net/wireless/nl80211.c

   1 /*
   2  * This is the new netlink-based wireless configuration interface.
   3  *
   4  * Copyright 2006-2010  Johannes Berg <johannes@sipsolutions.net>
   5  * Copyright 2013-2014  Intel Mobile Communications GmbH
   6  * Copyright 2015-2017  Intel Deutschland GmbH
   7  * Copyright (C) 2018 Intel Corporation
   8  */
   9
  10 #include <linux/if.h>
  11 #include <linux/module.h>
  12 #include <linux/err.h>
  13 #include <linux/slab.h>
  14 #include <linux/list.h>
  15 #include <linux/if_ether.h>
  16 #include <linux/ieee80211.h>
  17 #include <linux/nl80211.h>
  18 #include <linux/rtnetlink.h>
  19 #include <linux/netlink.h>
  20 #include <linux/nospec.h>
  21 #include <linux/etherdevice.h>
  22 #include <net/net_namespace.h>
  23 #include <net/genetlink.h>
  24 #include <net/cfg80211.h>
  25 #include <net/sock.h>
  26 #include <net/inet_connection_sock.h>
  27 #include "core.h"
  28 #include "nl80211.h"
  29 #include "reg.h"
  30 #include "rdev-ops.h"
  31
  32 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
  33                                    struct genl_info *info,
  34                                    struct cfg80211_crypto_settings *settings,
  35                                    int cipher_limit);
  36
  37 /* the netlink family */
  38 static struct genl_family nl80211_fam;
  39
  40 /* multicast groups */
  41 enum nl80211_multicast_groups {
  42         NL80211_MCGRP_CONFIG,
  43         NL80211_MCGRP_SCAN,
  44         NL80211_MCGRP_REGULATORY,
  45         NL80211_MCGRP_MLME,
  46         NL80211_MCGRP_VENDOR,
  47         NL80211_MCGRP_NAN,
  48         NL80211_MCGRP_TESTMODE /* keep last - ifdef! */
  49 };
  50
  51 static const struct genl_multicast_group nl80211_mcgrps[] = {
  52         [NL80211_MCGRP_CONFIG] = { .name = NL80211_MULTICAST_GROUP_CONFIG },
  53         [NL80211_MCGRP_SCAN] = { .name = NL80211_MULTICAST_GROUP_SCAN },
  54         [NL80211_MCGRP_REGULATORY] = { .name = NL80211_MULTICAST_GROUP_REG },
  55         [NL80211_MCGRP_MLME] = { .name = NL80211_MULTICAST_GROUP_MLME },
  56         [NL80211_MCGRP_VENDOR] = { .name = NL80211_MULTICAST_GROUP_VENDOR },
  57         [NL80211_MCGRP_NAN] = { .name = NL80211_MULTICAST_GROUP_NAN },
  58 #ifdef CONFIG_NL80211_TESTMODE
  59         [NL80211_MCGRP_TESTMODE] = { .name = NL80211_MULTICAST_GROUP_TESTMODE }
  60 #endif
  61 };
  62
  63 /* returns ERR_PTR values */
  64 static struct wireless_dev *
  65 __cfg80211_wdev_from_attrs(struct net *netns, struct nlattr **attrs)
  66 {
  67         struct cfg80211_registered_device *rdev;
  68         struct wireless_dev *result = NULL;
  69         bool have_ifidx = attrs[NL80211_ATTR_IFINDEX];
  70         bool have_wdev_id = attrs[NL80211_ATTR_WDEV];
  71         u64 wdev_id;
  72         int wiphy_idx = -1;
  73         int ifidx = -1;
  74
  75         ASSERT_RTNL();
  76
  77         if (!have_ifidx && !have_wdev_id)
  78                 return ERR_PTR(-EINVAL);
  79
  80         if (have_ifidx)
  81                 ifidx = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
  82         if (have_wdev_id) {
  83                 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
  84                 wiphy_idx = wdev_id >> 32;
  85         }
  86
  87         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
  88                 struct wireless_dev *wdev;
  89
  90                 if (wiphy_net(&rdev->wiphy) != netns)
  91                         continue;
  92
  93                 if (have_wdev_id && rdev->wiphy_idx != wiphy_idx)
  94                         continue;
  95
  96                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
  97                         if (have_ifidx && wdev->netdev &&
  98                             wdev->netdev->ifindex == ifidx) {
  99                                 result = wdev;
 100                                 break;
 101                         }
 102                         if (have_wdev_id && wdev->identifier == (u32)wdev_id) {
 103                                 result = wdev;
 104                                 break;
 105                         }
 106                 }
 107
 108                 if (result)
 109                         break;
 110         }
 111
 112         if (result)
 113                 return result;
 114         return ERR_PTR(-ENODEV);
 115 }
 116
 117 static struct cfg80211_registered_device *
 118 __cfg80211_rdev_from_attrs(struct net *netns, struct nlattr **attrs)
 119 {
 120         struct cfg80211_registered_device *rdev = NULL, *tmp;
 121         struct net_device *netdev;
 122
 123         ASSERT_RTNL();
 124
 125         if (!attrs[NL80211_ATTR_WIPHY] &&
 126             !attrs[NL80211_ATTR_IFINDEX] &&
 127             !attrs[NL80211_ATTR_WDEV])
 128                 return ERR_PTR(-EINVAL);
 129
 130         if (attrs[NL80211_ATTR_WIPHY])
 131                 rdev = cfg80211_rdev_by_wiphy_idx(
 132                                 nla_get_u32(attrs[NL80211_ATTR_WIPHY]));
 133
 134         if (attrs[NL80211_ATTR_WDEV]) {
 135                 u64 wdev_id = nla_get_u64(attrs[NL80211_ATTR_WDEV]);
 136                 struct wireless_dev *wdev;
 137                 bool found = false;
 138
 139                 tmp = cfg80211_rdev_by_wiphy_idx(wdev_id >> 32);
 140                 if (tmp) {
 141                         /* make sure wdev exists */
 142                         list_for_each_entry(wdev, &tmp->wiphy.wdev_list, list) {
 143                                 if (wdev->identifier != (u32)wdev_id)
 144                                         continue;
 145                                 found = true;
 146                                 break;
 147                         }
 148
 149                         if (!found)
 150                                 tmp = NULL;
 151
 152                         if (rdev && tmp != rdev)
 153                                 return ERR_PTR(-EINVAL);
 154                         rdev = tmp;
 155                 }
 156         }
 157
 158         if (attrs[NL80211_ATTR_IFINDEX]) {
 159                 int ifindex = nla_get_u32(attrs[NL80211_ATTR_IFINDEX]);
 160
 161                 netdev = __dev_get_by_index(netns, ifindex);
 162                 if (netdev) {
 163                         if (netdev->ieee80211_ptr)
 164                                 tmp = wiphy_to_rdev(
 165                                         netdev->ieee80211_ptr->wiphy);
 166                         else
 167                                 tmp = NULL;
 168
 169                         /* not wireless device -- return error */
 170                         if (!tmp)
 171                                 return ERR_PTR(-EINVAL);
 172
 173                         /* mismatch -- return error */
 174                         if (rdev && tmp != rdev)
 175                                 return ERR_PTR(-EINVAL);
 176
 177                         rdev = tmp;
 178                 }
 179         }
 180
 181         if (!rdev)
 182                 return ERR_PTR(-ENODEV);
 183
 184         if (netns != wiphy_net(&rdev->wiphy))
 185                 return ERR_PTR(-ENODEV);
 186
 187         return rdev;
 188 }
 189
 190 /*
 191  * This function returns a pointer to the driver
 192  * that the genl_info item that is passed refers to.
 193  *
 194  * The result of this can be a PTR_ERR and hence must
 195  * be checked with IS_ERR() for errors.
 196  */
 197 static struct cfg80211_registered_device *
 198 cfg80211_get_dev_from_info(struct net *netns, struct genl_info *info)
 199 {
 200         return __cfg80211_rdev_from_attrs(netns, info->attrs);
 201 }
 202
 203 static int validate_ie_attr(const struct nlattr *attr,
 204                             struct netlink_ext_ack *extack)
 205 {
 206         const u8 *pos;
 207         int len;
 208
 209         pos = nla_data(attr);
 210         len = nla_len(attr);
 211
 212         while (len) {
 213                 u8 elemlen;
 214
 215                 if (len < 2)
 216                         goto error;
 217                 len -= 2;
 218
 219                 elemlen = pos[1];
 220                 if (elemlen > len)
 221                         goto error;
 222
 223                 len -= elemlen;
 224                 pos += 2 + elemlen;
 225         }
 226
 227         return 0;
 228 error:
 229         NL_SET_ERR_MSG_ATTR(extack, attr, "malformed information elements");
 230         return -EINVAL;
 231 }
 232
 233 /* policy for the attributes */
 234 static const struct nla_policy
 235 nl80211_ftm_responder_policy[NL80211_FTM_RESP_ATTR_MAX + 1] = {
 236         [NL80211_FTM_RESP_ATTR_ENABLED] = { .type = NLA_FLAG, },
 237         [NL80211_FTM_RESP_ATTR_LCI] = { .type = NLA_BINARY,
 238                                         .len = U8_MAX },
 239         [NL80211_FTM_RESP_ATTR_CIVICLOC] = { .type = NLA_BINARY,
 240                                              .len = U8_MAX },
 241 };
 242
 243 static const struct nla_policy nl80211_policy[NUM_NL80211_ATTR] = {
 244         [NL80211_ATTR_WIPHY] = { .type = NLA_U32 },
 245         [NL80211_ATTR_WIPHY_NAME] = { .type = NLA_NUL_STRING,
 246                                       .len = 20-1 },
 247         [NL80211_ATTR_WIPHY_TXQ_PARAMS] = { .type = NLA_NESTED },
 248
 249         [NL80211_ATTR_WIPHY_FREQ] = { .type = NLA_U32 },
 250         [NL80211_ATTR_WIPHY_CHANNEL_TYPE] = { .type = NLA_U32 },
 251         [NL80211_ATTR_CHANNEL_WIDTH] = { .type = NLA_U32 },
 252         [NL80211_ATTR_CENTER_FREQ1] = { .type = NLA_U32 },
 253         [NL80211_ATTR_CENTER_FREQ2] = { .type = NLA_U32 },
 254
 255         [NL80211_ATTR_WIPHY_RETRY_SHORT] = NLA_POLICY_MIN(NLA_U8, 1),
 256         [NL80211_ATTR_WIPHY_RETRY_LONG] = NLA_POLICY_MIN(NLA_U8, 1),
 257         [NL80211_ATTR_WIPHY_FRAG_THRESHOLD] = { .type = NLA_U32 },
 258         [NL80211_ATTR_WIPHY_RTS_THRESHOLD] = { .type = NLA_U32 },
 259         [NL80211_ATTR_WIPHY_COVERAGE_CLASS] = { .type = NLA_U8 },
 260         [NL80211_ATTR_WIPHY_DYN_ACK] = { .type = NLA_FLAG },
 261
 262         [NL80211_ATTR_IFTYPE] = NLA_POLICY_MAX(NLA_U32, NL80211_IFTYPE_MAX),
 263         [NL80211_ATTR_IFINDEX] = { .type = NLA_U32 },
 264         [NL80211_ATTR_IFNAME] = { .type = NLA_NUL_STRING, .len = IFNAMSIZ-1 },
 265
 266         [NL80211_ATTR_MAC] = { .len = ETH_ALEN },
 267         [NL80211_ATTR_PREV_BSSID] = { .len = ETH_ALEN },
 268
 269         [NL80211_ATTR_KEY] = { .type = NLA_NESTED, },
 270         [NL80211_ATTR_KEY_DATA] = { .type = NLA_BINARY,
 271                                     .len = WLAN_MAX_KEY_LEN },
 272         [NL80211_ATTR_KEY_IDX] = NLA_POLICY_MAX(NLA_U8, 5),
 273         [NL80211_ATTR_KEY_CIPHER] = { .type = NLA_U32 },
 274         [NL80211_ATTR_KEY_DEFAULT] = { .type = NLA_FLAG },
 275         [NL80211_ATTR_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 276         [NL80211_ATTR_KEY_TYPE] =
 277                 NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES),
 278
 279         [NL80211_ATTR_BEACON_INTERVAL] = { .type = NLA_U32 },
 280         [NL80211_ATTR_DTIM_PERIOD] = { .type = NLA_U32 },
 281         [NL80211_ATTR_BEACON_HEAD] = { .type = NLA_BINARY,
 282                                        .len = IEEE80211_MAX_DATA_LEN },
 283         [NL80211_ATTR_BEACON_TAIL] =
 284                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 285                                        IEEE80211_MAX_DATA_LEN),
 286         [NL80211_ATTR_STA_AID] =
 287                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 288         [NL80211_ATTR_STA_FLAGS] = { .type = NLA_NESTED },
 289         [NL80211_ATTR_STA_LISTEN_INTERVAL] = { .type = NLA_U16 },
 290         [NL80211_ATTR_STA_SUPPORTED_RATES] = { .type = NLA_BINARY,
 291                                                .len = NL80211_MAX_SUPP_RATES },
 292         [NL80211_ATTR_STA_PLINK_ACTION] =
 293                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_ACTIONS - 1),
 294         [NL80211_ATTR_STA_VLAN] = { .type = NLA_U32 },
 295         [NL80211_ATTR_MNTR_FLAGS] = { /* NLA_NESTED can't be empty */ },
 296         [NL80211_ATTR_MESH_ID] = { .type = NLA_BINARY,
 297                                    .len = IEEE80211_MAX_MESH_ID_LEN },
 298         [NL80211_ATTR_MPATH_NEXT_HOP] = { .type = NLA_U32 },
 299
 300         [NL80211_ATTR_REG_ALPHA2] = { .type = NLA_STRING, .len = 2 },
 301         [NL80211_ATTR_REG_RULES] = { .type = NLA_NESTED },
 302
 303         [NL80211_ATTR_BSS_CTS_PROT] = { .type = NLA_U8 },
 304         [NL80211_ATTR_BSS_SHORT_PREAMBLE] = { .type = NLA_U8 },
 305         [NL80211_ATTR_BSS_SHORT_SLOT_TIME] = { .type = NLA_U8 },
 306         [NL80211_ATTR_BSS_BASIC_RATES] = { .type = NLA_BINARY,
 307                                            .len = NL80211_MAX_SUPP_RATES },
 308         [NL80211_ATTR_BSS_HT_OPMODE] = { .type = NLA_U16 },
 309
 310         [NL80211_ATTR_MESH_CONFIG] = { .type = NLA_NESTED },
 311         [NL80211_ATTR_SUPPORT_MESH_AUTH] = { .type = NLA_FLAG },
 312
 313         [NL80211_ATTR_HT_CAPABILITY] = { .len = NL80211_HT_CAPABILITY_LEN },
 314
 315         [NL80211_ATTR_MGMT_SUBTYPE] = { .type = NLA_U8 },
 316         [NL80211_ATTR_IE] = NLA_POLICY_VALIDATE_FN(NLA_BINARY,
 317                                                    validate_ie_attr,
 318                                                    IEEE80211_MAX_DATA_LEN),
 319         [NL80211_ATTR_SCAN_FREQUENCIES] = { .type = NLA_NESTED },
 320         [NL80211_ATTR_SCAN_SSIDS] = { .type = NLA_NESTED },
 321
 322         [NL80211_ATTR_SSID] = { .type = NLA_BINARY,
 323                                 .len = IEEE80211_MAX_SSID_LEN },
 324         [NL80211_ATTR_AUTH_TYPE] = { .type = NLA_U32 },
 325         [NL80211_ATTR_REASON_CODE] = { .type = NLA_U16 },
 326         [NL80211_ATTR_FREQ_FIXED] = { .type = NLA_FLAG },
 327         [NL80211_ATTR_TIMED_OUT] = { .type = NLA_FLAG },
 328         [NL80211_ATTR_USE_MFP] = NLA_POLICY_RANGE(NLA_U32,
 329                                                   NL80211_MFP_NO,
 330                                                   NL80211_MFP_OPTIONAL),
 331         [NL80211_ATTR_STA_FLAGS2] = {
 332                 .len = sizeof(struct nl80211_sta_flag_update),
 333         },
 334         [NL80211_ATTR_CONTROL_PORT] = { .type = NLA_FLAG },
 335         [NL80211_ATTR_CONTROL_PORT_ETHERTYPE] = { .type = NLA_U16 },
 336         [NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT] = { .type = NLA_FLAG },
 337         [NL80211_ATTR_CONTROL_PORT_OVER_NL80211] = { .type = NLA_FLAG },
 338         [NL80211_ATTR_PRIVACY] = { .type = NLA_FLAG },
 339         [NL80211_ATTR_CIPHER_SUITE_GROUP] = { .type = NLA_U32 },
 340         [NL80211_ATTR_WPA_VERSIONS] = { .type = NLA_U32 },
 341         [NL80211_ATTR_PID] = { .type = NLA_U32 },
 342         [NL80211_ATTR_4ADDR] = { .type = NLA_U8 },
 343         [NL80211_ATTR_PMKID] = { .len = WLAN_PMKID_LEN },
 344         [NL80211_ATTR_DURATION] = { .type = NLA_U32 },
 345         [NL80211_ATTR_COOKIE] = { .type = NLA_U64 },
 346         [NL80211_ATTR_TX_RATES] = { .type = NLA_NESTED },
 347         [NL80211_ATTR_FRAME] = { .type = NLA_BINARY,
 348                                  .len = IEEE80211_MAX_DATA_LEN },
 349         [NL80211_ATTR_FRAME_MATCH] = { .type = NLA_BINARY, },
 350         [NL80211_ATTR_PS_STATE] = NLA_POLICY_RANGE(NLA_U32,
 351                                                    NL80211_PS_DISABLED,
 352                                                    NL80211_PS_ENABLED),
 353         [NL80211_ATTR_CQM] = { .type = NLA_NESTED, },
 354         [NL80211_ATTR_LOCAL_STATE_CHANGE] = { .type = NLA_FLAG },
 355         [NL80211_ATTR_AP_ISOLATE] = { .type = NLA_U8 },
 356         [NL80211_ATTR_WIPHY_TX_POWER_SETTING] = { .type = NLA_U32 },
 357         [NL80211_ATTR_WIPHY_TX_POWER_LEVEL] = { .type = NLA_U32 },
 358         [NL80211_ATTR_FRAME_TYPE] = { .type = NLA_U16 },
 359         [NL80211_ATTR_WIPHY_ANTENNA_TX] = { .type = NLA_U32 },
 360         [NL80211_ATTR_WIPHY_ANTENNA_RX] = { .type = NLA_U32 },
 361         [NL80211_ATTR_MCAST_RATE] = { .type = NLA_U32 },
 362         [NL80211_ATTR_OFFCHANNEL_TX_OK] = { .type = NLA_FLAG },
 363         [NL80211_ATTR_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 364         [NL80211_ATTR_WOWLAN_TRIGGERS] = { .type = NLA_NESTED },
 365         [NL80211_ATTR_STA_PLINK_STATE] =
 366                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_PLINK_STATES - 1),
 367         [NL80211_ATTR_MESH_PEER_AID] =
 368                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 369         [NL80211_ATTR_SCHED_SCAN_INTERVAL] = { .type = NLA_U32 },
 370         [NL80211_ATTR_REKEY_DATA] = { .type = NLA_NESTED },
 371         [NL80211_ATTR_SCAN_SUPP_RATES] = { .type = NLA_NESTED },
 372         [NL80211_ATTR_HIDDEN_SSID] =
 373                 NLA_POLICY_RANGE(NLA_U32,
 374                                  NL80211_HIDDEN_SSID_NOT_IN_USE,
 375                                  NL80211_HIDDEN_SSID_ZERO_CONTENTS),
 376         [NL80211_ATTR_IE_PROBE_RESP] =
 377                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 378                                        IEEE80211_MAX_DATA_LEN),
 379         [NL80211_ATTR_IE_ASSOC_RESP] =
 380                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
 381                                        IEEE80211_MAX_DATA_LEN),
 382         [NL80211_ATTR_ROAM_SUPPORT] = { .type = NLA_FLAG },
 383         [NL80211_ATTR_SCHED_SCAN_MATCH] = { .type = NLA_NESTED },
 384         [NL80211_ATTR_TX_NO_CCK_RATE] = { .type = NLA_FLAG },
 385         [NL80211_ATTR_TDLS_ACTION] = { .type = NLA_U8 },
 386         [NL80211_ATTR_TDLS_DIALOG_TOKEN] = { .type = NLA_U8 },
 387         [NL80211_ATTR_TDLS_OPERATION] = { .type = NLA_U8 },
 388         [NL80211_ATTR_TDLS_SUPPORT] = { .type = NLA_FLAG },
 389         [NL80211_ATTR_TDLS_EXTERNAL_SETUP] = { .type = NLA_FLAG },
 390         [NL80211_ATTR_TDLS_INITIATOR] = { .type = NLA_FLAG },
 391         [NL80211_ATTR_DONT_WAIT_FOR_ACK] = { .type = NLA_FLAG },
 392         [NL80211_ATTR_PROBE_RESP] = { .type = NLA_BINARY,
 393                                       .len = IEEE80211_MAX_DATA_LEN },
 394         [NL80211_ATTR_DFS_REGION] = { .type = NLA_U8 },
 395         [NL80211_ATTR_DISABLE_HT] = { .type = NLA_FLAG },
 396         [NL80211_ATTR_HT_CAPABILITY_MASK] = {
 397                 .len = NL80211_HT_CAPABILITY_LEN
 398         },
 399         [NL80211_ATTR_NOACK_MAP] = { .type = NLA_U16 },
 400         [NL80211_ATTR_INACTIVITY_TIMEOUT] = { .type = NLA_U16 },
 401         [NL80211_ATTR_BG_SCAN_PERIOD] = { .type = NLA_U16 },
 402         [NL80211_ATTR_WDEV] = { .type = NLA_U64 },
 403         [NL80211_ATTR_USER_REG_HINT_TYPE] = { .type = NLA_U32 },
 404         [NL80211_ATTR_AUTH_DATA] = { .type = NLA_BINARY, },
 405         [NL80211_ATTR_VHT_CAPABILITY] = { .len = NL80211_VHT_CAPABILITY_LEN },
 406         [NL80211_ATTR_SCAN_FLAGS] = { .type = NLA_U32 },
 407         [NL80211_ATTR_P2P_CTWINDOW] = NLA_POLICY_MAX(NLA_U8, 127),
 408         [NL80211_ATTR_P2P_OPPPS] = NLA_POLICY_MAX(NLA_U8, 1),
 409         [NL80211_ATTR_LOCAL_MESH_POWER_MODE] =
 410                 NLA_POLICY_RANGE(NLA_U32,
 411                                  NL80211_MESH_POWER_UNKNOWN + 1,
 412                                  NL80211_MESH_POWER_MAX),
 413         [NL80211_ATTR_ACL_POLICY] = {. type = NLA_U32 },
 414         [NL80211_ATTR_MAC_ADDRS] = { .type = NLA_NESTED },
 415         [NL80211_ATTR_STA_CAPABILITY] = { .type = NLA_U16 },
 416         [NL80211_ATTR_STA_EXT_CAPABILITY] = { .type = NLA_BINARY, },
 417         [NL80211_ATTR_SPLIT_WIPHY_DUMP] = { .type = NLA_FLAG, },
 418         [NL80211_ATTR_DISABLE_VHT] = { .type = NLA_FLAG },
 419         [NL80211_ATTR_VHT_CAPABILITY_MASK] = {
 420                 .len = NL80211_VHT_CAPABILITY_LEN,
 421         },
 422         [NL80211_ATTR_MDID] = { .type = NLA_U16 },
 423         [NL80211_ATTR_IE_RIC] = { .type = NLA_BINARY,
 424                                   .len = IEEE80211_MAX_DATA_LEN },
 425         [NL80211_ATTR_PEER_AID] =
 426                 NLA_POLICY_RANGE(NLA_U16, 1, IEEE80211_MAX_AID),
 427         [NL80211_ATTR_CH_SWITCH_COUNT] = { .type = NLA_U32 },
 428         [NL80211_ATTR_CH_SWITCH_BLOCK_TX] = { .type = NLA_FLAG },
 429         [NL80211_ATTR_CSA_IES] = { .type = NLA_NESTED },
 430         [NL80211_ATTR_CSA_C_OFF_BEACON] = { .type = NLA_BINARY },
 431         [NL80211_ATTR_CSA_C_OFF_PRESP] = { .type = NLA_BINARY },
 432         [NL80211_ATTR_STA_SUPPORTED_CHANNELS] = { .type = NLA_BINARY },
 433         [NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES] = { .type = NLA_BINARY },
 434         [NL80211_ATTR_HANDLE_DFS] = { .type = NLA_FLAG },
