NL80211_ATTR_IE]);
11096
11097                                 if (cfg80211_find_elem(WLAN_EID_FRAGMENT,
11098                                                        req.links[link_id].elems,
11099                                                        req.links[link_id].elems_len)) {
11100                                         GENL_SET_ERR_MSG(info,
11101                                                          "cannot deal with fragmentation");
11102                                         err = -EINVAL;
11103                                         goto free;
11104                                 }
11105
11106                                 if (cfg80211_find_ext_elem(WLAN_EID_EXT_NON_INHERITANCE,
11107                                                            req.links[link_id].elems,
11108                                                            req.links[link_id].elems_len)) {
11109                                         GENL_SET_ERR_MSG(info,
11110                                                          "cannot deal with non-inheritance");
11111                                         err = -EINVAL;
11112                                         goto free;
11113                                 }
11114                         }
11115                 }
11116
11117                 if (!req.links[req.link_id].bss) {
11118                         err = -EINVAL;
11119                         goto free;
11120                 }
11121
11122                 if (req.links[req.link_id].elems_len) {
11123                         GENL_SET_ERR_MSG(info,
11124                                          "cannot have per-link elems on assoc link");
11125                         err = -EINVAL;
11126                         goto free;
11127                 }
11128
11129                 kfree(attrs);
11130                 attrs = NULL;
11131         } else {
11132                 if (req.link_id >= 0)
11133                         return -EINVAL;
11134
11135                 req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs);
11136                 if (IS_ERR(req.bss))
11137                         return PTR_ERR(req.bss);
11138                 ap_addr = req.bss->bssid;
11139         }
11140
11141         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
11142         if (!err) {
11143                 wdev_lock(dev->ieee80211_ptr);
11144
11145                 err = cfg80211_mlme_assoc(rdev, dev, &req);
11146
11147                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11148                         dev->ieee80211_ptr->conn_owner_nlportid =
11149                                 info->snd_portid;
11150                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11151                                ap_addr, ETH_ALEN);
11152                 }
11153
11154                 wdev_unlock(dev->ieee80211_ptr);
11155         }
11156
11157 free:
11158         for (link_id = 0; link_id < ARRAY_SIZE(req.links); link_id++)
11159                 cfg80211_put_bss(&rdev->wiphy, req.links[link_id].bss);
11160         cfg80211_put_bss(&rdev->wiphy, req.bss);
11161         kfree(attrs);
11162
11163         return err;
11164 }
11165
11166 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
11167 {
11168         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11169         struct net_device *dev = info->user_ptr[1];
11170         const u8 *ie = NULL, *bssid;
11171         int ie_len = 0, err;
11172         u16 reason_code;
11173         bool local_state_change;
11174
11175         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11176             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11177                 return -EPERM;
11178
11179         if (!info->attrs[NL80211_ATTR_MAC])
11180                 return -EINVAL;
11181
11182         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11183                 return -EINVAL;
11184
11185         if (!rdev->ops->deauth)
11186                 return -EOPNOTSUPP;
11187
11188         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11189             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11190                 return -EOPNOTSUPP;
11191
11192         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11193
11194         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11195         if (reason_code == 0) {
11196                 /* Reason Code 0 is reserved */
11197                 return -EINVAL;
11198         }
11199
11200         if (info->attrs[NL80211_ATTR_IE]) {
11201                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11202                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11203         }
11204
11205         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11206
11207         wdev_lock(dev->ieee80211_ptr);
11208         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
11209                                    local_state_change);
11210         wdev_unlock(dev->ieee80211_ptr);
11211         return err;
11212 }
11213
11214 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
11215 {
11216         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11217         struct net_device *dev = info->user_ptr[1];
11218         const u8 *ie = NULL, *bssid;
11219         int ie_len = 0, err;
11220         u16 reason_code;
11221         bool local_state_change;
11222
11223         if (dev->ieee80211_ptr->conn_owner_nlportid &&
11224             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
11225                 return -EPERM;
11226
11227         if (!info->attrs[NL80211_ATTR_MAC])
11228                 return -EINVAL;
11229
11230         if (!info->attrs[NL80211_ATTR_REASON_CODE])
11231                 return -EINVAL;
11232
11233         if (!rdev->ops->disassoc)
11234                 return -EOPNOTSUPP;
11235
11236         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11237             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11238                 return -EOPNOTSUPP;
11239
11240         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11241
11242         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
11243         if (reason_code == 0) {
11244                 /* Reason Code 0 is reserved */
11245                 return -EINVAL;
11246         }
11247
11248         if (info->attrs[NL80211_ATTR_IE]) {
11249                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11250                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11251         }
11252
11253         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
11254
11255         wdev_lock(dev->ieee80211_ptr);
11256         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
11257                                      local_state_change);
11258         wdev_unlock(dev->ieee80211_ptr);
11259         return err;
11260 }
11261
11262 static bool
11263 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
11264                          int mcast_rate[NUM_NL80211_BANDS],
11265                          int rateval)
11266 {
11267         struct wiphy *wiphy = &rdev->wiphy;
11268         bool found = false;
11269         int band, i;
11270
11271         for (band = 0; band < NUM_NL80211_BANDS; band++) {
11272                 struct ieee80211_supported_band *sband;
11273
11274                 sband = wiphy->bands[band];
11275                 if (!sband)
11276                         continue;
11277
11278                 for (i = 0; i < sband->n_bitrates; i++) {
11279                         if (sband->bitrates[i].bitrate == rateval) {
11280                                 mcast_rate[band] = i + 1;
11281                                 found = true;
11282                                 break;
11283                         }
11284                 }
11285         }
11286
11287         return found;
11288 }
11289
11290 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
11291 {
11292         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11293         struct net_device *dev = info->user_ptr[1];
11294         struct cfg80211_ibss_params ibss;
11295         struct wiphy *wiphy;
11296         struct cfg80211_cached_keys *connkeys = NULL;
11297         int err;
11298
11299         memset(&ibss, 0, sizeof(ibss));
11300
11301         if (!info->attrs[NL80211_ATTR_SSID] ||
11302             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11303                 return -EINVAL;
11304
11305         ibss.beacon_interval = 100;
11306
11307         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
11308                 ibss.beacon_interval =
11309                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
11310
11311         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
11312                                            ibss.beacon_interval);
11313         if (err)
11314                 return err;
11315
11316         if (!rdev->ops->join_ibss)
11317                 return -EOPNOTSUPP;
11318
11319         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11320                 return -EOPNOTSUPP;
11321
11322         wiphy = &rdev->wiphy;
11323
11324         if (info->attrs[NL80211_ATTR_MAC]) {
11325                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11326
11327                 if (!is_valid_ether_addr(ibss.bssid))
11328                         return -EINVAL;
11329         }
11330         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11331         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11332
11333         if (info->attrs[NL80211_ATTR_IE]) {
11334                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11335                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11336         }
11337
11338         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
11339         if (err)
11340                 return err;
11341
11342         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
11343                                      NL80211_IFTYPE_ADHOC))
11344                 return -EINVAL;
11345
11346         switch (ibss.chandef.width) {
11347         case NL80211_CHAN_WIDTH_5:
11348         case NL80211_CHAN_WIDTH_10:
11349         case NL80211_CHAN_WIDTH_20_NOHT:
11350                 break;
11351         case NL80211_CHAN_WIDTH_20:
11352         case NL80211_CHAN_WIDTH_40:
11353                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11354                         return -EINVAL;
11355                 break;
11356         case NL80211_CHAN_WIDTH_80:
11357         case NL80211_CHAN_WIDTH_80P80:
11358         case NL80211_CHAN_WIDTH_160:
11359                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
11360                         return -EINVAL;
11361                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
11362                                              NL80211_EXT_FEATURE_VHT_IBSS))
11363                         return -EINVAL;
11364                 break;
11365         case NL80211_CHAN_WIDTH_320:
11366                 return -EINVAL;
11367         default:
11368                 return -EINVAL;
11369         }
11370
11371         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
11372         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
11373
11374         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
11375                 u8 *rates =
11376                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11377                 int n_rates =
11378                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
11379                 struct ieee80211_supported_band *sband =
11380                         wiphy->bands[ibss.chandef.chan->band];
11381
11382                 err = ieee80211_get_ratemask(sband, rates, n_rates,
11383                                              &ibss.basic_rates);
11384                 if (err)
11385                         return err;
11386         }
11387
11388         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11389                 memcpy(&ibss.ht_capa_mask,
11390                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11391                        sizeof(ibss.ht_capa_mask));
11392
11393         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11394                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11395                         return -EINVAL;
11396                 memcpy(&ibss.ht_capa,
11397                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11398                        sizeof(ibss.ht_capa));
11399         }
11400
11401         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
11402             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
11403                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
11404                 return -EINVAL;
11405
11406         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11407                 bool no_ht = false;
11408
11409                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
11410                 if (IS_ERR(connkeys))
11411                         return PTR_ERR(connkeys);
11412
11413                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
11414                     no_ht) {
11415                         kfree_sensitive(connkeys);
11416                         return -EINVAL;
11417                 }
11418         }
11419
11420         ibss.control_port =
11421                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
11422
11423         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
11424                 int r = validate_pae_over_nl80211(rdev, info);
11425
11426                 if (r < 0) {
11427                         kfree_sensitive(connkeys);
11428                         return r;
11429                 }
11430
11431                 ibss.control_port_over_nl80211 = true;
11432         }
11433
11434         ibss.userspace_handles_dfs =
11435                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
11436
11437         wdev_lock(dev->ieee80211_ptr);
11438         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
11439         if (err)
11440                 kfree_sensitive(connkeys);
11441         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
11442                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11443         wdev_unlock(dev->ieee80211_ptr);
11444
11445         return err;
11446 }
11447
11448 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
11449 {
11450         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11451         struct net_device *dev = info->user_ptr[1];
11452
11453         if (!rdev->ops->leave_ibss)
11454                 return -EOPNOTSUPP;
11455
11456         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
11457                 return -EOPNOTSUPP;
11458
11459         return cfg80211_leave_ibss(rdev, dev, false);
11460 }
11461
11462 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
11463 {
11464         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11465         struct net_device *dev = info->user_ptr[1];
11466         int mcast_rate[NUM_NL80211_BANDS];
11467         u32 nla_rate;
11468
11469         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
11470             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
11471             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
11472                 return -EOPNOTSUPP;
11473
11474         if (!rdev->ops->set_mcast_rate)
11475                 return -EOPNOTSUPP;
11476
11477         memset(mcast_rate, 0, sizeof(mcast_rate));
11478
11479         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
11480                 return -EINVAL;
11481
11482         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
11483         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
11484                 return -EINVAL;
11485
11486         return rdev_set_mcast_rate(rdev, dev, mcast_rate);
11487 }
11488
11489 static struct sk_buff *
11490 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
11491                             struct wireless_dev *wdev, int approxlen,
11492                             u32 portid, u32 seq, enum nl80211_commands cmd,
11493                             enum nl80211_attrs attr,
11494                             const struct nl80211_vendor_cmd_info *info,
11495                             gfp_t gfp)
11496 {
11497         struct sk_buff *skb;
11498         void *hdr;
11499         struct nlattr *data;
11500
11501         skb = nlmsg_new(approxlen + 100, gfp);
11502         if (!skb)
11503                 return NULL;
11504
11505         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
11506         if (!hdr) {
11507                 kfree_skb(skb);
11508                 return NULL;
11509         }
11510
11511         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
11512                 goto nla_put_failure;
11513
11514         if (info) {
11515                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
11516                                 info->vendor_id))
11517                         goto nla_put_failure;
11518                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
11519                                 info->subcmd))
11520                         goto nla_put_failure;
11521         }
11522
11523         if (wdev) {
11524                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
11525                                       wdev_id(wdev), NL80211_ATTR_PAD))
11526                         goto nla_put_failure;
11527                 if (wdev->netdev &&
11528                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
11529                                 wdev->netdev->ifindex))
11530                         goto nla_put_failure;
11531         }
11532
11533         data = nla_nest_start_noflag(skb, attr);
11534         if (!data)
11535                 goto nla_put_failure;
11536
11537         ((void **)skb->cb)[0] = rdev;
11538         ((void **)skb->cb)[1] = hdr;
11539         ((void **)skb->cb)[2] = data;
11540
11541         return skb;
11542
11543  nla_put_failure:
11544         kfree_skb(skb);
11545         return NULL;
11546 }
11547
11548 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
11549                                            struct wireless_dev *wdev,
11550                                            enum nl80211_commands cmd,
11551                                            enum nl80211_attrs attr,
11552                                            unsigned int portid,
11553                                            int vendor_event_idx,
11554                                            int approxlen, gfp_t gfp)
11555 {
11556         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11557         const struct nl80211_vendor_cmd_info *info;
11558
11559         switch (cmd) {
11560         case NL80211_CMD_TESTMODE:
11561                 if (WARN_ON(vendor_event_idx != -1))
11562                         return NULL;
11563                 info = NULL;
11564                 break;
11565         case NL80211_CMD_VENDOR:
11566                 if (WARN_ON(vendor_event_idx < 0 ||
11567                             vendor_event_idx >= wiphy->n_vendor_events))
11568                         return NULL;
11569                 info = &wiphy->vendor_events[vendor_event_idx];
11570                 break;
11571         default:
11572                 WARN_ON(1);
11573                 return NULL;
11574         }
11575
11576         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, portid, 0,
11577                                            cmd, attr, info, gfp);
11578 }
11579 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
11580
11581 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
11582 {
11583         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
11584         void *hdr = ((void **)skb->cb)[1];
11585         struct nlmsghdr *nlhdr = nlmsg_hdr(skb);
11586         struct nlattr *data = ((void **)skb->cb)[2];
11587         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
11588
11589         /* clear CB data for netlink core to own from now on */
11590         memset(skb->cb, 0, sizeof(skb->cb));
11591
11592         nla_nest_end(skb, data);
11593         genlmsg_end(skb, hdr);
11594
11595         if (nlhdr->nlmsg_pid) {
11596                 genlmsg_unicast(wiphy_net(&rdev->wiphy), skb,
11597                                 nlhdr->nlmsg_pid);
11598         } else {
11599                 if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
11600                         mcgrp = NL80211_MCGRP_VENDOR;
11601
11602                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
11603                                         skb, 0, mcgrp, gfp);
11604         }
11605 }
11606 EXPORT_SYMBOL(__cfg80211_send_event_skb);
11607
11608 #ifdef CONFIG_NL80211_TESTMODE
11609 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
11610 {
11611         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11612         struct wireless_dev *wdev;
11613         int err;
11614
11615         lockdep_assert_held(&rdev->wiphy.mtx);
11616
11617         wdev = __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
11618                                           info->attrs);
11619
11620         if (!rdev->ops->testmode_cmd)
11621                 return -EOPNOTSUPP;
11622
11623         if (IS_ERR(wdev)) {
11624                 err = PTR_ERR(wdev);
11625                 if (err != -EINVAL)
11626                         return err;
11627                 wdev = NULL;
11628         } else if (wdev->wiphy != &rdev->wiphy) {
11629                 return -EINVAL;
11630         }
11631
11632         if (!info->attrs[NL80211_ATTR_TESTDATA])
11633                 return -EINVAL;
11634
11635         rdev->cur_cmd_info = info;
11636         err = rdev_testmode_cmd(rdev, wdev,
11637                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
11638                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
11639         rdev->cur_cmd_info = NULL;
11640
11641         return err;
11642 }
11643
11644 static int nl80211_testmode_dump(struct sk_buff *skb,
11645                                  struct netlink_callback *cb)
11646 {
11647         struct cfg80211_registered_device *rdev;
11648         struct nlattr **attrbuf = NULL;
11649         int err;
11650         long phy_idx;
11651         void *data = NULL;
11652         int data_len = 0;
11653
11654         rtnl_lock();
11655
11656         if (cb->args[0]) {
11657                 /*
11658                  * 0 is a valid index, but not valid for args[0],
11659                  * so we need to offset by 1.
11660                  */
11661                 phy_idx = cb->args[0] - 1;
11662
11663                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
11664                 if (!rdev) {
11665                         err = -ENOENT;
11666                         goto out_err;
11667                 }
11668         } else {
11669                 attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf),
11670                                   GFP_KERNEL);
11671                 if (!attrbuf) {
11672                         err = -ENOMEM;
11673                         goto out_err;
11674                 }
11675
11676                 err = nlmsg_parse_deprecated(cb->nlh,
11677                                              GENL_HDRLEN + nl80211_fam.hdrsize,
11678                                              attrbuf, nl80211_fam.maxattr,
11679                                              nl80211_policy, NULL);
11680                 if (err)
11681                         goto out_err;
11682
11683                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
11684                 if (IS_ERR(rdev)) {
11685                         err = PTR_ERR(rdev);
11686                         goto out_err;
11687                 }
11688                 phy_idx = rdev->wiphy_idx;
11689
11690                 if (attrbuf[NL80211_ATTR_TESTDATA])
11691                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
11692         }
11693
11694         if (cb->args[1]) {
11695                 data = nla_data((void *)cb->args[1]);
11696                 data_len = nla_len((void *)cb->args[1]);
11697         }
11698
11699         if (!rdev->ops->testmode_dump) {
11700                 err = -EOPNOTSUPP;
11701                 goto out_err;
11702         }
11703
11704         while (1) {
11705                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
11706                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
11707                                            NL80211_CMD_TESTMODE);
11708                 struct nlattr *tmdata;
11709
11710                 if (!hdr)
11711                         break;
11712
11713                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
11714                         genlmsg_cancel(skb, hdr);
11715                         break;
11716                 }
11717
11718                 tmdata = nla_nest_start_noflag(skb, NL80211_ATTR_TESTDATA);
11719                 if (!tmdata) {
11720                         genlmsg_cancel(skb, hdr);
11721                         break;
11722                 }
11723                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
11724                 nla_nest_end(skb, tmdata);
11725
11726                 if (err == -ENOBUFS || err == -ENOENT) {
11727                         genlmsg_cancel(skb, hdr);
11728                         break;
11729                 } else if (err) {
11730                         genlmsg_cancel(skb, hdr);
11731                         goto out_err;
11732                 }
11733
11734                 genlmsg_end(skb, hdr);
11735         }
11736
11737         err = skb->len;
11738         /* see above */
11739         cb->args[0] = phy_idx + 1;
11740  out_err:
11741         kfree(attrbuf);
11742         rtnl_unlock();
11743         return err;
11744 }
11745 #endif
11746
11747 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
11748 {
11749         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11750         struct net_device *dev = info->user_ptr[1];
11751         struct cfg80211_connect_params connect;
11752         struct wiphy *wiphy;
11753         struct cfg80211_cached_keys *connkeys = NULL;
11754         u32 freq = 0;
11755         int err;
11756
11757         memset(&connect, 0, sizeof(connect));
11758
11759         if (!info->attrs[NL80211_ATTR_SSID] ||
11760             !nla_len(info->attrs[NL80211_ATTR_SSID]))
11761                 return -EINVAL;
11762
11763         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
11764                 connect.auth_type =
11765                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
11766                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
11767                                              NL80211_CMD_CONNECT))
11768                         return -EINVAL;
11769         } else
11770                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
11771
11772         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
11773
11774         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
11775             !wiphy_ext_feature_isset(&rdev->wiphy,
11776                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
11777                 return -EINVAL;
11778         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
11779
11780         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
11781                                       NL80211_MAX_NR_CIPHER_SUITES);
11782         if (err)
11783                 return err;
11784
11785         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
11786             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
11787                 return -EOPNOTSUPP;
11788
11789         wiphy = &rdev->wiphy;
11790
11791         connect.bg_scan_period = -1;
11792         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
11793                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
11794                 connect.bg_scan_period =
11795                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
11796         }
11797
11798         if (info->attrs[NL80211_ATTR_MAC])
11799                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
11800         else if (info->attrs[NL80211_ATTR_MAC_HINT])
11801                 connect.bssid_hint =
11802                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
11803         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
11804         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
11805
11806         if (info->attrs[NL80211_ATTR_IE]) {
11807                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
11808                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
11809         }
11810
11811         if (info->attrs[NL80211_ATTR_USE_MFP]) {
11812                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
11813                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
11814                     !wiphy_ext_feature_isset(&rdev->wiphy,
11815                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
11816                         return -EOPNOTSUPP;
11817         } else {
11818                 connect.mfp = NL80211_MFP_NO;
11819         }
11820
11821         if (info->attrs[NL80211_ATTR_PREV_BSSID])
11822                 connect.prev_bssid =
11823                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
11824
11825         if (info->attrs[NL80211_ATTR_WIPHY_FREQ])
11826                 freq = MHZ_TO_KHZ(nla_get_u32(
11827                                         info->attrs[NL80211_ATTR_WIPHY_FREQ]));
11828         if (info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET])
11829                 freq +=
11830                     nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
11831
11832         if (freq) {
11833                 connect.channel = nl80211_get_valid_chan(wiphy, freq);
11834                 if (!connect.channel)
11835                         return -EINVAL;
11836         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
11837                 freq = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
11838                 freq = MHZ_TO_KHZ(freq);
11839                 connect.channel_hint = nl80211_get_valid_chan(wiphy, freq);
11840                 if (!connect.channel_hint)
11841                         return -EINVAL;
11842         }
11843
11844         if (info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]) {
11845                 connect.edmg.channels =
11846                       nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_CHANNELS]);
11847
11848                 if (info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG])
11849                         connect.edmg.bw_config =
11850                                 nla_get_u8(info->attrs[NL80211_ATTR_WIPHY_EDMG_BW_CONFIG]);
11851         }
11852
11853         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
11854                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
11855                 if (IS_ERR(connkeys))
11856                         return PTR_ERR(connkeys);
11857         }
11858
11859         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
11860                 connect.flags |= ASSOC_REQ_DISABLE_HT;
11861
11862         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
11863                 memcpy(&connect.ht_capa_mask,
11864                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
11865                        sizeof(connect.ht_capa_mask));
11866
11867         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
11868                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
11869                         kfree_sensitive(connkeys);
11870                         return -EINVAL;
11871                 }
11872                 memcpy(&connect.ht_capa,
11873                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
11874                        sizeof(connect.ht_capa));
11875         }
11876
11877         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
11878                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
11879
11880         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HE]))
11881                 connect.flags |= ASSOC_REQ_DISABLE_HE;
11882
11883         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_EHT]))
11884                 connect.flags |= ASSOC_REQ_DISABLE_EHT;
11885
11886         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
11887                 memcpy(&connect.vht_capa_mask,
11888                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
11889                        sizeof(connect.vht_capa_mask));
11890
11891         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
11892                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
11893                         kfree_sensitive(connkeys);
11894                         return -EINVAL;
11895                 }
11896                 memcpy(&connect.vht_capa,
11897                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
11898                        sizeof(connect.vht_capa));
11899         }
11900
11901         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
11902                 if (!((rdev->wiphy.features &
11903                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
11904                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
11905                     !wiphy_ext_feature_isset(&rdev->wiphy,
11906                                              NL80211_EXT_FEATURE_RRM)) {
11907                         kfree_sensitive(connkeys);
11908                         return -EINVAL;
11909                 }
11910                 connect.flags |= ASSOC_REQ_USE_RRM;
11911         }
11912
11913         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
11914         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
11915                 kfree_sensitive(connkeys);
11916                 return -EOPNOTSUPP;
11917         }
11918
11919         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
11920                 /* bss selection makes no sense if bssid is set */
11921                 if (connect.bssid) {
11922                         kfree_sensitive(connkeys);
11923                         return -EINVAL;
11924                 }
11925
11926                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
11927                                        wiphy, &connect.bss_select);
11928                 if (err) {
11929                         kfree_sensitive(connkeys);
11930                         return err;
11931                 }
11932         }
11933
11934         if (wiphy_ext_feature_isset(&rdev->wiphy,
11935                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
11936             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
11937             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
11938             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
11939             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11940                 connect.fils_erp_username =
11941                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11942                 connect.fils_erp_username_len =
11943                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
11944                 connect.fils_erp_realm =
11945                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11946                 connect.fils_erp_realm_len =
11947                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
11948                 connect.fils_erp_next_seq_num =
11949                         nla_get_u16(
11950                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
11951                 connect.fils_erp_rrk =
11952                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11953                 connect.fils_erp_rrk_len =
11954                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
11955         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
11956                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
11957                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
11958                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
11959                 kfree_sensitive(connkeys);
11960                 return -EINVAL;
11961         }
11962
11963         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
11964                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11965                         kfree_sensitive(connkeys);
11966                         GENL_SET_ERR_MSG(info,
11967                                          "external auth requires connection ownership");
11968                         return -EINVAL;
11969                 }
11970                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
11971         }
11972
11973         if (nla_get_flag(info->attrs[NL80211_ATTR_MLO_SUPPORT]))
11974                 connect.flags |= CONNECT_REQ_MLO_SUPPORT;
11975
11976         wdev_lock(dev->ieee80211_ptr);
11977
11978         err = cfg80211_connect(rdev, dev, &connect, connkeys,
11979                                connect.prev_bssid);
11980         if (err)
11981                 kfree_sensitive(connkeys);
11982
11983         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
11984                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
11985                 if (connect.bssid)
11986                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
11987                                connect.bssid, ETH_ALEN);
11988                 else
11989                         eth_zero_addr(dev->ieee80211_ptr->disconnect_bssid);
11990         }
11991
11992         wdev_unlock(dev->ieee80211_ptr);
11993
11994         return err;
11995 }
11996
11997 static int nl80211_update_connect_params(struct sk_buff *skb,
11998                                          struct genl_info *info)
11999 {
12000         struct cfg80211_connect_params connect = {};
12001         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12002         struct net_device *dev = info->user_ptr[1];
12003         struct wireless_dev *wdev = dev->ieee80211_ptr;
12004         bool fils_sk_offload;
12005         u32 auth_type;
12006         u32 changed = 0;
12007         int ret;
12008
12009         if (!rdev->ops->update_connect_params)
12010                 return -EOPNOTSUPP;
12011
12012         if (info->attrs[NL80211_ATTR_IE]) {
12013                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12014                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12015                 changed |= UPDATE_ASSOC_IES;
12016         }
12017
12018         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
12019                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
12020
12021         /*
12022          * when driver supports fils-sk offload all attributes must be
12023          * provided. So the else covers "fils-sk-not-all" and
12024          * "no-fils-sk-any".
12025          */
12026         if (fils_sk_offload &&
12027             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
12028             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
12029             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
12030             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12031                 connect.fils_erp_username =
12032                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12033                 connect.fils_erp_username_len =
12034                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
12035                 connect.fils_erp_realm =
12036                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12037                 connect.fils_erp_realm_len =
12038                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
12039                 connect.fils_erp_next_seq_num =
12040                         nla_get_u16(
12041                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
12042                 connect.fils_erp_rrk =
12043                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12044                 connect.fils_erp_rrk_len =
12045                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
12046                 changed |= UPDATE_FILS_ERP_INFO;
12047         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
12048                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
12049                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
12050                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
12051                 return -EINVAL;
12052         }
12053
12054         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
12055                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
12056                 if (!nl80211_valid_auth_type(rdev, auth_type,
12057                                              NL80211_CMD_CONNECT))
12058                         return -EINVAL;
12059
12060                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
12061                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
12062                         return -EINVAL;
12063
12064                 connect.auth_type = auth_type;
12065                 changed |= UPDATE_AUTH_TYPE;
12066         }
12067
12068         wdev_lock(dev->ieee80211_ptr);
12069         if (!wdev->connected)
12070                 ret = -ENOLINK;
12071         else
12072                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
12073         wdev_unlock(dev->ieee80211_ptr);
12074
12075         return ret;
12076 }
12077
12078 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
12079 {
12080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12081         struct net_device *dev = info->user_ptr[1];
12082         u16 reason;
12083         int ret;
12084
12085         if (dev->ieee80211_ptr->conn_owner_nlportid &&
12086             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
12087                 return -EPERM;
12088
12089         if (!info->attrs[NL80211_ATTR_REASON_CODE])
12090                 reason = WLAN_REASON_DEAUTH_LEAVING;
12091         else
12092                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
12093
12094         if (reason == 0)
12095                 return -EINVAL;
12096
12097         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12098             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12099                 return -EOPNOTSUPP;
12100
12101         wdev_lock(dev->ieee80211_ptr);
12102         ret = cfg80211_disconnect(rdev, dev, reason, true);
12103         wdev_unlock(dev->ieee80211_ptr);
12104         return ret;
12105 }
12106
12107 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
12108 {
12109         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12110         struct net *net;
12111         int err;
12112
12113         if (info->attrs[NL80211_ATTR_PID]) {
12114                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
12115
12116                 net = get_net_ns_by_pid(pid);
12117         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
12118                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
12119
12120                 net = get_net_ns_by_fd(fd);
12121         } else {
12122                 return -EINVAL;
12123         }
12124
12125         if (IS_ERR(net))
12126                 return PTR_ERR(net);
12127
12128         err = 0;
12129
12130         /* check if anything to do */
12131         if (!net_eq(wiphy_net(&rdev->wiphy), net))
12132                 err = cfg80211_switch_netns(rdev, net);
12133
12134         put_net(net);
12135         return err;
12136 }
12137
12138 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
12139 {
12140         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12141         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
12142                         struct cfg80211_pmksa *pmksa) = NULL;
12143         struct net_device *dev = info->user_ptr[1];
12144         struct cfg80211_pmksa pmksa;
12145
12146         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
12147
12148         if (!info->attrs[NL80211_ATTR_PMKID])
12149                 return -EINVAL;
12150
12151         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
12152
12153         if (info->attrs[NL80211_ATTR_MAC]) {
12154                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
12155         } else if (info->attrs[NL80211_ATTR_SSID] &&
12156                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
12157                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
12158                     info->attrs[NL80211_ATTR_PMK])) {
12159                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
12160                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12161                 pmksa.cache_id =
12162                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
12163         } else {
12164                 return -EINVAL;
12165         }
12166         if (info->attrs[NL80211_ATTR_PMK]) {
12167                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12168                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12169         }
12170
12171         if (info->attrs[NL80211_ATTR_PMK_LIFETIME])
12172                 pmksa.pmk_lifetime =
12173                         nla_get_u32(info->attrs[NL80211_ATTR_PMK_LIFETIME]);
12174
12175         if (info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD])
12176                 pmksa.pmk_reauth_threshold =
12177                         nla_get_u8(
12178                                 info->attrs[NL80211_ATTR_PMK_REAUTH_THRESHOLD]);
12179
12180         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12181             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT &&
12182             !(dev->ieee80211_ptr->iftype == NL80211_IFTYPE_AP &&
12183               wiphy_ext_feature_isset(&rdev->wiphy,
12184                                       NL80211_EXT_FEATURE_AP_PMKSA_CACHING)))
12185                 return -EOPNOTSUPP;
12186
12187         switch (info->genlhdr->cmd) {
12188         case NL80211_CMD_SET_PMKSA:
12189                 rdev_ops = rdev->ops->set_pmksa;
12190                 break;
12191         case NL80211_CMD_DEL_PMKSA:
12192                 rdev_ops = rdev->ops->del_pmksa;
12193                 break;
12194         default:
12195                 WARN_ON(1);
12196                 break;
12197         }
12198
12199         if (!rdev_ops)
12200                 return -EOPNOTSUPP;
12201
12202         return rdev_ops(&rdev->wiphy, dev, &pmksa);
12203 }
12204
12205 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
12206 {
12207         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12208         struct net_device *dev = info->user_ptr[1];
12209
12210         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
12211             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
12212                 return -EOPNOTSUPP;
12213
12214         if (!rdev->ops->flush_pmksa)
12215                 return -EOPNOTSUPP;
12216
12217         return rdev_flush_pmksa(rdev, dev);
12218 }
12219
12220 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
12221 {
12222         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12223         struct net_device *dev = info->user_ptr[1];
12224         u8 action_code, dialog_token;
12225         u32 peer_capability = 0;
12226         u16 status_code;
12227         u8 *peer;
12228         bool initiator;
12229
12230         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12231             !rdev->ops->tdls_mgmt)
12232                 return -EOPNOTSUPP;
12233
12234         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
12235             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
12236             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
12237             !info->attrs[NL80211_ATTR_IE] ||
12238             !info->attrs[NL80211_ATTR_MAC])
12239                 return -EINVAL;
12240
12241         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12242         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
12243         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12244         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
12245         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
12246         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
12247                 peer_capability =
12248                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
12249
12250         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
12251                               dialog_token, status_code, peer_capability,
12252                               initiator,
12253                               nla_data(info->attrs[NL80211_ATTR_IE]),
12254                               nla_len(info->attrs[NL80211_ATTR_IE]));
12255 }
12256
12257 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
12258 {
12259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12260         struct net_device *dev = info->user_ptr[1];
12261         enum nl80211_tdls_operation operation;
12262         u8 *peer;
12263
12264         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
12265             !rdev->ops->tdls_oper)
12266                 return -EOPNOTSUPP;
12267
12268         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
12269             !info->attrs[NL80211_ATTR_MAC])
12270                 return -EINVAL;
12271
12272         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
12273         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12274
12275         return rdev_tdls_oper(rdev, dev, peer, operation);
12276 }
12277
12278 static int nl80211_remain_on_channel(struct sk_buff *skb,
12279                                      struct genl_info *info)
12280 {
12281         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12282         unsigned int link_id = nl80211_link_id(info->attrs);
12283         struct wireless_dev *wdev = info->user_ptr[1];
12284         struct cfg80211_chan_def chandef;
12285         struct sk_buff *msg;
12286         void *hdr;
12287         u64 cookie;
12288         u32 duration;
12289         int err;
12290
12291         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
12292             !info->attrs[NL80211_ATTR_DURATION])
12293                 return -EINVAL;
12294
12295         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12296
12297         if (!rdev->ops->remain_on_channel ||
12298             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
12299                 return -EOPNOTSUPP;
12300
12301         /*
12302          * We should be on that channel for at least a minimum amount of
12303          * time (10ms) but no longer than the driver supports.