 435         [NL80211_ATTR_OPMODE_NOTIF] = { .type = NLA_U8 },
 436         [NL80211_ATTR_VENDOR_ID] = { .type = NLA_U32 },
 437         [NL80211_ATTR_VENDOR_SUBCMD] = { .type = NLA_U32 },
 438         [NL80211_ATTR_VENDOR_DATA] = { .type = NLA_BINARY },
 439         [NL80211_ATTR_QOS_MAP] = { .type = NLA_BINARY,
 440                                    .len = IEEE80211_QOS_MAP_LEN_MAX },
 441         [NL80211_ATTR_MAC_HINT] = { .len = ETH_ALEN },
 442         [NL80211_ATTR_WIPHY_FREQ_HINT] = { .type = NLA_U32 },
 443         [NL80211_ATTR_TDLS_PEER_CAPABILITY] = { .type = NLA_U32 },
 444         [NL80211_ATTR_SOCKET_OWNER] = { .type = NLA_FLAG },
 445         [NL80211_ATTR_CSA_C_OFFSETS_TX] = { .type = NLA_BINARY },
 446         [NL80211_ATTR_USE_RRM] = { .type = NLA_FLAG },
 447         [NL80211_ATTR_TSID] = NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_TIDS - 1),
 448         [NL80211_ATTR_USER_PRIO] =
 449                 NLA_POLICY_MAX(NLA_U8, IEEE80211_NUM_UPS - 1),
 450         [NL80211_ATTR_ADMITTED_TIME] = { .type = NLA_U16 },
 451         [NL80211_ATTR_SMPS_MODE] = { .type = NLA_U8 },
 452         [NL80211_ATTR_MAC_MASK] = { .len = ETH_ALEN },
 453         [NL80211_ATTR_WIPHY_SELF_MANAGED_REG] = { .type = NLA_FLAG },
 454         [NL80211_ATTR_NETNS_FD] = { .type = NLA_U32 },
 455         [NL80211_ATTR_SCHED_SCAN_DELAY] = { .type = NLA_U32 },
 456         [NL80211_ATTR_REG_INDOOR] = { .type = NLA_FLAG },
 457         [NL80211_ATTR_PBSS] = { .type = NLA_FLAG },
 458         [NL80211_ATTR_BSS_SELECT] = { .type = NLA_NESTED },
 459         [NL80211_ATTR_STA_SUPPORT_P2P_PS] =
 460                 NLA_POLICY_MAX(NLA_U8, NUM_NL80211_P2P_PS_STATUS - 1),
 461         [NL80211_ATTR_MU_MIMO_GROUP_DATA] = {
 462                 .len = VHT_MUMIMO_GROUPS_DATA_LEN
 463         },
 464         [NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR] = { .len = ETH_ALEN },
 465         [NL80211_ATTR_NAN_MASTER_PREF] = NLA_POLICY_MIN(NLA_U8, 1),
 466         [NL80211_ATTR_BANDS] = { .type = NLA_U32 },
 467         [NL80211_ATTR_NAN_FUNC] = { .type = NLA_NESTED },
 468         [NL80211_ATTR_FILS_KEK] = { .type = NLA_BINARY,
 469                                     .len = FILS_MAX_KEK_LEN },
 470         [NL80211_ATTR_FILS_NONCES] = { .len = 2 * FILS_NONCE_LEN },
 471         [NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED] = { .type = NLA_FLAG, },
 472         [NL80211_ATTR_BSSID] = { .len = ETH_ALEN },
 473         [NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] = { .type = NLA_S8 },
 474         [NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST] = {
 475                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 476         },
 477         [NL80211_ATTR_TIMEOUT_REASON] = { .type = NLA_U32 },
 478         [NL80211_ATTR_FILS_ERP_USERNAME] = { .type = NLA_BINARY,
 479                                              .len = FILS_ERP_MAX_USERNAME_LEN },
 480         [NL80211_ATTR_FILS_ERP_REALM] = { .type = NLA_BINARY,
 481                                           .len = FILS_ERP_MAX_REALM_LEN },
 482         [NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] = { .type = NLA_U16 },
 483         [NL80211_ATTR_FILS_ERP_RRK] = { .type = NLA_BINARY,
 484                                         .len = FILS_ERP_MAX_RRK_LEN },
 485         [NL80211_ATTR_FILS_CACHE_ID] = { .len = 2 },
 486         [NL80211_ATTR_PMK] = { .type = NLA_BINARY, .len = PMK_MAX_LEN },
 487         [NL80211_ATTR_SCHED_SCAN_MULTI] = { .type = NLA_FLAG },
 488         [NL80211_ATTR_EXTERNAL_AUTH_SUPPORT] = { .type = NLA_FLAG },
 489
 490         [NL80211_ATTR_TXQ_LIMIT] = { .type = NLA_U32 },
 491         [NL80211_ATTR_TXQ_MEMORY_LIMIT] = { .type = NLA_U32 },
 492         [NL80211_ATTR_TXQ_QUANTUM] = { .type = NLA_U32 },
 493         [NL80211_ATTR_HE_CAPABILITY] = { .type = NLA_BINARY,
 494                                          .len = NL80211_HE_MAX_CAPABILITY_LEN },
 495
 496         [NL80211_ATTR_FTM_RESPONDER] = {
 497                 .type = NLA_NESTED,
 498                 .validation_data = nl80211_ftm_responder_policy,
 499         },
 500 };
 501
 502 /* policy for the key attributes */
 503 static const struct nla_policy nl80211_key_policy[NL80211_KEY_MAX + 1] = {
 504         [NL80211_KEY_DATA] = { .type = NLA_BINARY, .len = WLAN_MAX_KEY_LEN },
 505         [NL80211_KEY_IDX] = { .type = NLA_U8 },
 506         [NL80211_KEY_CIPHER] = { .type = NLA_U32 },
 507         [NL80211_KEY_SEQ] = { .type = NLA_BINARY, .len = 16 },
 508         [NL80211_KEY_DEFAULT] = { .type = NLA_FLAG },
 509         [NL80211_KEY_DEFAULT_MGMT] = { .type = NLA_FLAG },
 510         [NL80211_KEY_TYPE] = NLA_POLICY_MAX(NLA_U32, NUM_NL80211_KEYTYPES - 1),
 511         [NL80211_KEY_DEFAULT_TYPES] = { .type = NLA_NESTED },
 512 };
 513
 514 /* policy for the key default flags */
 515 static const struct nla_policy
 516 nl80211_key_default_policy[NUM_NL80211_KEY_DEFAULT_TYPES] = {
 517         [NL80211_KEY_DEFAULT_TYPE_UNICAST] = { .type = NLA_FLAG },
 518         [NL80211_KEY_DEFAULT_TYPE_MULTICAST] = { .type = NLA_FLAG },
 519 };
 520
 521 #ifdef CONFIG_PM
 522 /* policy for WoWLAN attributes */
 523 static const struct nla_policy
 524 nl80211_wowlan_policy[NUM_NL80211_WOWLAN_TRIG] = {
 525         [NL80211_WOWLAN_TRIG_ANY] = { .type = NLA_FLAG },
 526         [NL80211_WOWLAN_TRIG_DISCONNECT] = { .type = NLA_FLAG },
 527         [NL80211_WOWLAN_TRIG_MAGIC_PKT] = { .type = NLA_FLAG },
 528         [NL80211_WOWLAN_TRIG_PKT_PATTERN] = { .type = NLA_NESTED },
 529         [NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE] = { .type = NLA_FLAG },
 530         [NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST] = { .type = NLA_FLAG },
 531         [NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE] = { .type = NLA_FLAG },
 532         [NL80211_WOWLAN_TRIG_RFKILL_RELEASE] = { .type = NLA_FLAG },
 533         [NL80211_WOWLAN_TRIG_TCP_CONNECTION] = { .type = NLA_NESTED },
 534         [NL80211_WOWLAN_TRIG_NET_DETECT] = { .type = NLA_NESTED },
 535 };
 536
 537 static const struct nla_policy
 538 nl80211_wowlan_tcp_policy[NUM_NL80211_WOWLAN_TCP] = {
 539         [NL80211_WOWLAN_TCP_SRC_IPV4] = { .type = NLA_U32 },
 540         [NL80211_WOWLAN_TCP_DST_IPV4] = { .type = NLA_U32 },
 541         [NL80211_WOWLAN_TCP_DST_MAC] = { .len = ETH_ALEN },
 542         [NL80211_WOWLAN_TCP_SRC_PORT] = { .type = NLA_U16 },
 543         [NL80211_WOWLAN_TCP_DST_PORT] = { .type = NLA_U16 },
 544         [NL80211_WOWLAN_TCP_DATA_PAYLOAD] = { .len = 1 },
 545         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ] = {
 546                 .len = sizeof(struct nl80211_wowlan_tcp_data_seq)
 547         },
 548         [NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN] = {
 549                 .len = sizeof(struct nl80211_wowlan_tcp_data_token)
 550         },
 551         [NL80211_WOWLAN_TCP_DATA_INTERVAL] = { .type = NLA_U32 },
 552         [NL80211_WOWLAN_TCP_WAKE_PAYLOAD] = { .len = 1 },
 553         [NL80211_WOWLAN_TCP_WAKE_MASK] = { .len = 1 },
 554 };
 555 #endif /* CONFIG_PM */
 556
 557 /* policy for coalesce rule attributes */
 558 static const struct nla_policy
 559 nl80211_coalesce_policy[NUM_NL80211_ATTR_COALESCE_RULE] = {
 560         [NL80211_ATTR_COALESCE_RULE_DELAY] = { .type = NLA_U32 },
 561         [NL80211_ATTR_COALESCE_RULE_CONDITION] =
 562                 NLA_POLICY_RANGE(NLA_U32,
 563                                  NL80211_COALESCE_CONDITION_MATCH,
 564                                  NL80211_COALESCE_CONDITION_NO_MATCH),
 565         [NL80211_ATTR_COALESCE_RULE_PKT_PATTERN] = { .type = NLA_NESTED },
 566 };
 567
 568 /* policy for GTK rekey offload attributes */
 569 static const struct nla_policy
 570 nl80211_rekey_policy[NUM_NL80211_REKEY_DATA] = {
 571         [NL80211_REKEY_DATA_KEK] = { .len = NL80211_KEK_LEN },
 572         [NL80211_REKEY_DATA_KCK] = { .len = NL80211_KCK_LEN },
 573         [NL80211_REKEY_DATA_REPLAY_CTR] = { .len = NL80211_REPLAY_CTR_LEN },
 574 };
 575
 576 static const struct nla_policy
 577 nl80211_match_policy[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1] = {
 578         [NL80211_SCHED_SCAN_MATCH_ATTR_SSID] = { .type = NLA_BINARY,
 579                                                  .len = IEEE80211_MAX_SSID_LEN },
 580         [NL80211_SCHED_SCAN_MATCH_ATTR_BSSID] = { .len = ETH_ALEN },
 581         [NL80211_SCHED_SCAN_MATCH_ATTR_RSSI] = { .type = NLA_U32 },
 582 };
 583
 584 static const struct nla_policy
 585 nl80211_plan_policy[NL80211_SCHED_SCAN_PLAN_MAX + 1] = {
 586         [NL80211_SCHED_SCAN_PLAN_INTERVAL] = { .type = NLA_U32 },
 587         [NL80211_SCHED_SCAN_PLAN_ITERATIONS] = { .type = NLA_U32 },
 588 };
 589
 590 static const struct nla_policy
 591 nl80211_bss_select_policy[NL80211_BSS_SELECT_ATTR_MAX + 1] = {
 592         [NL80211_BSS_SELECT_ATTR_RSSI] = { .type = NLA_FLAG },
 593         [NL80211_BSS_SELECT_ATTR_BAND_PREF] = { .type = NLA_U32 },
 594         [NL80211_BSS_SELECT_ATTR_RSSI_ADJUST] = {
 595                 .len = sizeof(struct nl80211_bss_select_rssi_adjust)
 596         },
 597 };
 598
 599 /* policy for NAN function attributes */
 600 static const struct nla_policy
 601 nl80211_nan_func_policy[NL80211_NAN_FUNC_ATTR_MAX + 1] = {
 602         [NL80211_NAN_FUNC_TYPE] = { .type = NLA_U8 },
 603         [NL80211_NAN_FUNC_SERVICE_ID] = {
 604                                     .len = NL80211_NAN_FUNC_SERVICE_ID_LEN },
 605         [NL80211_NAN_FUNC_PUBLISH_TYPE] = { .type = NLA_U8 },
 606         [NL80211_NAN_FUNC_PUBLISH_BCAST] = { .type = NLA_FLAG },
 607         [NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE] = { .type = NLA_FLAG },
 608         [NL80211_NAN_FUNC_FOLLOW_UP_ID] = { .type = NLA_U8 },
 609         [NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] = { .type = NLA_U8 },
 610         [NL80211_NAN_FUNC_FOLLOW_UP_DEST] = { .len = ETH_ALEN },
 611         [NL80211_NAN_FUNC_CLOSE_RANGE] = { .type = NLA_FLAG },
 612         [NL80211_NAN_FUNC_TTL] = { .type = NLA_U32 },
 613         [NL80211_NAN_FUNC_SERVICE_INFO] = { .type = NLA_BINARY,
 614                         .len = NL80211_NAN_FUNC_SERVICE_SPEC_INFO_MAX_LEN },
 615         [NL80211_NAN_FUNC_SRF] = { .type = NLA_NESTED },
 616         [NL80211_NAN_FUNC_RX_MATCH_FILTER] = { .type = NLA_NESTED },
 617         [NL80211_NAN_FUNC_TX_MATCH_FILTER] = { .type = NLA_NESTED },
 618         [NL80211_NAN_FUNC_INSTANCE_ID] = { .type = NLA_U8 },
 619         [NL80211_NAN_FUNC_TERM_REASON] = { .type = NLA_U8 },
 620 };
 621
 622 /* policy for Service Response Filter attributes */
 623 static const struct nla_policy
 624 nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
 625         [NL80211_NAN_SRF_INCLUDE] = { .type = NLA_FLAG },
 626         [NL80211_NAN_SRF_BF] = { .type = NLA_BINARY,
 627                                  .len =  NL80211_NAN_FUNC_SRF_MAX_LEN },
 628         [NL80211_NAN_SRF_BF_IDX] = { .type = NLA_U8 },
 629         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 630 };
 631
 632 /* policy for packet pattern attributes */
 633 static const struct nla_policy
 634 nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
 635         [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
 636         [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
 637         [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
 638 };
 639
 640 static int nl80211_prepare_wdev_dump(struct netlink_callback *cb,
 641                                      struct cfg80211_registered_device **rdev,
 642                                      struct wireless_dev **wdev)
 643 {
 644         int err;
 645
 646         if (!cb->args[0]) {
 647                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
 648                                   genl_family_attrbuf(&nl80211_fam),
 649                                   nl80211_fam.maxattr, nl80211_policy, NULL);
 650                 if (err)
 651                         return err;
 652
 653                 *wdev = __cfg80211_wdev_from_attrs(
 654                                         sock_net(cb->skb->sk),
 655                                         genl_family_attrbuf(&nl80211_fam));
 656                 if (IS_ERR(*wdev))
 657                         return PTR_ERR(*wdev);
 658                 *rdev = wiphy_to_rdev((*wdev)->wiphy);
 659                 /* 0 is the first index - add 1 to parse only once */
 660                 cb->args[0] = (*rdev)->wiphy_idx + 1;
 661                 cb->args[1] = (*wdev)->identifier;
 662         } else {
 663                 /* subtract the 1 again here */
 664                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
 665                 struct wireless_dev *tmp;
 666
 667                 if (!wiphy)
 668                         return -ENODEV;
 669                 *rdev = wiphy_to_rdev(wiphy);
 670                 *wdev = NULL;
 671
 672                 list_for_each_entry(tmp, &(*rdev)->wiphy.wdev_list, list) {
 673                         if (tmp->identifier == cb->args[1]) {
 674                                 *wdev = tmp;
 675                                 break;
 676                         }
 677                 }
 678
 679                 if (!*wdev)
 680                         return -ENODEV;
 681         }
 682
 683         return 0;
 684 }
 685
 686 /* message building helper */
 687 static inline void *nl80211hdr_put(struct sk_buff *skb, u32 portid, u32 seq,
 688                                    int flags, u8 cmd)
 689 {
 690         /* since there is no private header just add the generic one */
 691         return genlmsg_put(skb, portid, seq, &nl80211_fam, flags, cmd);
 692 }
 693
 694 static int nl80211_msg_put_wmm_rules(struct sk_buff *msg,
 695                                      const struct ieee80211_reg_rule *rule)
 696 {
 697         int j;
 698         struct nlattr *nl_wmm_rules =
 699                 nla_nest_start(msg, NL80211_FREQUENCY_ATTR_WMM);
 700
 701         if (!nl_wmm_rules)
 702                 goto nla_put_failure;
 703
 704         for (j = 0; j < IEEE80211_NUM_ACS; j++) {
 705                 struct nlattr *nl_wmm_rule = nla_nest_start(msg, j);
 706
 707                 if (!nl_wmm_rule)
 708                         goto nla_put_failure;
 709
 710                 if (nla_put_u16(msg, NL80211_WMMR_CW_MIN,
 711                                 rule->wmm_rule.client[j].cw_min) ||
 712                     nla_put_u16(msg, NL80211_WMMR_CW_MAX,
 713                                 rule->wmm_rule.client[j].cw_max) ||
 714                     nla_put_u8(msg, NL80211_WMMR_AIFSN,
 715                                rule->wmm_rule.client[j].aifsn) ||
 716                     nla_put_u16(msg, NL80211_WMMR_TXOP,
 717                                 rule->wmm_rule.client[j].cot))
 718                         goto nla_put_failure;
 719
 720                 nla_nest_end(msg, nl_wmm_rule);
 721         }
 722         nla_nest_end(msg, nl_wmm_rules);
 723
 724         return 0;
 725
 726 nla_put_failure:
 727         return -ENOBUFS;
 728 }
 729
 730 static int nl80211_msg_put_channel(struct sk_buff *msg, struct wiphy *wiphy,
 731                                    struct ieee80211_channel *chan,
 732                                    bool large)
 733 {
 734         /* Some channels must be completely excluded from the
 735          * list to protect old user-space tools from breaking
 736          */
 737         if (!large && chan->flags &
 738             (IEEE80211_CHAN_NO_10MHZ | IEEE80211_CHAN_NO_20MHZ))
 739                 return 0;
 740
 741         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_FREQ,
 742                         chan->center_freq))
 743                 goto nla_put_failure;
 744
 745         if ((chan->flags & IEEE80211_CHAN_DISABLED) &&
 746             nla_put_flag(msg, NL80211_FREQUENCY_ATTR_DISABLED))
 747                 goto nla_put_failure;
 748         if (chan->flags & IEEE80211_CHAN_NO_IR) {
 749                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_IR))
 750                         goto nla_put_failure;
 751                 if (nla_put_flag(msg, __NL80211_FREQUENCY_ATTR_NO_IBSS))
 752                         goto nla_put_failure;
 753         }
 754         if (chan->flags & IEEE80211_CHAN_RADAR) {
 755                 if (nla_put_flag(msg, NL80211_FREQUENCY_ATTR_RADAR))
 756                         goto nla_put_failure;
 757                 if (large) {
 758                         u32 time;
 759
 760                         time = elapsed_jiffies_msecs(chan->dfs_state_entered);
 761
 762                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_STATE,
 763                                         chan->dfs_state))
 764                                 goto nla_put_failure;
 765                         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_DFS_TIME,
 766                                         time))
 767                                 goto nla_put_failure;
 768                         if (nla_put_u32(msg,
 769                                         NL80211_FREQUENCY_ATTR_DFS_CAC_TIME,
 770                                         chan->dfs_cac_ms))
 771                                 goto nla_put_failure;
 772                 }
 773         }
 774
 775         if (large) {
 776                 if ((chan->flags & IEEE80211_CHAN_NO_HT40MINUS) &&
 777                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_MINUS))
 778                         goto nla_put_failure;
 779                 if ((chan->flags & IEEE80211_CHAN_NO_HT40PLUS) &&
 780                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_HT40_PLUS))
 781                         goto nla_put_failure;
 782                 if ((chan->flags & IEEE80211_CHAN_NO_80MHZ) &&
 783                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_80MHZ))
 784                         goto nla_put_failure;
 785                 if ((chan->flags & IEEE80211_CHAN_NO_160MHZ) &&
 786                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_160MHZ))
 787                         goto nla_put_failure;
 788                 if ((chan->flags & IEEE80211_CHAN_INDOOR_ONLY) &&
 789                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_INDOOR_ONLY))
 790                         goto nla_put_failure;
 791                 if ((chan->flags & IEEE80211_CHAN_IR_CONCURRENT) &&
 792                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_IR_CONCURRENT))
 793                         goto nla_put_failure;
 794                 if ((chan->flags & IEEE80211_CHAN_NO_20MHZ) &&
 795                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_20MHZ))
 796                         goto nla_put_failure;
 797                 if ((chan->flags & IEEE80211_CHAN_NO_10MHZ) &&
 798                     nla_put_flag(msg, NL80211_FREQUENCY_ATTR_NO_10MHZ))
 799                         goto nla_put_failure;
 800         }
 801
 802         if (nla_put_u32(msg, NL80211_FREQUENCY_ATTR_MAX_TX_POWER,
 803                         DBM_TO_MBM(chan->max_power)))
 804                 goto nla_put_failure;
 805
 806         if (large) {
 807                 const struct ieee80211_reg_rule *rule =
 808                         freq_reg_info(wiphy, MHZ_TO_KHZ(chan->center_freq));
 809
 810                 if (!IS_ERR_OR_NULL(rule) && rule->has_wmm) {
 811                         if (nl80211_msg_put_wmm_rules(msg, rule))
 812                                 goto nla_put_failure;
 813                 }
 814         }
 815
 816         return 0;
 817
 818  nla_put_failure:
 819         return -ENOBUFS;
 820 }
 821
 822 static bool nl80211_put_txq_stats(struct sk_buff *msg,
 823                                   struct cfg80211_txq_stats *txqstats,
 824                                   int attrtype)
 825 {
 826         struct nlattr *txqattr;
 827
 828 #define PUT_TXQVAL_U32(attr, memb) do {                                   \
 829         if (txqstats->filled & BIT(NL80211_TXQ_STATS_ ## attr) &&         \
 830             nla_put_u32(msg, NL80211_TXQ_STATS_ ## attr, txqstats->memb)) \
 831                 return false;                                             \
 832         } while (0)
 833
 834         txqattr = nla_nest_start(msg, attrtype);
 835         if (!txqattr)
 836                 return false;
 837
 838         PUT_TXQVAL_U32(BACKLOG_BYTES, backlog_bytes);
 839         PUT_TXQVAL_U32(BACKLOG_PACKETS, backlog_packets);
 840         PUT_TXQVAL_U32(FLOWS, flows);
 841         PUT_TXQVAL_U32(DROPS, drops);
 842         PUT_TXQVAL_U32(ECN_MARKS, ecn_marks);
 843         PUT_TXQVAL_U32(OVERLIMIT, overlimit);
 844         PUT_TXQVAL_U32(OVERMEMORY, overmemory);
 845         PUT_TXQVAL_U32(COLLISIONS, collisions);
 846         PUT_TXQVAL_U32(TX_BYTES, tx_bytes);
 847         PUT_TXQVAL_U32(TX_PACKETS, tx_packets);
 848         PUT_TXQVAL_U32(MAX_FLOWS, max_flows);
 849         nla_nest_end(msg, txqattr);
 850
 851 #undef PUT_TXQVAL_U32
 852         return true;
 853 }
 854
 855 /* netlink command implementations */
 856
 857 struct key_parse {
 858         struct key_params p;
 859         int idx;
 860         int type;
 861         bool def, defmgmt;
 862         bool def_uni, def_multi;
 863 };
 864
 865 static int nl80211_parse_key_new(struct genl_info *info, struct nlattr *key,
 866                                  struct key_parse *k)
 867 {
 868         struct nlattr *tb[NL80211_KEY_MAX + 1];
 869         int err = nla_parse_nested(tb, NL80211_KEY_MAX, key,
 870                                    nl80211_key_policy, info->extack);
 871         if (err)
 872                 return err;
 873
 874         k->def = !!tb[NL80211_KEY_DEFAULT];
 875         k->defmgmt = !!tb[NL80211_KEY_DEFAULT_MGMT];
 876
 877         if (k->def) {
 878                 k->def_uni = true;
 879                 k->def_multi = true;
 880         }
 881         if (k->defmgmt)
 882                 k->def_multi = true;
 883
 884         if (tb[NL80211_KEY_IDX])
 885                 k->idx = nla_get_u8(tb[NL80211_KEY_IDX]);
 886
 887         if (tb[NL80211_KEY_DATA]) {
 888                 k->p.key = nla_data(tb[NL80211_KEY_DATA]);
 889                 k->p.key_len = nla_len(tb[NL80211_KEY_DATA]);
 890         }
 891
 892         if (tb[NL80211_KEY_SEQ]) {
 893                 k->p.seq = nla_data(tb[NL80211_KEY_SEQ]);
 894                 k->p.seq_len = nla_len(tb[NL80211_KEY_SEQ]);
 895         }
 896
 897         if (tb[NL80211_KEY_CIPHER])
 898                 k->p.cipher = nla_get_u32(tb[NL80211_KEY_CIPHER]);
 899
 900         if (tb[NL80211_KEY_TYPE])
 901                 k->type = nla_get_u32(tb[NL80211_KEY_TYPE]);
 902
 903         if (tb[NL80211_KEY_DEFAULT_TYPES]) {
 904                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 905
 906                 err = nla_parse_nested(kdt, NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 907                                        tb[NL80211_KEY_DEFAULT_TYPES],
 908                                        nl80211_key_default_policy,
 909                                        info->extack);
 910                 if (err)
 911                         return err;
 912
 913                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 914                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 915         }
 916
 917         return 0;
 918 }
 919
 920 static int nl80211_parse_key_old(struct genl_info *info, struct key_parse *k)
 921 {
 922         if (info->attrs[NL80211_ATTR_KEY_DATA]) {
 923                 k->p.key = nla_data(info->attrs[NL80211_ATTR_KEY_DATA]);
 924                 k->p.key_len = nla_len(info->attrs[NL80211_ATTR_KEY_DATA]);
 925         }
 926
 927         if (info->attrs[NL80211_ATTR_KEY_SEQ]) {
 928                 k->p.seq = nla_data(info->attrs[NL80211_ATTR_KEY_SEQ]);
 929                 k->p.seq_len = nla_len(info->attrs[NL80211_ATTR_KEY_SEQ]);
 930         }
 931
 932         if (info->attrs[NL80211_ATTR_KEY_IDX])
 933                 k->idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
 934
 935         if (info->attrs[NL80211_ATTR_KEY_CIPHER])
 936                 k->p.cipher = nla_get_u32(info->attrs[NL80211_ATTR_KEY_CIPHER]);
 937
 938         k->def = !!info->attrs[NL80211_ATTR_KEY_DEFAULT];
 939         k->defmgmt = !!info->attrs[NL80211_ATTR_KEY_DEFAULT_MGMT];
 940
 941         if (k->def) {
 942                 k->def_uni = true;
 943                 k->def_multi = true;
 944         }
 945         if (k->defmgmt)
 946                 k->def_multi = true;
 947
 948         if (info->attrs[NL80211_ATTR_KEY_TYPE])
 949                 k->type = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
 950
 951         if (info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES]) {
 952                 struct nlattr *kdt[NUM_NL80211_KEY_DEFAULT_TYPES];
 953                 int err = nla_parse_nested(kdt,
 954                                            NUM_NL80211_KEY_DEFAULT_TYPES - 1,
 955                                            info->attrs[NL80211_ATTR_KEY_DEFAULT_TYPES],
 956                                            nl80211_key_default_policy,
 957                                            info->extack);
 958                 if (err)
 959                         return err;
 960
 961                 k->def_uni = kdt[NL80211_KEY_DEFAULT_TYPE_UNICAST];
 962                 k->def_multi = kdt[NL80211_KEY_DEFAULT_TYPE_MULTICAST];
 963         }
 964
 965         return 0;
 966 }
 967
 968 static int nl80211_parse_key(struct genl_info *info, struct key_parse *k)
 969 {
 970         int err;
 971
 972         memset(k, 0, sizeof(*k));
 973         k->idx = -1;
 974         k->type = -1;
 975
 976         if (info->attrs[NL80211_ATTR_KEY])
 977                 err = nl80211_parse_key_new(info, info->attrs[NL80211_ATTR_KEY], k);
 978         else
 979                 err = nl80211_parse_key_old(info, k);
 980
 981         if (err)
 982                 return err;
 983
 984         if (k->def && k->defmgmt) {
 985                 GENL_SET_ERR_MSG(info, "key with def && defmgmt is invalid");
 986                 return -EINVAL;
 987         }
 988
 989         if (k->defmgmt) {
 990                 if (k->def_uni || !k->def_multi) {
 991                         GENL_SET_ERR_MSG(info, "defmgmt key must be mcast");
 992                         return -EINVAL;
 993                 }
 994         }
 995
 996         if (k->idx != -1) {
 997                 if (k->defmgmt) {
 998                         if (k->idx < 4 || k->idx > 5) {
 999                                 GENL_SET_ERR_MSG(info,
1000                                                  "defmgmt key idx not 4 or 5");
1001                                 return -EINVAL;
1002                         }
1003                 } else if (k->def) {
1004                         if (k->idx < 0 || k->idx > 3) {
1005                                 GENL_SET_ERR_MSG(info, "def key idx not 0-3");
1006                                 return -EINVAL;
1007                         }
1008                 } else {
1009                         if (k->idx < 0 || k->idx > 5) {
1010                                 GENL_SET_ERR_MSG(info, "key idx not 0-5");
1011                                 return -EINVAL;
1012                         }
1013                 }
1014         }
1015
1016         return 0;
1017 }
1018
1019 static struct cfg80211_cached_keys *
1020 nl80211_parse_connkeys(struct cfg80211_registered_device *rdev,
1021                        struct genl_info *info, bool *no_ht)
1022 {
1023         struct nlattr *keys = info->attrs[NL80211_ATTR_KEYS];
1024         struct key_parse parse;
1025         struct nlattr *key;
1026         struct cfg80211_cached_keys *result;
1027         int rem, err, def = 0;
1028         bool have_key = false;
1029
1030         nla_for_each_nested(key, keys, rem) {
1031                 have_key = true;
1032                 break;
1033         }
1034
1035         if (!have_key)
1036                 return NULL;
1037
1038         result = kzalloc(sizeof(*result), GFP_KERNEL);
1039         if (!result)
1040                 return ERR_PTR(-ENOMEM);
1041
1042         result->def = -1;
1043
1044         nla_for_each_nested(key, keys, rem) {
1045                 memset(&parse, 0, sizeof(parse));
1046                 parse.idx = -1;
1047
1048                 err = nl80211_parse_key_new(info, key, &parse);
1049                 if (err)
1050                         goto error;
1051                 err = -EINVAL;
1052                 if (!parse.p.key)
1053                         goto error;
1054                 if (parse.idx < 0 || parse.idx > 3) {
1055                         GENL_SET_ERR_MSG(info, "key index out of range [0-3]");
1056                         goto error;
1057                 }
1058                 if (parse.def) {
1059                         if (def) {
1060                                 GENL_SET_ERR_MSG(info,
1061                                                  "only one key can be default");
1062                                 goto error;
1063                         }
1064                         def = 1;
1065                         result->def = parse.idx;
1066                         if (!parse.def_uni || !parse.def_multi)
1067                                 goto error;
1068                 } else if (parse.defmgmt)
1069                         goto error;
1070                 err = cfg80211_validate_key_settings(rdev, &parse.p,
1071                                                      parse.idx, false, NULL);
1072                 if (err)
1073                         goto error;
1074                 if (parse.p.cipher != WLAN_CIPHER_SUITE_WEP40 &&
1075                     parse.p.cipher != WLAN_CIPHER_SUITE_WEP104) {
1076                         GENL_SET_ERR_MSG(info, "connect key must be WEP");
1077                         err = -EINVAL;
1078                         goto error;
1079                 }
1080                 result->params[parse.idx].cipher = parse.p.cipher;
1081                 result->params[parse.idx].key_len = parse.p.key_len;
1082                 result->params[parse.idx].key = result->data[parse.idx];
1083                 memcpy(result->data[parse.idx], parse.p.key, parse.p.key_len);
1084
1085                 /* must be WEP key if we got here */
1086                 if (no_ht)
1087                         *no_ht = true;
1088         }
1089
1090         if (result->def < 0) {
1091                 err = -EINVAL;
1092                 GENL_SET_ERR_MSG(info, "need a default/TX key");
1093                 goto error;
1094         }
1095
1096         return result;
1097  error:
1098         kfree(result);
1099         return ERR_PTR(err);
1100 }
1101
1102 static int nl80211_key_allowed(struct wireless_dev *wdev)
1103 {
1104         ASSERT_WDEV_LOCK(wdev);
1105
1106         switch (wdev->iftype) {
1107         case NL80211_IFTYPE_AP:
1108         case NL80211_IFTYPE_AP_VLAN:
1109         case NL80211_IFTYPE_P2P_GO:
1110         case NL80211_IFTYPE_MESH_POINT:
1111                 break;
1112         case NL80211_IFTYPE_ADHOC:
1113         case NL80211_IFTYPE_STATION:
1114         case NL80211_IFTYPE_P2P_CLIENT:
1115                 if (!wdev->current_bss)
1116                         return -ENOLINK;
1117                 break;
1118         case NL80211_IFTYPE_UNSPECIFIED:
1119         case NL80211_IFTYPE_OCB:
1120         case NL80211_IFTYPE_MONITOR:
1121         case NL80211_IFTYPE_NAN:
1122         case NL80211_IFTYPE_P2P_DEVICE:
1123         case NL80211_IFTYPE_WDS:
1124         case NUM_NL80211_IFTYPES:
1125                 return -EINVAL;
1126         }
1127
1128         return 0;
1129 }
1130
1131 static struct ieee80211_channel *nl80211_get_valid_chan(struct wiphy *wiphy,
1132                                                         struct nlattr *tb)
1133 {
1134         struct ieee80211_channel *chan;
1135
1136         if (tb == NULL)
1137                 return NULL;
1138         chan = ieee80211_get_channel(wiphy, nla_get_u32(tb));
1139         if (!chan || chan->flags & IEEE80211_CHAN_DISABLED)
1140                 return NULL;
1141         return chan;
1142 }
1143
1144 static int nl80211_put_iftypes(struct sk_buff *msg, u32 attr, u16 ifmodes)
1145 {
1146         struct nlattr *nl_modes = nla_nest_start(msg, attr);
1147         int i;
1148
1149         if (!nl_modes)
1150                 goto nla_put_failure;
1151
1152         i = 0;
1153         while (ifmodes) {
1154                 if ((ifmodes & 1) && nla_put_flag(msg, i))
1155                         goto nla_put_failure;
1156                 ifmodes >>= 1;
1157                 i++;
1158         }
1159
1160         nla_nest_end(msg, nl_modes);
1161         return 0;
1162
1163 nla_put_failure:
1164         return -ENOBUFS;
1165 }
1166
1167 static int nl80211_put_iface_combinations(struct wiphy *wiphy,
1168                                           struct sk_buff *msg,
1169                                           bool large)
1170 {
1171         struct nlattr *nl_combis;
1172         int i, j;
1173
1174         nl_combis = nla_nest_start(msg,
1175                                 NL80211_ATTR_INTERFACE_COMBINATIONS);
1176         if (!nl_combis)
1177                 goto nla_put_failure;
1178
1179         for (i = 0; i < wiphy->n_iface_combinations; i++) {
1180                 const struct ieee80211_iface_combination *c;
1181                 struct nlattr *nl_combi, *nl_limits;
1182
1183                 c = &wiphy->iface_combinations[i];
1184
1185                 nl_combi = nla_nest_start(msg, i + 1);
1186                 if (!nl_combi)
1187                         goto nla_put_failure;
1188
1189                 nl_limits = nla_nest_start(msg, NL80211_IFACE_COMB_LIMITS);
1190                 if (!nl_limits)
1191                         goto nla_put_failure;
1192
1193                 for (j = 0; j < c->n_limits; j++) {
1194                         struct nlattr *nl_limit;
1195
1196                         nl_limit = nla_nest_start(msg, j + 1);
1197                         if (!nl_limit)
1198                                 goto nla_put_failure;
1199                         if (nla_put_u32(msg, NL80211_IFACE_LIMIT_MAX,
1200                                         c->limits[j].max))
1201                                 goto nla_put_failure;
1202                         if (nl80211_put_iftypes(msg, NL80211_IFACE_LIMIT_TYPES,
1203                                                 c->limits[j].types))
1204                                 goto nla_put_failure;
1205                         nla_nest_end(msg, nl_limit);
1206                 }
1207
1208                 nla_nest_end(msg, nl_limits);
1209
1210                 if (c->beacon_int_infra_match &&
1211                     nla_put_flag(msg, NL80211_IFACE_COMB_STA_AP_BI_MATCH))
1212                         goto nla_put_failure;
1213                 if (nla_put_u32(msg, NL80211_IFACE_COMB_NUM_CHANNELS,
1214                                 c->num_different_channels) ||
1215                     nla_put_u32(msg, NL80211_IFACE_COMB_MAXNUM,
1216                                 c->max_interfaces))
1217                         goto nla_put_failure;
1218                 if (large &&
1219                     (nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_WIDTHS,
1220                                 c->radar_detect_widths) ||
1221                      nla_put_u32(msg, NL80211_IFACE_COMB_RADAR_DETECT_REGIONS,
1222                                 c->radar_detect_regions)))
1223                         goto nla_put_failure;
1224                 if (c->beacon_int_min_gcd &&
1225                     nla_put_u32(msg, NL80211_IFACE_COMB_BI_MIN_GCD,
1226                                 c->beacon_int_min_gcd))
1227                         goto nla_put_failure;
1228
1229                 nla_nest_end(msg, nl_combi);
1230         }
1231
1232         nla_nest_end(msg, nl_combis);
1233
1234         return 0;
1235 nla_put_failure:
1236         return -ENOBUFS;
1237 }
1238
1239 #ifdef CONFIG_PM
1240 static int nl80211_send_wowlan_tcp_caps(struct cfg80211_registered_device *rdev,
1241                                         struct sk_buff *msg)
1242 {
1243         const struct wiphy_wowlan_tcp_support *tcp = rdev->wiphy.wowlan->tcp;
1244         struct nlattr *nl_tcp;
1245
1246         if (!tcp)
1247                 return 0;
1248
1249         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
1250         if (!nl_tcp)
1251                 return -ENOBUFS;
1252
1253         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1254                         tcp->data_payload_max))
1255                 return -ENOBUFS;
1256
1257         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
1258                         tcp->data_payload_max))
1259                 return -ENOBUFS;
1260
1261         if (tcp->seq && nla_put_flag(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ))
1262                 return -ENOBUFS;
1263
1264         if (tcp->tok && nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
1265                                 sizeof(*tcp->tok), tcp->tok))
1266                 return -ENOBUFS;
1267
1268         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
1269                         tcp->data_interval_max))
1270                 return -ENOBUFS;
1271
1272         if (nla_put_u32(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
1273                         tcp->wake_payload_max))
1274                 return -ENOBUFS;
1275
1276         nla_nest_end(msg, nl_tcp);
1277         return 0;
1278 }
1279
1280 static int nl80211_send_wowlan(struct sk_buff *msg,
1281                                struct cfg80211_registered_device *rdev,
1282                                bool large)
1283 {
1284         struct nlattr *nl_wowlan;
1285
1286         if (!rdev->wiphy.wowlan)
1287                 return 0;
1288
1289         nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS_SUPPORTED);
1290         if (!nl_wowlan)
1291                 return -ENOBUFS;
1292
1293         if (((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_ANY) &&
1294              nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
1295             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_DISCONNECT) &&
1296              nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
1297             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT) &&
1298              nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
1299             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_SUPPORTS_GTK_REKEY) &&
1300              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED)) ||
1301             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE) &&
1302              nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
1303             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ) &&
1304              nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
1305             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE) &&
1306              nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
1307             ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE) &&
1308              nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
1309                 return -ENOBUFS;
1310
1311         if (rdev->wiphy.wowlan->n_patterns) {
1312                 struct nl80211_pattern_support pat = {
1313                         .max_patterns = rdev->wiphy.wowlan->n_patterns,
1314                         .min_pattern_len = rdev->wiphy.wowlan->pattern_min_len,
1315                         .max_pattern_len = rdev->wiphy.wowlan->pattern_max_len,
1316                         .max_pkt_offset = rdev->wiphy.wowlan->max_pkt_offset,
1317                 };
1318
1319                 if (nla_put(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
1320                             sizeof(pat), &pat))
1321                         return -ENOBUFS;
1322         }
1323
1324         if ((rdev->wiphy.wowlan->flags & WIPHY_WOWLAN_NET_DETECT) &&
1325             nla_put_u32(msg, NL80211_WOWLAN_TRIG_NET_DETECT,
1326                         rdev->wiphy.wowlan->max_nd_match_sets))
1327                 return -ENOBUFS;
1328
1329         if (large && nl80211_send_wowlan_tcp_caps(rdev, msg))
1330                 return -ENOBUFS;
1331
1332         nla_nest_end(msg, nl_wowlan);
1333
1334         return 0;
1335 }
1336 #endif
1337
1338 static int nl80211_send_coalesce(struct sk_buff *msg,
1339                                  struct cfg80211_registered_device *rdev)
1340 {
1341         struct nl80211_coalesce_rule_support rule;
1342
1343         if (!rdev->wiphy.coalesce)
1344                 return 0;
1345
1346         rule.max_rules = rdev->wiphy.coalesce->n_rules;
1347         rule.max_delay = rdev->wiphy.coalesce->max_delay;
1348         rule.pat.max_patterns = rdev->wiphy.coalesce->n_patterns;
1349         rule.pat.min_pattern_len = rdev->wiphy.coalesce->pattern_min_len;
1350         rule.pat.max_pattern_len = rdev->wiphy.coalesce->pattern_max_len;
1351         rule.pat.max_pkt_offset = rdev->wiphy.coalesce->max_pkt_offset;
1352
1353         if (nla_put(msg, NL80211_ATTR_COALESCE_RULE, sizeof(rule), &rule))
1354                 return -ENOBUFS;
1355
1356         return 0;