12304          */
12305         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12306             duration > rdev->wiphy.max_remain_on_channel_duration)
12307                 return -EINVAL;
12308
12309         err = nl80211_parse_chandef(rdev, info, &chandef);
12310         if (err)
12311                 return err;
12312
12313         wdev_lock(wdev);
12314         if (!cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12315                 const struct cfg80211_chan_def *oper_chandef, *compat_chandef;
12316
12317                 oper_chandef = wdev_chandef(wdev, link_id);
12318
12319                 if (WARN_ON(!oper_chandef)) {
12320                         /* cannot happen since we must beacon to get here */
12321                         WARN_ON(1);
12322                         wdev_unlock(wdev);
12323                         return -EBUSY;
12324                 }
12325
12326                 /* note: returns first one if identical chandefs */
12327                 compat_chandef = cfg80211_chandef_compatible(&chandef,
12328                                                              oper_chandef);
12329
12330                 if (compat_chandef != &chandef) {
12331                         wdev_unlock(wdev);
12332                         return -EBUSY;
12333                 }
12334         }
12335         wdev_unlock(wdev);
12336
12337         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12338         if (!msg)
12339                 return -ENOMEM;
12340
12341         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12342                              NL80211_CMD_REMAIN_ON_CHANNEL);
12343         if (!hdr) {
12344                 err = -ENOBUFS;
12345                 goto free_msg;
12346         }
12347
12348         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
12349                                      duration, &cookie);
12350
12351         if (err)
12352                 goto free_msg;
12353
12354         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12355                               NL80211_ATTR_PAD))
12356                 goto nla_put_failure;
12357
12358         genlmsg_end(msg, hdr);
12359
12360         return genlmsg_reply(msg, info);
12361
12362  nla_put_failure:
12363         err = -ENOBUFS;
12364  free_msg:
12365         nlmsg_free(msg);
12366         return err;
12367 }
12368
12369 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
12370                                             struct genl_info *info)
12371 {
12372         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12373         struct wireless_dev *wdev = info->user_ptr[1];
12374         u64 cookie;
12375
12376         if (!info->attrs[NL80211_ATTR_COOKIE])
12377                 return -EINVAL;
12378
12379         if (!rdev->ops->cancel_remain_on_channel)
12380                 return -EOPNOTSUPP;
12381
12382         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12383
12384         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
12385 }
12386
12387 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
12388                                        struct genl_info *info)
12389 {
12390         struct cfg80211_bitrate_mask mask;
12391         unsigned int link_id = nl80211_link_id(info->attrs);
12392         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12393         struct net_device *dev = info->user_ptr[1];
12394         struct wireless_dev *wdev = dev->ieee80211_ptr;
12395         int err;
12396
12397         if (!rdev->ops->set_bitrate_mask)
12398                 return -EOPNOTSUPP;
12399
12400         wdev_lock(wdev);
12401         err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
12402                                             NL80211_ATTR_TX_RATES, &mask,
12403                                             dev, true, link_id);
12404         if (err)
12405                 goto out;
12406
12407         err = rdev_set_bitrate_mask(rdev, dev, link_id, NULL, &mask);
12408 out:
12409         wdev_unlock(wdev);
12410         return err;
12411 }
12412
12413 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
12414 {
12415         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12416         struct wireless_dev *wdev = info->user_ptr[1];
12417         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
12418
12419         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
12420                 return -EINVAL;
12421
12422         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
12423                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
12424
12425         switch (wdev->iftype) {
12426         case NL80211_IFTYPE_STATION:
12427         case NL80211_IFTYPE_ADHOC:
12428         case NL80211_IFTYPE_P2P_CLIENT:
12429         case NL80211_IFTYPE_AP:
12430         case NL80211_IFTYPE_AP_VLAN:
12431         case NL80211_IFTYPE_MESH_POINT:
12432         case NL80211_IFTYPE_P2P_GO:
12433         case NL80211_IFTYPE_P2P_DEVICE:
12434                 break;
12435         case NL80211_IFTYPE_NAN:
12436                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12437                                              NL80211_EXT_FEATURE_SECURE_NAN))
12438                         return -EOPNOTSUPP;
12439                 break;
12440         default:
12441                 return -EOPNOTSUPP;
12442         }
12443
12444         /* not much point in registering if we can't reply */
12445         if (!rdev->ops->mgmt_tx)
12446                 return -EOPNOTSUPP;
12447
12448         if (info->attrs[NL80211_ATTR_RECEIVE_MULTICAST] &&
12449             !wiphy_ext_feature_isset(&rdev->wiphy,
12450                                      NL80211_EXT_FEATURE_MULTICAST_REGISTRATIONS)) {
12451                 GENL_SET_ERR_MSG(info,
12452                                  "multicast RX registrations are not supported");
12453                 return -EOPNOTSUPP;
12454         }
12455
12456         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
12457                                            nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12458                                            nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]),
12459                                            info->attrs[NL80211_ATTR_RECEIVE_MULTICAST],
12460                                            info->extack);
12461 }
12462
12463 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
12464 {
12465         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12466         struct wireless_dev *wdev = info->user_ptr[1];
12467         struct cfg80211_chan_def chandef;
12468         int err;
12469         void *hdr = NULL;
12470         u64 cookie;
12471         struct sk_buff *msg = NULL;
12472         struct cfg80211_mgmt_tx_params params = {
12473                 .dont_wait_for_ack =
12474                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
12475         };
12476
12477         if (!info->attrs[NL80211_ATTR_FRAME])
12478                 return -EINVAL;
12479
12480         if (!rdev->ops->mgmt_tx)
12481                 return -EOPNOTSUPP;
12482
12483         switch (wdev->iftype) {
12484         case NL80211_IFTYPE_P2P_DEVICE:
12485                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
12486                         return -EINVAL;
12487                 break;
12488         case NL80211_IFTYPE_STATION:
12489         case NL80211_IFTYPE_ADHOC:
12490         case NL80211_IFTYPE_P2P_CLIENT:
12491         case NL80211_IFTYPE_AP:
12492         case NL80211_IFTYPE_AP_VLAN:
12493         case NL80211_IFTYPE_MESH_POINT:
12494         case NL80211_IFTYPE_P2P_GO:
12495                 break;
12496         case NL80211_IFTYPE_NAN:
12497                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12498                                              NL80211_EXT_FEATURE_SECURE_NAN))
12499                         return -EOPNOTSUPP;
12500                 break;
12501         default:
12502                 return -EOPNOTSUPP;
12503         }
12504
12505         if (info->attrs[NL80211_ATTR_DURATION]) {
12506                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12507                         return -EINVAL;
12508                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
12509
12510                 /*
12511                  * We should wait on the channel for at least a minimum amount
12512                  * of time (10ms) but no longer than the driver supports.
12513                  */
12514                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
12515                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
12516                         return -EINVAL;
12517         }
12518
12519         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
12520
12521         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
12522                 return -EINVAL;
12523
12524         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
12525
12526         /* get the channel if any has been specified, otherwise pass NULL to
12527          * the driver. The latter will use the current one
12528          */
12529         chandef.chan = NULL;
12530         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
12531                 err = nl80211_parse_chandef(rdev, info, &chandef);
12532                 if (err)
12533                         return err;
12534         }
12535
12536         if (!chandef.chan && params.offchan)
12537                 return -EINVAL;
12538
12539         wdev_lock(wdev);
12540         if (params.offchan &&
12541             !cfg80211_off_channel_oper_allowed(wdev, chandef.chan)) {
12542                 wdev_unlock(wdev);
12543                 return -EBUSY;
12544         }
12545
12546         params.link_id = nl80211_link_id_or_invalid(info->attrs);
12547         /*
12548          * This now races due to the unlock, but we cannot check
12549          * the valid links for the _station_ anyway, so that's up
12550          * to the driver.
12551          */
12552         if (params.link_id >= 0 &&
12553             !(wdev->valid_links & BIT(params.link_id))) {
12554                 wdev_unlock(wdev);
12555                 return -EINVAL;
12556         }
12557         wdev_unlock(wdev);
12558
12559         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12560         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12561
12562         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
12563                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12564                 int i;
12565
12566                 if (len % sizeof(u16))
12567                         return -EINVAL;
12568
12569                 params.n_csa_offsets = len / sizeof(u16);
12570                 params.csa_offsets =
12571                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
12572
12573                 /* check that all the offsets fit the frame */
12574                 for (i = 0; i < params.n_csa_offsets; i++) {
12575                         if (params.csa_offsets[i] >= params.len)
12576                                 return -EINVAL;
12577                 }
12578         }
12579
12580         if (!params.dont_wait_for_ack) {
12581                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12582                 if (!msg)
12583                         return -ENOMEM;
12584
12585                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12586                                      NL80211_CMD_FRAME);
12587                 if (!hdr) {
12588                         err = -ENOBUFS;
12589                         goto free_msg;
12590                 }
12591         }
12592
12593         params.chan = chandef.chan;
12594         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
12595         if (err)
12596                 goto free_msg;
12597
12598         if (msg) {
12599                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12600                                       NL80211_ATTR_PAD))
12601                         goto nla_put_failure;
12602
12603                 genlmsg_end(msg, hdr);
12604                 return genlmsg_reply(msg, info);
12605         }
12606
12607         return 0;
12608
12609  nla_put_failure:
12610         err = -ENOBUFS;
12611  free_msg:
12612         nlmsg_free(msg);
12613         return err;
12614 }
12615
12616 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
12617 {
12618         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12619         struct wireless_dev *wdev = info->user_ptr[1];
12620         u64 cookie;
12621
12622         if (!info->attrs[NL80211_ATTR_COOKIE])
12623                 return -EINVAL;
12624
12625         if (!rdev->ops->mgmt_tx_cancel_wait)
12626                 return -EOPNOTSUPP;
12627
12628         switch (wdev->iftype) {
12629         case NL80211_IFTYPE_STATION:
12630         case NL80211_IFTYPE_ADHOC:
12631         case NL80211_IFTYPE_P2P_CLIENT:
12632         case NL80211_IFTYPE_AP:
12633         case NL80211_IFTYPE_AP_VLAN:
12634         case NL80211_IFTYPE_P2P_GO:
12635         case NL80211_IFTYPE_P2P_DEVICE:
12636                 break;
12637         case NL80211_IFTYPE_NAN:
12638                 if (!wiphy_ext_feature_isset(wdev->wiphy,
12639                                              NL80211_EXT_FEATURE_SECURE_NAN))
12640                         return -EOPNOTSUPP;
12641                 break;
12642         default:
12643                 return -EOPNOTSUPP;
12644         }
12645
12646         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
12647
12648         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
12649 }
12650
12651 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
12652 {
12653         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12654         struct wireless_dev *wdev;
12655         struct net_device *dev = info->user_ptr[1];
12656         u8 ps_state;
12657         bool state;
12658         int err;
12659
12660         if (!info->attrs[NL80211_ATTR_PS_STATE])
12661                 return -EINVAL;
12662
12663         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
12664
12665         wdev = dev->ieee80211_ptr;
12666
12667         if (!rdev->ops->set_power_mgmt)
12668                 return -EOPNOTSUPP;
12669
12670         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
12671
12672         if (state == wdev->ps)
12673                 return 0;
12674
12675         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
12676         if (!err)
12677                 wdev->ps = state;
12678         return err;
12679 }
12680
12681 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
12682 {
12683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12684         enum nl80211_ps_state ps_state;
12685         struct wireless_dev *wdev;
12686         struct net_device *dev = info->user_ptr[1];
12687         struct sk_buff *msg;
12688         void *hdr;
12689         int err;
12690
12691         wdev = dev->ieee80211_ptr;
12692
12693         if (!rdev->ops->set_power_mgmt)
12694                 return -EOPNOTSUPP;
12695
12696         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12697         if (!msg)
12698                 return -ENOMEM;
12699
12700         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12701                              NL80211_CMD_GET_POWER_SAVE);
12702         if (!hdr) {
12703                 err = -ENOBUFS;
12704                 goto free_msg;
12705         }
12706
12707         if (wdev->ps)
12708                 ps_state = NL80211_PS_ENABLED;
12709         else
12710                 ps_state = NL80211_PS_DISABLED;
12711
12712         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
12713                 goto nla_put_failure;
12714
12715         genlmsg_end(msg, hdr);
12716         return genlmsg_reply(msg, info);
12717
12718  nla_put_failure:
12719         err = -ENOBUFS;
12720  free_msg:
12721         nlmsg_free(msg);
12722         return err;
12723 }
12724
12725 static const struct nla_policy
12726 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
12727         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
12728         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
12729         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
12730         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
12731         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
12732         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
12733         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
12734 };
12735
12736 static int nl80211_set_cqm_txe(struct genl_info *info,
12737                                u32 rate, u32 pkts, u32 intvl)
12738 {
12739         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12740         struct net_device *dev = info->user_ptr[1];
12741         struct wireless_dev *wdev = dev->ieee80211_ptr;
12742
12743         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
12744                 return -EINVAL;
12745
12746         if (!rdev->ops->set_cqm_txe_config)
12747                 return -EOPNOTSUPP;
12748
12749         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12750             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12751                 return -EOPNOTSUPP;
12752
12753         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
12754 }
12755
12756 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
12757                                     struct net_device *dev)
12758 {
12759         struct wireless_dev *wdev = dev->ieee80211_ptr;
12760         s32 last, low, high;
12761         u32 hyst;
12762         int i, n, low_index;
12763         int err;
12764
12765         /* RSSI reporting disabled? */
12766         if (!wdev->cqm_config)
12767                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
12768
12769         /*
12770          * Obtain current RSSI value if possible, if not and no RSSI threshold
12771          * event has been received yet, we should receive an event after a
12772          * connection is established and enough beacons received to calculate
12773          * the average.
12774          */
12775         if (!wdev->cqm_config->last_rssi_event_value &&
12776             wdev->links[0].client.current_bss &&
12777             rdev->ops->get_station) {
12778                 struct station_info sinfo = {};
12779                 u8 *mac_addr;
12780
12781                 mac_addr = wdev->links[0].client.current_bss->pub.bssid;
12782
12783                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
12784                 if (err)
12785                         return err;
12786
12787                 cfg80211_sinfo_release_content(&sinfo);
12788                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
12789                         wdev->cqm_config->last_rssi_event_value =
12790                                 (s8) sinfo.rx_beacon_signal_avg;
12791         }
12792
12793         last = wdev->cqm_config->last_rssi_event_value;
12794         hyst = wdev->cqm_config->rssi_hyst;
12795         n = wdev->cqm_config->n_rssi_thresholds;
12796
12797         for (i = 0; i < n; i++) {
12798                 i = array_index_nospec(i, n);
12799                 if (last < wdev->cqm_config->rssi_thresholds[i])
12800                         break;
12801         }
12802
12803         low_index = i - 1;
12804         if (low_index >= 0) {
12805                 low_index = array_index_nospec(low_index, n);
12806                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
12807         } else {
12808                 low = S32_MIN;
12809         }
12810         if (i < n) {
12811                 i = array_index_nospec(i, n);
12812                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
12813         } else {
12814                 high = S32_MAX;
12815         }
12816
12817         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
12818 }
12819
12820 static int nl80211_set_cqm_rssi(struct genl_info *info,
12821                                 const s32 *thresholds, int n_thresholds,
12822                                 u32 hysteresis)
12823 {
12824         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12825         struct net_device *dev = info->user_ptr[1];
12826         struct wireless_dev *wdev = dev->ieee80211_ptr;
12827         int i, err;
12828         s32 prev = S32_MIN;
12829
12830         /* Check all values negative and sorted */
12831         for (i = 0; i < n_thresholds; i++) {
12832                 if (thresholds[i] > 0 || thresholds[i] <= prev)
12833                         return -EINVAL;
12834
12835                 prev = thresholds[i];
12836         }
12837
12838         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12839             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12840                 return -EOPNOTSUPP;
12841
12842         wdev_lock(wdev);
12843         cfg80211_cqm_config_free(wdev);
12844         wdev_unlock(wdev);
12845
12846         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
12847                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
12848                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
12849
12850                 return rdev_set_cqm_rssi_config(rdev, dev,
12851                                                 thresholds[0], hysteresis);
12852         }
12853
12854         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12855                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
12856                 return -EOPNOTSUPP;
12857
12858         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
12859                 n_thresholds = 0;
12860
12861         wdev_lock(wdev);
12862         if (n_thresholds) {
12863                 struct cfg80211_cqm_config *cqm_config;
12864
12865                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
12866                                                  n_thresholds),
12867                                      GFP_KERNEL);
12868                 if (!cqm_config) {
12869                         err = -ENOMEM;
12870                         goto unlock;
12871                 }
12872
12873                 cqm_config->rssi_hyst = hysteresis;
12874                 cqm_config->n_rssi_thresholds = n_thresholds;
12875                 memcpy(cqm_config->rssi_thresholds, thresholds,
12876                        flex_array_size(cqm_config, rssi_thresholds,
12877                                        n_thresholds));
12878
12879                 wdev->cqm_config = cqm_config;
12880         }
12881
12882         err = cfg80211_cqm_rssi_update(rdev, dev);
12883
12884 unlock:
12885         wdev_unlock(wdev);
12886
12887         return err;
12888 }
12889
12890 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
12891 {
12892         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
12893         struct nlattr *cqm;
12894         int err;
12895
12896         cqm = info->attrs[NL80211_ATTR_CQM];
12897         if (!cqm)
12898                 return -EINVAL;
12899
12900         err = nla_parse_nested_deprecated(attrs, NL80211_ATTR_CQM_MAX, cqm,
12901                                           nl80211_attr_cqm_policy,
12902                                           info->extack);
12903         if (err)
12904                 return err;
12905
12906         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
12907             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
12908                 const s32 *thresholds =
12909                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12910                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
12911                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
12912
12913                 if (len % 4)
12914                         return -EINVAL;
12915
12916                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
12917                                             hysteresis);
12918         }
12919
12920         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
12921             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
12922             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
12923                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
12924                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
12925                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
12926
12927                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
12928         }
12929
12930         return -EINVAL;
12931 }
12932
12933 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
12934 {
12935         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12936         struct net_device *dev = info->user_ptr[1];
12937         struct ocb_setup setup = {};
12938         int err;
12939
12940         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
12941         if (err)
12942                 return err;
12943
12944         return cfg80211_join_ocb(rdev, dev, &setup);
12945 }
12946
12947 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
12948 {
12949         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12950         struct net_device *dev = info->user_ptr[1];
12951
12952         return cfg80211_leave_ocb(rdev, dev);
12953 }
12954
12955 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
12956 {
12957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12958         struct net_device *dev = info->user_ptr[1];
12959         struct mesh_config cfg;
12960         struct mesh_setup setup;
12961         int err;
12962
12963         /* start with default */
12964         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
12965         memcpy(&setup, &default_mesh_setup, sizeof(setup));
12966
12967         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
12968                 /* and parse parameters if given */
12969                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
12970                 if (err)
12971                         return err;
12972         }
12973
12974         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
12975             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
12976                 return -EINVAL;
12977
12978         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
12979         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
12980
12981         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
12982             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
12983                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
12984                         return -EINVAL;
12985
12986         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
12987                 setup.beacon_interval =
12988                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
12989
12990                 err = cfg80211_validate_beacon_int(rdev,
12991                                                    NL80211_IFTYPE_MESH_POINT,
12992                                                    setup.beacon_interval);
12993                 if (err)
12994                         return err;
12995         }
12996
12997         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
12998                 setup.dtim_period =
12999                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
13000                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
13001                         return -EINVAL;
13002         }
13003
13004         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
13005                 /* parse additional setup parameters if given */
13006                 err = nl80211_parse_mesh_setup(info, &setup);
13007                 if (err)
13008                         return err;
13009         }
13010
13011         if (setup.user_mpm)
13012                 cfg.auto_open_plinks = false;
13013
13014         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
13015                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
13016                 if (err)
13017                         return err;
13018         } else {
13019                 /* __cfg80211_join_mesh() will sort it out */
13020                 setup.chandef.chan = NULL;
13021         }
13022
13023         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
13024                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13025                 int n_rates =
13026                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
13027                 struct ieee80211_supported_band *sband;
13028
13029                 if (!setup.chandef.chan)
13030                         return -EINVAL;
13031
13032                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
13033
13034                 err = ieee80211_get_ratemask(sband, rates, n_rates,
13035                                              &setup.basic_rates);
13036                 if (err)
13037                         return err;
13038         }
13039
13040         if (info->attrs[NL80211_ATTR_TX_RATES]) {
13041                 err = nl80211_parse_tx_bitrate_mask(info, info->attrs,
13042                                                     NL80211_ATTR_TX_RATES,
13043                                                     &setup.beacon_rate,
13044                                                     dev, false, 0);
13045                 if (err)
13046                         return err;
13047
13048                 if (!setup.chandef.chan)
13049                         return -EINVAL;
13050
13051                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
13052                                               &setup.beacon_rate);
13053                 if (err)
13054                         return err;
13055         }
13056
13057         setup.userspace_handles_dfs =
13058                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
13059
13060         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
13061                 int r = validate_pae_over_nl80211(rdev, info);
13062
13063                 if (r < 0)
13064                         return r;
13065
13066                 setup.control_port_over_nl80211 = true;
13067         }
13068
13069         wdev_lock(dev->ieee80211_ptr);
13070         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
13071         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
13072                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
13073         wdev_unlock(dev->ieee80211_ptr);
13074
13075         return err;
13076 }
13077
13078 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
13079 {
13080         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13081         struct net_device *dev = info->user_ptr[1];
13082
13083         return cfg80211_leave_mesh(rdev, dev);
13084 }
13085
13086 #ifdef CONFIG_PM
13087 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
13088                                         struct cfg80211_registered_device *rdev)
13089 {
13090         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
13091         struct nlattr *nl_pats, *nl_pat;
13092         int i, pat_len;
13093
13094         if (!wowlan->n_patterns)
13095                 return 0;
13096
13097         nl_pats = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
13098         if (!nl_pats)
13099                 return -ENOBUFS;
13100
13101         for (i = 0; i < wowlan->n_patterns; i++) {
13102                 nl_pat = nla_nest_start_noflag(msg, i + 1);
13103                 if (!nl_pat)
13104                         return -ENOBUFS;
13105                 pat_len = wowlan->patterns[i].pattern_len;
13106                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
13107                             wowlan->patterns[i].mask) ||
13108                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13109                             wowlan->patterns[i].pattern) ||
13110                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13111                                 wowlan->patterns[i].pkt_offset))
13112                         return -ENOBUFS;
13113                 nla_nest_end(msg, nl_pat);
13114         }
13115         nla_nest_end(msg, nl_pats);
13116
13117         return 0;
13118 }
13119
13120 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
13121                                    struct cfg80211_wowlan_tcp *tcp)
13122 {
13123         struct nlattr *nl_tcp;
13124
13125         if (!tcp)
13126                 return 0;
13127
13128         nl_tcp = nla_nest_start_noflag(msg,
13129                                        NL80211_WOWLAN_TRIG_TCP_CONNECTION);
13130         if (!nl_tcp)
13131                 return -ENOBUFS;
13132
13133         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
13134             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
13135             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
13136             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
13137             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
13138             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
13139                     tcp->payload_len, tcp->payload) ||
13140             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
13141                         tcp->data_interval) ||
13142             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
13143                     tcp->wake_len, tcp->wake_data) ||
13144             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
13145                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
13146                 return -ENOBUFS;
13147
13148         if (tcp->payload_seq.len &&
13149             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
13150                     sizeof(tcp->payload_seq), &tcp->payload_seq))
13151                 return -ENOBUFS;
13152
13153         if (tcp->payload_tok.len &&
13154             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
13155                     sizeof(tcp->payload_tok) + tcp->tokens_size,
13156                     &tcp->payload_tok))
13157                 return -ENOBUFS;
13158
13159         nla_nest_end(msg, nl_tcp);
13160
13161         return 0;
13162 }
13163
13164 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
13165                                   struct cfg80211_sched_scan_request *req)
13166 {
13167         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
13168         int i;
13169
13170         if (!req)
13171                 return 0;
13172
13173         nd = nla_nest_start_noflag(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
13174         if (!nd)
13175                 return -ENOBUFS;
13176
13177         if (req->n_scan_plans == 1 &&
13178             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
13179                         req->scan_plans[0].interval * 1000))
13180                 return -ENOBUFS;
13181
13182         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
13183                 return -ENOBUFS;
13184
13185         if (req->relative_rssi_set) {
13186                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
13187
13188                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
13189                                req->relative_rssi))
13190                         return -ENOBUFS;
13191
13192                 rssi_adjust.band = req->rssi_adjust.band;
13193                 rssi_adjust.delta = req->rssi_adjust.delta;
13194                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
13195                             sizeof(rssi_adjust), &rssi_adjust))
13196                         return -ENOBUFS;
13197         }
13198
13199         freqs = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13200         if (!freqs)
13201                 return -ENOBUFS;
13202
13203         for (i = 0; i < req->n_channels; i++) {
13204                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13205                         return -ENOBUFS;
13206         }
13207
13208         nla_nest_end(msg, freqs);
13209
13210         if (req->n_match_sets) {
13211                 matches = nla_nest_start_noflag(msg,
13212                                                 NL80211_ATTR_SCHED_SCAN_MATCH);
13213                 if (!matches)
13214                         return -ENOBUFS;
13215
13216                 for (i = 0; i < req->n_match_sets; i++) {
13217                         match = nla_nest_start_noflag(msg, i);
13218                         if (!match)
13219                                 return -ENOBUFS;
13220
13221                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
13222                                     req->match_sets[i].ssid.ssid_len,
13223                                     req->match_sets[i].ssid.ssid))
13224                                 return -ENOBUFS;
13225                         nla_nest_end(msg, match);
13226                 }
13227                 nla_nest_end(msg, matches);
13228         }
13229
13230         scan_plans = nla_nest_start_noflag(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
13231         if (!scan_plans)
13232                 return -ENOBUFS;
13233
13234         for (i = 0; i < req->n_scan_plans; i++) {
13235                 scan_plan = nla_nest_start_noflag(msg, i + 1);
13236                 if (!scan_plan)
13237                         return -ENOBUFS;
13238
13239                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
13240                                 req->scan_plans[i].interval) ||
13241                     (req->scan_plans[i].iterations &&
13242                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
13243                                  req->scan_plans[i].iterations)))
13244                         return -ENOBUFS;
13245                 nla_nest_end(msg, scan_plan);
13246         }
13247         nla_nest_end(msg, scan_plans);
13248
13249         nla_nest_end(msg, nd);
13250
13251         return 0;
13252 }
13253
13254 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
13255 {
13256         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13257         struct sk_buff *msg;
13258         void *hdr;
13259         u32 size = NLMSG_DEFAULT_SIZE;
13260
13261         if (!rdev->wiphy.wowlan)
13262                 return -EOPNOTSUPP;
13263
13264         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
13265                 /* adjust size to have room for all the data */
13266                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
13267                         rdev->wiphy.wowlan_config->tcp->payload_len +
13268                         rdev->wiphy.wowlan_config->tcp->wake_len +
13269                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
13270         }
13271
13272         msg = nlmsg_new(size, GFP_KERNEL);
13273         if (!msg)
13274                 return -ENOMEM;
13275
13276         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13277                              NL80211_CMD_GET_WOWLAN);
13278         if (!hdr)
13279                 goto nla_put_failure;
13280
13281         if (rdev->wiphy.wowlan_config) {
13282                 struct nlattr *nl_wowlan;
13283
13284                 nl_wowlan = nla_nest_start_noflag(msg,
13285                                                   NL80211_ATTR_WOWLAN_TRIGGERS);
13286                 if (!nl_wowlan)
13287                         goto nla_put_failure;
13288
13289                 if ((rdev->wiphy.wowlan_config->any &&
13290                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
13291                     (rdev->wiphy.wowlan_config->disconnect &&
13292                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
13293                     (rdev->wiphy.wowlan_config->magic_pkt &&
13294                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
13295                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
13296                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
13297                     (rdev->wiphy.wowlan_config->eap_identity_req &&
13298                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
13299                     (rdev->wiphy.wowlan_config->four_way_handshake &&
13300                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
13301                     (rdev->wiphy.wowlan_config->rfkill_release &&
13302                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
13303                         goto nla_put_failure;
13304
13305                 if (nl80211_send_wowlan_patterns(msg, rdev))
13306                         goto nla_put_failure;
13307
13308                 if (nl80211_send_wowlan_tcp(msg,
13309                                             rdev->wiphy.wowlan_config->tcp))
13310                         goto nla_put_failure;
13311
13312                 if (nl80211_send_wowlan_nd(
13313                             msg,
13314                             rdev->wiphy.wowlan_config->nd_config))
13315                         goto nla_put_failure;
13316
13317                 nla_nest_end(msg, nl_wowlan);
13318         }
13319
13320         genlmsg_end(msg, hdr);
13321         return genlmsg_reply(msg, info);
13322
13323 nla_put_failure:
13324         nlmsg_free(msg);
13325         return -ENOBUFS;
13326 }
13327
13328 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
13329                                     struct nlattr *attr,
13330                                     struct cfg80211_wowlan *trig)
13331 {
13332         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
13333         struct cfg80211_wowlan_tcp *cfg;
13334         struct nl80211_wowlan_tcp_data_token *tok = NULL;
13335         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
13336         u32 size;
13337         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
13338         int err, port;
13339
13340         if (!rdev->wiphy.wowlan->tcp)
13341                 return -EINVAL;
13342
13343         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TCP, attr,
13344                                           nl80211_wowlan_tcp_policy, NULL);
13345         if (err)
13346                 return err;
13347
13348         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
13349             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
13350             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
13351             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
13352             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
13353             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
13354             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
13355             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
13356                 return -EINVAL;
13357
13358         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
13359         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
13360                 return -EINVAL;
13361
13362         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
13363                         rdev->wiphy.wowlan->tcp->data_interval_max ||
13364             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
13365                 return -EINVAL;
13366
13367         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
13368         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
13369                 return -EINVAL;
13370
13371         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
13372         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
13373                 return -EINVAL;
13374
13375         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
13376                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13377
13378                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
13379                 tokens_size = tokln - sizeof(*tok);
13380
13381                 if (!tok->len || tokens_size % tok->len)
13382                         return -EINVAL;
13383                 if (!rdev->wiphy.wowlan->tcp->tok)
13384                         return -EINVAL;
13385                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
13386                         return -EINVAL;
13387                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
13388                         return -EINVAL;
13389                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
13390                         return -EINVAL;
13391                 if (tok->offset + tok->len > data_size)
13392                         return -EINVAL;
13393         }
13394
13395         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
13396                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
13397                 if (!rdev->wiphy.wowlan->tcp->seq)
13398                         return -EINVAL;
13399                 if (seq->len == 0 || seq->len > 4)
13400                         return -EINVAL;
13401                 if (seq->len + seq->offset > data_size)
13402                         return -EINVAL;
13403         }
13404
13405         size = sizeof(*cfg);
13406         size += data_size;
13407         size += wake_size + wake_mask_size;
13408         size += tokens_size;
13409
13410         cfg = kzalloc(size, GFP_KERNEL);
13411         if (!cfg)
13412                 return -ENOMEM;
13413         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
13414         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
13415         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
13416                ETH_ALEN);
13417         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
13418                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
13419         else
13420                 port = 0;
13421 #ifdef CONFIG_INET
13422         /* allocate a socket and port for it and use it */
13423         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
13424                             IPPROTO_TCP, &cfg->sock, 1);
13425         if (err) {
13426                 kfree(cfg);
13427                 return err;
13428         }
13429         if (inet_csk_get_port(cfg->sock->sk, port)) {
13430                 sock_release(cfg->sock);
13431                 kfree(cfg);
13432                 return -EADDRINUSE;
13433         }
13434         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
13435 #else
13436         if (!port) {
13437                 kfree(cfg);
13438                 return -EINVAL;
13439         }
13440         cfg->src_port = port;
13441 #endif
13442
13443         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
13444         cfg->payload_len = data_size;
13445         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
13446         memcpy((void *)cfg->payload,
13447                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
13448                data_size);
13449         if (seq)
13450                 cfg->payload_seq = *seq;
13451         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
13452         cfg->wake_len = wake_size;
13453         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
13454         memcpy((void *)cfg->wake_data,
13455                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
13456                wake_size);
13457         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
13458                          data_size + wake_size;
13459         memcpy((void *)cfg->wake_mask,
13460                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
13461                wake_mask_size);
13462         if (tok) {
13463                 cfg->tokens_size = tokens_size;
13464                 cfg->payload_tok = *tok;
13465                 memcpy(cfg->payload_tok.token_stream, tok->token_stream,
13466                        tokens_size);
13467         }
13468
13469         trig->tcp = cfg;
13470
13471         return 0;
13472 }
13473
13474 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
13475                                    const struct wiphy_wowlan_support *wowlan,
13476                                    struct nlattr *attr,
13477                                    struct cfg80211_wowlan *trig)
13478 {
13479         struct nlattr **tb;
13480         int err;
13481
13482         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
13483         if (!tb)
13484                 return -ENOMEM;
13485
13486         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
13487                 err = -EOPNOTSUPP;
13488                 goto out;
13489         }
13490
13491         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_MAX, attr,
13492                                           nl80211_policy, NULL);
13493         if (err)
13494                 goto out;
13495
13496         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
13497                                                    wowlan->max_nd_match_sets);
13498         err = PTR_ERR_OR_ZERO(trig->nd_config);
13499         if (err)
13500                 trig->nd_config = NULL;
13501
13502 out:
13503         kfree(tb);
13504         return err;
13505 }
13506
13507 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
13508 {
13509         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13510         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
13511         struct cfg80211_wowlan new_triggers = {};
13512         struct cfg80211_wowlan *ntrig;
13513         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
13514         int err, i;
13515         bool prev_enabled = rdev->wiphy.wowlan_config;
13516         bool regular = false;
13517
13518         if (!wowlan)
13519                 return -EOPNOTSUPP;
13520
13521         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
13522                 cfg80211_rdev_free_wowlan(rdev);
13523                 rdev->wiphy.wowlan_config = NULL;
13524                 goto set_wakeup;
13525         }
13526
13527         err = nla_parse_nested_deprecated(tb, MAX_NL80211_WOWLAN_TRIG,
13528                                           info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
13529                                           nl80211_wowlan_policy, info->extack);
13530         if (err)
13531                 return err;
13532
13533         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
13534                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
13535                         return -EINVAL;
13536                 new_triggers.any = true;
13537         }
13538
13539         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
13540                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
13541                         return -EINVAL;
13542                 new_triggers.disconnect = true;
13543                 regular = true;
13544         }
13545
13546         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
13547                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
13548                         return -EINVAL;
13549                 new_triggers.magic_pkt = true;
13550                 regular = true;
13551         }
13552
13553         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
13554                 return -EINVAL;
13555
13556         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
13557                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
13558                         return -EINVAL;
13559                 new_triggers.gtk_rekey_failure = true;
13560                 regular = true;
13561         }
13562
13563         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
13564                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
13565                         return -EINVAL;
13566                 new_triggers.eap_identity_req = true;
13567                 regular = true;
13568         }
13569
13570         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
13571                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
13572                         return -EINVAL;
13573                 new_triggers.four_way_handshake = true;
13574                 regular = true;
13575         }
13576
13577         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
13578                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
13579                         return -EINVAL;
13580                 new_triggers.rfkill_release = true;
13581                 regular = true;
13582         }
13583
13584         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
13585                 struct nlattr *pat;
13586                 int n_patterns = 0;
13587                 int rem, pat_len, mask_len, pkt_offset;
13588                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13589
13590                 regular = true;
13591
13592                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13593                                     rem)
13594                         n_patterns++;
13595                 if (n_patterns > wowlan->n_patterns)
13596                         return -EINVAL;
13597
13598                 new_triggers.patterns = kcalloc(n_patterns,
13599                                                 sizeof(new_triggers.patterns[0]),
13600                                                 GFP_KERNEL);
13601                 if (!new_triggers.patterns)
13602                         return -ENOMEM;
13603
13604                 new_triggers.n_patterns = n_patterns;
13605                 i = 0;
13606
13607                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
13608                                     rem) {
13609                         u8 *mask_pat;
13610
13611                         err = nla_parse_nested_deprecated(pat_tb,
13612                                                           MAX_NL80211_PKTPAT,
13613                                                           pat,
13614                                                           nl80211_packet_pattern_policy,
13615                                                           info->extack);
13616                         if (err)
13617                                 goto error;
13618
13619                         err = -EINVAL;
13620                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
13621                             !pat_tb[NL80211_PKTPAT_PATTERN])
13622                                 goto error;
13623                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13624                         mask_len = DIV_ROUND_UP(pat_len, 8);
13625                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13626                                 goto error;
13627                         if (pat_len > wowlan->pattern_max_len ||
13628                             pat_len < wowlan->pattern_min_len)
13629                                 goto error;
13630
13631                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
13632                                 pkt_offset = 0;
13633                         else
13634                                 pkt_offset = nla_get_u32(
13635                                         pat_tb[NL80211_PKTPAT_OFFSET]);
13636                         if (pkt_offset > wowlan->max_pkt_offset)
13637                                 goto error;
13638                         new_triggers.patterns[i].pkt_offset = pkt_offset;
13639
13640                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13641                         if (!mask_pat) {
13642                                 err = -ENOMEM;
13643                                 goto error;
13644                         }
13645                         new_triggers.patterns[i].mask = mask_pat;
13646                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13647                                mask_len);
13648                         mask_pat += mask_len;
13649                         new_triggers.patterns[i].pattern = mask_pat;
13650                         new_triggers.patterns[i].pattern_len = pat_len;
13651                         memcpy(mask_pat,
13652                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13653                                pat_len);
13654                         i++;
13655                 }
13656         }
13657
13658         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
13659                 regular = true;
13660                 err = nl80211_parse_wowlan_tcp(
13661                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
13662                         &new_triggers);
13663                 if (err)
13664                         goto error;
13665         }
13666
13667         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
13668                 regular = true;
13669                 err = nl80211_parse_wowlan_nd(
13670                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
13671                         &new_triggers);
13672                 if (err)
13673                         goto error;
13674         }
13675
13676         /* The 'any' trigger means the device continues operating more or less
13677          * as in its normal operation mode and wakes up the host on most of the
13678          * normal interrupts (like packet RX, ...)