1357 }
1358
1359 static int
1360 nl80211_send_iftype_data(struct sk_buff *msg,
1361                          const struct ieee80211_sband_iftype_data *iftdata)
1362 {
1363         const struct ieee80211_sta_he_cap *he_cap = &iftdata->he_cap;
1364
1365         if (nl80211_put_iftypes(msg, NL80211_BAND_IFTYPE_ATTR_IFTYPES,
1366                                 iftdata->types_mask))
1367                 return -ENOBUFS;
1368
1369         if (he_cap->has_he) {
1370                 if (nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MAC,
1371                             sizeof(he_cap->he_cap_elem.mac_cap_info),
1372                             he_cap->he_cap_elem.mac_cap_info) ||
1373                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PHY,
1374                             sizeof(he_cap->he_cap_elem.phy_cap_info),
1375                             he_cap->he_cap_elem.phy_cap_info) ||
1376                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_MCS_SET,
1377                             sizeof(he_cap->he_mcs_nss_supp),
1378                             &he_cap->he_mcs_nss_supp) ||
1379                     nla_put(msg, NL80211_BAND_IFTYPE_ATTR_HE_CAP_PPE,
1380                             sizeof(he_cap->ppe_thres), he_cap->ppe_thres))
1381                         return -ENOBUFS;
1382         }
1383
1384         return 0;
1385 }
1386
1387 static int nl80211_send_band_rateinfo(struct sk_buff *msg,
1388                                       struct ieee80211_supported_band *sband)
1389 {
1390         struct nlattr *nl_rates, *nl_rate;
1391         struct ieee80211_rate *rate;
1392         int i;
1393
1394         /* add HT info */
1395         if (sband->ht_cap.ht_supported &&
1396             (nla_put(msg, NL80211_BAND_ATTR_HT_MCS_SET,
1397                      sizeof(sband->ht_cap.mcs),
1398                      &sband->ht_cap.mcs) ||
1399              nla_put_u16(msg, NL80211_BAND_ATTR_HT_CAPA,
1400                          sband->ht_cap.cap) ||
1401              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_FACTOR,
1402                         sband->ht_cap.ampdu_factor) ||
1403              nla_put_u8(msg, NL80211_BAND_ATTR_HT_AMPDU_DENSITY,
1404                         sband->ht_cap.ampdu_density)))
1405                 return -ENOBUFS;
1406
1407         /* add VHT info */
1408         if (sband->vht_cap.vht_supported &&
1409             (nla_put(msg, NL80211_BAND_ATTR_VHT_MCS_SET,
1410                      sizeof(sband->vht_cap.vht_mcs),
1411                      &sband->vht_cap.vht_mcs) ||
1412              nla_put_u32(msg, NL80211_BAND_ATTR_VHT_CAPA,
1413                          sband->vht_cap.cap)))
1414                 return -ENOBUFS;
1415
1416         if (sband->n_iftype_data) {
1417                 struct nlattr *nl_iftype_data =
1418                         nla_nest_start(msg, NL80211_BAND_ATTR_IFTYPE_DATA);
1419                 int err;
1420
1421                 if (!nl_iftype_data)
1422                         return -ENOBUFS;
1423
1424                 for (i = 0; i < sband->n_iftype_data; i++) {
1425                         struct nlattr *iftdata;
1426
1427                         iftdata = nla_nest_start(msg, i + 1);
1428                         if (!iftdata)
1429                                 return -ENOBUFS;
1430
1431                         err = nl80211_send_iftype_data(msg,
1432                                                        &sband->iftype_data[i]);
1433                         if (err)
1434                                 return err;
1435
1436                         nla_nest_end(msg, iftdata);
1437                 }
1438
1439                 nla_nest_end(msg, nl_iftype_data);
1440         }
1441
1442         /* add bitrates */
1443         nl_rates = nla_nest_start(msg, NL80211_BAND_ATTR_RATES);
1444         if (!nl_rates)
1445                 return -ENOBUFS;
1446
1447         for (i = 0; i < sband->n_bitrates; i++) {
1448                 nl_rate = nla_nest_start(msg, i);
1449                 if (!nl_rate)
1450                         return -ENOBUFS;
1451
1452                 rate = &sband->bitrates[i];
1453                 if (nla_put_u32(msg, NL80211_BITRATE_ATTR_RATE,
1454                                 rate->bitrate))
1455                         return -ENOBUFS;
1456                 if ((rate->flags & IEEE80211_RATE_SHORT_PREAMBLE) &&
1457                     nla_put_flag(msg,
1458                                  NL80211_BITRATE_ATTR_2GHZ_SHORTPREAMBLE))
1459                         return -ENOBUFS;
1460
1461                 nla_nest_end(msg, nl_rate);
1462         }
1463
1464         nla_nest_end(msg, nl_rates);
1465
1466         return 0;
1467 }
1468
1469 static int
1470 nl80211_send_mgmt_stypes(struct sk_buff *msg,
1471                          const struct ieee80211_txrx_stypes *mgmt_stypes)
1472 {
1473         u16 stypes;
1474         struct nlattr *nl_ftypes, *nl_ifs;
1475         enum nl80211_iftype ift;
1476         int i;
1477
1478         if (!mgmt_stypes)
1479                 return 0;
1480
1481         nl_ifs = nla_nest_start(msg, NL80211_ATTR_TX_FRAME_TYPES);
1482         if (!nl_ifs)
1483                 return -ENOBUFS;
1484
1485         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1486                 nl_ftypes = nla_nest_start(msg, ift);
1487                 if (!nl_ftypes)
1488                         return -ENOBUFS;
1489                 i = 0;
1490                 stypes = mgmt_stypes[ift].tx;
1491                 while (stypes) {
1492                         if ((stypes & 1) &&
1493                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1494                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1495                                 return -ENOBUFS;
1496                         stypes >>= 1;
1497                         i++;
1498                 }
1499                 nla_nest_end(msg, nl_ftypes);
1500         }
1501
1502         nla_nest_end(msg, nl_ifs);
1503
1504         nl_ifs = nla_nest_start(msg, NL80211_ATTR_RX_FRAME_TYPES);
1505         if (!nl_ifs)
1506                 return -ENOBUFS;
1507
1508         for (ift = 0; ift < NUM_NL80211_IFTYPES; ift++) {
1509                 nl_ftypes = nla_nest_start(msg, ift);
1510                 if (!nl_ftypes)
1511                         return -ENOBUFS;
1512                 i = 0;
1513                 stypes = mgmt_stypes[ift].rx;
1514                 while (stypes) {
1515                         if ((stypes & 1) &&
1516                             nla_put_u16(msg, NL80211_ATTR_FRAME_TYPE,
1517                                         (i << 4) | IEEE80211_FTYPE_MGMT))
1518                                 return -ENOBUFS;
1519                         stypes >>= 1;
1520                         i++;
1521                 }
1522                 nla_nest_end(msg, nl_ftypes);
1523         }
1524         nla_nest_end(msg, nl_ifs);
1525
1526         return 0;
1527 }
1528
1529 #define CMD(op, n)                                                      \
1530          do {                                                           \
1531                 if (rdev->ops->op) {                                    \
1532                         i++;                                            \
1533                         if (nla_put_u32(msg, i, NL80211_CMD_ ## n))     \
1534                                 goto nla_put_failure;                   \
1535                 }                                                       \
1536         } while (0)
1537
1538 static int nl80211_add_commands_unsplit(struct cfg80211_registered_device *rdev,
1539                                         struct sk_buff *msg)
1540 {
1541         int i = 0;
1542
1543         /*
1544          * do *NOT* add anything into this function, new things need to be
1545          * advertised only to new versions of userspace that can deal with
1546          * the split (and they can't possibly care about new features...
1547          */
1548         CMD(add_virtual_intf, NEW_INTERFACE);
1549         CMD(change_virtual_intf, SET_INTERFACE);
1550         CMD(add_key, NEW_KEY);
1551         CMD(start_ap, START_AP);
1552         CMD(add_station, NEW_STATION);
1553         CMD(add_mpath, NEW_MPATH);
1554         CMD(update_mesh_config, SET_MESH_CONFIG);
1555         CMD(change_bss, SET_BSS);
1556         CMD(auth, AUTHENTICATE);
1557         CMD(assoc, ASSOCIATE);
1558         CMD(deauth, DEAUTHENTICATE);
1559         CMD(disassoc, DISASSOCIATE);
1560         CMD(join_ibss, JOIN_IBSS);
1561         CMD(join_mesh, JOIN_MESH);
1562         CMD(set_pmksa, SET_PMKSA);
1563         CMD(del_pmksa, DEL_PMKSA);
1564         CMD(flush_pmksa, FLUSH_PMKSA);
1565         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL)
1566                 CMD(remain_on_channel, REMAIN_ON_CHANNEL);
1567         CMD(set_bitrate_mask, SET_TX_BITRATE_MASK);
1568         CMD(mgmt_tx, FRAME);
1569         CMD(mgmt_tx_cancel_wait, FRAME_WAIT_CANCEL);
1570         if (rdev->wiphy.flags & WIPHY_FLAG_NETNS_OK) {
1571                 i++;
1572                 if (nla_put_u32(msg, i, NL80211_CMD_SET_WIPHY_NETNS))
1573                         goto nla_put_failure;
1574         }
1575         if (rdev->ops->set_monitor_channel || rdev->ops->start_ap ||
1576             rdev->ops->join_mesh) {
1577                 i++;
1578                 if (nla_put_u32(msg, i, NL80211_CMD_SET_CHANNEL))
1579                         goto nla_put_failure;
1580         }
1581         CMD(set_wds_peer, SET_WDS_PEER);
1582         if (rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) {
1583                 CMD(tdls_mgmt, TDLS_MGMT);
1584                 CMD(tdls_oper, TDLS_OPER);
1585         }
1586         if (rdev->wiphy.max_sched_scan_reqs)
1587                 CMD(sched_scan_start, START_SCHED_SCAN);
1588         CMD(probe_client, PROBE_CLIENT);
1589         CMD(set_noack_map, SET_NOACK_MAP);
1590         if (rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS) {
1591                 i++;
1592                 if (nla_put_u32(msg, i, NL80211_CMD_REGISTER_BEACONS))
1593                         goto nla_put_failure;
1594         }
1595         CMD(start_p2p_device, START_P2P_DEVICE);
1596         CMD(set_mcast_rate, SET_MCAST_RATE);
1597 #ifdef CONFIG_NL80211_TESTMODE
1598         CMD(testmode_cmd, TESTMODE);
1599 #endif
1600
1601         if (rdev->ops->connect || rdev->ops->auth) {
1602                 i++;
1603                 if (nla_put_u32(msg, i, NL80211_CMD_CONNECT))
1604                         goto nla_put_failure;
1605         }
1606
1607         if (rdev->ops->disconnect || rdev->ops->deauth) {
1608                 i++;
1609                 if (nla_put_u32(msg, i, NL80211_CMD_DISCONNECT))
1610                         goto nla_put_failure;
1611         }
1612
1613         return i;
1614  nla_put_failure:
1615         return -ENOBUFS;
1616 }
1617
1618 struct nl80211_dump_wiphy_state {
1619         s64 filter_wiphy;
1620         long start;
1621         long split_start, band_start, chan_start, capa_start;
1622         bool split;
1623 };
1624
1625 static int nl80211_send_wiphy(struct cfg80211_registered_device *rdev,
1626                               enum nl80211_commands cmd,
1627                               struct sk_buff *msg, u32 portid, u32 seq,
1628                               int flags, struct nl80211_dump_wiphy_state *state)
1629 {
1630         void *hdr;
1631         struct nlattr *nl_bands, *nl_band;
1632         struct nlattr *nl_freqs, *nl_freq;
1633         struct nlattr *nl_cmds;
1634         enum nl80211_band band;
1635         struct ieee80211_channel *chan;
1636         int i;
1637         const struct ieee80211_txrx_stypes *mgmt_stypes =
1638                                 rdev->wiphy.mgmt_stypes;
1639         u32 features;
1640
1641         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
1642         if (!hdr)
1643                 return -ENOBUFS;
1644
1645         if (WARN_ON(!state))
1646                 return -EINVAL;
1647
1648         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
1649             nla_put_string(msg, NL80211_ATTR_WIPHY_NAME,
1650                            wiphy_name(&rdev->wiphy)) ||
1651             nla_put_u32(msg, NL80211_ATTR_GENERATION,
1652                         cfg80211_rdev_list_generation))
1653                 goto nla_put_failure;
1654
1655         if (cmd != NL80211_CMD_NEW_WIPHY)
1656                 goto finish;
1657
1658         switch (state->split_start) {
1659         case 0:
1660                 if (nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_SHORT,
1661                                rdev->wiphy.retry_short) ||
1662                     nla_put_u8(msg, NL80211_ATTR_WIPHY_RETRY_LONG,
1663                                rdev->wiphy.retry_long) ||
1664                     nla_put_u32(msg, NL80211_ATTR_WIPHY_FRAG_THRESHOLD,
1665                                 rdev->wiphy.frag_threshold) ||
1666                     nla_put_u32(msg, NL80211_ATTR_WIPHY_RTS_THRESHOLD,
1667                                 rdev->wiphy.rts_threshold) ||
1668                     nla_put_u8(msg, NL80211_ATTR_WIPHY_COVERAGE_CLASS,
1669                                rdev->wiphy.coverage_class) ||
1670                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCAN_SSIDS,
1671                                rdev->wiphy.max_scan_ssids) ||
1672                     nla_put_u8(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_SSIDS,
1673                                rdev->wiphy.max_sched_scan_ssids) ||
1674                     nla_put_u16(msg, NL80211_ATTR_MAX_SCAN_IE_LEN,
1675                                 rdev->wiphy.max_scan_ie_len) ||
1676                     nla_put_u16(msg, NL80211_ATTR_MAX_SCHED_SCAN_IE_LEN,
1677                                 rdev->wiphy.max_sched_scan_ie_len) ||
1678                     nla_put_u8(msg, NL80211_ATTR_MAX_MATCH_SETS,
1679                                rdev->wiphy.max_match_sets) ||
1680                     nla_put_u32(msg, NL80211_ATTR_MAX_NUM_SCHED_SCAN_PLANS,
1681                                 rdev->wiphy.max_sched_scan_plans) ||
1682                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_INTERVAL,
1683                                 rdev->wiphy.max_sched_scan_plan_interval) ||
1684                     nla_put_u32(msg, NL80211_ATTR_MAX_SCAN_PLAN_ITERATIONS,
1685                                 rdev->wiphy.max_sched_scan_plan_iterations))
1686                         goto nla_put_failure;
1687
1688                 if ((rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN) &&
1689                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_IBSS_RSN))
1690                         goto nla_put_failure;
1691                 if ((rdev->wiphy.flags & WIPHY_FLAG_MESH_AUTH) &&
1692                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_MESH_AUTH))
1693                         goto nla_put_failure;
1694                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) &&
1695                     nla_put_flag(msg, NL80211_ATTR_SUPPORT_AP_UAPSD))
1696                         goto nla_put_failure;
1697                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_FW_ROAM) &&
1698                     nla_put_flag(msg, NL80211_ATTR_ROAM_SUPPORT))
1699                         goto nla_put_failure;
1700                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) &&
1701                     nla_put_flag(msg, NL80211_ATTR_TDLS_SUPPORT))
1702                         goto nla_put_failure;
1703                 if ((rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP) &&
1704                     nla_put_flag(msg, NL80211_ATTR_TDLS_EXTERNAL_SETUP))
1705                         goto nla_put_failure;
1706                 state->split_start++;
1707                 if (state->split)
1708                         break;
1709         case 1:
1710                 if (nla_put(msg, NL80211_ATTR_CIPHER_SUITES,
1711                             sizeof(u32) * rdev->wiphy.n_cipher_suites,
1712                             rdev->wiphy.cipher_suites))
1713                         goto nla_put_failure;
1714
1715                 if (nla_put_u8(msg, NL80211_ATTR_MAX_NUM_PMKIDS,
1716                                rdev->wiphy.max_num_pmkids))
1717                         goto nla_put_failure;
1718
1719                 if ((rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
1720                     nla_put_flag(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE))
1721                         goto nla_put_failure;
1722
1723                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_TX,
1724                                 rdev->wiphy.available_antennas_tx) ||
1725                     nla_put_u32(msg, NL80211_ATTR_WIPHY_ANTENNA_AVAIL_RX,
1726                                 rdev->wiphy.available_antennas_rx))
1727                         goto nla_put_failure;
1728
1729                 if ((rdev->wiphy.flags & WIPHY_FLAG_AP_PROBE_RESP_OFFLOAD) &&
1730                     nla_put_u32(msg, NL80211_ATTR_PROBE_RESP_OFFLOAD,
1731                                 rdev->wiphy.probe_resp_offload))
1732                         goto nla_put_failure;
1733
1734                 if ((rdev->wiphy.available_antennas_tx ||
1735                      rdev->wiphy.available_antennas_rx) &&
1736                     rdev->ops->get_antenna) {
1737                         u32 tx_ant = 0, rx_ant = 0;
1738                         int res;
1739
1740                         res = rdev_get_antenna(rdev, &tx_ant, &rx_ant);
1741                         if (!res) {
1742                                 if (nla_put_u32(msg,
1743                                                 NL80211_ATTR_WIPHY_ANTENNA_TX,
1744                                                 tx_ant) ||
1745                                     nla_put_u32(msg,
1746                                                 NL80211_ATTR_WIPHY_ANTENNA_RX,
1747                                                 rx_ant))
1748                                         goto nla_put_failure;
1749                         }
1750                 }
1751
1752                 state->split_start++;
1753                 if (state->split)
1754                         break;
1755         case 2:
1756                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SUPPORTED_IFTYPES,
1757                                         rdev->wiphy.interface_modes))
1758                                 goto nla_put_failure;
1759                 state->split_start++;
1760                 if (state->split)
1761                         break;
1762         case 3:
1763                 nl_bands = nla_nest_start(msg, NL80211_ATTR_WIPHY_BANDS);
1764                 if (!nl_bands)
1765                         goto nla_put_failure;
1766
1767                 for (band = state->band_start;
1768                      band < NUM_NL80211_BANDS; band++) {
1769                         struct ieee80211_supported_band *sband;
1770
1771                         sband = rdev->wiphy.bands[band];
1772
1773                         if (!sband)
1774                                 continue;
1775
1776                         nl_band = nla_nest_start(msg, band);
1777                         if (!nl_band)
1778                                 goto nla_put_failure;
1779
1780                         switch (state->chan_start) {
1781                         case 0:
1782                                 if (nl80211_send_band_rateinfo(msg, sband))
1783                                         goto nla_put_failure;
1784                                 state->chan_start++;
1785                                 if (state->split)
1786                                         break;
1787                         default:
1788                                 /* add frequencies */
1789                                 nl_freqs = nla_nest_start(
1790                                         msg, NL80211_BAND_ATTR_FREQS);
1791                                 if (!nl_freqs)
1792                                         goto nla_put_failure;
1793
1794                                 for (i = state->chan_start - 1;
1795                                      i < sband->n_channels;
1796                                      i++) {
1797                                         nl_freq = nla_nest_start(msg, i);
1798                                         if (!nl_freq)
1799                                                 goto nla_put_failure;
1800
1801                                         chan = &sband->channels[i];
1802
1803                                         if (nl80211_msg_put_channel(