13679          * It therefore makes little sense to combine with the more constrained
13680          * wakeup trigger modes.
13681          */
13682         if (new_triggers.any && regular) {
13683                 err = -EINVAL;
13684                 goto error;
13685         }
13686
13687         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
13688         if (!ntrig) {
13689                 err = -ENOMEM;
13690                 goto error;
13691         }
13692         cfg80211_rdev_free_wowlan(rdev);
13693         rdev->wiphy.wowlan_config = ntrig;
13694
13695  set_wakeup:
13696         if (rdev->ops->set_wakeup &&
13697             prev_enabled != !!rdev->wiphy.wowlan_config)
13698                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
13699
13700         return 0;
13701  error:
13702         for (i = 0; i < new_triggers.n_patterns; i++)
13703                 kfree(new_triggers.patterns[i].mask);
13704         kfree(new_triggers.patterns);
13705         if (new_triggers.tcp && new_triggers.tcp->sock)
13706                 sock_release(new_triggers.tcp->sock);
13707         kfree(new_triggers.tcp);
13708         kfree(new_triggers.nd_config);
13709         return err;
13710 }
13711 #endif
13712
13713 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
13714                                        struct cfg80211_registered_device *rdev)
13715 {
13716         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
13717         int i, j, pat_len;
13718         struct cfg80211_coalesce_rules *rule;
13719
13720         if (!rdev->coalesce->n_rules)
13721                 return 0;
13722
13723         nl_rules = nla_nest_start_noflag(msg, NL80211_ATTR_COALESCE_RULE);
13724         if (!nl_rules)
13725                 return -ENOBUFS;
13726
13727         for (i = 0; i < rdev->coalesce->n_rules; i++) {
13728                 nl_rule = nla_nest_start_noflag(msg, i + 1);
13729                 if (!nl_rule)
13730                         return -ENOBUFS;
13731
13732                 rule = &rdev->coalesce->rules[i];
13733                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
13734                                 rule->delay))
13735                         return -ENOBUFS;
13736
13737                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
13738                                 rule->condition))
13739                         return -ENOBUFS;
13740
13741                 nl_pats = nla_nest_start_noflag(msg,
13742                                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
13743                 if (!nl_pats)
13744                         return -ENOBUFS;
13745
13746                 for (j = 0; j < rule->n_patterns; j++) {
13747                         nl_pat = nla_nest_start_noflag(msg, j + 1);
13748                         if (!nl_pat)
13749                                 return -ENOBUFS;
13750                         pat_len = rule->patterns[j].pattern_len;
13751                         if (nla_put(msg, NL80211_PKTPAT_MASK,
13752                                     DIV_ROUND_UP(pat_len, 8),
13753                                     rule->patterns[j].mask) ||
13754                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
13755                                     rule->patterns[j].pattern) ||
13756                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
13757                                         rule->patterns[j].pkt_offset))
13758                                 return -ENOBUFS;
13759                         nla_nest_end(msg, nl_pat);
13760                 }
13761                 nla_nest_end(msg, nl_pats);
13762                 nla_nest_end(msg, nl_rule);
13763         }
13764         nla_nest_end(msg, nl_rules);
13765
13766         return 0;
13767 }
13768
13769 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
13770 {
13771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13772         struct sk_buff *msg;
13773         void *hdr;
13774
13775         if (!rdev->wiphy.coalesce)
13776                 return -EOPNOTSUPP;
13777
13778         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13779         if (!msg)
13780                 return -ENOMEM;
13781
13782         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
13783                              NL80211_CMD_GET_COALESCE);
13784         if (!hdr)
13785                 goto nla_put_failure;
13786
13787         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
13788                 goto nla_put_failure;
13789
13790         genlmsg_end(msg, hdr);
13791         return genlmsg_reply(msg, info);
13792
13793 nla_put_failure:
13794         nlmsg_free(msg);
13795         return -ENOBUFS;
13796 }
13797
13798 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
13799 {
13800         struct cfg80211_coalesce *coalesce = rdev->coalesce;
13801         int i, j;
13802         struct cfg80211_coalesce_rules *rule;
13803
13804         if (!coalesce)
13805                 return;
13806
13807         for (i = 0; i < coalesce->n_rules; i++) {
13808                 rule = &coalesce->rules[i];
13809                 for (j = 0; j < rule->n_patterns; j++)
13810                         kfree(rule->patterns[j].mask);
13811                 kfree(rule->patterns);
13812         }
13813         kfree(coalesce->rules);
13814         kfree(coalesce);
13815         rdev->coalesce = NULL;
13816 }
13817
13818 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
13819                                        struct nlattr *rule,
13820                                        struct cfg80211_coalesce_rules *new_rule)
13821 {
13822         int err, i;
13823         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13824         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
13825         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
13826         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
13827
13828         err = nla_parse_nested_deprecated(tb, NL80211_ATTR_COALESCE_RULE_MAX,
13829                                           rule, nl80211_coalesce_policy, NULL);
13830         if (err)
13831                 return err;
13832
13833         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
13834                 new_rule->delay =
13835                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
13836         if (new_rule->delay > coalesce->max_delay)
13837                 return -EINVAL;
13838
13839         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
13840                 new_rule->condition =
13841                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
13842
13843         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
13844                 return -EINVAL;
13845
13846         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13847                             rem)
13848                 n_patterns++;
13849         if (n_patterns > coalesce->n_patterns)
13850                 return -EINVAL;
13851
13852         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
13853                                      GFP_KERNEL);
13854         if (!new_rule->patterns)
13855                 return -ENOMEM;
13856
13857         new_rule->n_patterns = n_patterns;
13858         i = 0;
13859
13860         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
13861                             rem) {
13862                 u8 *mask_pat;
13863
13864                 err = nla_parse_nested_deprecated(pat_tb, MAX_NL80211_PKTPAT,
13865                                                   pat,
13866                                                   nl80211_packet_pattern_policy,
13867                                                   NULL);
13868                 if (err)
13869                         return err;
13870
13871                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
13872                     !pat_tb[NL80211_PKTPAT_PATTERN])
13873                         return -EINVAL;
13874                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
13875                 mask_len = DIV_ROUND_UP(pat_len, 8);
13876                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
13877                         return -EINVAL;
13878                 if (pat_len > coalesce->pattern_max_len ||
13879                     pat_len < coalesce->pattern_min_len)
13880                         return -EINVAL;
13881
13882                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
13883                         pkt_offset = 0;
13884                 else
13885                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
13886                 if (pkt_offset > coalesce->max_pkt_offset)
13887                         return -EINVAL;
13888                 new_rule->patterns[i].pkt_offset = pkt_offset;
13889
13890                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
13891                 if (!mask_pat)
13892                         return -ENOMEM;
13893
13894                 new_rule->patterns[i].mask = mask_pat;
13895                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
13896                        mask_len);
13897
13898                 mask_pat += mask_len;
13899                 new_rule->patterns[i].pattern = mask_pat;
13900                 new_rule->patterns[i].pattern_len = pat_len;
13901                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
13902                        pat_len);
13903                 i++;
13904         }
13905
13906         return 0;
13907 }
13908
13909 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
13910 {
13911         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13912         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
13913         struct cfg80211_coalesce new_coalesce = {};
13914         struct cfg80211_coalesce *n_coalesce;
13915         int err, rem_rule, n_rules = 0, i, j;
13916         struct nlattr *rule;
13917         struct cfg80211_coalesce_rules *tmp_rule;
13918
13919         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
13920                 return -EOPNOTSUPP;
13921
13922         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
13923                 cfg80211_rdev_free_coalesce(rdev);
13924                 rdev_set_coalesce(rdev, NULL);
13925                 return 0;
13926         }
13927
13928         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13929                             rem_rule)
13930                 n_rules++;
13931         if (n_rules > coalesce->n_rules)
13932                 return -EINVAL;
13933
13934         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
13935                                      GFP_KERNEL);
13936         if (!new_coalesce.rules)
13937                 return -ENOMEM;
13938
13939         new_coalesce.n_rules = n_rules;
13940         i = 0;
13941
13942         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
13943                             rem_rule) {
13944                 err = nl80211_parse_coalesce_rule(rdev, rule,
13945                                                   &new_coalesce.rules[i]);
13946                 if (err)
13947                         goto error;
13948
13949                 i++;
13950         }
13951
13952         err = rdev_set_coalesce(rdev, &new_coalesce);
13953         if (err)
13954                 goto error;
13955
13956         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
13957         if (!n_coalesce) {
13958                 err = -ENOMEM;
13959                 goto error;
13960         }
13961         cfg80211_rdev_free_coalesce(rdev);
13962         rdev->coalesce = n_coalesce;
13963
13964         return 0;
13965 error:
13966         for (i = 0; i < new_coalesce.n_rules; i++) {
13967                 tmp_rule = &new_coalesce.rules[i];
13968                 for (j = 0; j < tmp_rule->n_patterns; j++)
13969                         kfree(tmp_rule->patterns[j].mask);
13970                 kfree(tmp_rule->patterns);
13971         }
13972         kfree(new_coalesce.rules);
13973
13974         return err;
13975 }
13976
13977 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
13978 {
13979         struct cfg80211_registered_device *rdev = info->user_ptr[0];
13980         struct net_device *dev = info->user_ptr[1];
13981         struct wireless_dev *wdev = dev->ieee80211_ptr;
13982         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
13983         struct cfg80211_gtk_rekey_data rekey_data = {};
13984         int err;
13985
13986         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
13987                 return -EINVAL;
13988
13989         err = nla_parse_nested_deprecated(tb, MAX_NL80211_REKEY_DATA,
13990                                           info->attrs[NL80211_ATTR_REKEY_DATA],
13991                                           nl80211_rekey_policy, info->extack);
13992         if (err)
13993                 return err;
13994
13995         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
13996             !tb[NL80211_REKEY_DATA_KCK])
13997                 return -EINVAL;
13998         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN &&
13999             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14000               nla_len(tb[NL80211_REKEY_DATA_KEK]) == NL80211_KEK_EXT_LEN))
14001                 return -ERANGE;
14002         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN &&
14003             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KEK_KCK &&
14004               nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN) &&
14005              !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_EXT_KCK_32 &&
14006                nla_len(tb[NL80211_REKEY_DATA_KCK]) == NL80211_KCK_EXT_LEN_32))
14007                 return -ERANGE;
14008
14009         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
14010         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
14011         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
14012         rekey_data.kek_len = nla_len(tb[NL80211_REKEY_DATA_KEK]);
14013         rekey_data.kck_len = nla_len(tb[NL80211_REKEY_DATA_KCK]);
14014         if (tb[NL80211_REKEY_DATA_AKM])
14015                 rekey_data.akm = nla_get_u32(tb[NL80211_REKEY_DATA_AKM]);
14016
14017         wdev_lock(wdev);
14018         if (!wdev->connected) {
14019                 err = -ENOTCONN;
14020                 goto out;
14021         }
14022
14023         if (!rdev->ops->set_rekey_data) {
14024                 err = -EOPNOTSUPP;
14025                 goto out;
14026         }
14027
14028         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
14029  out:
14030         wdev_unlock(wdev);
14031         return err;
14032 }
14033
14034 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
14035                                              struct genl_info *info)
14036 {
14037         struct net_device *dev = info->user_ptr[1];
14038         struct wireless_dev *wdev = dev->ieee80211_ptr;
14039
14040         if (wdev->iftype != NL80211_IFTYPE_AP &&
14041             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14042                 return -EINVAL;
14043
14044         if (wdev->ap_unexpected_nlportid)
14045                 return -EBUSY;
14046
14047         wdev->ap_unexpected_nlportid = info->snd_portid;
14048         return 0;
14049 }
14050
14051 static int nl80211_probe_client(struct sk_buff *skb,
14052                                 struct genl_info *info)
14053 {
14054         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14055         struct net_device *dev = info->user_ptr[1];
14056         struct wireless_dev *wdev = dev->ieee80211_ptr;
14057         struct sk_buff *msg;
14058         void *hdr;
14059         const u8 *addr;
14060         u64 cookie;
14061         int err;
14062
14063         if (wdev->iftype != NL80211_IFTYPE_AP &&
14064             wdev->iftype != NL80211_IFTYPE_P2P_GO)
14065                 return -EOPNOTSUPP;
14066
14067         if (!info->attrs[NL80211_ATTR_MAC])
14068                 return -EINVAL;
14069
14070         if (!rdev->ops->probe_client)
14071                 return -EOPNOTSUPP;
14072
14073         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14074         if (!msg)
14075                 return -ENOMEM;
14076
14077         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14078                              NL80211_CMD_PROBE_CLIENT);
14079         if (!hdr) {
14080                 err = -ENOBUFS;
14081                 goto free_msg;
14082         }
14083
14084         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
14085
14086         err = rdev_probe_client(rdev, dev, addr, &cookie);
14087         if (err)
14088                 goto free_msg;
14089
14090         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14091                               NL80211_ATTR_PAD))
14092                 goto nla_put_failure;
14093
14094         genlmsg_end(msg, hdr);
14095
14096         return genlmsg_reply(msg, info);
14097
14098  nla_put_failure:
14099         err = -ENOBUFS;
14100  free_msg:
14101         nlmsg_free(msg);
14102         return err;
14103 }
14104
14105 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
14106 {
14107         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14108         struct cfg80211_beacon_registration *reg, *nreg;
14109         int rv;
14110
14111         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
14112                 return -EOPNOTSUPP;
14113
14114         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
14115         if (!nreg)
14116                 return -ENOMEM;
14117
14118         /* First, check if already registered. */
14119         spin_lock_bh(&rdev->beacon_registrations_lock);
14120         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
14121                 if (reg->nlportid == info->snd_portid) {
14122                         rv = -EALREADY;
14123                         goto out_err;
14124                 }
14125         }
14126         /* Add it to the list */
14127         nreg->nlportid = info->snd_portid;
14128         list_add(&nreg->list, &rdev->beacon_registrations);
14129
14130         spin_unlock_bh(&rdev->beacon_registrations_lock);
14131
14132         return 0;
14133 out_err:
14134         spin_unlock_bh(&rdev->beacon_registrations_lock);
14135         kfree(nreg);
14136         return rv;
14137 }
14138
14139 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
14140 {
14141         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14142         struct wireless_dev *wdev = info->user_ptr[1];
14143         int err;
14144
14145         if (!rdev->ops->start_p2p_device)
14146                 return -EOPNOTSUPP;
14147
14148         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14149                 return -EOPNOTSUPP;
14150
14151         if (wdev_running(wdev))
14152                 return 0;
14153
14154         if (rfkill_blocked(rdev->wiphy.rfkill))
14155                 return -ERFKILL;
14156
14157         err = rdev_start_p2p_device(rdev, wdev);
14158         if (err)
14159                 return err;
14160
14161         wdev->is_running = true;
14162         rdev->opencount++;
14163
14164         return 0;
14165 }
14166
14167 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
14168 {
14169         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14170         struct wireless_dev *wdev = info->user_ptr[1];
14171
14172         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
14173                 return -EOPNOTSUPP;
14174
14175         if (!rdev->ops->stop_p2p_device)
14176                 return -EOPNOTSUPP;
14177
14178         cfg80211_stop_p2p_device(rdev, wdev);
14179
14180         return 0;
14181 }
14182
14183 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
14184 {
14185         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14186         struct wireless_dev *wdev = info->user_ptr[1];
14187         struct cfg80211_nan_conf conf = {};
14188         int err;
14189
14190         if (wdev->iftype != NL80211_IFTYPE_NAN)
14191                 return -EOPNOTSUPP;
14192
14193         if (wdev_running(wdev))
14194                 return -EEXIST;
14195
14196         if (rfkill_blocked(rdev->wiphy.rfkill))
14197                 return -ERFKILL;
14198
14199         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
14200                 return -EINVAL;
14201
14202         conf.master_pref =
14203                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14204
14205         if (info->attrs[NL80211_ATTR_BANDS]) {
14206                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14207
14208                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14209                         return -EOPNOTSUPP;
14210
14211                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14212                         return -EINVAL;
14213
14214                 conf.bands = bands;
14215         }
14216
14217         err = rdev_start_nan(rdev, wdev, &conf);
14218         if (err)
14219                 return err;
14220
14221         wdev->is_running = true;
14222         rdev->opencount++;
14223
14224         return 0;
14225 }
14226
14227 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
14228 {
14229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14230         struct wireless_dev *wdev = info->user_ptr[1];
14231
14232         if (wdev->iftype != NL80211_IFTYPE_NAN)
14233                 return -EOPNOTSUPP;
14234
14235         cfg80211_stop_nan(rdev, wdev);
14236
14237         return 0;
14238 }
14239
14240 static int validate_nan_filter(struct nlattr *filter_attr)
14241 {
14242         struct nlattr *attr;
14243         int len = 0, n_entries = 0, rem;
14244
14245         nla_for_each_nested(attr, filter_attr, rem) {
14246                 len += nla_len(attr);
14247                 n_entries++;
14248         }
14249
14250         if (len >= U8_MAX)
14251                 return -EINVAL;
14252
14253         return n_entries;
14254 }
14255
14256 static int handle_nan_filter(struct nlattr *attr_filter,
14257                              struct cfg80211_nan_func *func,
14258                              bool tx)
14259 {
14260         struct nlattr *attr;
14261         int n_entries, rem, i;
14262         struct cfg80211_nan_func_filter *filter;
14263
14264         n_entries = validate_nan_filter(attr_filter);
14265         if (n_entries < 0)
14266                 return n_entries;
14267
14268         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
14269
14270         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
14271         if (!filter)
14272                 return -ENOMEM;
14273
14274         i = 0;
14275         nla_for_each_nested(attr, attr_filter, rem) {
14276                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
14277                 if (!filter[i].filter)
14278                         goto err;
14279
14280                 filter[i].len = nla_len(attr);
14281                 i++;
14282         }
14283         if (tx) {
14284                 func->num_tx_filters = n_entries;
14285                 func->tx_filters = filter;
14286         } else {
14287                 func->num_rx_filters = n_entries;
14288                 func->rx_filters = filter;
14289         }
14290
14291         return 0;
14292
14293 err:
14294         i = 0;
14295         nla_for_each_nested(attr, attr_filter, rem) {
14296                 kfree(filter[i].filter);
14297                 i++;
14298         }
14299         kfree(filter);
14300         return -ENOMEM;
14301 }
14302
14303 static int nl80211_nan_add_func(struct sk_buff *skb,
14304                                 struct genl_info *info)
14305 {
14306         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14307         struct wireless_dev *wdev = info->user_ptr[1];
14308         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
14309         struct cfg80211_nan_func *func;
14310         struct sk_buff *msg = NULL;
14311         void *hdr = NULL;
14312         int err = 0;
14313
14314         if (wdev->iftype != NL80211_IFTYPE_NAN)
14315                 return -EOPNOTSUPP;
14316
14317         if (!wdev_running(wdev))
14318                 return -ENOTCONN;
14319
14320         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
14321                 return -EINVAL;
14322
14323         err = nla_parse_nested_deprecated(tb, NL80211_NAN_FUNC_ATTR_MAX,
14324                                           info->attrs[NL80211_ATTR_NAN_FUNC],
14325                                           nl80211_nan_func_policy,
14326                                           info->extack);
14327         if (err)
14328                 return err;
14329
14330         func = kzalloc(sizeof(*func), GFP_KERNEL);
14331         if (!func)
14332                 return -ENOMEM;
14333
14334         func->cookie = cfg80211_assign_cookie(rdev);
14335
14336         if (!tb[NL80211_NAN_FUNC_TYPE]) {
14337                 err = -EINVAL;
14338                 goto out;
14339         }
14340
14341
14342         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
14343
14344         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
14345                 err = -EINVAL;
14346                 goto out;
14347         }
14348
14349         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
14350                sizeof(func->service_id));
14351
14352         func->close_range =
14353                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
14354
14355         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
14356                 func->serv_spec_info_len =
14357                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
14358                 func->serv_spec_info =
14359                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
14360                                 func->serv_spec_info_len,
14361                                 GFP_KERNEL);
14362                 if (!func->serv_spec_info) {
14363                         err = -ENOMEM;
14364                         goto out;
14365                 }
14366         }
14367
14368         if (tb[NL80211_NAN_FUNC_TTL])
14369                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
14370
14371         switch (func->type) {
14372         case NL80211_NAN_FUNC_PUBLISH:
14373                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
14374                         err = -EINVAL;
14375                         goto out;
14376                 }
14377
14378                 func->publish_type =
14379                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
14380                 func->publish_bcast =
14381                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
14382
14383                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
14384                         func->publish_bcast) {
14385                         err = -EINVAL;
14386                         goto out;
14387                 }
14388                 break;
14389         case NL80211_NAN_FUNC_SUBSCRIBE:
14390                 func->subscribe_active =
14391                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
14392                 break;
14393         case NL80211_NAN_FUNC_FOLLOW_UP:
14394                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
14395                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
14396                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
14397                         err = -EINVAL;
14398                         goto out;
14399                 }
14400
14401                 func->followup_id =
14402                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
14403                 func->followup_reqid =
14404                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
14405                 memcpy(func->followup_dest.addr,
14406                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
14407                        sizeof(func->followup_dest.addr));
14408                 if (func->ttl) {
14409                         err = -EINVAL;
14410                         goto out;
14411                 }
14412                 break;
14413         default:
14414                 err = -EINVAL;
14415                 goto out;
14416         }
14417
14418         if (tb[NL80211_NAN_FUNC_SRF]) {
14419                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
14420
14421                 err = nla_parse_nested_deprecated(srf_tb,
14422                                                   NL80211_NAN_SRF_ATTR_MAX,
14423                                                   tb[NL80211_NAN_FUNC_SRF],
14424                                                   nl80211_nan_srf_policy,
14425                                                   info->extack);
14426                 if (err)
14427                         goto out;
14428
14429                 func->srf_include =
14430                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
14431
14432                 if (srf_tb[NL80211_NAN_SRF_BF]) {
14433                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
14434                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
14435                                 err = -EINVAL;
14436                                 goto out;
14437                         }
14438
14439                         func->srf_bf_len =
14440                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
14441                         func->srf_bf =
14442                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
14443                                         func->srf_bf_len, GFP_KERNEL);
14444                         if (!func->srf_bf) {
14445                                 err = -ENOMEM;
14446                                 goto out;
14447                         }
14448
14449                         func->srf_bf_idx =
14450                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
14451                 } else {
14452                         struct nlattr *attr, *mac_attr =
14453                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
14454                         int n_entries, rem, i = 0;
14455
14456                         if (!mac_attr) {
14457                                 err = -EINVAL;
14458                                 goto out;
14459                         }
14460
14461                         n_entries = validate_acl_mac_addrs(mac_attr);
14462                         if (n_entries <= 0) {
14463                                 err = -EINVAL;
14464                                 goto out;
14465                         }
14466
14467                         func->srf_num_macs = n_entries;
14468                         func->srf_macs =
14469                                 kcalloc(n_entries, sizeof(*func->srf_macs),
14470                                         GFP_KERNEL);
14471                         if (!func->srf_macs) {
14472                                 err = -ENOMEM;
14473                                 goto out;
14474                         }
14475
14476                         nla_for_each_nested(attr, mac_attr, rem)
14477                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
14478                                        sizeof(*func->srf_macs));
14479                 }
14480         }
14481
14482         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
14483                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
14484                                         func, true);
14485                 if (err)
14486                         goto out;
14487         }
14488
14489         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
14490                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
14491                                         func, false);
14492                 if (err)
14493                         goto out;
14494         }
14495
14496         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14497         if (!msg) {
14498                 err = -ENOMEM;
14499                 goto out;
14500         }
14501
14502         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14503                              NL80211_CMD_ADD_NAN_FUNCTION);
14504         /* This can't really happen - we just allocated 4KB */
14505         if (WARN_ON(!hdr)) {
14506                 err = -ENOMEM;
14507                 goto out;
14508         }
14509
14510         err = rdev_add_nan_func(rdev, wdev, func);
14511 out:
14512         if (err < 0) {
14513                 cfg80211_free_nan_func(func);
14514                 nlmsg_free(msg);
14515                 return err;
14516         }
14517
14518         /* propagate the instance id and cookie to userspace  */
14519         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
14520                               NL80211_ATTR_PAD))
14521                 goto nla_put_failure;
14522
14523         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14524         if (!func_attr)
14525                 goto nla_put_failure;
14526
14527         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
14528                        func->instance_id))
14529                 goto nla_put_failure;
14530
14531         nla_nest_end(msg, func_attr);
14532
14533         genlmsg_end(msg, hdr);
14534         return genlmsg_reply(msg, info);
14535
14536 nla_put_failure:
14537         nlmsg_free(msg);
14538         return -ENOBUFS;
14539 }
14540
14541 static int nl80211_nan_del_func(struct sk_buff *skb,
14542                                struct genl_info *info)
14543 {
14544         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14545         struct wireless_dev *wdev = info->user_ptr[1];
14546         u64 cookie;
14547
14548         if (wdev->iftype != NL80211_IFTYPE_NAN)
14549                 return -EOPNOTSUPP;
14550
14551         if (!wdev_running(wdev))
14552                 return -ENOTCONN;
14553
14554         if (!info->attrs[NL80211_ATTR_COOKIE])
14555                 return -EINVAL;
14556
14557         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
14558
14559         rdev_del_nan_func(rdev, wdev, cookie);
14560
14561         return 0;
14562 }
14563
14564 static int nl80211_nan_change_config(struct sk_buff *skb,
14565                                      struct genl_info *info)
14566 {
14567         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14568         struct wireless_dev *wdev = info->user_ptr[1];
14569         struct cfg80211_nan_conf conf = {};
14570         u32 changed = 0;
14571
14572         if (wdev->iftype != NL80211_IFTYPE_NAN)
14573                 return -EOPNOTSUPP;
14574
14575         if (!wdev_running(wdev))
14576                 return -ENOTCONN;
14577
14578         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
14579                 conf.master_pref =
14580                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
14581                 if (conf.master_pref <= 1 || conf.master_pref == 255)
14582                         return -EINVAL;
14583
14584                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
14585         }
14586
14587         if (info->attrs[NL80211_ATTR_BANDS]) {
14588                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
14589
14590                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
14591                         return -EOPNOTSUPP;
14592
14593                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
14594                         return -EINVAL;
14595
14596                 conf.bands = bands;
14597                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
14598         }
14599
14600         if (!changed)
14601                 return -EINVAL;
14602
14603         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
14604 }
14605
14606 void cfg80211_nan_match(struct wireless_dev *wdev,
14607                         struct cfg80211_nan_match_params *match, gfp_t gfp)
14608 {
14609         struct wiphy *wiphy = wdev->wiphy;
14610         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14611         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
14612         struct sk_buff *msg;
14613         void *hdr;
14614
14615         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
14616                 return;
14617
14618         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14619         if (!msg)
14620                 return;
14621
14622         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
14623         if (!hdr) {
14624                 nlmsg_free(msg);
14625                 return;
14626         }
14627
14628         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14629             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14630                                          wdev->netdev->ifindex)) ||
14631             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14632                               NL80211_ATTR_PAD))
14633                 goto nla_put_failure;
14634
14635         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
14636                               NL80211_ATTR_PAD) ||
14637             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
14638                 goto nla_put_failure;
14639
14640         match_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_MATCH);
14641         if (!match_attr)
14642                 goto nla_put_failure;
14643
14644         local_func_attr = nla_nest_start_noflag(msg,
14645                                                 NL80211_NAN_MATCH_FUNC_LOCAL);
14646         if (!local_func_attr)
14647                 goto nla_put_failure;
14648
14649         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
14650                 goto nla_put_failure;
14651
14652         nla_nest_end(msg, local_func_attr);
14653
14654         peer_func_attr = nla_nest_start_noflag(msg,
14655                                                NL80211_NAN_MATCH_FUNC_PEER);
14656         if (!peer_func_attr)
14657                 goto nla_put_failure;
14658
14659         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
14660             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
14661                 goto nla_put_failure;
14662
14663         if (match->info && match->info_len &&
14664             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
14665                     match->info))
14666                 goto nla_put_failure;
14667
14668         nla_nest_end(msg, peer_func_attr);
14669         nla_nest_end(msg, match_attr);
14670         genlmsg_end(msg, hdr);
14671
14672         if (!wdev->owner_nlportid)
14673                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14674                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14675         else
14676                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14677                                 wdev->owner_nlportid);
14678
14679         return;
14680
14681 nla_put_failure:
14682         nlmsg_free(msg);
14683 }
14684 EXPORT_SYMBOL(cfg80211_nan_match);
14685
14686 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
14687                                   u8 inst_id,
14688                                   enum nl80211_nan_func_term_reason reason,
14689                                   u64 cookie, gfp_t gfp)
14690 {
14691         struct wiphy *wiphy = wdev->wiphy;
14692         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14693         struct sk_buff *msg;
14694         struct nlattr *func_attr;
14695         void *hdr;
14696
14697         if (WARN_ON(!inst_id))
14698                 return;
14699
14700         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14701         if (!msg)
14702                 return;
14703
14704         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
14705         if (!hdr) {
14706                 nlmsg_free(msg);
14707                 return;
14708         }
14709
14710         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14711             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14712                                          wdev->netdev->ifindex)) ||
14713             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14714                               NL80211_ATTR_PAD))
14715                 goto nla_put_failure;
14716
14717         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14718                               NL80211_ATTR_PAD))
14719                 goto nla_put_failure;
14720
14721         func_attr = nla_nest_start_noflag(msg, NL80211_ATTR_NAN_FUNC);
14722         if (!func_attr)
14723                 goto nla_put_failure;
14724
14725         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
14726             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
14727                 goto nla_put_failure;
14728
14729         nla_nest_end(msg, func_attr);
14730         genlmsg_end(msg, hdr);
14731
14732         if (!wdev->owner_nlportid)
14733                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
14734                                         msg, 0, NL80211_MCGRP_NAN, gfp);
14735         else
14736                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
14737                                 wdev->owner_nlportid);
14738
14739         return;
14740
14741 nla_put_failure:
14742         nlmsg_free(msg);
14743 }
14744 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
14745
14746 static int nl80211_get_protocol_features(struct sk_buff *skb,
14747                                          struct genl_info *info)
14748 {
14749         void *hdr;
14750         struct sk_buff *msg;
14751
14752         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14753         if (!msg)
14754                 return -ENOMEM;
14755
14756         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
14757                              NL80211_CMD_GET_PROTOCOL_FEATURES);
14758         if (!hdr)
14759                 goto nla_put_failure;
14760
14761         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
14762                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
14763                 goto nla_put_failure;
14764
14765         genlmsg_end(msg, hdr);
14766         return genlmsg_reply(msg, info);
14767
14768  nla_put_failure:
14769         kfree_skb(msg);
14770         return -ENOBUFS;
14771 }
14772
14773 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
14774 {
14775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14776         struct cfg80211_update_ft_ies_params ft_params;
14777         struct net_device *dev = info->user_ptr[1];
14778
14779         if (!rdev->ops->update_ft_ies)
14780                 return -EOPNOTSUPP;
14781
14782         if (!info->attrs[NL80211_ATTR_MDID] ||
14783             !info->attrs[NL80211_ATTR_IE])
14784                 return -EINVAL;
14785
14786         memset(&ft_params, 0, sizeof(ft_params));
14787         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
14788         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
14789         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
14790
14791         return rdev_update_ft_ies(rdev, dev, &ft_params);
14792 }
14793
14794 static int nl80211_crit_protocol_start(struct sk_buff *skb,
14795                                        struct genl_info *info)
14796 {
14797         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14798         struct wireless_dev *wdev = info->user_ptr[1];
14799         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
14800         u16 duration;
14801         int ret;
14802
14803         if (!rdev->ops->crit_proto_start)
14804                 return -EOPNOTSUPP;
14805
14806         if (WARN_ON(!rdev->ops->crit_proto_stop))
14807                 return -EINVAL;
14808
14809         if (rdev->crit_proto_nlportid)
14810                 return -EBUSY;
14811
14812         /* determine protocol if provided */
14813         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
14814                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
14815
14816         if (proto >= NUM_NL80211_CRIT_PROTO)
14817                 return -EINVAL;
14818
14819         /* timeout must be provided */
14820         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
14821                 return -EINVAL;
14822
14823         duration =
14824                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
14825
14826         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
14827         if (!ret)
14828                 rdev->crit_proto_nlportid = info->snd_portid;
14829
14830         return ret;
14831 }
14832
14833 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
14834                                       struct genl_info *info)
14835 {
14836         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14837         struct wireless_dev *wdev = info->user_ptr[1];
14838
14839         if (!rdev->ops->crit_proto_stop)
14840                 return -EOPNOTSUPP;
14841
14842         if (rdev->crit_proto_nlportid) {
14843                 rdev->crit_proto_nlportid = 0;
14844                 rdev_crit_proto_stop(rdev, wdev);
14845         }
14846         return 0;
14847 }
14848
14849 static int nl80211_vendor_check_policy(const struct wiphy_vendor_command *vcmd,
14850                                        struct nlattr *attr,
14851                                        struct netlink_ext_ack *extack)
14852 {
14853         if (vcmd->policy == VENDOR_CMD_RAW_DATA) {
14854                 if (attr->nla_type & NLA_F_NESTED) {
14855                         NL_SET_ERR_MSG_ATTR(extack, attr,
14856                                             "unexpected nested data");
14857                         return -EINVAL;
14858                 }
14859
14860                 return 0;
14861         }
14862
14863         if (!(attr->nla_type & NLA_F_NESTED)) {
14864                 NL_SET_ERR_MSG_ATTR(extack, attr, "expected nested data");
14865                 return -EINVAL;
14866         }
14867
14868         return nla_validate_nested(attr, vcmd->maxattr, vcmd->policy, extack);
14869 }
14870
14871 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
14872 {
14873         struct cfg80211_registered_device *rdev = info->user_ptr[0];
14874         struct wireless_dev *wdev =
14875                 __cfg80211_wdev_from_attrs(rdev, genl_info_net(info),
14876                                            info->attrs);
14877         int i, err;
14878         u32 vid, subcmd;
14879
14880         if (!rdev->wiphy.vendor_commands)
14881                 return -EOPNOTSUPP;
14882
14883         if (IS_ERR(wdev)) {
14884                 err = PTR_ERR(wdev);
14885                 if (err != -EINVAL)
14886                         return err;
14887                 wdev = NULL;
14888         } else if (wdev->wiphy != &rdev->wiphy) {
14889                 return -EINVAL;
14890         }
14891
14892         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
14893             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
14894                 return -EINVAL;
14895
14896         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
14897         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
14898         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
14899                 const struct wiphy_vendor_command *vcmd;
14900                 void *data = NULL;
14901                 int len = 0;
14902
14903                 vcmd = &rdev->wiphy.vendor_commands[i];
14904
14905                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
14906                         continue;
14907
14908                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
14909                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
14910                         if (!wdev)
14911                                 return -EINVAL;
14912                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
14913                             !wdev->netdev)
14914                                 return -EINVAL;
14915
14916                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
14917                                 if (!wdev_running(wdev))
14918                                         return -ENETDOWN;
14919                         }
14920                 } else {
14921                         wdev = NULL;
14922                 }
14923
14924                 if (!vcmd->doit)
14925                         return -EOPNOTSUPP;
14926
14927                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
14928                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14929                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
14930
14931                         err = nl80211_vendor_check_policy(vcmd,
14932                                         info->attrs[NL80211_ATTR_VENDOR_DATA],
14933                                         info->extack);
14934                         if (err)
14935                                 return err;
14936                 }
14937
14938                 rdev->cur_cmd_info = info;
14939                 err = vcmd->doit(&rdev->wiphy, wdev, data, len);
14940                 rdev->cur_cmd_info = NULL;
14941                 return err;
14942         }
14943
14944         return -EOPNOTSUPP;
14945 }
14946
14947 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
14948                                        struct netlink_callback *cb,
14949                                        struct cfg80211_registered_device **rdev,
14950                                        struct wireless_dev **wdev)
14951 {
14952         struct nlattr **attrbuf;
14953         u32 vid, subcmd;
14954         unsigned int i;
14955         int vcmd_idx = -1;
14956         int err;
14957         void *data = NULL;
14958         unsigned int data_len = 0;
14959
14960         if (cb->args[0]) {
14961                 /* subtract the 1 again here */
14962                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
14963                 struct wireless_dev *tmp;
14964
14965                 if (!wiphy)
14966                         return -ENODEV;
14967                 *rdev = wiphy_to_rdev(wiphy);
14968                 *wdev = NULL;
14969
14970                 if (cb->args[1]) {
14971                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
14972                                 if (tmp->identifier == cb->args[1] - 1) {
14973                                         *wdev = tmp;
14974                                         break;
14975                                 }
14976                         }
14977                 }
14978
14979                 /* keep rtnl locked in successful case */
14980                 return 0;
14981         }
14982
14983         attrbuf = kcalloc(NUM_NL80211_ATTR, sizeof(*attrbuf), GFP_KERNEL);
14984         if (!attrbuf)
14985                 return -ENOMEM;
14986
14987         err = nlmsg_parse_deprecated(cb->nlh,
14988                                      GENL_HDRLEN + nl80211_fam.hdrsize,
14989                                      attrbuf, nl80211_fam.maxattr,
14990                                      nl80211_policy, NULL);
14991         if (err)
14992                 goto out;
14993
14994         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
14995             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD]) {
14996                 err = -EINVAL;
14997                 goto out;
14998         }
14999
15000         *wdev = __cfg80211_wdev_from_attrs(NULL, sock_net(skb->sk), attrbuf);
15001         if (IS_ERR(*wdev))
15002                 *wdev = NULL;
15003
15004         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
15005         if (IS_ERR(*rdev)) {
15006                 err = PTR_ERR(*rdev);
15007                 goto out;
15008         }
15009
15010         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
15011         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
15012
15013         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
15014                 const struct wiphy_vendor_command *vcmd;
15015
15016                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
15017
15018                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
15019                         continue;
15020
15021                 if (!vcmd->dumpit) {
15022                         err = -EOPNOTSUPP;
15023                         goto out;
15024                 }
15025
15026                 vcmd_idx = i;
15027                 break;
15028         }
15029
15030         if (vcmd_idx < 0) {
15031                 err = -EOPNOTSUPP;
15032                 goto out;
15033         }
15034
15035         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
15036                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15037                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
15038
15039                 err = nl80211_vendor_check_policy(
15040                                 &(*rdev)->wiphy.vendor_commands[vcmd_idx],
15041                                 attrbuf[NL80211_ATTR_VENDOR_DATA],
15042                                 cb->extack);
15043                 if (err)
15044                         goto out;
15045         }
15046
15047         /* 0 is the first index - add 1 to parse only once */
15048         cb->args[0] = (*rdev)->wiphy_idx + 1;
15049         /* add 1 to know if it was NULL */
15050         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
15051         cb->args[2] = vcmd_idx;
15052         cb->args[3] = (unsigned long)data;
15053         cb->args[4] = data_len;
15054
15055         /* keep rtnl locked in successful case */
15056         err = 0;
15057 out:
15058         kfree(attrbuf);
15059         return err;
15060 }
15061
15062 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
15063                                    struct netlink_callback *cb)
15064 {
15065         struct cfg80211_registered_device *rdev;
15066         struct wireless_dev *wdev;
15067         unsigned int vcmd_idx;
15068         const struct wiphy_vendor_command *vcmd;
15069         void *data;
15070         int data_len;
15071         int err;
15072         struct nlattr *vendor_data;
15073
15074         rtnl_lock();
15075         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
15076         if (err)
15077                 goto out;
15078
15079         vcmd_idx = cb->args[2];
15080         data = (void *)cb->args[3];
15081         data_len = cb->args[4];
15082         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
15083
15084         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
15085                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
15086                 if (!wdev) {
15087                         err = -EINVAL;
15088                         goto out;
15089                 }
15090                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
15091                     !wdev->netdev) {
15092                         err = -EINVAL;
15093                         goto out;
15094                 }
15095
15096                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
15097                         if (!wdev_running(wdev)) {
15098                                 err = -ENETDOWN;
15099                                 goto out;
15100                         }
15101                 }
15102         }
15103
15104         while (1) {
15105                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
15106                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
15107                                            NL80211_CMD_VENDOR);
15108                 if (!hdr)
15109                         break;
15110
15111                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15112                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
15113                                                wdev_id(wdev),
15114                                                NL80211_ATTR_PAD))) {
15115                         genlmsg_cancel(skb, hdr);
15116                         break;
15117                 }
15118
15119                 vendor_data = nla_nest_start_noflag(skb,
15120                                                     NL80211_ATTR_VENDOR_DATA);
15121                 if (!vendor_data) {
15122                         genlmsg_cancel(skb, hdr);
15123                         break;
15124                 }
15125
15126                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
15127                                    (unsigned long *)&cb->args[5]);
15128                 nla_nest_end(skb, vendor_data);
15129
15130                 if (err == -ENOBUFS || err == -ENOENT) {
15131                         genlmsg_cancel(skb, hdr);
15132                         break;
15133                 } else if (err <= 0) {
15134                         genlmsg_cancel(skb, hdr);
15135                         goto out;
15136                 }
15137
15138                 genlmsg_end(skb, hdr);
15139         }
15140
15141         err = skb->len;
15142  out:
15143         rtnl_unlock();
15144         return err;
15145 }
15146
15147 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
15148                                            enum nl80211_commands cmd,
15149                                            enum nl80211_attrs attr,
15150                                            int approxlen)
15151 {
15152         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15153
15154         if (WARN_ON(!rdev->cur_cmd_info))
15155                 return NULL;
15156
15157         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
15158                                            rdev->cur_cmd_info->snd_portid,
15159                                            rdev->cur_cmd_info->snd_seq,
15160                                            cmd, attr, NULL, GFP_KERNEL);
15161 }
15162 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
15163
15164 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
15165 {
15166         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
15167         void *hdr = ((void **)skb->cb)[1];
15168         struct nlattr *data = ((void **)skb->cb)[2];
15169
15170         /* clear CB data for netlink core to own from now on */
15171         memset(skb->cb, 0, sizeof(skb->cb));
15172
15173         if (WARN_ON(!rdev->cur_cmd_info)) {
15174                 kfree_skb(skb);
15175                 return -EINVAL;
15176         }
15177
15178         nla_nest_end(skb, data);
15179         genlmsg_end(skb, hdr);
15180         return genlmsg_reply(skb, rdev->cur_cmd_info);
15181 }
15182 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
15183
15184 unsigned int cfg80211_vendor_cmd_get_sender(struct wiphy *wiphy)
15185 {
15186         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15187
15188         if (WARN_ON(!rdev->cur_cmd_info))
15189                 return 0;
15190
15191         return rdev->cur_cmd_info->snd_portid;
15192 }
15193 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_get_sender);
15194
15195 static int nl80211_set_qos_map(struct sk_buff *skb,
15196                                struct genl_info *info)
15197 {
15198         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15199         struct cfg80211_qos_map *qos_map = NULL;
15200         struct net_device *dev = info->user_ptr[1];
15201         u8 *pos, len, num_des, des_len, des;
15202         int ret;
15203
15204         if (!rdev->ops->set_qos_map)
15205                 return -EOPNOTSUPP;
15206
15207         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
15208                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
15209                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
15210
15211                 if (len % 2)
15212                         return -EINVAL;
15213
15214                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
15215                 if (!qos_map)
15216                         return -ENOMEM;
15217
15218                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
15219                 if (num_des) {
15220                         des_len = num_des *
15221                                 sizeof(struct cfg80211_dscp_exception);
15222                         memcpy(qos_map->dscp_exception, pos, des_len);
15223                         qos_map->num_des = num_des;
15224                         for (des = 0; des < num_des; des++) {
15225                                 if (qos_map->dscp_exception[des].up > 7) {
15226                                         kfree(qos_map);
15227                                         return -EINVAL;
15228                                 }
15229                         }
15230                         pos += des_len;
15231                 }
15232                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
15233         }
15234
15235         wdev_lock(dev->ieee80211_ptr);
15236         ret = nl80211_key_allowed(dev->ieee80211_ptr);
15237         if (!ret)
15238                 ret = rdev_set_qos_map(rdev, dev, qos_map);
15239         wdev_unlock(dev->ieee80211_ptr);
15240
15241         kfree(qos_map);
15242         return ret;
15243 }
15244
15245 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
15246 {
15247         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15248         struct net_device *dev = info->user_ptr[1];
15249         struct wireless_dev *wdev = dev->ieee80211_ptr;
15250         const u8 *peer;
15251         u8 tsid, up;
15252         u16 admitted_time = 0;
15253         int err;
15254
15255         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
15256                 return -EOPNOTSUPP;
15257
15258         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
15259             !info->attrs[NL80211_ATTR_USER_PRIO])
15260                 return -EINVAL;
15261
15262         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15263         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
15264
15265         /* WMM uses TIDs 0-7 even for TSPEC */
15266         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
15267                 /* TODO: handle 802.11 TSPEC/admission control
15268                  * need more attributes for that (e.g. BA session requirement);
15269                  * change the WMM adminssion test above to allow both then
15270                  */
15271                 return -EINVAL;
15272         }
15273
15274         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15275
15276         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
15277                 admitted_time =
15278                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
15279                 if (!admitted_time)
15280                         return -EINVAL;
15281         }
15282
15283         wdev_lock(wdev);
15284         switch (wdev->iftype) {
15285         case NL80211_IFTYPE_STATION:
15286         case NL80211_IFTYPE_P2P_CLIENT:
15287                 if (wdev->connected)
15288                         break;
15289                 err = -ENOTCONN;
15290                 goto out;
15291         default:
15292                 err = -EOPNOTSUPP;
15293                 goto out;
15294         }
15295
15296         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
15297
15298  out:
15299         wdev_unlock(wdev);
15300         return err;
15301 }
15302
15303 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
15304 {
15305         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15306         struct net_device *dev = info->user_ptr[1];
15307         struct wireless_dev *wdev = dev->ieee80211_ptr;
15308         const u8 *peer;
15309         u8 tsid;
15310         int err;
15311
15312         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
15313                 return -EINVAL;
15314
15315         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
15316         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15317
15318         wdev_lock(wdev);
15319         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
15320         wdev_unlock(wdev);
15321
15322         return err;
15323 }
15324
15325 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
15326                                        struct genl_info *info)
15327 {
15328         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15329         struct net_device *dev = info->user_ptr[1];
15330         struct wireless_dev *wdev = dev->ieee80211_ptr;
15331         struct cfg80211_chan_def chandef = {};
15332         const u8 *addr;
15333         u8 oper_class;
15334         int err;
15335
15336         if (!rdev->ops->tdls_channel_switch ||
15337             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15338                 return -EOPNOTSUPP;
15339
15340         switch (dev->ieee80211_ptr->iftype) {
15341         case NL80211_IFTYPE_STATION:
15342         case NL80211_IFTYPE_P2P_CLIENT:
15343                 break;
15344         default:
15345                 return -EOPNOTSUPP;
15346         }
15347
15348         if (!info->attrs[NL80211_ATTR_MAC] ||
15349             !info->attrs[NL80211_ATTR_OPER_CLASS])
15350                 return -EINVAL;
15351
15352         err = nl80211_parse_chandef(rdev, info, &chandef);
15353         if (err)
15354                 return err;
15355
15356         /*
15357          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
15358          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
15359          * specification is not defined for them.
15360          */
15361         if (chandef.chan->band == NL80211_BAND_2GHZ &&
15362             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
15363             chandef.width != NL80211_CHAN_WIDTH_20)
15364                 return -EINVAL;
15365
15366         /* we will be active on the TDLS link */
15367         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
15368                                            wdev->iftype))
15369                 return -EINVAL;
15370
15371         /* don't allow switching to DFS channels */
15372         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
15373                 return -EINVAL;
15374
15375         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15376         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
15377
15378         wdev_lock(wdev);
15379         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
15380         wdev_unlock(wdev);
15381
15382         return err;
15383 }
15384
15385 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
15386                                               struct genl_info *info)
15387 {
15388         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15389         struct net_device *dev = info->user_ptr[1];
15390         struct wireless_dev *wdev = dev->ieee80211_ptr;
15391         const u8 *addr;
15392
15393         if (!rdev->ops->tdls_channel_switch ||
15394             !rdev->ops->tdls_cancel_channel_switch ||
15395             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
15396                 return -EOPNOTSUPP;
15397
15398         switch (dev->ieee80211_ptr->iftype) {
15399         case NL80211_IFTYPE_STATION:
15400         case NL80211_IFTYPE_P2P_CLIENT:
15401                 break;
15402         default:
15403                 return -EOPNOTSUPP;
15404         }
15405
15406         if (!info->attrs[NL80211_ATTR_MAC])
15407                 return -EINVAL;
15408
15409         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
15410
15411         wdev_lock(wdev);
15412         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
15413         wdev_unlock(wdev);
15414
15415         return 0;
15416 }
15417
15418 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
15419                                             struct genl_info *info)
15420 {
15421         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15422         struct net_device *dev = info->user_ptr[1];
15423         struct wireless_dev *wdev = dev->ieee80211_ptr;
15424         const struct nlattr *nla;
15425         bool enabled;
15426
15427         if (!rdev->ops->set_multicast_to_unicast)
15428                 return -EOPNOTSUPP;
15429
15430         if (wdev->iftype != NL80211_IFTYPE_AP &&
15431             wdev->iftype != NL80211_IFTYPE_P2P_GO)
15432                 return -EOPNOTSUPP;
15433
15434         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
15435         enabled = nla_get_flag(nla);
15436
15437         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
15438 }
15439
15440 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
15441 {
15442         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15443         struct net_device *dev = info->user_ptr[1];
15444         struct wireless_dev *wdev = dev->ieee80211_ptr;
15445         struct cfg80211_pmk_conf pmk_conf = {};
15446         int ret;
15447
15448         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15449             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15450                 return -EOPNOTSUPP;
15451
15452         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15453                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15454                 return -EOPNOTSUPP;
15455
15456         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
15457                 return -EINVAL;
15458
15459         wdev_lock(wdev);
15460         if (!wdev->connected) {
15461                 ret = -ENOTCONN;
15462                 goto out;
15463         }
15464
15465         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15466         if (memcmp(pmk_conf.aa, wdev->u.client.connected_addr, ETH_ALEN)) {
15467                 ret = -EINVAL;
15468                 goto out;
15469         }
15470
15471         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
15472         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
15473         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
15474             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
15475                 ret = -EINVAL;
15476                 goto out;
15477         }
15478
15479         if (info->attrs[NL80211_ATTR_PMKR0_NAME])
15480                 pmk_conf.pmk_r0_name =
15481                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
15482
15483         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
15484 out:
15485         wdev_unlock(wdev);
15486         return ret;
15487 }
15488
15489 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
15490 {
15491         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15492         struct net_device *dev = info->user_ptr[1];
15493         struct wireless_dev *wdev = dev->ieee80211_ptr;
15494         const u8 *aa;
15495         int ret;
15496
15497         if (wdev->iftype != NL80211_IFTYPE_STATION &&
15498             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
15499                 return -EOPNOTSUPP;
15500
15501         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15502                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
15503                 return -EOPNOTSUPP;
15504
15505         if (!info->attrs[NL80211_ATTR_MAC])
15506                 return -EINVAL;
15507
15508         wdev_lock(wdev);
15509         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
15510         ret = rdev_del_pmk(rdev, dev, aa);
15511         wdev_unlock(wdev);
15512
15513         return ret;
15514 }
15515
15516 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
15517 {
15518         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15519         struct net_device *dev = info->user_ptr[1];
15520         struct cfg80211_external_auth_params params;
15521
15522         if (!rdev->ops->external_auth)
15523                 return -EOPNOTSUPP;
15524
15525         if (!info->attrs[NL80211_ATTR_SSID] &&
15526             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
15527             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
15528                 return -EINVAL;
15529
15530         if (!info->attrs[NL80211_ATTR_BSSID])
15531                 return -EINVAL;
15532
15533         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
15534                 return -EINVAL;
15535
15536         memset(&params, 0, sizeof(params));
15537
15538         if (info->attrs[NL80211_ATTR_SSID]) {
15539                 params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
15540                 if (params.ssid.ssid_len == 0)
15541                         return -EINVAL;
15542                 memcpy(params.ssid.ssid,
15543                        nla_data(info->attrs[NL80211_ATTR_SSID]),
15544                        params.ssid.ssid_len);
15545         }
15546
15547         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
15548                ETH_ALEN);
15549
15550         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15551
15552         if (info->attrs[NL80211_ATTR_PMKID])
15553                 params.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
15554
15555         return rdev_external_auth(rdev, dev, &params);
15556 }
15557
15558 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
15559 {
15560         bool dont_wait_for_ack = info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK];
15561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15562         struct net_device *dev = info->user_ptr[1];
15563         struct wireless_dev *wdev = dev->ieee80211_ptr;
15564         const u8 *buf;
15565         size_t len;
15566         u8 *dest;
15567         u16 proto;
15568         bool noencrypt;
15569         u64 cookie = 0;
15570         int link_id;
15571         int err;
15572
15573         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15574                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
15575                 return -EOPNOTSUPP;
15576
15577         if (!rdev->ops->tx_control_port)
15578                 return -EOPNOTSUPP;
15579
15580         if (!info->attrs[NL80211_ATTR_FRAME] ||
15581             !info->attrs[NL80211_ATTR_MAC] ||
15582             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
15583                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
15584                 return -EINVAL;
15585         }
15586
15587         wdev_lock(wdev);
15588
15589         switch (wdev->iftype) {
15590         case NL80211_IFTYPE_AP:
15591         case NL80211_IFTYPE_P2P_GO:
15592         case NL80211_IFTYPE_MESH_POINT:
15593                 break;
15594         case NL80211_IFTYPE_ADHOC:
15595                 if (wdev->u.ibss.current_bss)
15596                         break;
15597                 err = -ENOTCONN;
15598                 goto out;
15599         case NL80211_IFTYPE_STATION:
15600         case NL80211_IFTYPE_P2P_CLIENT:
15601                 if (wdev->connected)
15602                         break;
15603                 err = -ENOTCONN;
15604                 goto out;
15605         default:
15606                 err = -EOPNOTSUPP;
15607                 goto out;
15608         }
15609
15610         wdev_unlock(wdev);
15611
15612         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15613         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15614         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15615         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
15616         noencrypt =
15617                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
15618
15619         link_id = nl80211_link_id_or_invalid(info->attrs);