1804                                                         msg, &rdev->wiphy, chan,
1805                                                         state->split))
1806                                                 goto nla_put_failure;
1807
1808                                         nla_nest_end(msg, nl_freq);
1809                                         if (state->split)
1810                                                 break;
1811                                 }
1812                                 if (i < sband->n_channels)
1813                                         state->chan_start = i + 2;
1814                                 else
1815                                         state->chan_start = 0;
1816                                 nla_nest_end(msg, nl_freqs);
1817                         }
1818
1819                         nla_nest_end(msg, nl_band);
1820
1821                         if (state->split) {
1822                                 /* start again here */
1823                                 if (state->chan_start)
1824                                         band--;
1825                                 break;
1826                         }
1827                 }
1828                 nla_nest_end(msg, nl_bands);
1829
1830                 if (band < NUM_NL80211_BANDS)
1831                         state->band_start = band + 1;
1832                 else
1833                         state->band_start = 0;
1834
1835                 /* if bands & channels are done, continue outside */
1836                 if (state->band_start == 0 && state->chan_start == 0)
1837                         state->split_start++;
1838                 if (state->split)
1839                         break;
1840         case 4:
1841                 nl_cmds = nla_nest_start(msg, NL80211_ATTR_SUPPORTED_COMMANDS);
1842                 if (!nl_cmds)
1843                         goto nla_put_failure;
1844
1845                 i = nl80211_add_commands_unsplit(rdev, msg);
1846                 if (i < 0)
1847                         goto nla_put_failure;
1848                 if (state->split) {
1849                         CMD(crit_proto_start, CRIT_PROTOCOL_START);
1850                         CMD(crit_proto_stop, CRIT_PROTOCOL_STOP);
1851                         if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH)
1852                                 CMD(channel_switch, CHANNEL_SWITCH);
1853                         CMD(set_qos_map, SET_QOS_MAP);
1854                         if (rdev->wiphy.features &
1855                                         NL80211_FEATURE_SUPPORTS_WMM_ADMISSION)
1856                                 CMD(add_tx_ts, ADD_TX_TS);
1857                         CMD(set_multicast_to_unicast, SET_MULTICAST_TO_UNICAST);
1858                         CMD(update_connect_params, UPDATE_CONNECT_PARAMS);
1859                 }
1860 #undef CMD
1861
1862                 nla_nest_end(msg, nl_cmds);
1863                 state->split_start++;
1864                 if (state->split)
1865                         break;
1866         case 5:
1867                 if (rdev->ops->remain_on_channel &&
1868                     (rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL) &&
1869                     nla_put_u32(msg,
1870                                 NL80211_ATTR_MAX_REMAIN_ON_CHANNEL_DURATION,
1871                                 rdev->wiphy.max_remain_on_channel_duration))
1872                         goto nla_put_failure;
1873
1874                 if ((rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX) &&
1875                     nla_put_flag(msg, NL80211_ATTR_OFFCHANNEL_TX_OK))
1876                         goto nla_put_failure;
1877
1878                 if (nl80211_send_mgmt_stypes(msg, mgmt_stypes))
1879                         goto nla_put_failure;
1880                 state->split_start++;
1881                 if (state->split)
1882                         break;
1883         case 6:
1884 #ifdef CONFIG_PM
1885                 if (nl80211_send_wowlan(msg, rdev, state->split))
1886                         goto nla_put_failure;
1887                 state->split_start++;
1888                 if (state->split)
1889                         break;
1890 #else
1891                 state->split_start++;
1892 #endif
1893         case 7:
1894                 if (nl80211_put_iftypes(msg, NL80211_ATTR_SOFTWARE_IFTYPES,
1895                                         rdev->wiphy.software_iftypes))
1896                         goto nla_put_failure;
1897
1898                 if (nl80211_put_iface_combinations(&rdev->wiphy, msg,
1899                                                    state->split))
1900                         goto nla_put_failure;
1901
1902                 state->split_start++;
1903                 if (state->split)
1904                         break;
1905         case 8:
1906                 if ((rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME) &&
1907                     nla_put_u32(msg, NL80211_ATTR_DEVICE_AP_SME,
1908                                 rdev->wiphy.ap_sme_capa))
1909                         goto nla_put_failure;
1910
1911                 features = rdev->wiphy.features;
1912                 /*
1913                  * We can only add the per-channel limit information if the
1914                  * dump is split, otherwise it makes it too big. Therefore
1915                  * only advertise it in that case.
1916                  */
1917                 if (state->split)
1918                         features |= NL80211_FEATURE_ADVERTISE_CHAN_LIMITS;
1919                 if (nla_put_u32(msg, NL80211_ATTR_FEATURE_FLAGS, features))
1920                         goto nla_put_failure;
1921
1922                 if (rdev->wiphy.ht_capa_mod_mask &&
1923                     nla_put(msg, NL80211_ATTR_HT_CAPABILITY_MASK,
1924                             sizeof(*rdev->wiphy.ht_capa_mod_mask),
1925                             rdev->wiphy.ht_capa_mod_mask))
1926                         goto nla_put_failure;
1927
1928                 if (rdev->wiphy.flags & WIPHY_FLAG_HAVE_AP_SME &&
1929                     rdev->wiphy.max_acl_mac_addrs &&
1930                     nla_put_u32(msg, NL80211_ATTR_MAC_ACL_MAX,
1931                                 rdev->wiphy.max_acl_mac_addrs))
1932                         goto nla_put_failure;
1933
1934                 /*
1935                  * Any information below this point is only available to
1936                  * applications that can deal with it being split. This
1937                  * helps ensure that newly added capabilities don't break
1938                  * older tools by overrunning their buffers.
1939                  *
1940                  * We still increment split_start so that in the split
1941                  * case we'll continue with more data in the next round,
1942                  * but break unconditionally so unsplit data stops here.
1943                  */
1944                 state->split_start++;
1945                 break;
1946         case 9:
1947                 if (rdev->wiphy.extended_capabilities &&
1948                     (nla_put(msg, NL80211_ATTR_EXT_CAPA,
1949                              rdev->wiphy.extended_capabilities_len,
1950                              rdev->wiphy.extended_capabilities) ||
1951                      nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
1952                              rdev->wiphy.extended_capabilities_len,
1953                              rdev->wiphy.extended_capabilities_mask)))
1954                         goto nla_put_failure;
1955
1956                 if (rdev->wiphy.vht_capa_mod_mask &&
1957                     nla_put(msg, NL80211_ATTR_VHT_CAPABILITY_MASK,
1958                             sizeof(*rdev->wiphy.vht_capa_mod_mask),
1959                             rdev->wiphy.vht_capa_mod_mask))
1960                         goto nla_put_failure;
1961
1962                 state->split_start++;
1963                 break;
1964         case 10:
1965                 if (nl80211_send_coalesce(msg, rdev))
1966                         goto nla_put_failure;
1967
1968                 if ((rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ) &&
1969                     (nla_put_flag(msg, NL80211_ATTR_SUPPORT_5_MHZ) ||
1970                      nla_put_flag(msg, NL80211_ATTR_SUPPORT_10_MHZ)))
1971                         goto nla_put_failure;
1972
1973                 if (rdev->wiphy.max_ap_assoc_sta &&
1974                     nla_put_u32(msg, NL80211_ATTR_MAX_AP_ASSOC_STA,
1975                                 rdev->wiphy.max_ap_assoc_sta))
1976                         goto nla_put_failure;
1977
1978                 state->split_start++;
1979                 break;
1980         case 11:
1981                 if (rdev->wiphy.n_vendor_commands) {
1982                         const struct nl80211_vendor_cmd_info *info;
1983                         struct nlattr *nested;
1984
1985                         nested = nla_nest_start(msg, NL80211_ATTR_VENDOR_DATA);
1986                         if (!nested)
1987                                 goto nla_put_failure;
1988
1989                         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
1990                                 info = &rdev->wiphy.vendor_commands[i].info;
1991                                 if (nla_put(msg, i + 1, sizeof(*info), info))
1992                                         goto nla_put_failure;
1993                         }
1994                         nla_nest_end(msg, nested);
1995                 }
1996
1997                 if (rdev->wiphy.n_vendor_events) {
1998                         const struct nl80211_vendor_cmd_info *info;
1999                         struct nlattr *nested;
2000
2001                         nested = nla_nest_start(msg,
2002                                                 NL80211_ATTR_VENDOR_EVENTS);
2003                         if (!nested)
2004                                 goto nla_put_failure;
2005
2006                         for (i = 0; i < rdev->wiphy.n_vendor_events; i++) {
2007                                 info = &rdev->wiphy.vendor_events[i];
2008                                 if (nla_put(msg, i + 1, sizeof(*info), info))
2009                                         goto nla_put_failure;
2010                         }
2011                         nla_nest_end(msg, nested);
2012                 }
2013                 state->split_start++;
2014                 break;
2015         case 12:
2016                 if (rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH &&
2017                     nla_put_u8(msg, NL80211_ATTR_MAX_CSA_COUNTERS,
2018                                rdev->wiphy.max_num_csa_counters))
2019                         goto nla_put_failure;
2020
2021                 if (rdev->wiphy.regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
2022                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
2023                         goto nla_put_failure;
2024
2025                 if (rdev->wiphy.max_sched_scan_reqs &&
2026                     nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_MAX_REQS,
2027                                 rdev->wiphy.max_sched_scan_reqs))
2028                         goto nla_put_failure;
2029
2030                 if (nla_put(msg, NL80211_ATTR_EXT_FEATURES,
2031                             sizeof(rdev->wiphy.ext_features),
2032                             rdev->wiphy.ext_features))
2033                         goto nla_put_failure;
2034
2035                 if (rdev->wiphy.bss_select_support) {
2036                         struct nlattr *nested;
2037                         u32 bss_select_support = rdev->wiphy.bss_select_support;
2038
2039                         nested = nla_nest_start(msg, NL80211_ATTR_BSS_SELECT);
2040                         if (!nested)
2041                                 goto nla_put_failure;
2042
2043                         i = 0;
2044                         while (bss_select_support) {
2045                                 if ((bss_select_support & 1) &&
2046                                     nla_put_flag(msg, i))
2047                                         goto nla_put_failure;
2048                                 i++;
2049                                 bss_select_support >>= 1;
2050                         }
2051                         nla_nest_end(msg, nested);
2052                 }
2053
2054                 state->split_start++;
2055                 break;
2056         case 13:
2057                 if (rdev->wiphy.num_iftype_ext_capab &&
2058                     rdev->wiphy.iftype_ext_capab) {
2059                         struct nlattr *nested_ext_capab, *nested;
2060
2061                         nested = nla_nest_start(msg,
2062                                                 NL80211_ATTR_IFTYPE_EXT_CAPA);
2063                         if (!nested)
2064                                 goto nla_put_failure;
2065
2066                         for (i = state->capa_start;
2067                              i < rdev->wiphy.num_iftype_ext_capab; i++) {
2068                                 const struct wiphy_iftype_ext_capab *capab;
2069
2070                                 capab = &rdev->wiphy.iftype_ext_capab[i];
2071
2072                                 nested_ext_capab = nla_nest_start(msg, i);
2073                                 if (!nested_ext_capab ||
2074                                     nla_put_u32(msg, NL80211_ATTR_IFTYPE,
2075                                                 capab->iftype) ||
2076                                     nla_put(msg, NL80211_ATTR_EXT_CAPA,
2077                                             capab->extended_capabilities_len,
2078                                             capab->extended_capabilities) ||
2079                                     nla_put(msg, NL80211_ATTR_EXT_CAPA_MASK,
2080                                             capab->extended_capabilities_len,
2081                                             capab->extended_capabilities_mask))
2082                                         goto nla_put_failure;
2083
2084                                 nla_nest_end(msg, nested_ext_capab);
2085                                 if (state->split)
2086                                         break;
2087                         }
2088                         nla_nest_end(msg, nested);
2089                         if (i < rdev->wiphy.num_iftype_ext_capab) {
2090                                 state->capa_start = i + 1;
2091                                 break;
2092                         }
2093                 }
2094
2095                 if (nla_put_u32(msg, NL80211_ATTR_BANDS,
2096                                 rdev->wiphy.nan_supported_bands))
2097                         goto nla_put_failure;
2098
2099                 if (wiphy_ext_feature_isset(&rdev->wiphy,
2100                                             NL80211_EXT_FEATURE_TXQS)) {
2101                         struct cfg80211_txq_stats txqstats = {};
2102                         int res;
2103
2104                         res = rdev_get_txq_stats(rdev, NULL, &txqstats);
2105                         if (!res &&
2106                             !nl80211_put_txq_stats(msg, &txqstats,
2107                                                    NL80211_ATTR_TXQ_STATS))
2108                                 goto nla_put_failure;
2109
2110                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_LIMIT,
2111                                         rdev->wiphy.txq_limit))
2112                                 goto nla_put_failure;
2113                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_MEMORY_LIMIT,
2114                                         rdev->wiphy.txq_memory_limit))
2115                                 goto nla_put_failure;
2116                         if (nla_put_u32(msg, NL80211_ATTR_TXQ_QUANTUM,
2117                                         rdev->wiphy.txq_quantum))
2118                                 goto nla_put_failure;
2119                 }
2120
2121                 /* done */
2122                 state->split_start = 0;
2123                 break;
2124         }
2125  finish:
2126         genlmsg_end(msg, hdr);
2127         return 0;
2128
2129  nla_put_failure:
2130         genlmsg_cancel(msg, hdr);
2131         return -EMSGSIZE;
2132 }
2133
2134 static int nl80211_dump_wiphy_parse(struct sk_buff *skb,
2135                                     struct netlink_callback *cb,
2136                                     struct nl80211_dump_wiphy_state *state)
2137 {
2138         struct nlattr **tb = genl_family_attrbuf(&nl80211_fam);
2139         int ret = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, tb,
2140                               nl80211_fam.maxattr, nl80211_policy, NULL);
2141         /* ignore parse errors for backward compatibility */
2142         if (ret)
2143                 return 0;
2144
2145         state->split = tb[NL80211_ATTR_SPLIT_WIPHY_DUMP];
2146         if (tb[NL80211_ATTR_WIPHY])
2147                 state->filter_wiphy = nla_get_u32(tb[NL80211_ATTR_WIPHY]);
2148         if (tb[NL80211_ATTR_WDEV])
2149                 state->filter_wiphy = nla_get_u64(tb[NL80211_ATTR_WDEV]) >> 32;
2150         if (tb[NL80211_ATTR_IFINDEX]) {
2151                 struct net_device *netdev;
2152                 struct cfg80211_registered_device *rdev;
2153                 int ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
2154
2155                 netdev = __dev_get_by_index(sock_net(skb->sk), ifidx);
2156                 if (!netdev)
2157                         return -ENODEV;
2158                 if (netdev->ieee80211_ptr) {
2159                         rdev = wiphy_to_rdev(
2160                                 netdev->ieee80211_ptr->wiphy);
2161                         state->filter_wiphy = rdev->wiphy_idx;
2162                 }
2163         }
2164
2165         return 0;
2166 }
2167
2168 static int nl80211_dump_wiphy(struct sk_buff *skb, struct netlink_callback *cb)
2169 {
2170         int idx = 0, ret;
2171         struct nl80211_dump_wiphy_state *state = (void *)cb->args[0];
2172         struct cfg80211_registered_device *rdev;
2173
2174         rtnl_lock();
2175         if (!state) {
2176                 state = kzalloc(sizeof(*state), GFP_KERNEL);
2177                 if (!state) {
2178                         rtnl_unlock();
2179                         return -ENOMEM;
2180                 }
2181                 state->filter_wiphy = -1;
2182                 ret = nl80211_dump_wiphy_parse(skb, cb, state);
2183                 if (ret) {
2184                         kfree(state);
2185                         rtnl_unlock();
2186                         return ret;
2187                 }
2188                 cb->args[0] = (long)state;
2189         }
2190
2191         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2192                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2193                         continue;
2194                 if (++idx <= state->start)
2195                         continue;
2196                 if (state->filter_wiphy != -1 &&
2197                     state->filter_wiphy != rdev->wiphy_idx)
2198                         continue;
2199                 /* attempt to fit multiple wiphy data chunks into the skb */
2200                 do {
2201                         ret = nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY,
2202                                                  skb,
2203                                                  NETLINK_CB(cb->skb).portid,
2204                                                  cb->nlh->nlmsg_seq,
2205                                                  NLM_F_MULTI, state);
2206                         if (ret < 0) {
2207                                 /*
2208                                  * If sending the wiphy data didn't fit (ENOBUFS
2209                                  * or EMSGSIZE returned), this SKB is still
2210                                  * empty (so it's not too big because another
2211                                  * wiphy dataset is already in the skb) and
2212                                  * we've not tried to adjust the dump allocation
2213                                  * yet ... then adjust the alloc size to be
2214                                  * bigger, and return 1 but with the empty skb.
2215                                  * This results in an empty message being RX'ed
2216                                  * in userspace, but that is ignored.
2217                                  *
2218                                  * We can then retry with the larger buffer.