15620
15621         err = rdev_tx_control_port(rdev, dev, buf, len,
15622                                    dest, cpu_to_be16(proto), noencrypt, link_id,
15623                                    dont_wait_for_ack ? NULL : &cookie);
15624         if (!err && !dont_wait_for_ack)
15625                 nl_set_extack_cookie_u64(info->extack, cookie);
15626         return err;
15627  out:
15628         wdev_unlock(wdev);
15629         return err;
15630 }
15631
15632 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
15633                                            struct genl_info *info)
15634 {
15635         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15636         struct net_device *dev = info->user_ptr[1];
15637         struct wireless_dev *wdev = dev->ieee80211_ptr;
15638         struct cfg80211_ftm_responder_stats ftm_stats = {};
15639         unsigned int link_id = nl80211_link_id(info->attrs);
15640         struct sk_buff *msg;
15641         void *hdr;
15642         struct nlattr *ftm_stats_attr;
15643         int err;
15644
15645         if (wdev->iftype != NL80211_IFTYPE_AP ||
15646             !wdev->links[link_id].ap.beacon_interval)
15647                 return -EOPNOTSUPP;
15648
15649         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
15650         if (err)
15651                 return err;
15652
15653         if (!ftm_stats.filled)
15654                 return -ENODATA;
15655
15656         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
15657         if (!msg)
15658                 return -ENOMEM;
15659
15660         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
15661                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
15662         if (!hdr)
15663                 goto nla_put_failure;
15664
15665         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15666                 goto nla_put_failure;
15667
15668         ftm_stats_attr = nla_nest_start_noflag(msg,
15669                                                NL80211_ATTR_FTM_RESPONDER_STATS);
15670         if (!ftm_stats_attr)
15671                 goto nla_put_failure;
15672
15673 #define SET_FTM(field, name, type)                                       \
15674         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15675             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
15676                              ftm_stats.field))                           \
15677                 goto nla_put_failure; } while (0)
15678 #define SET_FTM_U64(field, name)                                         \
15679         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
15680             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
15681                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
15682                 goto nla_put_failure; } while (0)
15683
15684         SET_FTM(success_num, SUCCESS_NUM, u32);
15685         SET_FTM(partial_num, PARTIAL_NUM, u32);
15686         SET_FTM(failed_num, FAILED_NUM, u32);
15687         SET_FTM(asap_num, ASAP_NUM, u32);
15688         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
15689         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
15690         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
15691         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
15692         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
15693 #undef SET_FTM
15694
15695         nla_nest_end(msg, ftm_stats_attr);
15696
15697         genlmsg_end(msg, hdr);
15698         return genlmsg_reply(msg, info);
15699
15700 nla_put_failure:
15701         nlmsg_free(msg);
15702         return -ENOBUFS;
15703 }
15704
15705 static int nl80211_update_owe_info(struct sk_buff *skb, struct genl_info *info)
15706 {
15707         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15708         struct cfg80211_update_owe_info owe_info;
15709         struct net_device *dev = info->user_ptr[1];
15710
15711         if (!rdev->ops->update_owe_info)
15712                 return -EOPNOTSUPP;
15713
15714         if (!info->attrs[NL80211_ATTR_STATUS_CODE] ||
15715             !info->attrs[NL80211_ATTR_MAC])
15716                 return -EINVAL;
15717
15718         memset(&owe_info, 0, sizeof(owe_info));
15719         owe_info.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
15720         nla_memcpy(owe_info.peer, info->attrs[NL80211_ATTR_MAC], ETH_ALEN);
15721
15722         if (info->attrs[NL80211_ATTR_IE]) {
15723                 owe_info.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
15724                 owe_info.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
15725         }
15726
15727         return rdev_update_owe_info(rdev, dev, &owe_info);
15728 }
15729
15730 static int nl80211_probe_mesh_link(struct sk_buff *skb, struct genl_info *info)
15731 {
15732         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15733         struct net_device *dev = info->user_ptr[1];
15734         struct wireless_dev *wdev = dev->ieee80211_ptr;
15735         struct station_info sinfo = {};
15736         const u8 *buf;
15737         size_t len;
15738         u8 *dest;
15739         int err;
15740
15741         if (!rdev->ops->probe_mesh_link || !rdev->ops->get_station)
15742                 return -EOPNOTSUPP;
15743
15744         if (!info->attrs[NL80211_ATTR_MAC] ||
15745             !info->attrs[NL80211_ATTR_FRAME]) {
15746                 GENL_SET_ERR_MSG(info, "Frame or MAC missing");
15747                 return -EINVAL;
15748         }
15749
15750         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
15751                 return -EOPNOTSUPP;
15752
15753         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
15754         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
15755         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
15756
15757         if (len < sizeof(struct ethhdr))
15758                 return -EINVAL;
15759
15760         if (!ether_addr_equal(buf, dest) || is_multicast_ether_addr(buf) ||
15761             !ether_addr_equal(buf + ETH_ALEN, dev->dev_addr))
15762                 return -EINVAL;
15763
15764         err = rdev_get_station(rdev, dev, dest, &sinfo);
15765         if (err)
15766                 return err;
15767
15768         cfg80211_sinfo_release_content(&sinfo);
15769
15770         return rdev_probe_mesh_link(rdev, dev, dest, buf, len);
15771 }
15772
15773 static int parse_tid_conf(struct cfg80211_registered_device *rdev,
15774                           struct nlattr *attrs[], struct net_device *dev,
15775                           struct cfg80211_tid_cfg *tid_conf,
15776                           struct genl_info *info, const u8 *peer,
15777                           unsigned int link_id)
15778 {
15779         struct netlink_ext_ack *extack = info->extack;
15780         u64 mask;
15781         int err;
15782
15783         if (!attrs[NL80211_TID_CONFIG_ATTR_TIDS])
15784                 return -EINVAL;
15785
15786         tid_conf->config_override =
15787                         nla_get_flag(attrs[NL80211_TID_CONFIG_ATTR_OVERRIDE]);
15788         tid_conf->tids = nla_get_u16(attrs[NL80211_TID_CONFIG_ATTR_TIDS]);
15789
15790         if (tid_conf->config_override) {
15791                 if (rdev->ops->reset_tid_config) {
15792                         err = rdev_reset_tid_config(rdev, dev, peer,
15793                                                     tid_conf->tids);
15794                         if (err)
15795                                 return err;
15796                 } else {
15797                         return -EINVAL;
15798                 }
15799         }
15800
15801         if (attrs[NL80211_TID_CONFIG_ATTR_NOACK]) {
15802                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_NOACK);
15803                 tid_conf->noack =
15804                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_NOACK]);
15805         }
15806
15807         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]) {
15808                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_SHORT);
15809                 tid_conf->retry_short =
15810                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_SHORT]);
15811
15812                 if (tid_conf->retry_short > rdev->wiphy.max_data_retry_count)
15813                         return -EINVAL;
15814         }
15815
15816         if (attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]) {
15817                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RETRY_LONG);
15818                 tid_conf->retry_long =
15819                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RETRY_LONG]);
15820
15821                 if (tid_conf->retry_long > rdev->wiphy.max_data_retry_count)
15822                         return -EINVAL;
15823         }
15824
15825         if (attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]) {
15826                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMPDU_CTRL);
15827                 tid_conf->ampdu =
15828                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMPDU_CTRL]);
15829         }
15830
15831         if (attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]) {
15832                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL);
15833                 tid_conf->rtscts =
15834                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_RTSCTS_CTRL]);
15835         }
15836
15837         if (attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]) {
15838                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_AMSDU_CTRL);
15839                 tid_conf->amsdu =
15840                         nla_get_u8(attrs[NL80211_TID_CONFIG_ATTR_AMSDU_CTRL]);
15841         }
15842
15843         if (attrs[NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE]) {
15844                 u32 idx = NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE, attr;
15845
15846                 tid_conf->txrate_type = nla_get_u8(attrs[idx]);
15847
15848                 if (tid_conf->txrate_type != NL80211_TX_RATE_AUTOMATIC) {
15849                         attr = NL80211_TID_CONFIG_ATTR_TX_RATE;
15850                         err = nl80211_parse_tx_bitrate_mask(info, attrs, attr,
15851                                                     &tid_conf->txrate_mask, dev,
15852                                                     true, link_id);
15853                         if (err)
15854                                 return err;
15855
15856                         tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE);
15857                 }
15858                 tid_conf->mask |= BIT(NL80211_TID_CONFIG_ATTR_TX_RATE_TYPE);
15859         }
15860
15861         if (peer)
15862                 mask = rdev->wiphy.tid_config_support.peer;
15863         else
15864                 mask = rdev->wiphy.tid_config_support.vif;
15865
15866         if (tid_conf->mask & ~mask) {
15867                 NL_SET_ERR_MSG(extack, "unsupported TID configuration");
15868                 return -ENOTSUPP;
15869         }
15870
15871         return 0;
15872 }
15873
15874 static int nl80211_set_tid_config(struct sk_buff *skb,
15875                                   struct genl_info *info)
15876 {
15877         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15878         struct nlattr *attrs[NL80211_TID_CONFIG_ATTR_MAX + 1];
15879         unsigned int link_id = nl80211_link_id(info->attrs);
15880         struct net_device *dev = info->user_ptr[1];
15881         struct cfg80211_tid_config *tid_config;
15882         struct nlattr *tid;
15883         int conf_idx = 0, rem_conf;
15884         int ret = -EINVAL;
15885         u32 num_conf = 0;
15886
15887         if (!info->attrs[NL80211_ATTR_TID_CONFIG])
15888                 return -EINVAL;
15889
15890         if (!rdev->ops->set_tid_config)
15891                 return -EOPNOTSUPP;
15892
15893         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15894                             rem_conf)
15895                 num_conf++;
15896
15897         tid_config = kzalloc(struct_size(tid_config, tid_conf, num_conf),
15898                              GFP_KERNEL);
15899         if (!tid_config)
15900                 return -ENOMEM;
15901
15902         tid_config->n_tid_conf = num_conf;
15903
15904         if (info->attrs[NL80211_ATTR_MAC])
15905                 tid_config->peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
15906
15907         wdev_lock(dev->ieee80211_ptr);
15908
15909         nla_for_each_nested(tid, info->attrs[NL80211_ATTR_TID_CONFIG],
15910                             rem_conf) {
15911                 ret = nla_parse_nested(attrs, NL80211_TID_CONFIG_ATTR_MAX,
15912                                        tid, NULL, NULL);
15913
15914                 if (ret)
15915                         goto bad_tid_conf;
15916
15917                 ret = parse_tid_conf(rdev, attrs, dev,
15918                                      &tid_config->tid_conf[conf_idx],
15919                                      info, tid_config->peer, link_id);
15920                 if (ret)
15921                         goto bad_tid_conf;
15922
15923                 conf_idx++;
15924         }
15925
15926         ret = rdev_set_tid_config(rdev, dev, tid_config);
15927
15928 bad_tid_conf:
15929         kfree(tid_config);
15930         wdev_unlock(dev->ieee80211_ptr);
15931         return ret;
15932 }
15933
15934 static int nl80211_color_change(struct sk_buff *skb, struct genl_info *info)
15935 {
15936         struct cfg80211_registered_device *rdev = info->user_ptr[0];
15937         struct cfg80211_color_change_settings params = {};
15938         struct net_device *dev = info->user_ptr[1];
15939         struct wireless_dev *wdev = dev->ieee80211_ptr;
15940         struct nlattr **tb;
15941         u16 offset;
15942         int err;
15943
15944         if (!rdev->ops->color_change)
15945                 return -EOPNOTSUPP;
15946
15947         if (!wiphy_ext_feature_isset(&rdev->wiphy,
15948                                      NL80211_EXT_FEATURE_BSS_COLOR))
15949                 return -EOPNOTSUPP;
15950
15951         if (wdev->iftype != NL80211_IFTYPE_AP)
15952                 return -EOPNOTSUPP;
15953
15954         if (!info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT] ||
15955             !info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR] ||
15956             !info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS])
15957                 return -EINVAL;
15958
15959         params.count = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COUNT]);
15960         params.color = nla_get_u8(info->attrs[NL80211_ATTR_COLOR_CHANGE_COLOR]);
15961
15962         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_next,
15963                                    info->extack);
15964         if (err)
15965                 return err;
15966
15967         tb = kcalloc(NL80211_ATTR_MAX + 1, sizeof(*tb), GFP_KERNEL);
15968         if (!tb)
15969                 return -ENOMEM;
15970
15971         err = nla_parse_nested(tb, NL80211_ATTR_MAX,
15972                                info->attrs[NL80211_ATTR_COLOR_CHANGE_ELEMS],
15973                                nl80211_policy, info->extack);
15974         if (err)
15975                 goto out;
15976
15977         err = nl80211_parse_beacon(rdev, tb, &params.beacon_color_change,
15978                                    info->extack);
15979         if (err)
15980                 goto out;
15981
15982         if (!tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) {
15983                 err = -EINVAL;
15984                 goto out;
15985         }
15986
15987         if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]) != sizeof(u16)) {
15988                 err = -EINVAL;
15989                 goto out;
15990         }
15991
15992         offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_BEACON]);
15993         if (offset >= params.beacon_color_change.tail_len) {
15994                 err = -EINVAL;
15995                 goto out;
15996         }
15997
15998         if (params.beacon_color_change.tail[offset] != params.count) {
15999                 err = -EINVAL;
16000                 goto out;
16001         }
16002
16003         params.counter_offset_beacon = offset;
16004
16005         if (tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) {
16006                 if (nla_len(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]) !=
16007                     sizeof(u16)) {
16008                         err = -EINVAL;
16009                         goto out;
16010                 }
16011
16012                 offset = nla_get_u16(tb[NL80211_ATTR_CNTDWN_OFFS_PRESP]);
16013                 if (offset >= params.beacon_color_change.probe_resp_len) {
16014                         err = -EINVAL;
16015                         goto out;
16016                 }
16017
16018                 if (params.beacon_color_change.probe_resp[offset] !=
16019                     params.count) {
16020                         err = -EINVAL;
16021                         goto out;
16022                 }
16023
16024                 params.counter_offset_presp = offset;
16025         }
16026
16027         wdev_lock(wdev);
16028         err = rdev_color_change(rdev, dev, &params);
16029         wdev_unlock(wdev);
16030
16031 out:
16032         kfree(params.beacon_next.mbssid_ies);
16033         kfree(params.beacon_color_change.mbssid_ies);
16034         kfree(params.beacon_next.rnr_ies);
16035         kfree(params.beacon_color_change.rnr_ies);
16036         kfree(tb);
16037         return err;
16038 }
16039
16040 static int nl80211_set_fils_aad(struct sk_buff *skb,
16041                                 struct genl_info *info)
16042 {
16043         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16044         struct net_device *dev = info->user_ptr[1];
16045         struct cfg80211_fils_aad fils_aad = {};
16046         u8 *nonces;
16047
16048         if (!info->attrs[NL80211_ATTR_MAC] ||
16049             !info->attrs[NL80211_ATTR_FILS_KEK] ||
16050             !info->attrs[NL80211_ATTR_FILS_NONCES])
16051                 return -EINVAL;
16052
16053         fils_aad.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16054         fils_aad.kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
16055         fils_aad.kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
16056         nonces = nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
16057         fils_aad.snonce = nonces;
16058         fils_aad.anonce = nonces + FILS_NONCE_LEN;
16059
16060         return rdev_set_fils_aad(rdev, dev, &fils_aad);
16061 }
16062
16063 static int nl80211_add_link(struct sk_buff *skb, struct genl_info *info)
16064 {
16065         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16066         unsigned int link_id = nl80211_link_id(info->attrs);
16067         struct net_device *dev = info->user_ptr[1];
16068         struct wireless_dev *wdev = dev->ieee80211_ptr;
16069         int ret;
16070
16071         if (!(wdev->wiphy->flags & WIPHY_FLAG_SUPPORTS_MLO))
16072                 return -EINVAL;
16073
16074         switch (wdev->iftype) {
16075         case NL80211_IFTYPE_AP:
16076                 break;
16077         default:
16078                 return -EINVAL;
16079         }
16080
16081         if (!info->attrs[NL80211_ATTR_MAC] ||
16082             !is_valid_ether_addr(nla_data(info->attrs[NL80211_ATTR_MAC])))
16083                 return -EINVAL;
16084
16085         wdev_lock(wdev);
16086         wdev->valid_links |= BIT(link_id);
16087         ether_addr_copy(wdev->links[link_id].addr,
16088                         nla_data(info->attrs[NL80211_ATTR_MAC]));
16089
16090         ret = rdev_add_intf_link(rdev, wdev, link_id);
16091         if (ret) {
16092                 wdev->valid_links &= ~BIT(link_id);
16093                 eth_zero_addr(wdev->links[link_id].addr);
16094         }
16095         wdev_unlock(wdev);
16096
16097         return ret;
16098 }
16099
16100 static int nl80211_remove_link(struct sk_buff *skb, struct genl_info *info)
16101 {
16102         unsigned int link_id = nl80211_link_id(info->attrs);
16103         struct net_device *dev = info->user_ptr[1];
16104         struct wireless_dev *wdev = dev->ieee80211_ptr;
16105
16106         /* cannot remove if there's no link */
16107         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16108                 return -EINVAL;
16109
16110         switch (wdev->iftype) {
16111         case NL80211_IFTYPE_AP:
16112                 break;
16113         default:
16114                 return -EINVAL;
16115         }
16116
16117         wdev_lock(wdev);
16118         cfg80211_remove_link(wdev, link_id);
16119         wdev_unlock(wdev);
16120
16121         return 0;
16122 }
16123
16124 static int
16125 nl80211_add_mod_link_station(struct sk_buff *skb, struct genl_info *info,
16126                              bool add)
16127 {
16128         struct link_station_parameters params = {};
16129         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16130         struct net_device *dev = info->user_ptr[1];
16131         int err;
16132
16133         if ((add && !rdev->ops->add_link_station) ||
16134             (!add && !rdev->ops->mod_link_station))
16135                 return -EOPNOTSUPP;
16136
16137         if (add && !info->attrs[NL80211_ATTR_MAC])
16138                 return -EINVAL;
16139
16140         if (!info->attrs[NL80211_ATTR_MLD_ADDR])
16141                 return -EINVAL;
16142
16143         if (add && !info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
16144                 return -EINVAL;
16145
16146         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16147
16148         if (info->attrs[NL80211_ATTR_MAC]) {
16149                 params.link_mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
16150                 if (!is_valid_ether_addr(params.link_mac))
16151                         return -EINVAL;
16152         }
16153
16154         if (!info->attrs[NL80211_ATTR_MLO_LINK_ID])
16155                 return -EINVAL;
16156
16157         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16158
16159         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
16160                 params.supported_rates =
16161                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16162                 params.supported_rates_len =
16163                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
16164         }
16165
16166         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
16167                 params.ht_capa =
16168                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
16169
16170         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
16171                 params.vht_capa =
16172                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
16173
16174         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
16175                 params.he_capa =
16176                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16177                 params.he_capa_len =
16178                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
16179
16180                 if (info->attrs[NL80211_ATTR_EHT_CAPABILITY]) {
16181                         params.eht_capa =
16182                                 nla_data(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16183                         params.eht_capa_len =
16184                                 nla_len(info->attrs[NL80211_ATTR_EHT_CAPABILITY]);
16185
16186                         if (!ieee80211_eht_capa_size_ok((const u8 *)params.he_capa,
16187                                                         (const u8 *)params.eht_capa,
16188                                                         params.eht_capa_len,
16189                                                         false))
16190                                 return -EINVAL;
16191                 }
16192         }
16193
16194         if (info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY])
16195                 params.he_6ghz_capa =
16196                         nla_data(info->attrs[NL80211_ATTR_HE_6GHZ_CAPABILITY]);
16197
16198         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
16199                 params.opmode_notif_used = true;
16200                 params.opmode_notif =
16201                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
16202         }
16203
16204         err = nl80211_parse_sta_txpower_setting(info, &params.txpwr,
16205                                                 &params.txpwr_set);
16206         if (err)
16207                 return err;
16208
16209         wdev_lock(dev->ieee80211_ptr);
16210         if (add)
16211                 err = rdev_add_link_station(rdev, dev, &params);
16212         else
16213                 err = rdev_mod_link_station(rdev, dev, &params);
16214         wdev_unlock(dev->ieee80211_ptr);
16215
16216         return err;
16217 }
16218
16219 static int
16220 nl80211_add_link_station(struct sk_buff *skb, struct genl_info *info)
16221 {
16222         return nl80211_add_mod_link_station(skb, info, true);
16223 }
16224
16225 static int
16226 nl80211_modify_link_station(struct sk_buff *skb, struct genl_info *info)
16227 {
16228         return nl80211_add_mod_link_station(skb, info, false);
16229 }
16230
16231 static int
16232 nl80211_remove_link_station(struct sk_buff *skb, struct genl_info *info)
16233 {
16234         struct link_station_del_parameters params = {};
16235         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16236         struct net_device *dev = info->user_ptr[1];
16237         int ret;
16238
16239         if (!rdev->ops->del_link_station)
16240                 return -EOPNOTSUPP;
16241
16242         if (!info->attrs[NL80211_ATTR_MLD_ADDR] ||
16243             !info->attrs[NL80211_ATTR_MLO_LINK_ID])
16244                 return -EINVAL;
16245
16246         params.mld_mac = nla_data(info->attrs[NL80211_ATTR_MLD_ADDR]);
16247         params.link_id = nla_get_u8(info->attrs[NL80211_ATTR_MLO_LINK_ID]);
16248
16249         wdev_lock(dev->ieee80211_ptr);
16250         ret = rdev_del_link_station(rdev, dev, &params);
16251         wdev_unlock(dev->ieee80211_ptr);
16252
16253         return ret;
16254 }
16255
16256 static int nl80211_set_hw_timestamp(struct sk_buff *skb,
16257                                     struct genl_info *info)
16258 {
16259         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16260         struct net_device *dev = info->user_ptr[1];
16261         struct cfg80211_set_hw_timestamp hwts = {};
16262
16263         if (!rdev->wiphy.hw_timestamp_max_peers)
16264                 return -EOPNOTSUPP;
16265
16266         if (!info->attrs[NL80211_ATTR_MAC] &&
16267             rdev->wiphy.hw_timestamp_max_peers != CFG80211_HW_TIMESTAMP_ALL_PEERS)
16268                 return -EOPNOTSUPP;
16269
16270         if (info->attrs[NL80211_ATTR_MAC])
16271                 hwts.macaddr = nla_data(info->attrs[NL80211_ATTR_MAC]);
16272
16273         hwts.enable =
16274                 nla_get_flag(info->attrs[NL80211_ATTR_HW_TIMESTAMP_ENABLED]);
16275
16276         return rdev_set_hw_timestamp(rdev, dev, &hwts);
16277 }
16278
16279 #define NL80211_FLAG_NEED_WIPHY         0x01
16280 #define NL80211_FLAG_NEED_NETDEV        0x02
16281 #define NL80211_FLAG_NEED_RTNL          0x04
16282 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
16283 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
16284                                          NL80211_FLAG_CHECK_NETDEV_UP)
16285 #define NL80211_FLAG_NEED_WDEV          0x10
16286 /* If a netdev is associated, it must be UP, P2P must be started */
16287 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
16288                                          NL80211_FLAG_CHECK_NETDEV_UP)
16289 #define NL80211_FLAG_CLEAR_SKB          0x20
16290 #define NL80211_FLAG_NO_WIPHY_MTX       0x40
16291 #define NL80211_FLAG_MLO_VALID_LINK_ID  0x80
16292 #define NL80211_FLAG_MLO_UNSUPPORTED    0x100
16293
16294 #define INTERNAL_FLAG_SELECTORS(__sel)                  \
16295         SELECTOR(__sel, NONE, 0) /* must be first */    \
16296         SELECTOR(__sel, WIPHY,                          \
16297                  NL80211_FLAG_NEED_WIPHY)               \
16298         SELECTOR(__sel, WDEV,                           \
16299                  NL80211_FLAG_NEED_WDEV)                \
16300         SELECTOR(__sel, NETDEV,                         \
16301                  NL80211_FLAG_NEED_NETDEV)              \
16302         SELECTOR(__sel, NETDEV_LINK,                    \
16303                  NL80211_FLAG_NEED_NETDEV |             \
16304                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16305         SELECTOR(__sel, NETDEV_NO_MLO,                  \
16306                  NL80211_FLAG_NEED_NETDEV |             \
16307                  NL80211_FLAG_MLO_UNSUPPORTED)  \
16308         SELECTOR(__sel, WIPHY_RTNL,                     \
16309                  NL80211_FLAG_NEED_WIPHY |              \
16310                  NL80211_FLAG_NEED_RTNL)                \
16311         SELECTOR(__sel, WIPHY_RTNL_NOMTX,               \
16312                  NL80211_FLAG_NEED_WIPHY |              \
16313                  NL80211_FLAG_NEED_RTNL |               \
16314                  NL80211_FLAG_NO_WIPHY_MTX)             \
16315         SELECTOR(__sel, WDEV_RTNL,                      \
16316                  NL80211_FLAG_NEED_WDEV |               \
16317                  NL80211_FLAG_NEED_RTNL)                \
16318         SELECTOR(__sel, NETDEV_RTNL,                    \
16319                  NL80211_FLAG_NEED_NETDEV |             \
16320                  NL80211_FLAG_NEED_RTNL)                \
16321         SELECTOR(__sel, NETDEV_UP,                      \
16322                  NL80211_FLAG_NEED_NETDEV_UP)           \
16323         SELECTOR(__sel, NETDEV_UP_LINK,                 \
16324                  NL80211_FLAG_NEED_NETDEV_UP |          \
16325                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16326         SELECTOR(__sel, NETDEV_UP_NO_MLO,               \
16327                  NL80211_FLAG_NEED_NETDEV_UP |          \
16328                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16329         SELECTOR(__sel, NETDEV_UP_NO_MLO_CLEAR,         \
16330                  NL80211_FLAG_NEED_NETDEV_UP |          \
16331                  NL80211_FLAG_CLEAR_SKB |               \
16332                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16333         SELECTOR(__sel, NETDEV_UP_NOTMX,                \
16334                  NL80211_FLAG_NEED_NETDEV_UP |          \
16335                  NL80211_FLAG_NO_WIPHY_MTX)             \
16336         SELECTOR(__sel, NETDEV_UP_NOTMX_NOMLO,          \
16337                  NL80211_FLAG_NEED_NETDEV_UP |          \
16338                  NL80211_FLAG_NO_WIPHY_MTX |            \
16339                  NL80211_FLAG_MLO_UNSUPPORTED)          \
16340         SELECTOR(__sel, NETDEV_UP_CLEAR,                \
16341                  NL80211_FLAG_NEED_NETDEV_UP |          \
16342                  NL80211_FLAG_CLEAR_SKB)                \
16343         SELECTOR(__sel, WDEV_UP,                        \
16344                  NL80211_FLAG_NEED_WDEV_UP)             \
16345         SELECTOR(__sel, WDEV_UP_LINK,                   \
16346                  NL80211_FLAG_NEED_WDEV_UP |            \
16347                  NL80211_FLAG_MLO_VALID_LINK_ID)        \
16348         SELECTOR(__sel, WDEV_UP_RTNL,                   \
16349                  NL80211_FLAG_NEED_WDEV_UP |            \
16350                  NL80211_FLAG_NEED_RTNL)                \
16351         SELECTOR(__sel, WIPHY_CLEAR,                    \
16352                  NL80211_FLAG_NEED_WIPHY |              \
16353                  NL80211_FLAG_CLEAR_SKB)
16354
16355 enum nl80211_internal_flags_selector {
16356 #define SELECTOR(_, name, value)        NL80211_IFL_SEL_##name,
16357         INTERNAL_FLAG_SELECTORS(_)
16358 #undef SELECTOR
16359 };
16360
16361 static u32 nl80211_internal_flags[] = {
16362 #define SELECTOR(_, name, value)        [NL80211_IFL_SEL_##name] = value,
16363         INTERNAL_FLAG_SELECTORS(_)
16364 #undef SELECTOR
16365 };
16366
16367 static int nl80211_pre_doit(const struct genl_split_ops *ops,
16368                             struct sk_buff *skb,
16369                             struct genl_info *info)
16370 {
16371         struct cfg80211_registered_device *rdev = NULL;
16372         struct wireless_dev *wdev = NULL;
16373         struct net_device *dev = NULL;
16374         u32 internal_flags;
16375         int err;
16376
16377         if (WARN_ON(ops->internal_flags >= ARRAY_SIZE(nl80211_internal_flags)))
16378                 return -EINVAL;
16379
16380         internal_flags = nl80211_internal_flags[ops->internal_flags];
16381
16382         rtnl_lock();
16383         if (internal_flags & NL80211_FLAG_NEED_WIPHY) {
16384                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
16385                 if (IS_ERR(rdev)) {
16386                         err = PTR_ERR(rdev);
16387                         goto out_unlock;
16388                 }
16389                 info->user_ptr[0] = rdev;
16390         } else if (internal_flags & NL80211_FLAG_NEED_NETDEV ||
16391                    internal_flags & NL80211_FLAG_NEED_WDEV) {
16392                 wdev = __cfg80211_wdev_from_attrs(NULL, genl_info_net(info),
16393                                                   info->attrs);
16394                 if (IS_ERR(wdev)) {
16395                         err = PTR_ERR(wdev);
16396                         goto out_unlock;
16397                 }
16398
16399                 dev = wdev->netdev;
16400                 dev_hold(dev);
16401                 rdev = wiphy_to_rdev(wdev->wiphy);
16402
16403                 if (internal_flags & NL80211_FLAG_NEED_NETDEV) {
16404                         if (!dev) {
16405                                 err = -EINVAL;
16406                                 goto out_unlock;
16407                         }
16408
16409                         info->user_ptr[1] = dev;
16410                 } else {
16411                         info->user_ptr[1] = wdev;
16412                 }
16413
16414                 if (internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
16415                     !wdev_running(wdev)) {
16416                         err = -ENETDOWN;
16417                         goto out_unlock;
16418                 }
16419
16420                 info->user_ptr[0] = rdev;
16421         }
16422
16423         if (internal_flags & NL80211_FLAG_MLO_VALID_LINK_ID) {
16424                 struct nlattr *link_id = info->attrs[NL80211_ATTR_MLO_LINK_ID];
16425
16426                 if (!wdev) {
16427                         err = -EINVAL;
16428                         goto out_unlock;
16429                 }
16430
16431                 /* MLO -> require valid link ID */
16432                 if (wdev->valid_links &&
16433                     (!link_id ||
16434                      !(wdev->valid_links & BIT(nla_get_u8(link_id))))) {
16435                         err = -EINVAL;
16436                         goto out_unlock;
16437                 }
16438
16439                 /* non-MLO -> no link ID attribute accepted */
16440                 if (!wdev->valid_links && link_id) {
16441                         err = -EINVAL;
16442                         goto out_unlock;
16443                 }
16444         }
16445
16446         if (internal_flags & NL80211_FLAG_MLO_UNSUPPORTED) {
16447                 if (info->attrs[NL80211_ATTR_MLO_LINK_ID] ||
16448                     (wdev && wdev->valid_links)) {
16449                         err = -EINVAL;
16450                         goto out_unlock;
16451                 }
16452         }
16453
16454         if (rdev && !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16455                 wiphy_lock(&rdev->wiphy);
16456                 /* we keep the mutex locked until post_doit */
16457                 __release(&rdev->wiphy.mtx);
16458         }
16459         if (!(internal_flags & NL80211_FLAG_NEED_RTNL))
16460                 rtnl_unlock();
16461
16462         return 0;
16463 out_unlock:
16464         rtnl_unlock();
16465         dev_put(dev);
16466         return err;
16467 }
16468
16469 static void nl80211_post_doit(const struct genl_split_ops *ops,
16470                               struct sk_buff *skb,
16471                               struct genl_info *info)
16472 {
16473         u32 internal_flags = nl80211_internal_flags[ops->internal_flags];
16474
16475         if (info->user_ptr[1]) {
16476                 if (internal_flags & NL80211_FLAG_NEED_WDEV) {
16477                         struct wireless_dev *wdev = info->user_ptr[1];
16478
16479                         dev_put(wdev->netdev);
16480                 } else {
16481                         dev_put(info->user_ptr[1]);
16482                 }
16483         }
16484
16485         if (info->user_ptr[0] &&
16486             !(internal_flags & NL80211_FLAG_NO_WIPHY_MTX)) {
16487                 struct cfg80211_registered_device *rdev = info->user_ptr[0];
16488
16489                 /* we kept the mutex locked since pre_doit */
16490                 __acquire(&rdev->wiphy.mtx);
16491                 wiphy_unlock(&rdev->wiphy);
16492         }
16493
16494         if (internal_flags & NL80211_FLAG_NEED_RTNL)
16495                 rtnl_unlock();
16496
16497         /* If needed, clear the netlink message payload from the SKB
16498          * as it might contain key data that shouldn't stick around on
16499          * the heap after the SKB is freed. The netlink message header
16500          * is still needed for further processing, so leave it intact.
16501          */
16502         if (internal_flags & NL80211_FLAG_CLEAR_SKB) {
16503                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
16504
16505                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
16506         }
16507 }
16508
16509 static int nl80211_set_sar_sub_specs(struct cfg80211_registered_device *rdev,
16510                                      struct cfg80211_sar_specs *sar_specs,
16511                                      struct nlattr *spec[], int index)
16512 {
16513         u32 range_index, i;
16514
16515         if (!sar_specs || !spec)
16516                 return -EINVAL;
16517
16518         if (!spec[NL80211_SAR_ATTR_SPECS_POWER] ||
16519             !spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX])
16520                 return -EINVAL;
16521
16522         range_index = nla_get_u32(spec[NL80211_SAR_ATTR_SPECS_RANGE_INDEX]);
16523
16524         /* check if range_index exceeds num_freq_ranges */
16525         if (range_index >= rdev->wiphy.sar_capa->num_freq_ranges)
16526                 return -EINVAL;
16527
16528         /* check if range_index duplicates */
16529         for (i = 0; i < index; i++) {
16530                 if (sar_specs->sub_specs[i].freq_range_index == range_index)
16531                         return -EINVAL;
16532         }
16533
16534         sar_specs->sub_specs[index].power =
16535                 nla_get_s32(spec[NL80211_SAR_ATTR_SPECS_POWER]);
16536
16537         sar_specs->sub_specs[index].freq_range_index = range_index;
16538
16539         return 0;
16540 }
16541
16542 static int nl80211_set_sar_specs(struct sk_buff *skb, struct genl_info *info)
16543 {
16544         struct cfg80211_registered_device *rdev = info->user_ptr[0];
16545         struct nlattr *spec[NL80211_SAR_ATTR_SPECS_MAX + 1];
16546         struct nlattr *tb[NL80211_SAR_ATTR_MAX + 1];
16547         struct cfg80211_sar_specs *sar_spec;
16548         enum nl80211_sar_type type;
16549         struct nlattr *spec_list;
16550         u32 specs;
16551         int rem, err;
16552
16553         if (!rdev->wiphy.sar_capa || !rdev->ops->set_sar_specs)
16554                 return -EOPNOTSUPP;
16555
16556         if (!info->attrs[NL80211_ATTR_SAR_SPEC])
16557                 return -EINVAL;
16558
16559         nla_parse_nested(tb, NL80211_SAR_ATTR_MAX,
16560                          info->attrs[NL80211_ATTR_SAR_SPEC],
16561                          NULL, NULL);
16562
16563         if (!tb[NL80211_SAR_ATTR_TYPE] || !tb[NL80211_SAR_ATTR_SPECS])
16564                 return -EINVAL;
16565
16566         type = nla_get_u32(tb[NL80211_SAR_ATTR_TYPE]);
16567         if (type != rdev->wiphy.sar_capa->type)
16568                 return -EINVAL;
16569
16570         specs = 0;
16571         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem)
16572                 specs++;
16573
16574         if (specs > rdev->wiphy.sar_capa->num_freq_ranges)
16575                 return -EINVAL;
16576
16577         sar_spec = kzalloc(struct_size(sar_spec, sub_specs, specs), GFP_KERNEL);
16578         if (!sar_spec)
16579                 return -ENOMEM;
16580
16581         sar_spec->type = type;
16582         specs = 0;
16583         nla_for_each_nested(spec_list, tb[NL80211_SAR_ATTR_SPECS], rem) {
16584                 nla_parse_nested(spec, NL80211_SAR_ATTR_SPECS_MAX,
16585                                  spec_list, NULL, NULL);
16586
16587                 switch (type) {
16588                 case NL80211_SAR_TYPE_POWER:
16589                         if (nl80211_set_sar_sub_specs(rdev, sar_spec,
16590                                                       spec, specs)) {
16591                                 err = -EINVAL;
16592                                 goto error;
16593                         }
16594                         break;
16595                 default:
16596                         err = -EINVAL;
16597                         goto error;
16598                 }
16599                 specs++;
16600         }
16601
16602         sar_spec->num_sub_specs = specs;
16603
16604         rdev->cur_cmd_info = info;
16605         err = rdev_set_sar_specs(rdev, sar_spec);
16606         rdev->cur_cmd_info = NULL;
16607 error:
16608         kfree(sar_spec);
16609         return err;
16610 }
16611
16612 #define SELECTOR(__sel, name, value) \
16613         ((__sel) == (value)) ? NL80211_IFL_SEL_##name :
16614 int __missing_selector(void);
16615 #define IFLAGS(__val) INTERNAL_FLAG_SELECTORS(__val) __missing_selector()
16616
16617 static const struct genl_ops nl80211_ops[] = {
16618         {
16619                 .cmd = NL80211_CMD_GET_WIPHY,
16620                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16621                 .doit = nl80211_get_wiphy,
16622                 .dumpit = nl80211_dump_wiphy,
16623                 .done = nl80211_dump_wiphy_done,
16624                 /* can be retrieved by unprivileged users */
16625                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16626         },
16627 };
16628
16629 static const struct genl_small_ops nl80211_small_ops[] = {
16630         {
16631                 .cmd = NL80211_CMD_SET_WIPHY,
16632                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16633                 .doit = nl80211_set_wiphy,
16634                 .flags = GENL_UNS_ADMIN_PERM,
16635         },
16636         {
16637                 .cmd = NL80211_CMD_GET_INTERFACE,
16638                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16639                 .doit = nl80211_get_interface,
16640                 .dumpit = nl80211_dump_interface,
16641                 /* can be retrieved by unprivileged users */
16642                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
16643         },
16644         {
16645                 .cmd = NL80211_CMD_SET_INTERFACE,
16646                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16647                 .doit = nl80211_set_interface,
16648                 .flags = GENL_UNS_ADMIN_PERM,
16649                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
16650                                          NL80211_FLAG_NEED_RTNL),
16651         },
16652         {
16653                 .cmd = NL80211_CMD_NEW_INTERFACE,
16654                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16655                 .doit = nl80211_new_interface,
16656                 .flags = GENL_UNS_ADMIN_PERM,
16657                 .internal_flags =
16658                         IFLAGS(NL80211_FLAG_NEED_WIPHY |
16659                                NL80211_FLAG_NEED_RTNL |
16660                                /* we take the wiphy mutex later ourselves */
16661                                NL80211_FLAG_NO_WIPHY_MTX),
16662         },
16663         {
16664                 .cmd = NL80211_CMD_DEL_INTERFACE,
16665                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16666                 .doit = nl80211_del_interface,
16667                 .flags = GENL_UNS_ADMIN_PERM,
16668                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
16669                                          NL80211_FLAG_NEED_RTNL),
16670         },
16671         {
16672                 .cmd = NL80211_CMD_GET_KEY,
16673                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16674                 .doit = nl80211_get_key,
16675                 .flags = GENL_UNS_ADMIN_PERM,
16676                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16677         },
16678         {
16679                 .cmd = NL80211_CMD_SET_KEY,
16680                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16681                 .doit = nl80211_set_key,
16682                 .flags = GENL_UNS_ADMIN_PERM,
16683                 /* cannot use NL80211_FLAG_MLO_VALID_LINK_ID, depends on key */
16684                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16685                                          NL80211_FLAG_CLEAR_SKB),
16686         },
16687         {
16688                 .cmd = NL80211_CMD_NEW_KEY,
16689                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16690                 .doit = nl80211_new_key,
16691                 .flags = GENL_UNS_ADMIN_PERM,
16692                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16693                                          NL80211_FLAG_CLEAR_SKB),
16694         },
16695         {
16696                 .cmd = NL80211_CMD_DEL_KEY,
16697                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16698                 .doit = nl80211_del_key,
16699                 .flags = GENL_UNS_ADMIN_PERM,
16700                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16701         },
16702         {
16703                 .cmd = NL80211_CMD_SET_BEACON,
16704                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16705                 .flags = GENL_UNS_ADMIN_PERM,
16706                 .doit = nl80211_set_beacon,
16707                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16708                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16709         },
16710         {
16711                 .cmd = NL80211_CMD_START_AP,
16712                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16713                 .flags = GENL_UNS_ADMIN_PERM,
16714                 .doit = nl80211_start_ap,
16715                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16716                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16717         },
16718         {
16719                 .cmd = NL80211_CMD_STOP_AP,
16720                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16721                 .flags = GENL_UNS_ADMIN_PERM,
16722                 .doit = nl80211_stop_ap,
16723                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16724                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16725         },
16726         {
16727                 .cmd = NL80211_CMD_GET_STATION,
16728                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16729                 .doit = nl80211_get_station,
16730                 .dumpit = nl80211_dump_station,
16731                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
16732         },
16733         {
16734                 .cmd = NL80211_CMD_SET_STATION,
16735                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16736                 .doit = nl80211_set_station,
16737                 .flags = GENL_UNS_ADMIN_PERM,
16738                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16739         },
16740         {
16741                 .cmd = NL80211_CMD_NEW_STATION,
16742                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16743                 .doit = nl80211_new_station,
16744                 .flags = GENL_UNS_ADMIN_PERM,
16745                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16746         },
16747         {
16748                 .cmd = NL80211_CMD_DEL_STATION,
16749                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16750                 .doit = nl80211_del_station,
16751                 .flags = GENL_UNS_ADMIN_PERM,
16752                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16753         },
16754         {
16755                 .cmd = NL80211_CMD_GET_MPATH,
16756                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16757                 .doit = nl80211_get_mpath,
16758                 .dumpit = nl80211_dump_mpath,
16759                 .flags = GENL_UNS_ADMIN_PERM,
16760                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16761         },
16762         {
16763                 .cmd = NL80211_CMD_GET_MPP,
16764                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16765                 .doit = nl80211_get_mpp,
16766                 .dumpit = nl80211_dump_mpp,
16767                 .flags = GENL_UNS_ADMIN_PERM,
16768                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16769         },
16770         {
16771                 .cmd = NL80211_CMD_SET_MPATH,
16772                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16773                 .doit = nl80211_set_mpath,
16774                 .flags = GENL_UNS_ADMIN_PERM,
16775                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16776         },
16777         {
16778                 .cmd = NL80211_CMD_NEW_MPATH,
16779                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16780                 .doit = nl80211_new_mpath,
16781                 .flags = GENL_UNS_ADMIN_PERM,
16782                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16783         },
16784         {
16785                 .cmd = NL80211_CMD_DEL_MPATH,
16786                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16787                 .doit = nl80211_del_mpath,
16788                 .flags = GENL_UNS_ADMIN_PERM,
16789                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16790         },
16791         {
16792                 .cmd = NL80211_CMD_SET_BSS,
16793                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16794                 .doit = nl80211_set_bss,
16795                 .flags = GENL_UNS_ADMIN_PERM,
16796                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16797                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16798         },
16799         {
16800                 .cmd = NL80211_CMD_GET_REG,
16801                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16802                 .doit = nl80211_get_reg_do,
16803                 .dumpit = nl80211_get_reg_dump,
16804                 /* can be retrieved by unprivileged users */
16805         },
16806 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
16807         {
16808                 .cmd = NL80211_CMD_SET_REG,
16809                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16810                 .doit = nl80211_set_reg,
16811                 .flags = GENL_ADMIN_PERM,
16812         },
16813 #endif
16814         {
16815                 .cmd = NL80211_CMD_REQ_SET_REG,
16816                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16817                 .doit = nl80211_req_set_reg,
16818                 .flags = GENL_ADMIN_PERM,
16819         },
16820         {
16821                 .cmd = NL80211_CMD_RELOAD_REGDB,
16822                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16823                 .doit = nl80211_reload_regdb,
16824                 .flags = GENL_ADMIN_PERM,
16825         },
16826         {
16827                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
16828                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16829                 .doit = nl80211_get_mesh_config,
16830                 /* can be retrieved by unprivileged users */
16831                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16832         },
16833         {
16834                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
16835                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16836                 .doit = nl80211_update_mesh_config,
16837                 .flags = GENL_UNS_ADMIN_PERM,
16838                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16839         },
16840         {
16841                 .cmd = NL80211_CMD_TRIGGER_SCAN,
16842                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16843                 .doit = nl80211_trigger_scan,
16844                 .flags = GENL_UNS_ADMIN_PERM,
16845                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16846         },
16847         {
16848                 .cmd = NL80211_CMD_ABORT_SCAN,
16849                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16850                 .doit = nl80211_abort_scan,
16851                 .flags = GENL_UNS_ADMIN_PERM,
16852                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
16853         },
16854         {
16855                 .cmd = NL80211_CMD_GET_SCAN,
16856                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16857                 .dumpit = nl80211_dump_scan,
16858         },
16859         {
16860                 .cmd = NL80211_CMD_START_SCHED_SCAN,
16861                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16862                 .doit = nl80211_start_sched_scan,
16863                 .flags = GENL_UNS_ADMIN_PERM,
16864                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16865         },
16866         {
16867                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
16868                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16869                 .doit = nl80211_stop_sched_scan,
16870                 .flags = GENL_UNS_ADMIN_PERM,
16871                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16872         },
16873         {
16874                 .cmd = NL80211_CMD_AUTHENTICATE,
16875                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16876                 .doit = nl80211_authenticate,
16877                 .flags = GENL_UNS_ADMIN_PERM,
16878                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16879                                          NL80211_FLAG_CLEAR_SKB),
16880         },
16881         {
16882                 .cmd = NL80211_CMD_ASSOCIATE,
16883                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16884                 .doit = nl80211_associate,
16885                 .flags = GENL_UNS_ADMIN_PERM,
16886                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16887                                          NL80211_FLAG_CLEAR_SKB),
16888         },
16889         {
16890                 .cmd = NL80211_CMD_DEAUTHENTICATE,
16891                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16892                 .doit = nl80211_deauthenticate,
16893                 .flags = GENL_UNS_ADMIN_PERM,
16894                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16895         },
16896         {
16897                 .cmd = NL80211_CMD_DISASSOCIATE,
16898                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16899                 .doit = nl80211_disassociate,
16900                 .flags = GENL_UNS_ADMIN_PERM,
16901                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16902         },
16903         {
16904                 .cmd = NL80211_CMD_JOIN_IBSS,
16905                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16906                 .doit = nl80211_join_ibss,
16907                 .flags = GENL_UNS_ADMIN_PERM,
16908                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16909         },
16910         {
16911                 .cmd = NL80211_CMD_LEAVE_IBSS,
16912                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16913                 .doit = nl80211_leave_ibss,
16914                 .flags = GENL_UNS_ADMIN_PERM,
16915                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16916         },
16917 #ifdef CONFIG_NL80211_TESTMODE
16918         {
16919                 .cmd = NL80211_CMD_TESTMODE,
16920                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16921                 .doit = nl80211_testmode_do,
16922                 .dumpit = nl80211_testmode_dump,
16923                 .flags = GENL_UNS_ADMIN_PERM,
16924                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
16925         },
16926 #endif
16927         {
16928                 .cmd = NL80211_CMD_CONNECT,
16929                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16930                 .doit = nl80211_connect,
16931                 .flags = GENL_UNS_ADMIN_PERM,
16932                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16933                                          NL80211_FLAG_CLEAR_SKB),
16934         },
16935         {
16936                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
16937                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16938                 .doit = nl80211_update_connect_params,
16939                 .flags = GENL_ADMIN_PERM,
16940                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16941                                          NL80211_FLAG_CLEAR_SKB),
16942         },
16943         {
16944                 .cmd = NL80211_CMD_DISCONNECT,
16945                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16946                 .doit = nl80211_disconnect,
16947                 .flags = GENL_UNS_ADMIN_PERM,
16948                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16949         },
16950         {
16951                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
16952                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16953                 .doit = nl80211_wiphy_netns,
16954                 .flags = GENL_UNS_ADMIN_PERM,
16955                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
16956                                          NL80211_FLAG_NEED_RTNL |
16957                                          NL80211_FLAG_NO_WIPHY_MTX),
16958         },
16959         {
16960                 .cmd = NL80211_CMD_GET_SURVEY,
16961                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16962                 .dumpit = nl80211_dump_survey,
16963         },
16964         {
16965                 .cmd = NL80211_CMD_SET_PMKSA,
16966                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16967                 .doit = nl80211_setdel_pmksa,
16968                 .flags = GENL_UNS_ADMIN_PERM,
16969                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
16970                                          NL80211_FLAG_CLEAR_SKB),
16971         },
16972         {
16973                 .cmd = NL80211_CMD_DEL_PMKSA,
16974                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16975                 .doit = nl80211_setdel_pmksa,
16976                 .flags = GENL_UNS_ADMIN_PERM,
16977                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16978         },
16979         {
16980                 .cmd = NL80211_CMD_FLUSH_PMKSA,
16981                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16982                 .doit = nl80211_flush_pmksa,
16983                 .flags = GENL_UNS_ADMIN_PERM,
16984                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
16985         },
16986         {
16987                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
16988                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16989                 .doit = nl80211_remain_on_channel,
16990                 .flags = GENL_UNS_ADMIN_PERM,
16991                 /* FIXME: requiring a link ID here is probably not good */
16992                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
16993                                          NL80211_FLAG_MLO_VALID_LINK_ID),
16994         },
16995         {
16996                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
16997                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
16998                 .doit = nl80211_cancel_remain_on_channel,
16999                 .flags = GENL_UNS_ADMIN_PERM,
17000                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17001         },
17002         {
17003                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
17004                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17005                 .doit = nl80211_set_tx_bitrate_mask,
17006                 .flags = GENL_UNS_ADMIN_PERM,
17007                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17008                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17009         },
17010         {
17011                 .cmd = NL80211_CMD_REGISTER_FRAME,
17012                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17013                 .doit = nl80211_register_mgmt,
17014                 .flags = GENL_UNS_ADMIN_PERM,
17015                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV),
17016         },
17017         {
17018                 .cmd = NL80211_CMD_FRAME,
17019                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17020                 .doit = nl80211_tx_mgmt,
17021                 .flags = GENL_UNS_ADMIN_PERM,
17022                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17023         },
17024         {
17025                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
17026                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17027                 .doit = nl80211_tx_mgmt_cancel_wait,
17028                 .flags = GENL_UNS_ADMIN_PERM,
17029                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17030         },
17031         {
17032                 .cmd = NL80211_CMD_SET_POWER_SAVE,
17033                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17034                 .doit = nl80211_set_power_save,
17035                 .flags = GENL_UNS_ADMIN_PERM,
17036                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17037         },
17038         {
17039                 .cmd = NL80211_CMD_GET_POWER_SAVE,
17040                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17041                 .doit = nl80211_get_power_save,
17042                 /* can be retrieved by unprivileged users */
17043                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17044         },
17045         {
17046                 .cmd = NL80211_CMD_SET_CQM,
17047                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17048                 .doit = nl80211_set_cqm,
17049                 .flags = GENL_UNS_ADMIN_PERM,
17050                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17051         },
17052         {
17053                 .cmd = NL80211_CMD_SET_CHANNEL,
17054                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17055                 .doit = nl80211_set_channel,
17056                 .flags = GENL_UNS_ADMIN_PERM,
17057                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17058                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17059         },
17060         {
17061                 .cmd = NL80211_CMD_JOIN_MESH,
17062                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17063                 .doit = nl80211_join_mesh,
17064                 .flags = GENL_UNS_ADMIN_PERM,
17065                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17066         },
17067         {
17068                 .cmd = NL80211_CMD_LEAVE_MESH,
17069                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17070                 .doit = nl80211_leave_mesh,
17071                 .flags = GENL_UNS_ADMIN_PERM,
17072                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17073         },
17074         {
17075                 .cmd = NL80211_CMD_JOIN_OCB,
17076                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17077                 .doit = nl80211_join_ocb,
17078                 .flags = GENL_UNS_ADMIN_PERM,
17079                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17080         },
17081         {
17082                 .cmd = NL80211_CMD_LEAVE_OCB,
17083                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17084                 .doit = nl80211_leave_ocb,
17085                 .flags = GENL_UNS_ADMIN_PERM,
17086                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17087         },
17088 #ifdef CONFIG_PM
17089         {
17090                 .cmd = NL80211_CMD_GET_WOWLAN,
17091                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17092                 .doit = nl80211_get_wowlan,
17093                 /* can be retrieved by unprivileged users */
17094                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17095         },
17096         {
17097                 .cmd = NL80211_CMD_SET_WOWLAN,
17098                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17099                 .doit = nl80211_set_wowlan,
17100                 .flags = GENL_UNS_ADMIN_PERM,
17101                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17102         },
17103 #endif
17104         {
17105                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
17106                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17107                 .doit = nl80211_set_rekey_data,
17108                 .flags = GENL_UNS_ADMIN_PERM,
17109                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17110                                          NL80211_FLAG_CLEAR_SKB),
17111         },
17112         {
17113                 .cmd = NL80211_CMD_TDLS_MGMT,
17114                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17115                 .doit = nl80211_tdls_mgmt,
17116                 .flags = GENL_UNS_ADMIN_PERM,
17117                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17118         },
17119         {
17120                 .cmd = NL80211_CMD_TDLS_OPER,
17121                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17122                 .doit = nl80211_tdls_oper,
17123                 .flags = GENL_UNS_ADMIN_PERM,
17124                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17125         },
17126         {
17127                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
17128                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17129                 .doit = nl80211_register_unexpected_frame,
17130                 .flags = GENL_UNS_ADMIN_PERM,
17131                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17132         },
17133         {
17134                 .cmd = NL80211_CMD_PROBE_CLIENT,
17135                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17136                 .doit = nl80211_probe_client,
17137                 .flags = GENL_UNS_ADMIN_PERM,
17138                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17139         },
17140         {
17141                 .cmd = NL80211_CMD_REGISTER_BEACONS,
17142                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17143                 .doit = nl80211_register_beacons,
17144                 .flags = GENL_UNS_ADMIN_PERM,
17145                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17146         },
17147         {
17148                 .cmd = NL80211_CMD_SET_NOACK_MAP,
17149                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17150                 .doit = nl80211_set_noack_map,
17151                 .flags = GENL_UNS_ADMIN_PERM,
17152                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17153         },
17154         {
17155                 .cmd = NL80211_CMD_START_P2P_DEVICE,
17156                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17157                 .doit = nl80211_start_p2p_device,
17158                 .flags = GENL_UNS_ADMIN_PERM,
17159                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17160                                          NL80211_FLAG_NEED_RTNL),
17161         },
17162         {
17163                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
17164                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17165                 .doit = nl80211_stop_p2p_device,
17166                 .flags = GENL_UNS_ADMIN_PERM,
17167                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17168                                          NL80211_FLAG_NEED_RTNL),
17169         },
17170         {
17171                 .cmd = NL80211_CMD_START_NAN,
17172                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17173                 .doit = nl80211_start_nan,
17174                 .flags = GENL_ADMIN_PERM,
17175                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV |
17176                                          NL80211_FLAG_NEED_RTNL),
17177         },
17178         {
17179                 .cmd = NL80211_CMD_STOP_NAN,
17180                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17181                 .doit = nl80211_stop_nan,
17182                 .flags = GENL_ADMIN_PERM,
17183                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP |
17184                                          NL80211_FLAG_NEED_RTNL),
17185         },
17186         {
17187                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
17188                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17189                 .doit = nl80211_nan_add_func,
17190                 .flags = GENL_ADMIN_PERM,
17191                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17192         },
17193         {
17194                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
17195                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17196                 .doit = nl80211_nan_del_func,
17197                 .flags = GENL_ADMIN_PERM,
17198                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17199         },
17200         {
17201                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
17202                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17203                 .doit = nl80211_nan_change_config,
17204                 .flags = GENL_ADMIN_PERM,
17205                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17206         },
17207         {
17208                 .cmd = NL80211_CMD_SET_MCAST_RATE,
17209                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17210                 .doit = nl80211_set_mcast_rate,
17211                 .flags = GENL_UNS_ADMIN_PERM,
17212                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17213         },
17214         {
17215                 .cmd = NL80211_CMD_SET_MAC_ACL,
17216                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17217                 .doit = nl80211_set_mac_acl,
17218                 .flags = GENL_UNS_ADMIN_PERM,
17219                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17220                                          NL80211_FLAG_MLO_UNSUPPORTED),
17221         },
17222         {
17223                 .cmd = NL80211_CMD_RADAR_DETECT,
17224                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17225                 .doit = nl80211_start_radar_detection,
17226                 .flags = GENL_UNS_ADMIN_PERM,
17227                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17228                                          NL80211_FLAG_NO_WIPHY_MTX |
17229                                          NL80211_FLAG_MLO_UNSUPPORTED),
17230         },
17231         {
17232                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
17233                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17234                 .doit = nl80211_get_protocol_features,
17235         },
17236         {
17237                 .cmd = NL80211_CMD_UPDATE_FT_IES,
17238                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17239                 .doit = nl80211_update_ft_ies,
17240                 .flags = GENL_UNS_ADMIN_PERM,
17241                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17242         },
17243         {
17244                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
17245                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17246                 .doit = nl80211_crit_protocol_start,
17247                 .flags = GENL_UNS_ADMIN_PERM,
17248                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17249         },
17250         {
17251                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
17252                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17253                 .doit = nl80211_crit_protocol_stop,
17254                 .flags = GENL_UNS_ADMIN_PERM,
17255                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17256         },
17257         {
17258                 .cmd = NL80211_CMD_GET_COALESCE,
17259                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17260                 .doit = nl80211_get_coalesce,
17261                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17262         },
17263         {
17264                 .cmd = NL80211_CMD_SET_COALESCE,
17265                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17266                 .doit = nl80211_set_coalesce,
17267                 .flags = GENL_UNS_ADMIN_PERM,
17268                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY),
17269         },
17270         {
17271                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
17272                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17273                 .doit = nl80211_channel_switch,
17274                 .flags = GENL_UNS_ADMIN_PERM,
17275                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17276                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17277         },
17278         {
17279                 .cmd = NL80211_CMD_VENDOR,
17280                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17281                 .doit = nl80211_vendor_cmd,
17282                 .dumpit = nl80211_vendor_cmd_dump,
17283                 .flags = GENL_UNS_ADMIN_PERM,
17284                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17285                                          NL80211_FLAG_CLEAR_SKB),
17286         },
17287         {
17288                 .cmd = NL80211_CMD_SET_QOS_MAP,
17289                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17290                 .doit = nl80211_set_qos_map,
17291                 .flags = GENL_UNS_ADMIN_PERM,
17292                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17293         },
17294         {
17295                 .cmd = NL80211_CMD_ADD_TX_TS,
17296                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17297                 .doit = nl80211_add_tx_ts,
17298                 .flags = GENL_UNS_ADMIN_PERM,
17299                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17300                                          NL80211_FLAG_MLO_UNSUPPORTED),
17301         },
17302         {
17303                 .cmd = NL80211_CMD_DEL_TX_TS,
17304                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17305                 .doit = nl80211_del_tx_ts,
17306                 .flags = GENL_UNS_ADMIN_PERM,
17307                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17308         },
17309         {
17310                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
17311                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17312                 .doit = nl80211_tdls_channel_switch,
17313                 .flags = GENL_UNS_ADMIN_PERM,
17314                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17315         },
17316         {
17317                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
17318                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17319                 .doit = nl80211_tdls_cancel_channel_switch,
17320                 .flags = GENL_UNS_ADMIN_PERM,
17321                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17322         },
17323         {
17324                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
17325                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17326                 .doit = nl80211_set_multicast_to_unicast,
17327                 .flags = GENL_UNS_ADMIN_PERM,
17328                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV),
17329         },
17330         {
17331                 .cmd = NL80211_CMD_SET_PMK,
17332                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17333                 .doit = nl80211_set_pmk,
17334                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17335                                          NL80211_FLAG_CLEAR_SKB),
17336         },
17337         {
17338                 .cmd = NL80211_CMD_DEL_PMK,
17339                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17340                 .doit = nl80211_del_pmk,
17341                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17342         },
17343         {
17344                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
17345                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17346                 .doit = nl80211_external_auth,
17347                 .flags = GENL_ADMIN_PERM,
17348                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17349         },
17350         {
17351                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
17352                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17353                 .doit = nl80211_tx_control_port,
17354                 .flags = GENL_UNS_ADMIN_PERM,
17355                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17356         },
17357         {
17358                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
17359                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17360                 .doit = nl80211_get_ftm_responder_stats,
17361                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17362                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17363         },
17364         {
17365                 .cmd = NL80211_CMD_PEER_MEASUREMENT_START,
17366                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17367                 .doit = nl80211_pmsr_start,
17368                 .flags = GENL_UNS_ADMIN_PERM,
17369                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WDEV_UP),
17370         },
17371         {
17372                 .cmd = NL80211_CMD_NOTIFY_RADAR,
17373                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17374                 .doit = nl80211_notify_radar_detection,
17375                 .flags = GENL_UNS_ADMIN_PERM,
17376                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17377         },
17378         {
17379                 .cmd = NL80211_CMD_UPDATE_OWE_INFO,
17380                 .doit = nl80211_update_owe_info,
17381                 .flags = GENL_ADMIN_PERM,
17382                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17383         },
17384         {
17385                 .cmd = NL80211_CMD_PROBE_MESH_LINK,
17386                 .doit = nl80211_probe_mesh_link,
17387                 .flags = GENL_UNS_ADMIN_PERM,
17388                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17389         },
17390         {
17391                 .cmd = NL80211_CMD_SET_TID_CONFIG,
17392                 .doit = nl80211_set_tid_config,
17393                 .flags = GENL_UNS_ADMIN_PERM,
17394                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV |
17395                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17396         },
17397         {
17398                 .cmd = NL80211_CMD_SET_SAR_SPECS,
17399                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17400                 .doit = nl80211_set_sar_specs,
17401                 .flags = GENL_UNS_ADMIN_PERM,
17402                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_WIPHY |
17403                                          NL80211_FLAG_NEED_RTNL),
17404         },
17405         {
17406                 .cmd = NL80211_CMD_COLOR_CHANGE_REQUEST,
17407                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17408                 .doit = nl80211_color_change,
17409                 .flags = GENL_UNS_ADMIN_PERM,
17410                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17411         },
17412         {
17413                 .cmd = NL80211_CMD_SET_FILS_AAD,
17414                 .validate = GENL_DONT_VALIDATE_STRICT | GENL_DONT_VALIDATE_DUMP,
17415                 .doit = nl80211_set_fils_aad,
17416                 .flags = GENL_UNS_ADMIN_PERM,
17417                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17418         },
17419         {
17420                 .cmd = NL80211_CMD_ADD_LINK,
17421                 .doit = nl80211_add_link,
17422                 .flags = GENL_UNS_ADMIN_PERM,
17423                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17424         },
17425         {
17426                 .cmd = NL80211_CMD_REMOVE_LINK,
17427                 .doit = nl80211_remove_link,
17428                 .flags = GENL_UNS_ADMIN_PERM,
17429                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17430                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17431         },
17432         {
17433                 .cmd = NL80211_CMD_ADD_LINK_STA,
17434                 .doit = nl80211_add_link_station,
17435                 .flags = GENL_UNS_ADMIN_PERM,
17436                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17437                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17438         },
17439         {
17440                 .cmd = NL80211_CMD_MODIFY_LINK_STA,
17441                 .doit = nl80211_modify_link_station,
17442                 .flags = GENL_UNS_ADMIN_PERM,
17443                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17444                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17445         },
17446         {
17447                 .cmd = NL80211_CMD_REMOVE_LINK_STA,
17448                 .doit = nl80211_remove_link_station,
17449                 .flags = GENL_UNS_ADMIN_PERM,
17450                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP |
17451                                          NL80211_FLAG_MLO_VALID_LINK_ID),
17452         },
17453         {
17454                 .cmd = NL80211_CMD_SET_HW_TIMESTAMP,
17455                 .doit = nl80211_set_hw_timestamp,
17456                 .flags = GENL_UNS_ADMIN_PERM,
17457                 .internal_flags = IFLAGS(NL80211_FLAG_NEED_NETDEV_UP),
17458         },
17459 };
17460
17461 static struct genl_family nl80211_fam __ro_after_init = {
17462         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
17463         .hdrsize = 0,                   /* no private header */
17464         .version = 1,                   /* no particular meaning now */
17465         .maxattr = NL80211_ATTR_MAX,
17466         .policy = nl80211_policy,
17467         .netnsok = true,
17468         .pre_doit = nl80211_pre_doit,
17469         .post_doit = nl80211_post_doit,
17470         .module = THIS_MODULE,
17471         .ops = nl80211_ops,
17472         .n_ops = ARRAY_SIZE(nl80211_ops),
17473         .small_ops = nl80211_small_ops,
17474         .n_small_ops = ARRAY_SIZE(nl80211_small_ops),
17475         .resv_start_op = NL80211_CMD_REMOVE_LINK_STA + 1,
17476         .mcgrps = nl80211_mcgrps,
17477         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
17478         .parallel_ops = true,
17479 };
17480
17481 /* notification functions */
17482
17483 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
17484                           enum nl80211_commands cmd)
17485 {
17486         struct sk_buff *msg;
17487         struct nl80211_dump_wiphy_state state = {};
17488
17489         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
17490                 cmd != NL80211_CMD_DEL_WIPHY);
17491
17492         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17493         if (!msg)
17494                 return;
17495
17496         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
17497                 nlmsg_free(msg);
17498                 return;
17499         }
17500
17501         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17502                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17503 }
17504
17505 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
17506                                 struct wireless_dev *wdev,
17507                                 enum nl80211_commands cmd)
17508 {
17509         struct sk_buff *msg;
17510
17511         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17512         if (!msg)
17513                 return;
17514
17515         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev, cmd) < 0) {
17516                 nlmsg_free(msg);
17517                 return;
17518         }
17519
17520         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17521                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
17522 }
17523
17524 static int nl80211_add_scan_req(struct sk_buff *msg,
17525                                 struct cfg80211_registered_device *rdev)
17526 {
17527         struct cfg80211_scan_request *req = rdev->scan_req;
17528         struct nlattr *nest;
17529         int i;
17530         struct cfg80211_scan_info *info;
17531
17532         if (WARN_ON(!req))
17533                 return 0;
17534
17535         nest = nla_nest_start_noflag(msg, NL80211_ATTR_SCAN_SSIDS);
17536         if (!nest)
17537                 goto nla_put_failure;
17538         for (i = 0; i < req->n_ssids; i++) {
17539                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
17540                         goto nla_put_failure;
17541         }
17542         nla_nest_end(msg, nest);
17543
17544         if (req->flags & NL80211_SCAN_FLAG_FREQ_KHZ) {
17545                 nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQ_KHZ);
17546                 if (!nest)
17547                         goto nla_put_failure;
17548                 for (i = 0; i < req->n_channels; i++) {
17549                         if (nla_put_u32(msg, i,
17550                                    ieee80211_channel_to_khz(req->channels[i])))
17551                                 goto nla_put_failure;
17552                 }
17553                 nla_nest_end(msg, nest);
17554         } else {
17555                 nest = nla_nest_start_noflag(msg,
17556                                              NL80211_ATTR_SCAN_FREQUENCIES);
17557                 if (!nest)
17558                         goto nla_put_failure;
17559                 for (i = 0; i < req->n_channels; i++) {
17560                         if (nla_put_u32(msg, i, req->channels[i]->center_freq))
17561                                 goto nla_put_failure;
17562                 }
17563                 nla_nest_end(msg, nest);
17564         }
17565
17566         if (req->ie &&
17567             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
17568                 goto nla_put_failure;
17569
17570         if (req->flags &&
17571             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
17572                 goto nla_put_failure;
17573
17574         info = rdev->int_scan_req ? &rdev->int_scan_req->info :
17575                 &rdev->scan_req->info;
17576         if (info->scan_start_tsf &&
17577             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
17578                                info->scan_start_tsf, NL80211_BSS_PAD) ||
17579              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
17580                      info->tsf_bssid)))
17581                 goto nla_put_failure;
17582
17583         return 0;
17584  nla_put_failure:
17585         return -ENOBUFS;
17586 }
17587
17588 static int nl80211_prep_scan_msg(struct sk_buff *msg,
17589                                  struct cfg80211_registered_device *rdev,
17590                                  struct wireless_dev *wdev,
17591                                  u32 portid, u32 seq, int flags,
17592                                  u32 cmd)
17593 {
17594         void *hdr;
17595
17596         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
17597         if (!hdr)
17598                 return -1;
17599
17600         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17601             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
17602                                          wdev->netdev->ifindex)) ||
17603             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
17604                               NL80211_ATTR_PAD))
17605                 goto nla_put_failure;
17606
17607         /* ignore errors and send incomplete event anyway */
17608         nl80211_add_scan_req(msg, rdev);
17609
17610         genlmsg_end(msg, hdr);
17611         return 0;
17612
17613  nla_put_failure:
17614         genlmsg_cancel(msg, hdr);
17615         return -EMSGSIZE;
17616 }
17617
17618 static int
17619 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
17620                             struct cfg80211_sched_scan_request *req, u32 cmd)
17621 {
17622         void *hdr;
17623
17624         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17625         if (!hdr)
17626                 return -1;
17627
17628         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
17629                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
17630             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
17631             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
17632                               NL80211_ATTR_PAD))
17633                 goto nla_put_failure;
17634
17635         genlmsg_end(msg, hdr);
17636         return 0;
17637
17638  nla_put_failure:
17639         genlmsg_cancel(msg, hdr);
17640         return -EMSGSIZE;
17641 }
17642
17643 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
17644                              struct wireless_dev *wdev)
17645 {
17646         struct sk_buff *msg;
17647
17648         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17649         if (!msg)
17650                 return;
17651
17652         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17653                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
17654                 nlmsg_free(msg);
17655                 return;
17656         }
17657
17658         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17659                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17660 }
17661
17662 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
17663                                        struct wireless_dev *wdev, bool aborted)
17664 {
17665         struct sk_buff *msg;
17666
17667         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17668         if (!msg)
17669                 return NULL;
17670
17671         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
17672                                   aborted ? NL80211_CMD_SCAN_ABORTED :
17673                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
17674                 nlmsg_free(msg);
17675                 return NULL;
17676         }
17677
17678         return msg;
17679 }
17680
17681 /* send message created by nl80211_build_scan_msg() */
17682 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
17683                            struct sk_buff *msg)
17684 {
17685         if (!msg)
17686                 return;
17687
17688         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17689                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17690 }
17691
17692 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
17693 {
17694         struct sk_buff *msg;
17695
17696         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17697         if (!msg)
17698                 return;
17699
17700         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
17701                 nlmsg_free(msg);
17702                 return;
17703         }
17704
17705         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
17706                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
17707 }
17708
17709 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
17710                                           struct regulatory_request *request)
17711 {
17712         /* Userspace can always count this one always being set */
17713         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
17714                 goto nla_put_failure;
17715
17716         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
17717                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17718                                NL80211_REGDOM_TYPE_WORLD))
17719                         goto nla_put_failure;
17720         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
17721                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17722                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
17723                         goto nla_put_failure;
17724         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
17725                    request->intersect) {
17726                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17727                                NL80211_REGDOM_TYPE_INTERSECTION))
17728                         goto nla_put_failure;
17729         } else {
17730                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
17731                                NL80211_REGDOM_TYPE_COUNTRY) ||
17732                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
17733                                    request->alpha2))
17734                         goto nla_put_failure;
17735         }
17736
17737         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
17738                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
17739
17740                 if (wiphy &&
17741                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
17742                         goto nla_put_failure;
17743
17744                 if (wiphy &&
17745                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
17746                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
17747                         goto nla_put_failure;
17748         }
17749
17750         return true;
17751
17752 nla_put_failure:
17753         return false;
17754 }
17755
17756 /*
17757  * This can happen on global regulatory changes or device specific settings
17758  * based on custom regulatory domains.