2219                                  */
2220                                 if ((ret == -ENOBUFS || ret == -EMSGSIZE) &&
2221                                     !skb->len && !state->split &&
2222                                     cb->min_dump_alloc < 4096) {
2223                                         cb->min_dump_alloc = 4096;
2224                                         state->split_start = 0;
2225                                         rtnl_unlock();
2226                                         return 1;
2227                                 }
2228                                 idx--;
2229                                 break;
2230                         }
2231                 } while (state->split_start > 0);
2232                 break;
2233         }
2234         rtnl_unlock();
2235
2236         state->start = idx;
2237
2238         return skb->len;
2239 }
2240
2241 static int nl80211_dump_wiphy_done(struct netlink_callback *cb)
2242 {
2243         kfree((void *)cb->args[0]);
2244         return 0;
2245 }
2246
2247 static int nl80211_get_wiphy(struct sk_buff *skb, struct genl_info *info)
2248 {
2249         struct sk_buff *msg;
2250         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2251         struct nl80211_dump_wiphy_state state = {};
2252
2253         msg = nlmsg_new(4096, GFP_KERNEL);
2254         if (!msg)
2255                 return -ENOMEM;
2256
2257         if (nl80211_send_wiphy(rdev, NL80211_CMD_NEW_WIPHY, msg,
2258                                info->snd_portid, info->snd_seq, 0,
2259                                &state) < 0) {
2260                 nlmsg_free(msg);
2261                 return -ENOBUFS;
2262         }
2263
2264         return genlmsg_reply(msg, info);
2265 }
2266
2267 static const struct nla_policy txq_params_policy[NL80211_TXQ_ATTR_MAX + 1] = {
2268         [NL80211_TXQ_ATTR_QUEUE]                = { .type = NLA_U8 },
2269         [NL80211_TXQ_ATTR_TXOP]                 = { .type = NLA_U16 },
2270         [NL80211_TXQ_ATTR_CWMIN]                = { .type = NLA_U16 },
2271         [NL80211_TXQ_ATTR_CWMAX]                = { .type = NLA_U16 },
2272         [NL80211_TXQ_ATTR_AIFS]                 = { .type = NLA_U8 },
2273 };
2274
2275 static int parse_txq_params(struct nlattr *tb[],
2276                             struct ieee80211_txq_params *txq_params)
2277 {
2278         u8 ac;
2279
2280         if (!tb[NL80211_TXQ_ATTR_AC] || !tb[NL80211_TXQ_ATTR_TXOP] ||
2281             !tb[NL80211_TXQ_ATTR_CWMIN] || !tb[NL80211_TXQ_ATTR_CWMAX] ||
2282             !tb[NL80211_TXQ_ATTR_AIFS])
2283                 return -EINVAL;
2284
2285         ac = nla_get_u8(tb[NL80211_TXQ_ATTR_AC]);
2286         txq_params->txop = nla_get_u16(tb[NL80211_TXQ_ATTR_TXOP]);
2287         txq_params->cwmin = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMIN]);
2288         txq_params->cwmax = nla_get_u16(tb[NL80211_TXQ_ATTR_CWMAX]);
2289         txq_params->aifs = nla_get_u8(tb[NL80211_TXQ_ATTR_AIFS]);
2290
2291         if (ac >= NL80211_NUM_ACS)
2292                 return -EINVAL;
2293         txq_params->ac = array_index_nospec(ac, NL80211_NUM_ACS);
2294         return 0;
2295 }
2296
2297 static bool nl80211_can_set_dev_channel(struct wireless_dev *wdev)
2298 {
2299         /*
2300          * You can only set the channel explicitly for WDS interfaces,
2301          * all others have their channel managed via their respective
2302          * "establish a connection" command (connect, join, ...)
2303          *
2304          * For AP/GO and mesh mode, the channel can be set with the
2305          * channel userspace API, but is only stored and passed to the
2306          * low-level driver when the AP starts or the mesh is joined.
2307          * This is for backward compatibility, userspace can also give
2308          * the channel in the start-ap or join-mesh commands instead.
2309          *
2310          * Monitors are special as they are normally slaved to
2311          * whatever else is going on, so they have their own special
2312          * operation to set the monitor channel if possible.
2313          */
2314         return !wdev ||
2315                 wdev->iftype == NL80211_IFTYPE_AP ||
2316                 wdev->iftype == NL80211_IFTYPE_MESH_POINT ||
2317                 wdev->iftype == NL80211_IFTYPE_MONITOR ||
2318                 wdev->iftype == NL80211_IFTYPE_P2P_GO;
2319 }
2320
2321 static int nl80211_parse_chandef(struct cfg80211_registered_device *rdev,
2322                                  struct genl_info *info,
2323                                  struct cfg80211_chan_def *chandef)
2324 {
2325         struct netlink_ext_ack *extack = info->extack;
2326         struct nlattr **attrs = info->attrs;
2327         u32 control_freq;
2328
2329         if (!attrs[NL80211_ATTR_WIPHY_FREQ])
2330                 return -EINVAL;
2331
2332         control_freq = nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ]);
2333
2334         chandef->chan = ieee80211_get_channel(&rdev->wiphy, control_freq);
2335         chandef->width = NL80211_CHAN_WIDTH_20_NOHT;
2336         chandef->center_freq1 = control_freq;
2337         chandef->center_freq2 = 0;
2338
2339         /* Primary channel not allowed */
2340         if (!chandef->chan || chandef->chan->flags & IEEE80211_CHAN_DISABLED) {
2341                 NL_SET_ERR_MSG_ATTR(extack, attrs[NL80211_ATTR_WIPHY_FREQ],
2342                                     "Channel is disabled");
2343                 return -EINVAL;
2344         }
2345
2346         if (attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]) {
2347                 enum nl80211_channel_type chantype;
2348
2349                 chantype = nla_get_u32(attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE]);
2350
2351                 switch (chantype) {
2352                 case NL80211_CHAN_NO_HT:
2353                 case NL80211_CHAN_HT20:
2354                 case NL80211_CHAN_HT40PLUS:
2355                 case NL80211_CHAN_HT40MINUS:
2356                         cfg80211_chandef_create(chandef, chandef->chan,
2357                                                 chantype);
2358                         /* user input for center_freq is incorrect */
2359                         if (attrs[NL80211_ATTR_CENTER_FREQ1] &&
2360                             chandef->center_freq1 != nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1])) {
2361                                 NL_SET_ERR_MSG_ATTR(extack,
2362                                                     attrs[NL80211_ATTR_CENTER_FREQ1],
2363                                                     "bad center frequency 1");
2364                                 return -EINVAL;
2365                         }
2366                         /* center_freq2 must be zero */
2367                         if (attrs[NL80211_ATTR_CENTER_FREQ2] &&
2368                             nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2])) {
2369                                 NL_SET_ERR_MSG_ATTR(extack,
2370                                                     attrs[NL80211_ATTR_CENTER_FREQ2],
2371                                                     "center frequency 2 can't be used");
2372                                 return -EINVAL;
2373                         }
2374                         break;
2375                 default:
2376                         NL_SET_ERR_MSG_ATTR(extack,
2377                                             attrs[NL80211_ATTR_WIPHY_CHANNEL_TYPE],
2378                                             "invalid channel type");
2379                         return -EINVAL;
2380                 }
2381         } else if (attrs[NL80211_ATTR_CHANNEL_WIDTH]) {
2382                 chandef->width =
2383                         nla_get_u32(attrs[NL80211_ATTR_CHANNEL_WIDTH]);
2384                 if (attrs[NL80211_ATTR_CENTER_FREQ1])
2385                         chandef->center_freq1 =
2386                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ1]);
2387                 if (attrs[NL80211_ATTR_CENTER_FREQ2])
2388                         chandef->center_freq2 =
2389                                 nla_get_u32(attrs[NL80211_ATTR_CENTER_FREQ2]);
2390         }
2391
2392         if (!cfg80211_chandef_valid(chandef)) {
2393                 NL_SET_ERR_MSG(extack, "invalid channel definition");
2394                 return -EINVAL;
2395         }
2396
2397         if (!cfg80211_chandef_usable(&rdev->wiphy, chandef,
2398                                      IEEE80211_CHAN_DISABLED)) {
2399                 NL_SET_ERR_MSG(extack, "(extension) channel is disabled");
2400                 return -EINVAL;
2401         }
2402
2403         if ((chandef->width == NL80211_CHAN_WIDTH_5 ||
2404              chandef->width == NL80211_CHAN_WIDTH_10) &&
2405             !(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_5_10_MHZ)) {
2406                 NL_SET_ERR_MSG(extack, "5/10 MHz not supported");
2407                 return -EINVAL;
2408         }
2409
2410         return 0;
2411 }
2412
2413 static int __nl80211_set_channel(struct cfg80211_registered_device *rdev,
2414                                  struct net_device *dev,
2415                                  struct genl_info *info)
2416 {
2417         struct cfg80211_chan_def chandef;
2418         int result;
2419         enum nl80211_iftype iftype = NL80211_IFTYPE_MONITOR;
2420         struct wireless_dev *wdev = NULL;
2421
2422         if (dev)
2423                 wdev = dev->ieee80211_ptr;
2424         if (!nl80211_can_set_dev_channel(wdev))
2425                 return -EOPNOTSUPP;
2426         if (wdev)
2427                 iftype = wdev->iftype;
2428
2429         result = nl80211_parse_chandef(rdev, info, &chandef);
2430         if (result)
2431                 return result;
2432
2433         switch (iftype) {
2434         case NL80211_IFTYPE_AP:
2435         case NL80211_IFTYPE_P2P_GO:
2436                 if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
2437                                                    iftype)) {
2438                         result = -EINVAL;
2439                         break;
2440                 }
2441                 if (wdev->beacon_interval) {
2442                         if (!dev || !rdev->ops->set_ap_chanwidth ||
2443                             !(rdev->wiphy.features &
2444                               NL80211_FEATURE_AP_MODE_CHAN_WIDTH_CHANGE)) {
2445                                 result = -EBUSY;
2446                                 break;
2447                         }
2448
2449                         /* Only allow dynamic channel width changes */
2450                         if (chandef.chan != wdev->preset_chandef.chan) {
2451                                 result = -EBUSY;
2452                                 break;
2453                         }
2454                         result = rdev_set_ap_chanwidth(rdev, dev, &chandef);
2455                         if (result)
2456                                 break;
2457                 }
2458                 wdev->preset_chandef = chandef;
2459                 result = 0;
2460                 break;
2461         case NL80211_IFTYPE_MESH_POINT:
2462                 result = cfg80211_set_mesh_channel(rdev, wdev, &chandef);
2463                 break;
2464         case NL80211_IFTYPE_MONITOR:
2465                 result = cfg80211_set_monitor_channel(rdev, &chandef);
2466                 break;
2467         default:
2468                 result = -EINVAL;
2469         }
2470
2471         return result;
2472 }
2473
2474 static int nl80211_set_channel(struct sk_buff *skb, struct genl_info *info)
2475 {
2476         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2477         struct net_device *netdev = info->user_ptr[1];
2478
2479         return __nl80211_set_channel(rdev, netdev, info);
2480 }
2481
2482 static int nl80211_set_wds_peer(struct sk_buff *skb, struct genl_info *info)
2483 {
2484         struct cfg80211_registered_device *rdev = info->user_ptr[0];
2485         struct net_device *dev = info->user_ptr[1];
2486         struct wireless_dev *wdev = dev->ieee80211_ptr;
2487         const u8 *bssid;
2488
2489         if (!info->attrs[NL80211_ATTR_MAC])
2490                 return -EINVAL;
2491
2492         if (netif_running(dev))
2493                 return -EBUSY;
2494
2495         if (!rdev->ops->set_wds_peer)
2496                 return -EOPNOTSUPP;
2497
2498         if (wdev->iftype != NL80211_IFTYPE_WDS)
2499                 return -EOPNOTSUPP;
2500
2501         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
2502         return rdev_set_wds_peer(rdev, dev, bssid);
2503 }
2504
2505 static int nl80211_set_wiphy(struct sk_buff *skb, struct genl_info *info)
2506 {
2507         struct cfg80211_registered_device *rdev;
2508         struct net_device *netdev = NULL;
2509         struct wireless_dev *wdev;
2510         int result = 0, rem_txq_params = 0;
2511         struct nlattr *nl_txq_params;
2512         u32 changed;
2513         u8 retry_short = 0, retry_long = 0;
2514         u32 frag_threshold = 0, rts_threshold = 0;
2515         u8 coverage_class = 0;
2516         u32 txq_limit = 0, txq_memory_limit = 0, txq_quantum = 0;
2517
2518         ASSERT_RTNL();
2519
2520         /*
2521          * Try to find the wiphy and netdev. Normally this
2522          * function shouldn't need the netdev, but this is
2523          * done for backward compatibility -- previously
2524          * setting the channel was done per wiphy, but now
2525          * it is per netdev. Previous userland like hostapd
2526          * also passed a netdev to set_wiphy, so that it is
2527          * possible to let that go to the right netdev!
2528          */
2529
2530         if (info->attrs[NL80211_ATTR_IFINDEX]) {
2531                 int ifindex = nla_get_u32(info->attrs[NL80211_ATTR_IFINDEX]);
2532
2533                 netdev = __dev_get_by_index(genl_info_net(info), ifindex);
2534                 if (netdev && netdev->ieee80211_ptr)
2535                         rdev = wiphy_to_rdev(netdev->ieee80211_ptr->wiphy);
2536                 else
2537                         netdev = NULL;
2538         }
2539
2540         if (!netdev) {
2541                 rdev = __cfg80211_rdev_from_attrs(genl_info_net(info),
2542                                                   info->attrs);
2543                 if (IS_ERR(rdev))
2544                         return PTR_ERR(rdev);
2545                 wdev = NULL;
2546                 netdev = NULL;
2547                 result = 0;
2548         } else
2549                 wdev = netdev->ieee80211_ptr;
2550
2551         /*
2552          * end workaround code, by now the rdev is available
2553          * and locked, and wdev may or may not be NULL.
2554          */
2555
2556         if (info->attrs[NL80211_ATTR_WIPHY_NAME])
2557                 result = cfg80211_dev_rename(
2558                         rdev, nla_data(info->attrs[NL80211_ATTR_WIPHY_NAME]));
2559
2560         if (result)
2561                 return result;
2562
2563         if (info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS]) {
2564                 struct ieee80211_txq_params txq_params;
2565                 struct nlattr *tb[NL80211_TXQ_ATTR_MAX + 1];
2566
2567                 if (!rdev->ops->set_txq_params)
2568                         return -EOPNOTSUPP;
2569
2570                 if (!netdev)
2571                         return -EINVAL;
2572
2573                 if (netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
2574                     netdev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
2575                         return -EINVAL;
2576
2577                 if (!netif_running(netdev))
2578                         return -ENETDOWN;
2579
2580                 nla_for_each_nested(nl_txq_params,
2581                                     info->attrs[NL80211_ATTR_WIPHY_TXQ_PARAMS],
2582                                     rem_txq_params) {
2583                         result = nla_parse_nested(tb, NL80211_TXQ_ATTR_MAX,
2584                                                   nl_txq_params,
2585                                                   txq_params_policy,
2586                                                   info->extack);
2587                         if (result)
2588                                 return result;
2589                         result = parse_txq_params(tb, &txq_params);
2590                         if (result)
2591                                 return result;
2592
2593                         result = rdev_set_txq_params(rdev, netdev,
2594                                                      &txq_params);
2595                         if (result)
2596                                 return result;
2597                 }
2598         }
2599
2600         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
2601                 result = __nl80211_set_channel(
2602                         rdev,
2603                         nl80211_can_set_dev_channel(wdev) ? netdev : NULL,
2604                         info);
2605                 if (result)
2606                         return result;
2607         }
2608
2609         if (info->attrs[NL80211_ATTR_WIPHY_TX_POWER_SETTING]) {
2610                 struct wireless_dev *txp_wdev = wdev;
2611                 enum nl80211_tx_power_setting type;
2612                 int idx, mbm = 0;
2613
2614                 if (!(rdev->wiphy.features & NL80211_FEATURE_VIF_TXPOWER))
2615                         txp_wdev = NULL;
2616
2617                 if (!rdev->ops->set_tx_power)
2618                         return -EOPNOTSUPP;
2619
2620                 idx = NL80211_ATTR_WIPHY_TX_POWER_SETTING;
2621                 type = nla_get_u32(info->attrs[idx]);
2622
2623                 if (!info->attrs[NL80211_ATTR_WIPHY_TX_POWER_LEVEL] &&
2624                     (type != NL80211_TX_POWER_AUTOMATIC))
2625                         return -EINVAL;
2626
2627                 if (type != NL80211_TX_POWER_AUTOMATIC) {
2628                         idx = NL80211_ATTR_WIPHY_TX_POWER_LEVEL;
2629                         mbm = nla_get_u32(info->attrs[idx]);
2630                 }
2631
2632                 result = rdev_set_tx_power(rdev, txp_wdev, type, mbm);
2633                 if (result)
2634                         return result;
2635         }
2636
2637         if (info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX] &&
2638             info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]) {
2639                 u32 tx_ant, rx_ant;
2640
2641                 if ((!rdev->wiphy.available_antennas_tx &&
2642                      !rdev->wiphy.available_antennas_rx) ||
2643                     !rdev->ops->set_antenna)
2644                         return -EOPNOTSUPP;
2645
2646                 tx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_TX]);
2647                 rx_ant = nla_get_u32(info->attrs[NL80211_ATTR_WIPHY_ANTENNA_RX]);
2648
2649                 /* reject antenna configurations which don't match the
2650                  * available antenna masks, except for the "all" mask */
2651                 if ((~tx_ant && (tx_ant & ~rdev->wiphy.available_antennas_tx)) ||
2652                     (~rx_ant && (rx_ant & ~rdev->wiphy.available_antennas_rx)))
2653                         return -EINVAL;
2654
2655                 tx_ant = tx_ant & rdev->wiphy.available_antennas_tx;
2656                 rx_ant = rx_ant & rdev->wiphy.available_antennas_rx;
2657
2658                 result = rdev_set_antenna(rdev, tx_ant, rx_ant);
2659                 if (result)
2660                         return result;
2661         }
2662
2663         changed = 0;
2664
2665         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]) {
2666                 retry_short = nla_get_u8(
2667                         info->attrs[NL80211_ATTR_WIPHY_RETRY_SHORT]);
2668
2669                 changed |= WIPHY_PARAM_RETRY_SHORT;
2670         }
2671
2672         if (info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]) {
2673                 retry_long = nla_get_u8(
2674                         info->attrs[NL80211_ATTR_WIPHY_RETRY_LONG]);
2675
2676                 changed |= WIPHY_PARAM_RETRY_LONG;
2677         }
2678
2679         if (info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]) {
2680                 frag_threshold = nla_get_u32(
2681                         info->attrs[NL80211_ATTR_WIPHY_FRAG_THRESHOLD]);
2682                 if (frag_threshold < 256)
2683                         return -EINVAL;
2684
2685                 if (frag_threshold != (u32) -1) {
2686                         /*
2687                          * Fragments (apart from the last one) are required to
2688                          * have even length. Make the fragmentation code
2689                          * simpler by stripping LSB should someone try to use
2690                          * odd threshold value.
2691                          */
2692                         frag_threshold &= ~0x1;
2693                 }
2694                 changed |= WIPHY_PARAM_FRAG_THRESHOLD;
2695         }
2696
2697         if (info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]) {
2698                 rts_threshold = nla_get_u32(
2699                         info->attrs[NL80211_ATTR_WIPHY_RTS_THRESHOLD]);
2700                 changed |= WIPHY_PARAM_RTS_THRESHOLD;
2701         }
2702
2703         if (info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]) {
2704                 if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK])
2705                         return -EINVAL;
2706
2707                 coverage_class = nla_get_u8(
2708                         info->attrs[NL80211_ATTR_WIPHY_COVERAGE_CLASS]);
2709                 changed |= WIPHY_PARAM_COVERAGE_CLASS;
2710         }
2711
2712         if (info->attrs[NL80211_ATTR_WIPHY_DYN_ACK]) {
2713                 if (!(rdev->wiphy.features & NL80211_FEATURE_ACKTO_ESTIMATION))
2714                         return -EOPNOTSUPP;
2715
2716                 changed |= WIPHY_PARAM_DYN_ACK;
2717         }
2718
2719         if (info->attrs[NL80211_ATTR_TXQ_LIMIT]) {
2720                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2721                                              NL80211_EXT_FEATURE_TXQS))
2722                         return -EOPNOTSUPP;
2723                 txq_limit = nla_get_u32(
2724                         info->attrs[NL80211_ATTR_TXQ_LIMIT]);
2725                 changed |= WIPHY_PARAM_TXQ_LIMIT;
2726         }
2727
2728         if (info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]) {
2729                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2730                                              NL80211_EXT_FEATURE_TXQS))
2731                         return -EOPNOTSUPP;
2732                 txq_memory_limit = nla_get_u32(
2733                         info->attrs[NL80211_ATTR_TXQ_MEMORY_LIMIT]);
2734                 changed |= WIPHY_PARAM_TXQ_MEMORY_LIMIT;
2735         }
2736
2737         if (info->attrs[NL80211_ATTR_TXQ_QUANTUM]) {
2738                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
2739                                              NL80211_EXT_FEATURE_TXQS))
2740                         return -EOPNOTSUPP;
2741                 txq_quantum = nla_get_u32(
2742                         info->attrs[NL80211_ATTR_TXQ_QUANTUM]);
2743                 changed |= WIPHY_PARAM_TXQ_QUANTUM;
2744         }
2745
2746         if (changed) {
2747                 u8 old_retry_short, old_retry_long;
2748                 u32 old_frag_threshold, old_rts_threshold;
2749                 u8 old_coverage_class;
2750                 u32 old_txq_limit, old_txq_memory_limit, old_txq_quantum;
2751
2752                 if (!rdev->ops->set_wiphy_params)
2753                         return -EOPNOTSUPP;
2754
2755                 old_retry_short = rdev->wiphy.retry_short;
2756                 old_retry_long = rdev->wiphy.retry_long;
2757                 old_frag_threshold = rdev->wiphy.frag_threshold;
2758                 old_rts_threshold = rdev->wiphy.rts_threshold;
2759                 old_coverage_class = rdev->wiphy.coverage_class;
2760                 old_txq_limit = rdev->wiphy.txq_limit;
2761                 old_txq_memory_limit = rdev->wiphy.txq_memory_limit;
2762                 old_txq_quantum = rdev->wiphy.txq_quantum;
2763
2764                 if (changed & WIPHY_PARAM_RETRY_SHORT)
2765                         rdev->wiphy.retry_short = retry_short;
2766                 if (changed & WIPHY_PARAM_RETRY_LONG)
2767                         rdev->wiphy.retry_long = retry_long;
2768                 if (changed & WIPHY_PARAM_FRAG_THRESHOLD)
2769                         rdev->wiphy.frag_threshold = frag_threshold;
2770                 if (changed & WIPHY_PARAM_RTS_THRESHOLD)
2771                         rdev->wiphy.rts_threshold = rts_threshold;
2772                 if (changed & WIPHY_PARAM_COVERAGE_CLASS)
2773                         rdev->wiphy.coverage_class = coverage_class;
2774                 if (changed & WIPHY_PARAM_TXQ_LIMIT)
2775                         rdev->wiphy.txq_limit = txq_limit;
2776                 if (changed & WIPHY_PARAM_TXQ_MEMORY_LIMIT)
2777                         rdev->wiphy.txq_memory_limit = txq_memory_limit;
2778                 if (changed & WIPHY_PARAM_TXQ_QUANTUM)
2779                         rdev->wiphy.txq_quantum = txq_quantum;
2780
2781                 result = rdev_set_wiphy_params(rdev, changed);
2782                 if (result) {
2783                         rdev->wiphy.retry_short = old_retry_short;
2784                         rdev->wiphy.retry_long = old_retry_long;
2785                         rdev->wiphy.frag_threshold = old_frag_threshold;
2786                         rdev->wiphy.rts_threshold = old_rts_threshold;
2787                         rdev->wiphy.coverage_class = old_coverage_class;
2788                         rdev->wiphy.txq_limit = old_txq_limit;
2789                         rdev->wiphy.txq_memory_limit = old_txq_memory_limit;
2790                         rdev->wiphy.txq_quantum = old_txq_quantum;
2791                         return result;
2792                 }
2793         }
2794         return 0;
2795 }
2796
2797 static inline u64 wdev_id(struct wireless_dev *wdev)
2798 {
2799         return (u64)wdev->identifier |
2800                ((u64)wiphy_to_rdev(wdev->wiphy)->wiphy_idx << 32);
2801 }
2802
2803 static int nl80211_send_chandef(struct sk_buff *msg,
2804                                 const struct cfg80211_chan_def *chandef)
2805 {
2806         if (WARN_ON(!cfg80211_chandef_valid(chandef)))
2807                 return -EINVAL;
2808
2809         if (nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ,
2810                         chandef->chan->center_freq))
2811                 return -ENOBUFS;
2812         switch (chandef->width) {
2813         case NL80211_CHAN_WIDTH_20_NOHT:
2814         case NL80211_CHAN_WIDTH_20:
2815         case NL80211_CHAN_WIDTH_40:
2816                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
2817                                 cfg80211_get_chandef_type(chandef)))
2818                         return -ENOBUFS;
2819                 break;
2820         default:
2821                 break;
2822         }
2823         if (nla_put_u32(msg, NL80211_ATTR_CHANNEL_WIDTH, chandef->width))
2824                 return -ENOBUFS;
2825         if (nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ1, chandef->center_freq1))
2826                 return -ENOBUFS;
2827         if (chandef->center_freq2 &&
2828             nla_put_u32(msg, NL80211_ATTR_CENTER_FREQ2, chandef->center_freq2))
2829                 return -ENOBUFS;
2830         return 0;
2831 }
2832
2833 static int nl80211_send_iface(struct sk_buff *msg, u32 portid, u32 seq, int flags,
2834                               struct cfg80211_registered_device *rdev,
2835                               struct wireless_dev *wdev, bool removal)
2836 {
2837         struct net_device *dev = wdev->netdev;
2838         u8 cmd = NL80211_CMD_NEW_INTERFACE;
2839         void *hdr;
2840
2841         if (removal)
2842                 cmd = NL80211_CMD_DEL_INTERFACE;
2843
2844         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
2845         if (!hdr)
2846                 return -1;
2847
2848         if (dev &&
2849             (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
2850              nla_put_string(msg, NL80211_ATTR_IFNAME, dev->name)))
2851                 goto nla_put_failure;
2852
2853         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
2854             nla_put_u32(msg, NL80211_ATTR_IFTYPE, wdev->iftype) ||
2855             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
2856                               NL80211_ATTR_PAD) ||
2857             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, wdev_address(wdev)) ||
2858             nla_put_u32(msg, NL80211_ATTR_GENERATION,
2859                         rdev->devlist_generation ^
2860                         (cfg80211_rdev_list_generation << 2)) ||
2861             nla_put_u8(msg, NL80211_ATTR_4ADDR, wdev->use_4addr))
2862                 goto nla_put_failure;
2863
2864         if (rdev->ops->get_channel) {
2865                 int ret;
2866                 struct cfg80211_chan_def chandef;
2867
2868                 ret = rdev_get_channel(rdev, wdev, &chandef);
2869                 if (ret == 0) {
2870                         if (nl80211_send_chandef(msg, &chandef))
2871                                 goto nla_put_failure;
2872                 }
2873         }
2874
2875         if (rdev->ops->get_tx_power) {
2876                 int dbm, ret;
2877
2878                 ret = rdev_get_tx_power(rdev, wdev, &dbm);
2879                 if (ret == 0 &&
2880                     nla_put_u32(msg, NL80211_ATTR_WIPHY_TX_POWER_LEVEL,
2881                                 DBM_TO_MBM(dbm)))
2882                         goto nla_put_failure;
2883         }
2884
2885         wdev_lock(wdev);
2886         switch (wdev->iftype) {
2887         case NL80211_IFTYPE_AP:
2888                 if (wdev->ssid_len &&
2889                     nla_put(msg, NL80211_ATTR_SSID, wdev->ssid_len, wdev->ssid))
2890                         goto nla_put_failure_locked;
2891                 break;
2892         case NL80211_IFTYPE_STATION:
2893         case NL80211_IFTYPE_P2P_CLIENT:
2894         case NL80211_IFTYPE_ADHOC: {
2895                 const u8 *ssid_ie;
2896                 if (!wdev->current_bss)
2897                         break;
2898                 rcu_read_lock();
2899                 ssid_ie = ieee80211_bss_get_ie(&wdev->current_bss->pub,
2900                                                WLAN_EID_SSID);
2901                 if (ssid_ie &&
2902                     nla_put(msg, NL80211_ATTR_SSID, ssid_ie[1], ssid_ie + 2))
2903                         goto nla_put_failure_rcu_locked;
2904                 rcu_read_unlock();
2905                 break;
2906                 }
2907         default:
2908                 /* nothing */
2909                 break;
2910         }
2911         wdev_unlock(wdev);
2912
2913         if (rdev->ops->get_txq_stats) {
2914                 struct cfg80211_txq_stats txqstats = {};
2915                 int ret = rdev_get_txq_stats(rdev, wdev, &txqstats);
2916
2917                 if (ret == 0 &&
2918                     !nl80211_put_txq_stats(msg, &txqstats,
2919                                            NL80211_ATTR_TXQ_STATS))
2920                         goto nla_put_failure;
2921         }
2922
2923         genlmsg_end(msg, hdr);
2924         return 0;
2925
2926  nla_put_failure_rcu_locked:
2927         rcu_read_unlock();
2928  nla_put_failure_locked:
2929         wdev_unlock(wdev);
2930  nla_put_failure:
2931         genlmsg_cancel(msg, hdr);
2932         return -EMSGSIZE;
2933 }
2934
2935 static int nl80211_dump_interface(struct sk_buff *skb, struct netlink_callback *cb)
2936 {
2937         int wp_idx = 0;
2938         int if_idx = 0;
2939         int wp_start = cb->args[0];
2940         int if_start = cb->args[1];
2941         int filter_wiphy = -1;
2942         struct cfg80211_registered_device *rdev;
2943         struct wireless_dev *wdev;
2944         int ret;
2945
2946         rtnl_lock();
2947         if (!cb->args[2]) {
2948                 struct nl80211_dump_wiphy_state state = {
2949                         .filter_wiphy = -1,
2950                 };
2951
2952                 ret = nl80211_dump_wiphy_parse(skb, cb, &state);
2953                 if (ret)
2954                         goto out_unlock;
2955
2956                 filter_wiphy = state.filter_wiphy;
2957
2958                 /*
2959                  * if filtering, set cb->args[2] to +1 since 0 is the default
2960                  * value needed to determine that parsing is necessary.
2961                  */
2962                 if (filter_wiphy >= 0)
2963                         cb->args[2] = filter_wiphy + 1;
2964                 else
2965                         cb->args[2] = -1;
2966         } else if (cb->args[2] > 0) {
2967                 filter_wiphy = cb->args[2] - 1;
2968         }
2969
2970         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
2971                 if (!net_eq(wiphy_net(&rdev->wiphy), sock_net(skb->sk)))
2972                         continue;
2973                 if (wp_idx < wp_start) {
2974                         wp_idx++;
2975                         continue;
2976                 }
2977
2978                 if (filter_wiphy >= 0 && filter_wiphy != rdev->wiphy_idx)
2979                         continue;
2980
2981                 if_idx = 0;
2982
2983                 list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
2984                         if (if_idx < if_start) {
2985                                 if_idx++;
2986                                 continue;
2987                         }
2988                         if (nl80211_send_iface(skb, NETLINK_CB(cb->skb).portid,
2989                                                cb->nlh->nlmsg_seq, NLM_F_MULTI,
2990                                                rdev, wdev, false) < 0) {
2991                                 goto out;
2992                         }
2993                         if_idx++;
2994                 }
2995
2996                 wp_idx++;
2997         }
2998  out:
2999         cb->args[0] = wp_idx;
3000         cb->args[1] = if_idx;
3001
3002         ret = skb->len;
3003  out_unlock:
3004         rtnl_unlock();
3005
3006         return ret;
3007 }
3008
3009 static int nl80211_get_interface(struct sk_buff *skb, struct genl_info *info)
3010 {
3011         struct sk_buff *msg;
3012         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3013         struct wireless_dev *wdev = info->user_ptr[1];
3014
3015         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3016         if (!msg)
3017                 return -ENOMEM;
3018
3019         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3020                                rdev, wdev, false) < 0) {
3021                 nlmsg_free(msg);
3022                 return -ENOBUFS;
3023         }
3024
3025         return genlmsg_reply(msg, info);
3026 }
3027
3028 static const struct nla_policy mntr_flags_policy[NL80211_MNTR_FLAG_MAX + 1] = {
3029         [NL80211_MNTR_FLAG_FCSFAIL] = { .type = NLA_FLAG },
3030         [NL80211_MNTR_FLAG_PLCPFAIL] = { .type = NLA_FLAG },
3031         [NL80211_MNTR_FLAG_CONTROL] = { .type = NLA_FLAG },
3032         [NL80211_MNTR_FLAG_OTHER_BSS] = { .type = NLA_FLAG },
3033         [NL80211_MNTR_FLAG_COOK_FRAMES] = { .type = NLA_FLAG },
3034         [NL80211_MNTR_FLAG_ACTIVE] = { .type = NLA_FLAG },
3035 };
3036
3037 static int parse_monitor_flags(struct nlattr *nla, u32 *mntrflags)
3038 {
3039         struct nlattr *flags[NL80211_MNTR_FLAG_MAX + 1];
3040         int flag;
3041
3042         *mntrflags = 0;
3043
3044         if (!nla)
3045                 return -EINVAL;
3046
3047         if (nla_parse_nested(flags, NL80211_MNTR_FLAG_MAX, nla,
3048                              mntr_flags_policy, NULL))
3049                 return -EINVAL;
3050
3051         for (flag = 1; flag <= NL80211_MNTR_FLAG_MAX; flag++)
3052                 if (flags[flag])
3053                         *mntrflags |= (1<<flag);
3054
3055         *mntrflags |= MONITOR_FLAG_CHANGED;
3056
3057         return 0;
3058 }
3059
3060 static int nl80211_parse_mon_options(struct cfg80211_registered_device *rdev,
3061                                      enum nl80211_iftype type,
3062                                      struct genl_info *info,
3063                                      struct vif_params *params)
3064 {
3065         bool change = false;
3066         int err;
3067
3068         if (info->attrs[NL80211_ATTR_MNTR_FLAGS]) {
3069                 if (type != NL80211_IFTYPE_MONITOR)
3070                         return -EINVAL;
3071
3072                 err = parse_monitor_flags(info->attrs[NL80211_ATTR_MNTR_FLAGS],
3073                                           &params->flags);
3074                 if (err)
3075                         return err;
3076
3077                 change = true;
3078         }
3079
3080         if (params->flags & MONITOR_FLAG_ACTIVE &&
3081             !(rdev->wiphy.features & NL80211_FEATURE_ACTIVE_MONITOR))
3082                 return -EOPNOTSUPP;
3083
3084         if (info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]) {
3085                 const u8 *mumimo_groups;
3086                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3087
3088                 if (type != NL80211_IFTYPE_MONITOR)
3089                         return -EINVAL;
3090
3091                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3092                         return -EOPNOTSUPP;
3093
3094                 mumimo_groups =
3095                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_GROUP_DATA]);
3096
3097                 /* bits 0 and 63 are reserved and must be zero */
3098                 if ((mumimo_groups[0] & BIT(0)) ||
3099                     (mumimo_groups[VHT_MUMIMO_GROUPS_DATA_LEN - 1] & BIT(7)))
3100                         return -EINVAL;
3101
3102                 params->vht_mumimo_groups = mumimo_groups;
3103                 change = true;
3104         }
3105
3106         if (info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]) {
3107                 u32 cap_flag = NL80211_EXT_FEATURE_MU_MIMO_AIR_SNIFFER;
3108
3109                 if (type != NL80211_IFTYPE_MONITOR)
3110                         return -EINVAL;
3111
3112                 if (!wiphy_ext_feature_isset(&rdev->wiphy, cap_flag))
3113                         return -EOPNOTSUPP;
3114
3115                 params->vht_mumimo_follow_addr =
3116                         nla_data(info->attrs[NL80211_ATTR_MU_MIMO_FOLLOW_MAC_ADDR]);
3117                 change = true;
3118         }
3119
3120         return change ? 1 : 0;
3121 }
3122
3123 static int nl80211_valid_4addr(struct cfg80211_registered_device *rdev,
3124                                struct net_device *netdev, u8 use_4addr,
3125                                enum nl80211_iftype iftype)
3126 {
3127         if (!use_4addr) {
3128                 if (netdev && (netdev->priv_flags & IFF_BRIDGE_PORT))
3129                         return -EBUSY;
3130                 return 0;
3131         }
3132
3133         switch (iftype) {
3134         case NL80211_IFTYPE_AP_VLAN:
3135                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_AP)
3136                         return 0;
3137                 break;
3138         case NL80211_IFTYPE_STATION:
3139                 if (rdev->wiphy.flags & WIPHY_FLAG_4ADDR_STATION)
3140                         return 0;
3141                 break;
3142         default:
3143                 break;
3144         }
3145
3146         return -EOPNOTSUPP;
3147 }
3148
3149 static int nl80211_set_interface(struct sk_buff *skb, struct genl_info *info)
3150 {
3151         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3152         struct vif_params params;
3153         int err;
3154         enum nl80211_iftype otype, ntype;
3155         struct net_device *dev = info->user_ptr[1];
3156         bool change = false;
3157
3158         memset(&params, 0, sizeof(params));
3159
3160         otype = ntype = dev->ieee80211_ptr->iftype;
3161
3162         if (info->attrs[NL80211_ATTR_IFTYPE]) {
3163                 ntype = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3164                 if (otype != ntype)
3165                         change = true;
3166         }
3167
3168         if (info->attrs[NL80211_ATTR_MESH_ID]) {
3169                 struct wireless_dev *wdev = dev->ieee80211_ptr;
3170
3171                 if (ntype != NL80211_IFTYPE_MESH_POINT)
3172                         return -EINVAL;
3173                 if (netif_running(dev))
3174                         return -EBUSY;
3175
3176                 wdev_lock(wdev);
3177                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3178                              IEEE80211_MAX_MESH_ID_LEN);
3179                 wdev->mesh_id_up_len =
3180                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3181                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3182                        wdev->mesh_id_up_len);
3183                 wdev_unlock(wdev);
3184         }
3185
3186         if (info->attrs[NL80211_ATTR_4ADDR]) {
3187                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3188                 change = true;
3189                 err = nl80211_valid_4addr(rdev, dev, params.use_4addr, ntype);
3190                 if (err)
3191                         return err;
3192         } else {
3193                 params.use_4addr = -1;
3194         }
3195
3196         err = nl80211_parse_mon_options(rdev, ntype, info, &params);
3197         if (err < 0)
3198                 return err;
3199         if (err > 0)
3200                 change = true;
3201
3202         if (change)
3203                 err = cfg80211_change_iface(rdev, dev, ntype, &params);
3204         else
3205                 err = 0;
3206
3207         if (!err && params.use_4addr != -1)
3208                 dev->ieee80211_ptr->use_4addr = params.use_4addr;
3209
3210         return err;
3211 }
3212
3213 static int nl80211_new_interface(struct sk_buff *skb, struct genl_info *info)
3214 {
3215         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3216         struct vif_params params;
3217         struct wireless_dev *wdev;
3218         struct sk_buff *msg;
3219         int err;
3220         enum nl80211_iftype type = NL80211_IFTYPE_UNSPECIFIED;
3221
3222         /* to avoid failing a new interface creation due to pending removal */
3223         cfg80211_destroy_ifaces(rdev);
3224
3225         memset(&params, 0, sizeof(params));
3226
3227         if (!info->attrs[NL80211_ATTR_IFNAME])
3228                 return -EINVAL;
3229
3230         if (info->attrs[NL80211_ATTR_IFTYPE])
3231                 type = nla_get_u32(info->attrs[NL80211_ATTR_IFTYPE]);
3232
3233         if (!rdev->ops->add_virtual_intf ||
3234             !(rdev->wiphy.interface_modes & (1 << type)))
3235                 return -EOPNOTSUPP;
3236
3237         if ((type == NL80211_IFTYPE_P2P_DEVICE || type == NL80211_IFTYPE_NAN ||
3238              rdev->wiphy.features & NL80211_FEATURE_MAC_ON_CREATE) &&
3239             info->attrs[NL80211_ATTR_MAC]) {
3240                 nla_memcpy(params.macaddr, info->attrs[NL80211_ATTR_MAC],
3241                            ETH_ALEN);
3242                 if (!is_valid_ether_addr(params.macaddr))
3243                         return -EADDRNOTAVAIL;
3244         }
3245
3246         if (info->attrs[NL80211_ATTR_4ADDR]) {
3247                 params.use_4addr = !!nla_get_u8(info->attrs[NL80211_ATTR_4ADDR]);
3248                 err = nl80211_valid_4addr(rdev, NULL, params.use_4addr, type);
3249                 if (err)
3250                         return err;
3251         }
3252
3253         err = nl80211_parse_mon_options(rdev, type, info, &params);
3254         if (err < 0)
3255                 return err;
3256
3257         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3258         if (!msg)
3259                 return -ENOMEM;
3260
3261         wdev = rdev_add_virtual_intf(rdev,
3262                                 nla_data(info->attrs[NL80211_ATTR_IFNAME]),
3263                                 NET_NAME_USER, type, &params);
3264         if (WARN_ON(!wdev)) {
3265                 nlmsg_free(msg);
3266                 return -EPROTO;
3267         } else if (IS_ERR(wdev)) {
3268                 nlmsg_free(msg);
3269                 return PTR_ERR(wdev);
3270         }
3271
3272         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
3273                 wdev->owner_nlportid = info->snd_portid;
3274
3275         switch (type) {
3276         case NL80211_IFTYPE_MESH_POINT:
3277                 if (!info->attrs[NL80211_ATTR_MESH_ID])
3278                         break;
3279                 wdev_lock(wdev);
3280                 BUILD_BUG_ON(IEEE80211_MAX_SSID_LEN !=
3281                              IEEE80211_MAX_MESH_ID_LEN);
3282                 wdev->mesh_id_up_len =
3283                         nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
3284                 memcpy(wdev->ssid, nla_data(info->attrs[NL80211_ATTR_MESH_ID]),
3285                        wdev->mesh_id_up_len);
3286                 wdev_unlock(wdev);
3287                 break;
3288         case NL80211_IFTYPE_NAN:
3289         case NL80211_IFTYPE_P2P_DEVICE:
3290                 /*
3291                  * P2P Device and NAN do not have a netdev, so don't go
3292                  * through the netdev notifier and must be added here
3293                  */
3294                 cfg80211_init_wdev(rdev, wdev);
3295                 break;
3296         default:
3297                 break;
3298         }
3299
3300         if (nl80211_send_iface(msg, info->snd_portid, info->snd_seq, 0,
3301                                rdev, wdev, false) < 0) {
3302                 nlmsg_free(msg);
3303                 return -ENOBUFS;
3304         }
3305
3306         return genlmsg_reply(msg, info);
3307 }
3308
3309 static int nl80211_del_interface(struct sk_buff *skb, struct genl_info *info)
3310 {
3311         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3312         struct wireless_dev *wdev = info->user_ptr[1];
3313
3314         if (!rdev->ops->del_virtual_intf)
3315                 return -EOPNOTSUPP;
3316
3317         /*
3318          * If we remove a wireless device without a netdev then clear
3319          * user_ptr[1] so that nl80211_post_doit won't dereference it
3320          * to check if it needs to do dev_put(). Otherwise it crashes
3321          * since the wdev has been freed, unlike with a netdev where
3322          * we need the dev_put() for the netdev to really be freed.