17759  */
17760 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
17761                                      struct regulatory_request *request)
17762 {
17763         struct sk_buff *msg;
17764         void *hdr;
17765
17766         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
17767         if (!msg)
17768                 return;
17769
17770         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
17771         if (!hdr)
17772                 goto nla_put_failure;
17773
17774         if (!nl80211_reg_change_event_fill(msg, request))
17775                 goto nla_put_failure;
17776
17777         genlmsg_end(msg, hdr);
17778
17779         rcu_read_lock();
17780         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
17781                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
17782         rcu_read_unlock();
17783
17784         return;
17785
17786 nla_put_failure:
17787         nlmsg_free(msg);
17788 }
17789
17790 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
17791                                     struct net_device *netdev,
17792                                     const u8 *buf, size_t len,
17793                                     enum nl80211_commands cmd, gfp_t gfp,
17794                                     int uapsd_queues, const u8 *req_ies,
17795                                     size_t req_ies_len, bool reconnect)
17796 {
17797         struct sk_buff *msg;
17798         void *hdr;
17799
17800         msg = nlmsg_new(100 + len + req_ies_len, gfp);
17801         if (!msg)
17802                 return;
17803
17804         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17805         if (!hdr) {
17806                 nlmsg_free(msg);
17807                 return;
17808         }
17809
17810         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17811             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17812             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
17813             (req_ies &&
17814              nla_put(msg, NL80211_ATTR_REQ_IE, req_ies_len, req_ies)))
17815                 goto nla_put_failure;
17816
17817         if (reconnect && nla_put_flag(msg, NL80211_ATTR_RECONNECT_REQUESTED))
17818                 goto nla_put_failure;
17819
17820         if (uapsd_queues >= 0) {
17821                 struct nlattr *nla_wmm =
17822                         nla_nest_start_noflag(msg, NL80211_ATTR_STA_WME);
17823                 if (!nla_wmm)
17824                         goto nla_put_failure;
17825
17826                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
17827                                uapsd_queues))
17828                         goto nla_put_failure;
17829
17830                 nla_nest_end(msg, nla_wmm);
17831         }
17832
17833         genlmsg_end(msg, hdr);
17834
17835         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17836                                 NL80211_MCGRP_MLME, gfp);
17837         return;
17838
17839  nla_put_failure:
17840         nlmsg_free(msg);
17841 }
17842
17843 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
17844                           struct net_device *netdev, const u8 *buf,
17845                           size_t len, gfp_t gfp)
17846 {
17847         nl80211_send_mlme_event(rdev, netdev, buf, len,
17848                                 NL80211_CMD_AUTHENTICATE, gfp, -1, NULL, 0,
17849                                 false);
17850 }
17851
17852 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
17853                            struct net_device *netdev,
17854                            struct cfg80211_rx_assoc_resp *data)
17855 {
17856         nl80211_send_mlme_event(rdev, netdev, data->buf, data->len,
17857                                 NL80211_CMD_ASSOCIATE, GFP_KERNEL,
17858                                 data->uapsd_queues,
17859                                 data->req_ies, data->req_ies_len, false);
17860 }
17861
17862 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
17863                          struct net_device *netdev, const u8 *buf,
17864                          size_t len, bool reconnect, gfp_t gfp)
17865 {
17866         nl80211_send_mlme_event(rdev, netdev, buf, len,
17867                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1, NULL, 0,
17868                                 reconnect);
17869 }
17870
17871 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
17872                            struct net_device *netdev, const u8 *buf,
17873                            size_t len, bool reconnect, gfp_t gfp)
17874 {
17875         nl80211_send_mlme_event(rdev, netdev, buf, len,
17876                                 NL80211_CMD_DISASSOCIATE, gfp, -1, NULL, 0,
17877                                 reconnect);
17878 }
17879
17880 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
17881                                   size_t len)
17882 {
17883         struct wireless_dev *wdev = dev->ieee80211_ptr;
17884         struct wiphy *wiphy = wdev->wiphy;
17885         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
17886         const struct ieee80211_mgmt *mgmt = (void *)buf;
17887         u32 cmd;
17888
17889         if (WARN_ON(len < 2))
17890                 return;
17891
17892         if (ieee80211_is_deauth(mgmt->frame_control)) {
17893                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
17894         } else if (ieee80211_is_disassoc(mgmt->frame_control)) {
17895                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
17896         } else if (ieee80211_is_beacon(mgmt->frame_control)) {
17897                 if (wdev->unprot_beacon_reported &&
17898                     elapsed_jiffies_msecs(wdev->unprot_beacon_reported) < 10000)
17899                         return;
17900                 cmd = NL80211_CMD_UNPROT_BEACON;
17901                 wdev->unprot_beacon_reported = jiffies;
17902         } else {
17903                 return;
17904         }
17905
17906         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
17907         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1,
17908                                 NULL, 0, false);
17909 }
17910 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
17911
17912 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
17913                                       struct net_device *netdev, int cmd,
17914                                       const u8 *addr, gfp_t gfp)
17915 {
17916         struct sk_buff *msg;
17917         void *hdr;
17918
17919         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
17920         if (!msg)
17921                 return;
17922
17923         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
17924         if (!hdr) {
17925                 nlmsg_free(msg);
17926                 return;
17927         }
17928
17929         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
17930             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
17931             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
17932             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
17933                 goto nla_put_failure;
17934
17935         genlmsg_end(msg, hdr);
17936
17937         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
17938                                 NL80211_MCGRP_MLME, gfp);
17939         return;
17940
17941  nla_put_failure:
17942         nlmsg_free(msg);
17943 }
17944
17945 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
17946                                struct net_device *netdev, const u8 *addr,
17947                                gfp_t gfp)
17948 {
17949         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
17950                                   addr, gfp);
17951 }
17952
17953 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
17954                                 struct net_device *netdev, const u8 *addr,
17955                                 gfp_t gfp)
17956 {
17957         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
17958                                   addr, gfp);
17959 }
17960
17961 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
17962                                  struct net_device *netdev,
17963                                  struct cfg80211_connect_resp_params *cr,
17964                                  gfp_t gfp)
17965 {
17966         struct sk_buff *msg;
17967         void *hdr;
17968         unsigned int link;
17969         size_t link_info_size = 0;
17970         const u8 *connected_addr = cr->valid_links ?
17971                                    cr->ap_mld_addr : cr->links[0].bssid;
17972
17973         if (cr->valid_links) {
17974                 for_each_valid_link(cr, link) {
17975                         /* Nested attribute header */
17976                         link_info_size += NLA_HDRLEN;
17977                         /* Link ID */
17978                         link_info_size += nla_total_size(sizeof(u8));
17979                         link_info_size += cr->links[link].addr ?
17980                                           nla_total_size(ETH_ALEN) : 0;
17981                         link_info_size += (cr->links[link].bssid ||
17982                                            cr->links[link].bss) ?
17983                                           nla_total_size(ETH_ALEN) : 0;
17984                         link_info_size += nla_total_size(sizeof(u16));
17985                 }
17986         }
17987
17988         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
17989                         cr->fils.kek_len + cr->fils.pmk_len +
17990                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0) + link_info_size,
17991                         gfp);
17992         if (!msg)
17993                 return;
17994
17995         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
17996         if (!hdr) {
17997                 nlmsg_free(msg);
17998                 return;
17999         }
18000
18001         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18002             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18003             (connected_addr &&
18004              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr)) ||
18005             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18006                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
18007                         cr->status) ||
18008             (cr->status < 0 &&
18009              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
18010               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
18011                           cr->timeout_reason))) ||
18012             (cr->req_ie &&
18013              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
18014             (cr->resp_ie &&
18015              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
18016                      cr->resp_ie)) ||
18017             (cr->fils.update_erp_next_seq_num &&
18018              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18019                          cr->fils.erp_next_seq_num)) ||
18020             (cr->status == WLAN_STATUS_SUCCESS &&
18021              ((cr->fils.kek &&
18022                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
18023                        cr->fils.kek)) ||
18024               (cr->fils.pmk &&
18025                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
18026               (cr->fils.pmkid &&
18027                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
18028                 goto nla_put_failure;
18029
18030         if (cr->valid_links) {
18031                 int i = 1;
18032                 struct nlattr *nested;
18033
18034                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18035                 if (!nested)
18036                         goto nla_put_failure;
18037
18038                 for_each_valid_link(cr, link) {
18039                         struct nlattr *nested_mlo_links;
18040                         const u8 *bssid = cr->links[link].bss ?
18041                                           cr->links[link].bss->bssid :
18042                                           cr->links[link].bssid;
18043
18044                         nested_mlo_links = nla_nest_start(msg, i);
18045                         if (!nested_mlo_links)
18046                                 goto nla_put_failure;
18047
18048                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18049                             (bssid &&
18050                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18051                             (cr->links[link].addr &&
18052                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18053                                      cr->links[link].addr)) ||
18054                             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
18055                                         cr->links[link].status))
18056                                 goto nla_put_failure;
18057
18058                         nla_nest_end(msg, nested_mlo_links);
18059                         i++;
18060                 }
18061                 nla_nest_end(msg, nested);
18062         }
18063
18064         genlmsg_end(msg, hdr);
18065
18066         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18067                                 NL80211_MCGRP_MLME, gfp);
18068         return;
18069
18070  nla_put_failure:
18071         nlmsg_free(msg);
18072 }
18073
18074 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
18075                          struct net_device *netdev,
18076                          struct cfg80211_roam_info *info, gfp_t gfp)
18077 {
18078         struct sk_buff *msg;
18079         void *hdr;
18080         size_t link_info_size = 0;
18081         unsigned int link;
18082         const u8 *connected_addr = info->ap_mld_addr ?
18083                                    info->ap_mld_addr :
18084                                    (info->links[0].bss ?
18085                                     info->links[0].bss->bssid :
18086                                     info->links[0].bssid);
18087
18088         if (info->valid_links) {
18089                 for_each_valid_link(info, link) {
18090                         /* Nested attribute header */
18091                         link_info_size += NLA_HDRLEN;
18092                         /* Link ID */
18093                         link_info_size += nla_total_size(sizeof(u8));
18094                         link_info_size += info->links[link].addr ?
18095                                           nla_total_size(ETH_ALEN) : 0;
18096                         link_info_size += (info->links[link].bssid ||
18097                                            info->links[link].bss) ?
18098                                           nla_total_size(ETH_ALEN) : 0;
18099                 }
18100         }
18101
18102         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
18103                         info->fils.kek_len + info->fils.pmk_len +
18104                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0) +
18105                         link_info_size, gfp);
18106         if (!msg)
18107                 return;
18108
18109         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
18110         if (!hdr) {
18111                 nlmsg_free(msg);
18112                 return;
18113         }
18114
18115         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18116             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18117             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, connected_addr) ||
18118             (info->req_ie &&
18119              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
18120                      info->req_ie)) ||
18121             (info->resp_ie &&
18122              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
18123                      info->resp_ie)) ||
18124             (info->fils.update_erp_next_seq_num &&
18125              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
18126                          info->fils.erp_next_seq_num)) ||
18127             (info->fils.kek &&
18128              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
18129                      info->fils.kek)) ||
18130             (info->fils.pmk &&
18131              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
18132             (info->fils.pmkid &&
18133              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
18134                 goto nla_put_failure;
18135
18136         if (info->valid_links) {
18137                 int i = 1;
18138                 struct nlattr *nested;
18139
18140                 nested = nla_nest_start(msg, NL80211_ATTR_MLO_LINKS);
18141                 if (!nested)
18142                         goto nla_put_failure;
18143
18144                 for_each_valid_link(info, link) {
18145                         struct nlattr *nested_mlo_links;
18146                         const u8 *bssid = info->links[link].bss ?
18147                                           info->links[link].bss->bssid :
18148                                           info->links[link].bssid;
18149
18150                         nested_mlo_links = nla_nest_start(msg, i);
18151                         if (!nested_mlo_links)
18152                                 goto nla_put_failure;
18153
18154                         if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link) ||
18155                             (bssid &&
18156                              nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, bssid)) ||
18157                             (info->links[link].addr &&
18158                              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN,
18159                                      info->links[link].addr)))
18160                                 goto nla_put_failure;
18161
18162                         nla_nest_end(msg, nested_mlo_links);
18163                         i++;
18164                 }
18165                 nla_nest_end(msg, nested);
18166         }
18167
18168         genlmsg_end(msg, hdr);
18169
18170         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18171                                 NL80211_MCGRP_MLME, gfp);
18172         return;
18173
18174  nla_put_failure:
18175         nlmsg_free(msg);
18176 }
18177
18178 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
18179                                   struct net_device *netdev, const u8 *bssid,
18180                                   const u8 *td_bitmap, u8 td_bitmap_len)
18181 {
18182         struct sk_buff *msg;
18183         void *hdr;
18184
18185         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18186         if (!msg)
18187                 return;
18188
18189         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
18190         if (!hdr) {
18191                 nlmsg_free(msg);
18192                 return;
18193         }
18194
18195         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18196             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18197             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18198                 goto nla_put_failure;
18199
18200         if ((td_bitmap_len > 0) && td_bitmap)
18201                 if (nla_put(msg, NL80211_ATTR_TD_BITMAP,
18202                             td_bitmap_len, td_bitmap))
18203                         goto nla_put_failure;
18204
18205         genlmsg_end(msg, hdr);
18206
18207         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18208                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18209         return;
18210
18211  nla_put_failure:
18212         nlmsg_free(msg);
18213 }
18214
18215 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
18216                                struct net_device *netdev, u16 reason,
18217                                const u8 *ie, size_t ie_len, bool from_ap)
18218 {
18219         struct sk_buff *msg;
18220         void *hdr;
18221
18222         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
18223         if (!msg)
18224                 return;
18225
18226         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
18227         if (!hdr) {
18228                 nlmsg_free(msg);
18229                 return;
18230         }
18231
18232         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18233             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18234             (reason &&
18235              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
18236             (from_ap &&
18237              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
18238             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
18239                 goto nla_put_failure;
18240
18241         genlmsg_end(msg, hdr);
18242
18243         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18244                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18245         return;
18246
18247  nla_put_failure:
18248         nlmsg_free(msg);
18249 }
18250
18251 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
18252                              struct net_device *netdev, const u8 *bssid,
18253                              gfp_t gfp)
18254 {
18255         struct sk_buff *msg;
18256         void *hdr;
18257
18258         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18259         if (!msg)
18260                 return;
18261
18262         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
18263         if (!hdr) {
18264                 nlmsg_free(msg);
18265                 return;
18266         }
18267
18268         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18269             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18270             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
18271                 goto nla_put_failure;
18272
18273         genlmsg_end(msg, hdr);
18274
18275         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18276                                 NL80211_MCGRP_MLME, gfp);
18277         return;
18278
18279  nla_put_failure:
18280         nlmsg_free(msg);
18281 }
18282
18283 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
18284                                         const u8 *ie, u8 ie_len,
18285                                         int sig_dbm, gfp_t gfp)
18286 {
18287         struct wireless_dev *wdev = dev->ieee80211_ptr;
18288         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18289         struct sk_buff *msg;
18290         void *hdr;
18291
18292         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
18293                 return;
18294
18295         trace_cfg80211_notify_new_peer_candidate(dev, addr);
18296
18297         msg = nlmsg_new(100 + ie_len, gfp);
18298         if (!msg)
18299                 return;
18300
18301         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
18302         if (!hdr) {
18303                 nlmsg_free(msg);
18304                 return;
18305         }
18306
18307         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18308             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18309             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18310             (ie_len && ie &&
18311              nla_put(msg, NL80211_ATTR_IE, ie_len, ie)) ||
18312             (sig_dbm &&
18313              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)))
18314                 goto nla_put_failure;
18315
18316         genlmsg_end(msg, hdr);
18317
18318         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18319                                 NL80211_MCGRP_MLME, gfp);
18320         return;
18321
18322  nla_put_failure:
18323         nlmsg_free(msg);
18324 }
18325 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
18326
18327 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
18328                                  struct net_device *netdev, const u8 *addr,
18329                                  enum nl80211_key_type key_type, int key_id,
18330                                  const u8 *tsc, gfp_t gfp)
18331 {
18332         struct sk_buff *msg;
18333         void *hdr;
18334
18335         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18336         if (!msg)
18337                 return;
18338
18339         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
18340         if (!hdr) {
18341                 nlmsg_free(msg);
18342                 return;
18343         }
18344
18345         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18346             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18347             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
18348             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
18349             (key_id != -1 &&
18350              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
18351             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
18352                 goto nla_put_failure;
18353
18354         genlmsg_end(msg, hdr);
18355
18356         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18357                                 NL80211_MCGRP_MLME, gfp);
18358         return;
18359
18360  nla_put_failure:
18361         nlmsg_free(msg);
18362 }
18363
18364 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
18365                                     struct ieee80211_channel *channel_before,
18366                                     struct ieee80211_channel *channel_after)
18367 {
18368         struct sk_buff *msg;
18369         void *hdr;
18370         struct nlattr *nl_freq;
18371
18372         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
18373         if (!msg)
18374                 return;
18375
18376         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
18377         if (!hdr) {
18378                 nlmsg_free(msg);
18379                 return;
18380         }
18381
18382         /*
18383          * Since we are applying the beacon hint to a wiphy we know its
18384          * wiphy_idx is valid
18385          */
18386         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
18387                 goto nla_put_failure;
18388
18389         /* Before */
18390         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_BEFORE);
18391         if (!nl_freq)
18392                 goto nla_put_failure;
18393
18394         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
18395                 goto nla_put_failure;
18396         nla_nest_end(msg, nl_freq);
18397
18398         /* After */
18399         nl_freq = nla_nest_start_noflag(msg, NL80211_ATTR_FREQ_AFTER);
18400         if (!nl_freq)
18401                 goto nla_put_failure;
18402
18403         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
18404                 goto nla_put_failure;
18405         nla_nest_end(msg, nl_freq);
18406
18407         genlmsg_end(msg, hdr);
18408
18409         rcu_read_lock();
18410         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
18411                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
18412         rcu_read_unlock();
18413
18414         return;
18415
18416 nla_put_failure:
18417         nlmsg_free(msg);
18418 }
18419
18420 static void nl80211_send_remain_on_chan_event(
18421         int cmd, struct cfg80211_registered_device *rdev,
18422         struct wireless_dev *wdev, u64 cookie,
18423         struct ieee80211_channel *chan,
18424         unsigned int duration, gfp_t gfp)
18425 {
18426         struct sk_buff *msg;
18427         void *hdr;
18428
18429         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18430         if (!msg)
18431                 return;
18432
18433         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18434         if (!hdr) {
18435                 nlmsg_free(msg);
18436                 return;
18437         }
18438
18439         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18440             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18441                                          wdev->netdev->ifindex)) ||
18442             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18443                               NL80211_ATTR_PAD) ||
18444             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
18445             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
18446                         NL80211_CHAN_NO_HT) ||
18447             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
18448                               NL80211_ATTR_PAD))
18449                 goto nla_put_failure;
18450
18451         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
18452             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
18453                 goto nla_put_failure;
18454
18455         genlmsg_end(msg, hdr);
18456
18457         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18458                                 NL80211_MCGRP_MLME, gfp);
18459         return;
18460
18461  nla_put_failure:
18462         nlmsg_free(msg);
18463 }
18464
18465 void cfg80211_assoc_comeback(struct net_device *netdev,
18466                              const u8 *ap_addr, u32 timeout)
18467 {
18468         struct wireless_dev *wdev = netdev->ieee80211_ptr;
18469         struct wiphy *wiphy = wdev->wiphy;
18470         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18471         struct sk_buff *msg;
18472         void *hdr;
18473
18474         trace_cfg80211_assoc_comeback(wdev, ap_addr, timeout);
18475
18476         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
18477         if (!msg)
18478                 return;
18479
18480         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ASSOC_COMEBACK);
18481         if (!hdr) {
18482                 nlmsg_free(msg);
18483                 return;
18484         }
18485
18486         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18487             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
18488             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ap_addr) ||
18489             nla_put_u32(msg, NL80211_ATTR_TIMEOUT, timeout))
18490                 goto nla_put_failure;
18491
18492         genlmsg_end(msg, hdr);
18493
18494         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18495                                 NL80211_MCGRP_MLME, GFP_KERNEL);
18496         return;
18497
18498  nla_put_failure:
18499         nlmsg_free(msg);
18500 }
18501 EXPORT_SYMBOL(cfg80211_assoc_comeback);
18502
18503 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
18504                                struct ieee80211_channel *chan,
18505                                unsigned int duration, gfp_t gfp)
18506 {
18507         struct wiphy *wiphy = wdev->wiphy;
18508         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18509
18510         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
18511         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
18512                                           rdev, wdev, cookie, chan,
18513                                           duration, gfp);
18514 }
18515 EXPORT_SYMBOL(cfg80211_ready_on_channel);
18516
18517 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
18518                                         struct ieee80211_channel *chan,
18519                                         gfp_t gfp)
18520 {
18521         struct wiphy *wiphy = wdev->wiphy;
18522         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18523
18524         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
18525         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
18526                                           rdev, wdev, cookie, chan, 0, gfp);
18527 }
18528 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
18529
18530 void cfg80211_tx_mgmt_expired(struct wireless_dev *wdev, u64 cookie,
18531                                         struct ieee80211_channel *chan,
18532                                         gfp_t gfp)
18533 {
18534         struct wiphy *wiphy = wdev->wiphy;
18535         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18536
18537         trace_cfg80211_tx_mgmt_expired(wdev, cookie, chan);
18538         nl80211_send_remain_on_chan_event(NL80211_CMD_FRAME_WAIT_CANCEL,
18539                                           rdev, wdev, cookie, chan, 0, gfp);
18540 }
18541 EXPORT_SYMBOL(cfg80211_tx_mgmt_expired);
18542
18543 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
18544                       struct station_info *sinfo, gfp_t gfp)
18545 {
18546         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18547         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18548         struct sk_buff *msg;
18549
18550         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
18551
18552         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18553         if (!msg)
18554                 return;
18555
18556         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
18557                                  rdev, dev, mac_addr, sinfo) < 0) {
18558                 nlmsg_free(msg);
18559                 return;
18560         }
18561
18562         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18563                                 NL80211_MCGRP_MLME, gfp);
18564 }
18565 EXPORT_SYMBOL(cfg80211_new_sta);
18566
18567 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
18568                             struct station_info *sinfo, gfp_t gfp)
18569 {
18570         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18571         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18572         struct sk_buff *msg;
18573         struct station_info empty_sinfo = {};
18574
18575         if (!sinfo)
18576                 sinfo = &empty_sinfo;
18577
18578         trace_cfg80211_del_sta(dev, mac_addr);
18579
18580         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18581         if (!msg) {
18582                 cfg80211_sinfo_release_content(sinfo);
18583                 return;
18584         }
18585
18586         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
18587                                  rdev, dev, mac_addr, sinfo) < 0) {
18588                 nlmsg_free(msg);
18589                 return;
18590         }
18591
18592         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18593                                 NL80211_MCGRP_MLME, gfp);
18594 }
18595 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
18596
18597 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
18598                           enum nl80211_connect_failed_reason reason,
18599                           gfp_t gfp)
18600 {
18601         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
18602         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18603         struct sk_buff *msg;
18604         void *hdr;
18605
18606         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
18607         if (!msg)
18608                 return;
18609
18610         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
18611         if (!hdr) {
18612                 nlmsg_free(msg);
18613                 return;
18614         }
18615
18616         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18617             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
18618             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
18619                 goto nla_put_failure;
18620
18621         genlmsg_end(msg, hdr);
18622
18623         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18624                                 NL80211_MCGRP_MLME, gfp);
18625         return;
18626
18627  nla_put_failure:
18628         nlmsg_free(msg);
18629 }
18630 EXPORT_SYMBOL(cfg80211_conn_failed);
18631
18632 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
18633                                        const u8 *addr, gfp_t gfp)
18634 {
18635         struct wireless_dev *wdev = dev->ieee80211_ptr;
18636         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18637         struct sk_buff *msg;
18638         void *hdr;
18639         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
18640
18641         if (!nlportid)
18642                 return false;
18643
18644         msg = nlmsg_new(100, gfp);
18645         if (!msg)
18646                 return true;
18647
18648         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
18649         if (!hdr) {
18650                 nlmsg_free(msg);
18651                 return true;
18652         }
18653
18654         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18655             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18656             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
18657                 goto nla_put_failure;
18658
18659         genlmsg_end(msg, hdr);
18660         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18661         return true;
18662
18663  nla_put_failure:
18664         nlmsg_free(msg);
18665         return true;
18666 }
18667
18668 bool cfg80211_rx_spurious_frame(struct net_device *dev,
18669                                 const u8 *addr, gfp_t gfp)
18670 {
18671         struct wireless_dev *wdev = dev->ieee80211_ptr;
18672         bool ret;
18673
18674         trace_cfg80211_rx_spurious_frame(dev, addr);
18675
18676         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18677                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
18678                 trace_cfg80211_return_bool(false);
18679                 return false;
18680         }
18681         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
18682                                          addr, gfp);
18683         trace_cfg80211_return_bool(ret);
18684         return ret;
18685 }
18686 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
18687
18688 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
18689                                         const u8 *addr, gfp_t gfp)
18690 {
18691         struct wireless_dev *wdev = dev->ieee80211_ptr;
18692         bool ret;
18693
18694         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
18695
18696         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
18697                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
18698                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
18699                 trace_cfg80211_return_bool(false);
18700                 return false;
18701         }
18702         ret = __nl80211_unexpected_frame(dev,
18703                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
18704                                          addr, gfp);
18705         trace_cfg80211_return_bool(ret);
18706         return ret;
18707 }
18708 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
18709
18710 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
18711                       struct wireless_dev *wdev, u32 nlportid,
18712                       struct cfg80211_rx_info *info, gfp_t gfp)
18713 {
18714         struct net_device *netdev = wdev->netdev;
18715         struct sk_buff *msg;
18716         void *hdr;
18717
18718         msg = nlmsg_new(100 + info->len, gfp);
18719         if (!msg)
18720                 return -ENOMEM;
18721
18722         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
18723         if (!hdr) {
18724                 nlmsg_free(msg);
18725                 return -ENOMEM;
18726         }
18727
18728         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18729             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18730                                         netdev->ifindex)) ||
18731             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18732                               NL80211_ATTR_PAD) ||
18733             (info->have_link_id &&
18734              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, info->link_id)) ||
18735             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, KHZ_TO_MHZ(info->freq)) ||
18736             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET, info->freq % 1000) ||
18737             (info->sig_dbm &&
18738              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, info->sig_dbm)) ||
18739             nla_put(msg, NL80211_ATTR_FRAME, info->len, info->buf) ||
18740             (info->flags &&
18741              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, info->flags)) ||
18742             (info->rx_tstamp && nla_put_u64_64bit(msg,
18743                                                   NL80211_ATTR_RX_HW_TIMESTAMP,
18744                                                   info->rx_tstamp,
18745                                                   NL80211_ATTR_PAD)) ||
18746             (info->ack_tstamp && nla_put_u64_64bit(msg,
18747                                                    NL80211_ATTR_TX_HW_TIMESTAMP,
18748                                                    info->ack_tstamp,
18749                                                    NL80211_ATTR_PAD)))
18750                 goto nla_put_failure;
18751
18752         genlmsg_end(msg, hdr);
18753
18754         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18755
18756  nla_put_failure:
18757         nlmsg_free(msg);
18758         return -ENOBUFS;
18759 }
18760
18761 static void nl80211_frame_tx_status(struct wireless_dev *wdev,
18762                                     struct cfg80211_tx_status *status,
18763                                     gfp_t gfp, enum nl80211_commands command)
18764 {
18765         struct wiphy *wiphy = wdev->wiphy;
18766         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
18767         struct net_device *netdev = wdev->netdev;
18768         struct sk_buff *msg;
18769         void *hdr;
18770
18771         if (command == NL80211_CMD_FRAME_TX_STATUS)
18772                 trace_cfg80211_mgmt_tx_status(wdev, status->cookie,
18773                                               status->ack);
18774         else
18775                 trace_cfg80211_control_port_tx_status(wdev, status->cookie,
18776                                                       status->ack);
18777
18778         msg = nlmsg_new(100 + status->len, gfp);
18779         if (!msg)
18780                 return;
18781
18782         hdr = nl80211hdr_put(msg, 0, 0, 0, command);
18783         if (!hdr) {
18784                 nlmsg_free(msg);
18785                 return;
18786         }
18787
18788         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18789             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
18790                                    netdev->ifindex)) ||
18791             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18792                               NL80211_ATTR_PAD) ||
18793             nla_put(msg, NL80211_ATTR_FRAME, status->len, status->buf) ||
18794             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, status->cookie,
18795                               NL80211_ATTR_PAD) ||
18796             (status->ack && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
18797             (status->tx_tstamp &&
18798              nla_put_u64_64bit(msg, NL80211_ATTR_TX_HW_TIMESTAMP,
18799                                status->tx_tstamp, NL80211_ATTR_PAD)) ||
18800             (status->ack_tstamp &&
18801              nla_put_u64_64bit(msg, NL80211_ATTR_RX_HW_TIMESTAMP,
18802                                status->ack_tstamp, NL80211_ATTR_PAD)))
18803                 goto nla_put_failure;
18804
18805         genlmsg_end(msg, hdr);
18806
18807         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18808                                 NL80211_MCGRP_MLME, gfp);
18809         return;
18810
18811 nla_put_failure:
18812         nlmsg_free(msg);
18813 }
18814
18815 void cfg80211_control_port_tx_status(struct wireless_dev *wdev, u64 cookie,
18816                                      const u8 *buf, size_t len, bool ack,
18817                                      gfp_t gfp)
18818 {
18819         struct cfg80211_tx_status status = {
18820                 .cookie = cookie,
18821                 .buf = buf,
18822                 .len = len,
18823                 .ack = ack
18824         };
18825
18826         nl80211_frame_tx_status(wdev, &status, gfp,
18827                                 NL80211_CMD_CONTROL_PORT_FRAME_TX_STATUS);
18828 }
18829 EXPORT_SYMBOL(cfg80211_control_port_tx_status);
18830
18831 void cfg80211_mgmt_tx_status_ext(struct wireless_dev *wdev,
18832                                  struct cfg80211_tx_status *status, gfp_t gfp)
18833 {
18834         nl80211_frame_tx_status(wdev, status, gfp, NL80211_CMD_FRAME_TX_STATUS);
18835 }
18836 EXPORT_SYMBOL(cfg80211_mgmt_tx_status_ext);
18837
18838 static int __nl80211_rx_control_port(struct net_device *dev,
18839                                      struct sk_buff *skb,
18840                                      bool unencrypted,
18841                                      int link_id,
18842                                      gfp_t gfp)
18843 {
18844         struct wireless_dev *wdev = dev->ieee80211_ptr;
18845         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18846         struct ethhdr *ehdr = eth_hdr(skb);
18847         const u8 *addr = ehdr->h_source;
18848         u16 proto = be16_to_cpu(skb->protocol);
18849         struct sk_buff *msg;
18850         void *hdr;
18851         struct nlattr *frame;
18852
18853         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
18854
18855         if (!nlportid)
18856                 return -ENOENT;
18857
18858         msg = nlmsg_new(100 + skb->len, gfp);
18859         if (!msg)
18860                 return -ENOMEM;
18861
18862         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
18863         if (!hdr) {
18864                 nlmsg_free(msg);
18865                 return -ENOBUFS;
18866         }
18867
18868         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18869             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
18870             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
18871                               NL80211_ATTR_PAD) ||
18872             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
18873             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
18874             (link_id >= 0 &&
18875              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)) ||
18876             (unencrypted && nla_put_flag(msg,
18877                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
18878                 goto nla_put_failure;
18879
18880         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
18881         if (!frame)
18882                 goto nla_put_failure;
18883
18884         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
18885         genlmsg_end(msg, hdr);
18886
18887         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
18888
18889  nla_put_failure:
18890         nlmsg_free(msg);
18891         return -ENOBUFS;
18892 }
18893
18894 bool cfg80211_rx_control_port(struct net_device *dev, struct sk_buff *skb,
18895                               bool unencrypted, int link_id)
18896 {
18897         int ret;
18898
18899         trace_cfg80211_rx_control_port(dev, skb, unencrypted, link_id);
18900         ret = __nl80211_rx_control_port(dev, skb, unencrypted, link_id,
18901                                         GFP_ATOMIC);
18902         trace_cfg80211_return_bool(ret == 0);
18903         return ret == 0;
18904 }
18905 EXPORT_SYMBOL(cfg80211_rx_control_port);
18906
18907 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
18908                                             const char *mac, gfp_t gfp)
18909 {
18910         struct wireless_dev *wdev = dev->ieee80211_ptr;
18911         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18912         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
18913         void **cb;
18914
18915         if (!msg)
18916                 return NULL;
18917
18918         cb = (void **)msg->cb;
18919
18920         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
18921         if (!cb[0]) {
18922                 nlmsg_free(msg);
18923                 return NULL;
18924         }
18925
18926         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
18927             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
18928                 goto nla_put_failure;
18929
18930         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
18931                 goto nla_put_failure;
18932
18933         cb[1] = nla_nest_start_noflag(msg, NL80211_ATTR_CQM);
18934         if (!cb[1])
18935                 goto nla_put_failure;
18936
18937         cb[2] = rdev;
18938
18939         return msg;
18940  nla_put_failure:
18941         nlmsg_free(msg);
18942         return NULL;
18943 }
18944
18945 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
18946 {
18947         void **cb = (void **)msg->cb;
18948         struct cfg80211_registered_device *rdev = cb[2];
18949
18950         nla_nest_end(msg, cb[1]);
18951         genlmsg_end(msg, cb[0]);
18952
18953         memset(msg->cb, 0, sizeof(msg->cb));
18954
18955         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
18956                                 NL80211_MCGRP_MLME, gfp);
18957 }
18958
18959 void cfg80211_cqm_rssi_notify(struct net_device *dev,
18960                               enum nl80211_cqm_rssi_threshold_event rssi_event,
18961                               s32 rssi_level, gfp_t gfp)
18962 {
18963         struct sk_buff *msg;
18964         struct wireless_dev *wdev = dev->ieee80211_ptr;
18965         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
18966
18967         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
18968
18969         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
18970                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
18971                 return;
18972
18973         if (wdev->cqm_config) {
18974                 wdev->cqm_config->last_rssi_event_value = rssi_level;
18975
18976                 cfg80211_cqm_rssi_update(rdev, dev);
18977
18978                 if (rssi_level == 0)
18979                         rssi_level = wdev->cqm_config->last_rssi_event_value;
18980         }
18981
18982         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
18983         if (!msg)
18984                 return;
18985
18986         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
18987                         rssi_event))
18988                 goto nla_put_failure;
18989
18990         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
18991                                       rssi_level))
18992                 goto nla_put_failure;
18993
18994         cfg80211_send_cqm(msg, gfp);
18995
18996         return;
18997
18998  nla_put_failure:
18999         nlmsg_free(msg);
19000 }
19001 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
19002
19003 void cfg80211_cqm_txe_notify(struct net_device *dev,
19004                              const u8 *peer, u32 num_packets,
19005                              u32 rate, u32 intvl, gfp_t gfp)
19006 {
19007         struct sk_buff *msg;
19008
19009         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19010         if (!msg)
19011                 return;
19012
19013         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
19014                 goto nla_put_failure;
19015
19016         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
19017                 goto nla_put_failure;
19018
19019         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
19020                 goto nla_put_failure;
19021
19022         cfg80211_send_cqm(msg, gfp);
19023         return;
19024
19025  nla_put_failure:
19026         nlmsg_free(msg);
19027 }
19028 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
19029
19030 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
19031                                  const u8 *peer, u32 num_packets, gfp_t gfp)
19032 {
19033         struct sk_buff *msg;
19034
19035         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
19036
19037         msg = cfg80211_prepare_cqm(dev, peer, gfp);
19038         if (!msg)
19039                 return;
19040
19041         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
19042                 goto nla_put_failure;
19043
19044         cfg80211_send_cqm(msg, gfp);
19045         return;
19046
19047  nla_put_failure:
19048         nlmsg_free(msg);
19049 }
19050 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
19051
19052 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
19053 {
19054         struct sk_buff *msg;
19055
19056         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
19057         if (!msg)
19058                 return;
19059
19060         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
19061                 goto nla_put_failure;
19062
19063         cfg80211_send_cqm(msg, gfp);
19064         return;
19065
19066  nla_put_failure:
19067         nlmsg_free(msg);
19068 }
19069 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
19070
19071 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
19072                                      struct net_device *netdev, const u8 *bssid,
19073                                      const u8 *replay_ctr, gfp_t gfp)
19074 {
19075         struct sk_buff *msg;
19076         struct nlattr *rekey_attr;
19077         void *hdr;
19078
19079         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19080         if (!msg)
19081                 return;
19082
19083         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
19084         if (!hdr) {
19085                 nlmsg_free(msg);
19086                 return;
19087         }
19088
19089         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19090             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19091             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
19092                 goto nla_put_failure;
19093
19094         rekey_attr = nla_nest_start_noflag(msg, NL80211_ATTR_REKEY_DATA);
19095         if (!rekey_attr)
19096                 goto nla_put_failure;
19097
19098         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
19099                     NL80211_REPLAY_CTR_LEN, replay_ctr))
19100                 goto nla_put_failure;
19101
19102         nla_nest_end(msg, rekey_attr);
19103
19104         genlmsg_end(msg, hdr);
19105
19106         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19107                                 NL80211_MCGRP_MLME, gfp);
19108         return;
19109
19110  nla_put_failure:
19111         nlmsg_free(msg);
19112 }
19113
19114 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
19115                                const u8 *replay_ctr, gfp_t gfp)
19116 {
19117         struct wireless_dev *wdev = dev->ieee80211_ptr;
19118         struct wiphy *wiphy = wdev->wiphy;
19119         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19120
19121         trace_cfg80211_gtk_rekey_notify(dev, bssid);
19122         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
19123 }
19124 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
19125
19126 static void
19127 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
19128                                struct net_device *netdev, int index,
19129                                const u8 *bssid, bool preauth, gfp_t gfp)
19130 {
19131         struct sk_buff *msg;
19132         struct nlattr *attr;
19133         void *hdr;
19134
19135         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19136         if (!msg)
19137                 return;
19138
19139         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
19140         if (!hdr) {
19141                 nlmsg_free(msg);
19142                 return;
19143         }
19144
19145         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19146             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19147                 goto nla_put_failure;
19148
19149         attr = nla_nest_start_noflag(msg, NL80211_ATTR_PMKSA_CANDIDATE);
19150         if (!attr)
19151                 goto nla_put_failure;
19152
19153         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
19154             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
19155             (preauth &&
19156              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
19157                 goto nla_put_failure;
19158
19159         nla_nest_end(msg, attr);
19160
19161         genlmsg_end(msg, hdr);
19162
19163         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19164                                 NL80211_MCGRP_MLME, gfp);
19165         return;
19166
19167  nla_put_failure:
19168         nlmsg_free(msg);
19169 }
19170
19171 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
19172                                      const u8 *bssid, bool preauth, gfp_t gfp)
19173 {
19174         struct wireless_dev *wdev = dev->ieee80211_ptr;
19175         struct wiphy *wiphy = wdev->wiphy;
19176         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19177
19178         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
19179         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
19180 }
19181 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
19182
19183 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
19184                                      struct net_device *netdev,
19185                                      unsigned int link_id,
19186                                      struct cfg80211_chan_def *chandef,
19187                                      gfp_t gfp,
19188                                      enum nl80211_commands notif,
19189                                      u8 count, bool quiet, u16 punct_bitmap)
19190 {
19191         struct wireless_dev *wdev = netdev->ieee80211_ptr;
19192         struct sk_buff *msg;
19193         void *hdr;
19194
19195         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19196         if (!msg)
19197                 return;
19198
19199         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
19200         if (!hdr) {
19201                 nlmsg_free(msg);
19202                 return;
19203         }
19204
19205         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
19206                 goto nla_put_failure;
19207
19208         if (wdev->valid_links &&
19209             nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id))
19210                 goto nla_put_failure;
19211
19212         if (nl80211_send_chandef(msg, chandef))
19213                 goto nla_put_failure;
19214
19215         if (notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) {
19216                 if (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count))
19217                         goto nla_put_failure;
19218                 if (quiet &&
19219                     nla_put_flag(msg, NL80211_ATTR_CH_SWITCH_BLOCK_TX))
19220                         goto nla_put_failure;
19221         }
19222
19223         if (nla_put_u32(msg, NL80211_ATTR_PUNCT_BITMAP, punct_bitmap))
19224                 goto nla_put_failure;
19225
19226         genlmsg_end(msg, hdr);
19227
19228         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19229                                 NL80211_MCGRP_MLME, gfp);
19230         return;
19231
19232  nla_put_failure:
19233         nlmsg_free(msg);
19234 }
19235
19236 void cfg80211_ch_switch_notify(struct net_device *dev,
19237                                struct cfg80211_chan_def *chandef,
19238                                unsigned int link_id, u16 punct_bitmap)
19239 {
19240         struct wireless_dev *wdev = dev->ieee80211_ptr;
19241         struct wiphy *wiphy = wdev->wiphy;
19242         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19243
19244         ASSERT_WDEV_LOCK(wdev);
19245         WARN_INVALID_LINK_ID(wdev, link_id);
19246
19247         trace_cfg80211_ch_switch_notify(dev, chandef, link_id, punct_bitmap);
19248
19249         switch (wdev->iftype) {
19250         case NL80211_IFTYPE_STATION:
19251         case NL80211_IFTYPE_P2P_CLIENT:
19252                 if (!WARN_ON(!wdev->links[link_id].client.current_bss))
19253                         cfg80211_update_assoc_bss_entry(wdev, link_id,
19254                                                         chandef->chan);
19255                 break;
19256         case NL80211_IFTYPE_MESH_POINT:
19257                 wdev->u.mesh.chandef = *chandef;
19258                 wdev->u.mesh.preset_chandef = *chandef;
19259                 break;
19260         case NL80211_IFTYPE_AP:
19261         case NL80211_IFTYPE_P2P_GO:
19262                 wdev->links[link_id].ap.chandef = *chandef;
19263                 break;
19264         case NL80211_IFTYPE_ADHOC:
19265                 wdev->u.ibss.chandef = *chandef;
19266                 break;
19267         default:
19268                 WARN_ON(1);
19269                 break;
19270         }
19271
19272         cfg80211_sched_dfs_chan_update(rdev);
19273
19274         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19275                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0, false,
19276                                  punct_bitmap);
19277 }
19278 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
19279
19280 void cfg80211_ch_switch_started_notify(struct net_device *dev,
19281                                        struct cfg80211_chan_def *chandef,
19282                                        unsigned int link_id, u8 count,
19283                                        bool quiet, u16 punct_bitmap)
19284 {
19285         struct wireless_dev *wdev = dev->ieee80211_ptr;
19286         struct wiphy *wiphy = wdev->wiphy;
19287         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19288
19289         ASSERT_WDEV_LOCK(wdev);
19290         WARN_INVALID_LINK_ID(wdev, link_id);
19291
19292         trace_cfg80211_ch_switch_started_notify(dev, chandef, link_id,
19293                                                 punct_bitmap);
19294
19295
19296         nl80211_ch_switch_notify(rdev, dev, link_id, chandef, GFP_KERNEL,
19297                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY,
19298                                  count, quiet, punct_bitmap);
19299 }
19300 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
19301
19302 int cfg80211_bss_color_notify(struct net_device *dev,
19303                               enum nl80211_commands cmd, u8 count,
19304                               u64 color_bitmap)
19305 {
19306         struct wireless_dev *wdev = dev->ieee80211_ptr;
19307         struct wiphy *wiphy = wdev->wiphy;
19308         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19309         struct sk_buff *msg;
19310         void *hdr;
19311
19312         ASSERT_WDEV_LOCK(wdev);
19313
19314         trace_cfg80211_bss_color_notify(dev, cmd, count, color_bitmap);
19315
19316         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19317         if (!msg)
19318                 return -ENOMEM;
19319
19320         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
19321         if (!hdr)
19322                 goto nla_put_failure;
19323
19324         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19325                 goto nla_put_failure;
19326
19327         if (cmd == NL80211_CMD_COLOR_CHANGE_STARTED &&
19328             nla_put_u32(msg, NL80211_ATTR_COLOR_CHANGE_COUNT, count))
19329                 goto nla_put_failure;
19330
19331         if (cmd == NL80211_CMD_OBSS_COLOR_COLLISION &&
19332             nla_put_u64_64bit(msg, NL80211_ATTR_OBSS_COLOR_BITMAP,
19333                               color_bitmap, NL80211_ATTR_PAD))
19334                 goto nla_put_failure;
19335
19336         genlmsg_end(msg, hdr);
19337
19338         return genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
19339                                        msg, 0, NL80211_MCGRP_MLME, GFP_KERNEL);
19340
19341 nla_put_failure:
19342         nlmsg_free(msg);
19343         return -EINVAL;
19344 }
19345 EXPORT_SYMBOL(cfg80211_bss_color_notify);
19346
19347 void
19348 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
19349                      const struct cfg80211_chan_def *chandef,
19350                      enum nl80211_radar_event event,
19351                      struct net_device *netdev, gfp_t gfp)
19352 {
19353         struct sk_buff *msg;
19354         void *hdr;
19355
19356         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19357         if (!msg)
19358                 return;
19359
19360         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
19361         if (!hdr) {
19362                 nlmsg_free(msg);
19363                 return;
19364         }
19365
19366         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19367                 goto nla_put_failure;
19368
19369         /* NOP and radar events don't need a netdev parameter */
19370         if (netdev) {
19371                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
19372
19373                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19374                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19375                                       NL80211_ATTR_PAD))
19376                         goto nla_put_failure;
19377         }
19378
19379         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
19380                 goto nla_put_failure;
19381
19382         if (nl80211_send_chandef(msg, chandef))
19383                 goto nla_put_failure;
19384
19385         genlmsg_end(msg, hdr);
19386
19387         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19388                                 NL80211_MCGRP_MLME, gfp);
19389         return;
19390
19391  nla_put_failure:
19392         nlmsg_free(msg);
19393 }
19394
19395 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
19396                                        struct sta_opmode_info *sta_opmode,
19397                                        gfp_t gfp)
19398 {
19399         struct sk_buff *msg;
19400         struct wireless_dev *wdev = dev->ieee80211_ptr;
19401         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19402         void *hdr;
19403
19404         if (WARN_ON(!mac))
19405                 return;
19406
19407         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19408         if (!msg)
19409                 return;
19410
19411         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
19412         if (!hdr) {
19413                 nlmsg_free(msg);
19414                 return;
19415         }
19416
19417         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
19418                 goto nla_put_failure;
19419
19420         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
19421                 goto nla_put_failure;
19422
19423         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
19424                 goto nla_put_failure;
19425
19426         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
19427             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
19428                 goto nla_put_failure;
19429
19430         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
19431             nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
19432                 goto nla_put_failure;
19433
19434         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
19435             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
19436                 goto nla_put_failure;
19437
19438         genlmsg_end(msg, hdr);
19439
19440         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19441                                 NL80211_MCGRP_MLME, gfp);
19442
19443         return;
19444
19445 nla_put_failure:
19446         nlmsg_free(msg);
19447 }
19448 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
19449
19450 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
19451                            u64 cookie, bool acked, s32 ack_signal,
19452                            bool is_valid_ack_signal, gfp_t gfp)
19453 {
19454         struct wireless_dev *wdev = dev->ieee80211_ptr;
19455         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19456         struct sk_buff *msg;
19457         void *hdr;
19458
19459         trace_cfg80211_probe_status(dev, addr, cookie, acked);
19460
19461         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19462
19463         if (!msg)
19464                 return;
19465
19466         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
19467         if (!hdr) {
19468                 nlmsg_free(msg);
19469                 return;
19470         }
19471
19472         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19473             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19474             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
19475             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
19476                               NL80211_ATTR_PAD) ||
19477             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
19478             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
19479                                                 ack_signal)))
19480                 goto nla_put_failure;
19481
19482         genlmsg_end(msg, hdr);
19483
19484         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19485                                 NL80211_MCGRP_MLME, gfp);
19486         return;
19487
19488  nla_put_failure:
19489         nlmsg_free(msg);
19490 }
19491 EXPORT_SYMBOL(cfg80211_probe_status);
19492
19493 void cfg80211_report_obss_beacon_khz(struct wiphy *wiphy, const u8 *frame,
19494                                      size_t len, int freq, int sig_dbm)
19495 {
19496         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19497         struct sk_buff *msg;
19498         void *hdr;
19499         struct cfg80211_beacon_registration *reg;
19500
19501         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
19502
19503         spin_lock_bh(&rdev->beacon_registrations_lock);
19504         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
19505                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
19506                 if (!msg) {
19507                         spin_unlock_bh(&rdev->beacon_registrations_lock);
19508                         return;
19509                 }
19510
19511                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
19512                 if (!hdr)
19513                         goto nla_put_failure;
19514
19515                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19516                     (freq &&
19517                      (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
19518                                   KHZ_TO_MHZ(freq)) ||
19519                       nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ_OFFSET,
19520                                   freq % 1000))) ||
19521                     (sig_dbm &&
19522                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
19523                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
19524                         goto nla_put_failure;
19525
19526                 genlmsg_end(msg, hdr);
19527
19528                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
19529         }
19530         spin_unlock_bh(&rdev->beacon_registrations_lock);
19531         return;
19532
19533  nla_put_failure:
19534         spin_unlock_bh(&rdev->beacon_registrations_lock);
19535         nlmsg_free(msg);
19536 }
19537 EXPORT_SYMBOL(cfg80211_report_obss_beacon_khz);
19538
19539 #ifdef CONFIG_PM
19540 static int cfg80211_net_detect_results(struct sk_buff *msg,
19541                                        struct cfg80211_wowlan_wakeup *wakeup)
19542 {
19543         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
19544         struct nlattr *nl_results, *nl_match, *nl_freqs;
19545         int i, j;
19546
19547         nl_results = nla_nest_start_noflag(msg,
19548                                            NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
19549         if (!nl_results)
19550                 return -EMSGSIZE;
19551
19552         for (i = 0; i < nd->n_matches; i++) {
19553                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
19554
19555                 nl_match = nla_nest_start_noflag(msg, i);
19556                 if (!nl_match)
19557                         break;
19558
19559                 /* The SSID attribute is optional in nl80211, but for
19560                  * simplicity reasons it's always present in the
19561                  * cfg80211 structure.  If a driver can't pass the
19562                  * SSID, that needs to be changed.  A zero length SSID
19563                  * is still a valid SSID (wildcard), so it cannot be
19564                  * used for this purpose.
19565                  */
19566                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
19567                             match->ssid.ssid)) {
19568                         nla_nest_cancel(msg, nl_match);
19569                         goto out;
19570                 }
19571
19572                 if (match->n_channels) {
19573                         nl_freqs = nla_nest_start_noflag(msg,
19574                                                          NL80211_ATTR_SCAN_FREQUENCIES);
19575                         if (!nl_freqs) {
19576                                 nla_nest_cancel(msg, nl_match);
19577                                 goto out;
19578                         }
19579
19580                         for (j = 0; j < match->n_channels; j++) {
19581                                 if (nla_put_u32(msg, j, match->channels[j])) {
19582                                         nla_nest_cancel(msg, nl_freqs);
19583                                         nla_nest_cancel(msg, nl_match);
19584                                         goto out;
19585                                 }
19586                         }
19587
19588                         nla_nest_end(msg, nl_freqs);
19589                 }
19590
19591                 nla_nest_end(msg, nl_match);
19592         }
19593
19594 out:
19595         nla_nest_end(msg, nl_results);
19596         return 0;
19597 }
19598
19599 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
19600                                    struct cfg80211_wowlan_wakeup *wakeup,
19601                                    gfp_t gfp)
19602 {
19603         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19604         struct sk_buff *msg;
19605         void *hdr;
19606         int size = 200;
19607
19608         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
19609
19610         if (wakeup)
19611                 size += wakeup->packet_present_len;
19612
19613         msg = nlmsg_new(size, gfp);
19614         if (!msg)
19615                 return;
19616
19617         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
19618         if (!hdr)
19619                 goto free_msg;
19620
19621         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19622             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19623                               NL80211_ATTR_PAD))
19624                 goto free_msg;
19625
19626         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
19627                                         wdev->netdev->ifindex))
19628                 goto free_msg;
19629
19630         if (wakeup) {
19631                 struct nlattr *reasons;
19632
19633                 reasons = nla_nest_start_noflag(msg,
19634                                                 NL80211_ATTR_WOWLAN_TRIGGERS);
19635                 if (!reasons)
19636                         goto free_msg;
19637
19638                 if (wakeup->disconnect &&
19639                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
19640                         goto free_msg;
19641                 if (wakeup->magic_pkt &&
19642                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
19643                         goto free_msg;
19644                 if (wakeup->gtk_rekey_failure &&
19645                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
19646                         goto free_msg;
19647                 if (wakeup->eap_identity_req &&
19648                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
19649                         goto free_msg;
19650                 if (wakeup->four_way_handshake &&
19651                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
19652                         goto free_msg;
19653                 if (wakeup->rfkill_release &&
19654                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
19655                         goto free_msg;
19656
19657                 if (wakeup->pattern_idx >= 0 &&
19658                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
19659                                 wakeup->pattern_idx))
19660                         goto free_msg;
19661
19662                 if (wakeup->tcp_match &&
19663                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
19664                         goto free_msg;
19665
19666                 if (wakeup->tcp_connlost &&
19667                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
19668                         goto free_msg;
19669
19670                 if (wakeup->tcp_nomoretokens &&
19671                     nla_put_flag(msg,
19672                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
19673                         goto free_msg;
19674
19675                 if (wakeup->packet) {
19676                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
19677                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
19678
19679                         if (!wakeup->packet_80211) {
19680                                 pkt_attr =
19681                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
19682                                 len_attr =
19683                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
19684                         }
19685
19686                         if (wakeup->packet_len &&
19687                             nla_put_u32(msg, len_attr, wakeup->packet_len))
19688                                 goto free_msg;
19689
19690                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
19691                                     wakeup->packet))
19692                                 goto free_msg;
19693                 }
19694
19695                 if (wakeup->net_detect &&
19696                     cfg80211_net_detect_results(msg, wakeup))
19697                                 goto free_msg;
19698
19699                 nla_nest_end(msg, reasons);
19700         }
19701
19702         genlmsg_end(msg, hdr);
19703
19704         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19705                                 NL80211_MCGRP_MLME, gfp);
19706         return;
19707
19708  free_msg:
19709         nlmsg_free(msg);
19710 }
19711 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
19712 #endif
19713
19714 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
19715                                 enum nl80211_tdls_operation oper,
19716                                 u16 reason_code, gfp_t gfp)
19717 {
19718         struct wireless_dev *wdev = dev->ieee80211_ptr;
19719         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19720         struct sk_buff *msg;
19721         void *hdr;
19722
19723         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
19724                                          reason_code);
19725
19726         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19727         if (!msg)
19728                 return;
19729
19730         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
19731         if (!hdr) {
19732                 nlmsg_free(msg);
19733                 return;
19734         }
19735
19736         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19737             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19738             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
19739             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
19740             (reason_code > 0 &&
19741              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
19742                 goto nla_put_failure;
19743
19744         genlmsg_end(msg, hdr);
19745
19746         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19747                                 NL80211_MCGRP_MLME, gfp);
19748         return;
19749
19750  nla_put_failure:
19751         nlmsg_free(msg);
19752 }
19753 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
19754
19755 static int nl80211_netlink_notify(struct notifier_block * nb,
19756                                   unsigned long state,
19757                                   void *_notify)
19758 {
19759         struct netlink_notify *notify = _notify;
19760         struct cfg80211_registered_device *rdev;
19761         struct wireless_dev *wdev;
19762         struct cfg80211_beacon_registration *reg, *tmp;
19763
19764         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
19765                 return NOTIFY_DONE;
19766
19767         rcu_read_lock();
19768
19769         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
19770                 struct cfg80211_sched_scan_request *sched_scan_req;
19771
19772                 list_for_each_entry_rcu(sched_scan_req,
19773                                         &rdev->sched_scan_req_list,
19774                                         list) {
19775                         if (sched_scan_req->owner_nlportid == notify->portid) {
19776                                 sched_scan_req->nl_owner_dead = true;
19777                                 schedule_work(&rdev->sched_scan_stop_wk);
19778                         }
19779                 }
19780
19781                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
19782                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
19783
19784                         if (wdev->owner_nlportid == notify->portid) {
19785                                 wdev->nl_owner_dead = true;
19786                                 schedule_work(&rdev->destroy_work);
19787                         } else if (wdev->conn_owner_nlportid == notify->portid) {
19788                                 schedule_work(&wdev->disconnect_wk);
19789                         }
19790
19791                         cfg80211_release_pmsr(wdev, notify->portid);
19792                 }
19793
19794                 spin_lock_bh(&rdev->beacon_registrations_lock);
19795                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
19796                                          list) {
19797                         if (reg->nlportid == notify->portid) {
19798                                 list_del(&reg->list);
19799                                 kfree(reg);
19800                                 break;
19801                         }
19802                 }
19803                 spin_unlock_bh(&rdev->beacon_registrations_lock);
19804         }
19805
19806         rcu_read_unlock();
19807
19808         /*
19809          * It is possible that the user space process that is controlling the
19810          * indoor setting disappeared, so notify the regulatory core.
19811          */
19812         regulatory_netlink_notify(notify->portid);
19813         return NOTIFY_OK;
19814 }
19815
19816 static struct notifier_block nl80211_netlink_notifier = {
19817         .notifier_call = nl80211_netlink_notify,
19818 };
19819
19820 void cfg80211_ft_event(struct net_device *netdev,
19821                        struct cfg80211_ft_event_params *ft_event)
19822 {
19823         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19824         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19825         struct sk_buff *msg;
19826         void *hdr;
19827
19828         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
19829
19830         if (!ft_event->target_ap)
19831                 return;
19832
19833         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
19834                         GFP_KERNEL);
19835         if (!msg)
19836                 return;
19837
19838         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
19839         if (!hdr)
19840                 goto out;
19841
19842         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19843             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19844             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
19845                 goto out;
19846
19847         if (ft_event->ies &&
19848             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
19849                 goto out;
19850         if (ft_event->ric_ies &&
19851             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
19852                     ft_event->ric_ies))
19853                 goto out;
19854
19855         genlmsg_end(msg, hdr);
19856
19857         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
19858                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19859         return;
19860  out:
19861         nlmsg_free(msg);
19862 }
19863 EXPORT_SYMBOL(cfg80211_ft_event);
19864
19865 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
19866 {
19867         struct cfg80211_registered_device *rdev;
19868         struct sk_buff *msg;
19869         void *hdr;
19870         u32 nlportid;
19871
19872         rdev = wiphy_to_rdev(wdev->wiphy);
19873         if (!rdev->crit_proto_nlportid)
19874                 return;
19875
19876         nlportid = rdev->crit_proto_nlportid;
19877         rdev->crit_proto_nlportid = 0;
19878
19879         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19880         if (!msg)
19881                 return;
19882
19883         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
19884         if (!hdr)
19885                 goto nla_put_failure;
19886
19887         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19888             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19889                               NL80211_ATTR_PAD))
19890                 goto nla_put_failure;
19891
19892         genlmsg_end(msg, hdr);
19893
19894         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
19895         return;
19896
19897  nla_put_failure:
19898         nlmsg_free(msg);
19899 }
19900 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
19901
19902 void nl80211_send_ap_stopped(struct wireless_dev *wdev, unsigned int link_id)
19903 {
19904         struct wiphy *wiphy = wdev->wiphy;
19905         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19906         struct sk_buff *msg;
19907         void *hdr;
19908
19909         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
19910         if (!msg)
19911                 return;
19912
19913         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
19914         if (!hdr)
19915                 goto out;
19916
19917         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19918             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
19919             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
19920                               NL80211_ATTR_PAD) ||
19921             (wdev->valid_links &&
19922              nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID, link_id)))
19923                 goto out;
19924
19925         genlmsg_end(msg, hdr);
19926
19927         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
19928                                 NL80211_MCGRP_MLME, GFP_KERNEL);
19929         return;
19930  out:
19931         nlmsg_free(msg);
19932 }
19933
19934 int cfg80211_external_auth_request(struct net_device *dev,
19935                                    struct cfg80211_external_auth_params *params,
19936                                    gfp_t gfp)
19937 {
19938         struct wireless_dev *wdev = dev->ieee80211_ptr;
19939         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
19940         struct sk_buff *msg;
19941         void *hdr;
19942
19943         if (!wdev->conn_owner_nlportid)
19944                 return -EINVAL;
19945
19946         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19947         if (!msg)
19948                 return -ENOMEM;
19949
19950         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
19951         if (!hdr)
19952                 goto nla_put_failure;
19953
19954         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19955             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
19956             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
19957             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
19958                         params->action) ||
19959             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
19960             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
19961                     params->ssid.ssid) ||
19962             (!is_zero_ether_addr(params->mld_addr) &&
19963              nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN, params->mld_addr)))
19964                 goto nla_put_failure;
19965
19966         genlmsg_end(msg, hdr);
19967         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
19968                         wdev->conn_owner_nlportid);
19969         return 0;
19970
19971  nla_put_failure:
19972         nlmsg_free(msg);
19973         return -ENOBUFS;
19974 }
19975 EXPORT_SYMBOL(cfg80211_external_auth_request);
19976
19977 void cfg80211_update_owe_info_event(struct net_device *netdev,
19978                                     struct cfg80211_update_owe_info *owe_info,
19979                                     gfp_t gfp)
19980 {
19981         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
19982         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
19983         struct sk_buff *msg;
19984         void *hdr;
19985
19986         trace_cfg80211_update_owe_info_event(wiphy, netdev, owe_info);
19987
19988         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
19989         if (!msg)
19990                 return;
19991
19992         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_UPDATE_OWE_INFO);
19993         if (!hdr)
19994                 goto nla_put_failure;
19995
19996         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
19997             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
19998             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, owe_info->peer))
19999                 goto nla_put_failure;
20000
20001         if (!owe_info->ie_len ||
20002             nla_put(msg, NL80211_ATTR_IE, owe_info->ie_len, owe_info->ie))
20003                 goto nla_put_failure;
20004
20005         if (owe_info->assoc_link_id != -1) {
20006                 if (nla_put_u8(msg, NL80211_ATTR_MLO_LINK_ID,
20007                                owe_info->assoc_link_id))
20008                         goto nla_put_failure;
20009
20010                 if (!is_zero_ether_addr(owe_info->peer_mld_addr) &&
20011                     nla_put(msg, NL80211_ATTR_MLD_ADDR, ETH_ALEN,
20012                             owe_info->peer_mld_addr))
20013                         goto nla_put_failure;
20014         }
20015
20016         genlmsg_end(msg, hdr);
20017
20018         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
20019                                 NL80211_MCGRP_MLME, gfp);
20020         return;
20021
20022 nla_put_failure:
20023         genlmsg_cancel(msg, hdr);
20024         nlmsg_free(msg);
20025 }
20026 EXPORT_SYMBOL(cfg80211_update_owe_info_event);
20027
20028 /* initialisation/exit functions */
20029
20030 int __init nl80211_init(void)
20031 {
20032         int err;
20033
20034         err = genl_register_family(&nl80211_fam);
20035         if (err)
20036                 return err;
20037
20038         err = netlink_register_notifier(&nl80211_netlink_notifier);
20039         if (err)
20040                 goto err_out;
20041
20042         return 0;
20043  err_out:
20044         genl_unregister_family(&nl80211_fam);
20045         return err;
20046 }
20047
20048 void nl80211_exit(void)
20049 {
20050         netlink_unregister_notifier(&nl80211_netlink_notifier);
20051         genl_unregister_family(&nl80211_fam);
20052 }