3323          */
3324         if (!wdev->netdev)
3325                 info->user_ptr[1] = NULL;
3326
3327         return rdev_del_virtual_intf(rdev, wdev);
3328 }
3329
3330 static int nl80211_set_noack_map(struct sk_buff *skb, struct genl_info *info)
3331 {
3332         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3333         struct net_device *dev = info->user_ptr[1];
3334         u16 noack_map;
3335
3336         if (!info->attrs[NL80211_ATTR_NOACK_MAP])
3337                 return -EINVAL;
3338
3339         if (!rdev->ops->set_noack_map)
3340                 return -EOPNOTSUPP;
3341
3342         noack_map = nla_get_u16(info->attrs[NL80211_ATTR_NOACK_MAP]);
3343
3344         return rdev_set_noack_map(rdev, dev, noack_map);
3345 }
3346
3347 struct get_key_cookie {
3348         struct sk_buff *msg;
3349         int error;
3350         int idx;
3351 };
3352
3353 static void get_key_callback(void *c, struct key_params *params)
3354 {
3355         struct nlattr *key;
3356         struct get_key_cookie *cookie = c;
3357
3358         if ((params->key &&
3359              nla_put(cookie->msg, NL80211_ATTR_KEY_DATA,
3360                      params->key_len, params->key)) ||
3361             (params->seq &&
3362              nla_put(cookie->msg, NL80211_ATTR_KEY_SEQ,
3363                      params->seq_len, params->seq)) ||
3364             (params->cipher &&
3365              nla_put_u32(cookie->msg, NL80211_ATTR_KEY_CIPHER,
3366                          params->cipher)))
3367                 goto nla_put_failure;
3368
3369         key = nla_nest_start(cookie->msg, NL80211_ATTR_KEY);
3370         if (!key)
3371                 goto nla_put_failure;
3372
3373         if ((params->key &&
3374              nla_put(cookie->msg, NL80211_KEY_DATA,
3375                      params->key_len, params->key)) ||
3376             (params->seq &&
3377              nla_put(cookie->msg, NL80211_KEY_SEQ,
3378                      params->seq_len, params->seq)) ||
3379             (params->cipher &&
3380              nla_put_u32(cookie->msg, NL80211_KEY_CIPHER,
3381                          params->cipher)))
3382                 goto nla_put_failure;
3383
3384         if (nla_put_u8(cookie->msg, NL80211_KEY_IDX, cookie->idx))
3385                 goto nla_put_failure;
3386
3387         nla_nest_end(cookie->msg, key);
3388
3389         return;
3390  nla_put_failure:
3391         cookie->error = 1;
3392 }
3393
3394 static int nl80211_get_key(struct sk_buff *skb, struct genl_info *info)
3395 {
3396         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3397         int err;
3398         struct net_device *dev = info->user_ptr[1];
3399         u8 key_idx = 0;
3400         const u8 *mac_addr = NULL;
3401         bool pairwise;
3402         struct get_key_cookie cookie = {
3403                 .error = 0,
3404         };
3405         void *hdr;
3406         struct sk_buff *msg;
3407
3408         if (info->attrs[NL80211_ATTR_KEY_IDX])
3409                 key_idx = nla_get_u8(info->attrs[NL80211_ATTR_KEY_IDX]);
3410
3411         if (info->attrs[NL80211_ATTR_MAC])
3412                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3413
3414         pairwise = !!mac_addr;
3415         if (info->attrs[NL80211_ATTR_KEY_TYPE]) {
3416                 u32 kt = nla_get_u32(info->attrs[NL80211_ATTR_KEY_TYPE]);
3417
3418                 if (kt != NL80211_KEYTYPE_GROUP &&
3419                     kt != NL80211_KEYTYPE_PAIRWISE)
3420                         return -EINVAL;
3421                 pairwise = kt == NL80211_KEYTYPE_PAIRWISE;
3422         }
3423
3424         if (!rdev->ops->get_key)
3425                 return -EOPNOTSUPP;
3426
3427         if (!pairwise && mac_addr && !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3428                 return -ENOENT;
3429
3430         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
3431         if (!msg)
3432                 return -ENOMEM;
3433
3434         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
3435                              NL80211_CMD_NEW_KEY);
3436         if (!hdr)
3437                 goto nla_put_failure;
3438
3439         cookie.msg = msg;
3440         cookie.idx = key_idx;
3441
3442         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
3443             nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_idx))
3444                 goto nla_put_failure;
3445         if (mac_addr &&
3446             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr))
3447                 goto nla_put_failure;
3448
3449         err = rdev_get_key(rdev, dev, key_idx, pairwise, mac_addr, &cookie,
3450                            get_key_callback);
3451
3452         if (err)
3453                 goto free_msg;
3454
3455         if (cookie.error)
3456                 goto nla_put_failure;
3457
3458         genlmsg_end(msg, hdr);
3459         return genlmsg_reply(msg, info);
3460
3461  nla_put_failure:
3462         err = -ENOBUFS;
3463  free_msg:
3464         nlmsg_free(msg);
3465         return err;
3466 }
3467
3468 static int nl80211_set_key(struct sk_buff *skb, struct genl_info *info)
3469 {
3470         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3471         struct key_parse key;
3472         int err;
3473         struct net_device *dev = info->user_ptr[1];
3474
3475         err = nl80211_parse_key(info, &key);
3476         if (err)
3477                 return err;
3478
3479         if (key.idx < 0)
3480                 return -EINVAL;
3481
3482         /* only support setting default key */
3483         if (!key.def && !key.defmgmt)
3484                 return -EINVAL;
3485
3486         wdev_lock(dev->ieee80211_ptr);
3487
3488         if (key.def) {
3489                 if (!rdev->ops->set_default_key) {
3490                         err = -EOPNOTSUPP;
3491                         goto out;
3492                 }
3493
3494                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3495                 if (err)
3496                         goto out;
3497
3498                 err = rdev_set_default_key(rdev, dev, key.idx,
3499                                                  key.def_uni, key.def_multi);
3500
3501                 if (err)
3502                         goto out;
3503
3504 #ifdef CONFIG_CFG80211_WEXT
3505                 dev->ieee80211_ptr->wext.default_key = key.idx;
3506 #endif
3507         } else {
3508                 if (key.def_uni || !key.def_multi) {
3509                         err = -EINVAL;
3510                         goto out;
3511                 }
3512
3513                 if (!rdev->ops->set_default_mgmt_key) {
3514                         err = -EOPNOTSUPP;
3515                         goto out;
3516                 }
3517
3518                 err = nl80211_key_allowed(dev->ieee80211_ptr);
3519                 if (err)
3520                         goto out;
3521
3522                 err = rdev_set_default_mgmt_key(rdev, dev, key.idx);
3523                 if (err)
3524                         goto out;
3525
3526 #ifdef CONFIG_CFG80211_WEXT
3527                 dev->ieee80211_ptr->wext.default_mgmt_key = key.idx;
3528 #endif
3529         }
3530
3531  out:
3532         wdev_unlock(dev->ieee80211_ptr);
3533
3534         return err;
3535 }
3536
3537 static int nl80211_new_key(struct sk_buff *skb, struct genl_info *info)
3538 {
3539         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3540         int err;
3541         struct net_device *dev = info->user_ptr[1];
3542         struct key_parse key;
3543         const u8 *mac_addr = NULL;
3544
3545         err = nl80211_parse_key(info, &key);
3546         if (err)
3547                 return err;
3548
3549         if (!key.p.key)
3550                 return -EINVAL;
3551
3552         if (info->attrs[NL80211_ATTR_MAC])
3553                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3554
3555         if (key.type == -1) {
3556                 if (mac_addr)
3557                         key.type = NL80211_KEYTYPE_PAIRWISE;
3558                 else
3559                         key.type = NL80211_KEYTYPE_GROUP;
3560         }
3561
3562         /* for now */
3563         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3564             key.type != NL80211_KEYTYPE_GROUP)
3565                 return -EINVAL;
3566
3567         if (!rdev->ops->add_key)
3568                 return -EOPNOTSUPP;
3569
3570         if (cfg80211_validate_key_settings(rdev, &key.p, key.idx,
3571                                            key.type == NL80211_KEYTYPE_PAIRWISE,
3572                                            mac_addr))
3573                 return -EINVAL;
3574
3575         wdev_lock(dev->ieee80211_ptr);
3576         err = nl80211_key_allowed(dev->ieee80211_ptr);
3577         if (!err)
3578                 err = rdev_add_key(rdev, dev, key.idx,
3579                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3580                                     mac_addr, &key.p);
3581         wdev_unlock(dev->ieee80211_ptr);
3582
3583         return err;
3584 }
3585
3586 static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
3587 {
3588         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3589         int err;
3590         struct net_device *dev = info->user_ptr[1];
3591         u8 *mac_addr = NULL;
3592         struct key_parse key;
3593
3594         err = nl80211_parse_key(info, &key);
3595         if (err)
3596                 return err;
3597
3598         if (info->attrs[NL80211_ATTR_MAC])
3599                 mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
3600
3601         if (key.type == -1) {
3602                 if (mac_addr)
3603                         key.type = NL80211_KEYTYPE_PAIRWISE;
3604                 else
3605                         key.type = NL80211_KEYTYPE_GROUP;
3606         }
3607
3608         /* for now */
3609         if (key.type != NL80211_KEYTYPE_PAIRWISE &&
3610             key.type != NL80211_KEYTYPE_GROUP)
3611                 return -EINVAL;
3612
3613         if (!rdev->ops->del_key)
3614                 return -EOPNOTSUPP;
3615
3616         wdev_lock(dev->ieee80211_ptr);
3617         err = nl80211_key_allowed(dev->ieee80211_ptr);
3618
3619         if (key.type == NL80211_KEYTYPE_GROUP && mac_addr &&
3620             !(rdev->wiphy.flags & WIPHY_FLAG_IBSS_RSN))
3621                 err = -ENOENT;
3622
3623         if (!err)
3624                 err = rdev_del_key(rdev, dev, key.idx,
3625                                    key.type == NL80211_KEYTYPE_PAIRWISE,
3626                                    mac_addr);
3627
3628 #ifdef CONFIG_CFG80211_WEXT
3629         if (!err) {
3630                 if (key.idx == dev->ieee80211_ptr->wext.default_key)
3631                         dev->ieee80211_ptr->wext.default_key = -1;
3632                 else if (key.idx == dev->ieee80211_ptr->wext.default_mgmt_key)
3633                         dev->ieee80211_ptr->wext.default_mgmt_key = -1;
3634         }
3635 #endif
3636         wdev_unlock(dev->ieee80211_ptr);
3637
3638         return err;
3639 }
3640
3641 /* This function returns an error or the number of nested attributes */
3642 static int validate_acl_mac_addrs(struct nlattr *nl_attr)
3643 {
3644         struct nlattr *attr;
3645         int n_entries = 0, tmp;
3646
3647         nla_for_each_nested(attr, nl_attr, tmp) {
3648                 if (nla_len(attr) != ETH_ALEN)
3649                         return -EINVAL;
3650
3651                 n_entries++;
3652         }
3653
3654         return n_entries;
3655 }
3656
3657 /*
3658  * This function parses ACL information and allocates memory for ACL data.
3659  * On successful return, the calling function is responsible to free the
3660  * ACL buffer returned by this function.
3661  */
3662 static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy,
3663                                                 struct genl_info *info)
3664 {
3665         enum nl80211_acl_policy acl_policy;
3666         struct nlattr *attr;
3667         struct cfg80211_acl_data *acl;
3668         int i = 0, n_entries, tmp;
3669
3670         if (!wiphy->max_acl_mac_addrs)
3671                 return ERR_PTR(-EOPNOTSUPP);
3672
3673         if (!info->attrs[NL80211_ATTR_ACL_POLICY])
3674                 return ERR_PTR(-EINVAL);
3675
3676         acl_policy = nla_get_u32(info->attrs[NL80211_ATTR_ACL_POLICY]);
3677         if (acl_policy != NL80211_ACL_POLICY_ACCEPT_UNLESS_LISTED &&
3678             acl_policy != NL80211_ACL_POLICY_DENY_UNLESS_LISTED)
3679                 return ERR_PTR(-EINVAL);
3680
3681         if (!info->attrs[NL80211_ATTR_MAC_ADDRS])
3682                 return ERR_PTR(-EINVAL);
3683
3684         n_entries = validate_acl_mac_addrs(info->attrs[NL80211_ATTR_MAC_ADDRS]);
3685         if (n_entries < 0)
3686                 return ERR_PTR(n_entries);
3687
3688         if (n_entries > wiphy->max_acl_mac_addrs)
3689                 return ERR_PTR(-ENOTSUPP);
3690
3691         acl = kzalloc(sizeof(*acl) + (sizeof(struct mac_address) * n_entries),
3692                       GFP_KERNEL);
3693         if (!acl)
3694                 return ERR_PTR(-ENOMEM);
3695
3696         nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) {
3697                 memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN);
3698                 i++;
3699         }
3700
3701         acl->n_acl_entries = n_entries;
3702         acl->acl_policy = acl_policy;
3703
3704         return acl;
3705 }
3706
3707 static int nl80211_set_mac_acl(struct sk_buff *skb, struct genl_info *info)
3708 {
3709         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3710         struct net_device *dev = info->user_ptr[1];
3711         struct cfg80211_acl_data *acl;
3712         int err;
3713
3714         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
3715             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
3716                 return -EOPNOTSUPP;
3717
3718         if (!dev->ieee80211_ptr->beacon_interval)
3719                 return -EINVAL;
3720
3721         acl = parse_acl_data(&rdev->wiphy, info);
3722         if (IS_ERR(acl))
3723                 return PTR_ERR(acl);
3724
3725         err = rdev_set_mac_acl(rdev, dev, acl);
3726
3727         kfree(acl);
3728
3729         return err;
3730 }
3731
3732 static u32 rateset_to_mask(struct ieee80211_supported_band *sband,
3733                            u8 *rates, u8 rates_len)
3734 {
3735         u8 i;
3736         u32 mask = 0;
3737
3738         for (i = 0; i < rates_len; i++) {
3739                 int rate = (rates[i] & 0x7f) * 5;
3740                 int ridx;
3741
3742                 for (ridx = 0; ridx < sband->n_bitrates; ridx++) {
3743                         struct ieee80211_rate *srate =
3744                                 &sband->bitrates[ridx];
3745                         if (rate == srate->bitrate) {
3746                                 mask |= 1 << ridx;
3747                                 break;
3748                         }
3749                 }
3750                 if (ridx == sband->n_bitrates)
3751                         return 0; /* rate not found */
3752         }
3753
3754         return mask;
3755 }
3756
3757 static bool ht_rateset_to_mask(struct ieee80211_supported_band *sband,
3758                                u8 *rates, u8 rates_len,
3759                                u8 mcs[IEEE80211_HT_MCS_MASK_LEN])
3760 {
3761         u8 i;
3762
3763         memset(mcs, 0, IEEE80211_HT_MCS_MASK_LEN);
3764
3765         for (i = 0; i < rates_len; i++) {
3766                 int ridx, rbit;
3767
3768                 ridx = rates[i] / 8;
3769                 rbit = BIT(rates[i] % 8);
3770
3771                 /* check validity */
3772                 if ((ridx < 0) || (ridx >= IEEE80211_HT_MCS_MASK_LEN))
3773                         return false;
3774
3775                 /* check availability */
3776                 ridx = array_index_nospec(ridx, IEEE80211_HT_MCS_MASK_LEN);
3777                 if (sband->ht_cap.mcs.rx_mask[ridx] & rbit)
3778                         mcs[ridx] |= rbit;
3779                 else
3780                         return false;
3781         }
3782
3783         return true;
3784 }
3785
3786 static u16 vht_mcs_map_to_mcs_mask(u8 vht_mcs_map)
3787 {
3788         u16 mcs_mask = 0;
3789
3790         switch (vht_mcs_map) {
3791         case IEEE80211_VHT_MCS_NOT_SUPPORTED:
3792                 break;
3793         case IEEE80211_VHT_MCS_SUPPORT_0_7:
3794                 mcs_mask = 0x00FF;
3795                 break;
3796         case IEEE80211_VHT_MCS_SUPPORT_0_8:
3797                 mcs_mask = 0x01FF;
3798                 break;
3799         case IEEE80211_VHT_MCS_SUPPORT_0_9:
3800                 mcs_mask = 0x03FF;
3801                 break;
3802         default:
3803                 break;
3804         }
3805
3806         return mcs_mask;
3807 }
3808
3809 static void vht_build_mcs_mask(u16 vht_mcs_map,
3810                                u16 vht_mcs_mask[NL80211_VHT_NSS_MAX])
3811 {
3812         u8 nss;
3813
3814         for (nss = 0; nss < NL80211_VHT_NSS_MAX; nss++) {
3815                 vht_mcs_mask[nss] = vht_mcs_map_to_mcs_mask(vht_mcs_map & 0x03);
3816                 vht_mcs_map >>= 2;
3817         }
3818 }
3819
3820 static bool vht_set_mcs_mask(struct ieee80211_supported_band *sband,
3821                              struct nl80211_txrate_vht *txrate,
3822                              u16 mcs[NL80211_VHT_NSS_MAX])
3823 {
3824         u16 tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3825         u16 tx_mcs_mask[NL80211_VHT_NSS_MAX] = {};
3826         u8 i;
3827
3828         if (!sband->vht_cap.vht_supported)
3829                 return false;
3830
3831         memset(mcs, 0, sizeof(u16) * NL80211_VHT_NSS_MAX);
3832
3833         /* Build vht_mcs_mask from VHT capabilities */
3834         vht_build_mcs_mask(tx_mcs_map, tx_mcs_mask);
3835
3836         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3837                 if ((tx_mcs_mask[i] & txrate->mcs[i]) == txrate->mcs[i])
3838                         mcs[i] = txrate->mcs[i];
3839                 else
3840                         return false;
3841         }
3842
3843         return true;
3844 }
3845
3846 static const struct nla_policy nl80211_txattr_policy[NL80211_TXRATE_MAX + 1] = {
3847         [NL80211_TXRATE_LEGACY] = { .type = NLA_BINARY,
3848                                     .len = NL80211_MAX_SUPP_RATES },
3849         [NL80211_TXRATE_HT] = { .type = NLA_BINARY,
3850                                 .len = NL80211_MAX_SUPP_HT_RATES },
3851         [NL80211_TXRATE_VHT] = { .len = sizeof(struct nl80211_txrate_vht)},
3852         [NL80211_TXRATE_GI] = { .type = NLA_U8 },
3853 };
3854
3855 static int nl80211_parse_tx_bitrate_mask(struct genl_info *info,
3856                                          struct cfg80211_bitrate_mask *mask)
3857 {
3858         struct nlattr *tb[NL80211_TXRATE_MAX + 1];
3859         struct cfg80211_registered_device *rdev = info->user_ptr[0];
3860         int rem, i;
3861         struct nlattr *tx_rates;
3862         struct ieee80211_supported_band *sband;
3863         u16 vht_tx_mcs_map;
3864
3865         memset(mask, 0, sizeof(*mask));
3866         /* Default to all rates enabled */
3867         for (i = 0; i < NUM_NL80211_BANDS; i++) {
3868                 sband = rdev->wiphy.bands[i];
3869
3870                 if (!sband)
3871                         continue;
3872
3873                 mask->control[i].legacy = (1 << sband->n_bitrates) - 1;
3874                 memcpy(mask->control[i].ht_mcs,
3875                        sband->ht_cap.mcs.rx_mask,
3876                        sizeof(mask->control[i].ht_mcs));
3877
3878                 if (!sband->vht_cap.vht_supported)
3879                         continue;
3880
3881                 vht_tx_mcs_map = le16_to_cpu(sband->vht_cap.vht_mcs.tx_mcs_map);
3882                 vht_build_mcs_mask(vht_tx_mcs_map, mask->control[i].vht_mcs);
3883         }
3884
3885         /* if no rates are given set it back to the defaults */
3886         if (!info->attrs[NL80211_ATTR_TX_RATES])
3887                 goto out;
3888
3889         /* The nested attribute uses enum nl80211_band as the index. This maps
3890          * directly to the enum nl80211_band values used in cfg80211.
3891          */
3892         BUILD_BUG_ON(NL80211_MAX_SUPP_HT_RATES > IEEE80211_HT_MCS_MASK_LEN * 8);
3893         nla_for_each_nested(tx_rates, info->attrs[NL80211_ATTR_TX_RATES], rem) {
3894                 enum nl80211_band band = nla_type(tx_rates);
3895                 int err;
3896
3897                 if (band < 0 || band >= NUM_NL80211_BANDS)
3898                         return -EINVAL;
3899                 sband = rdev->wiphy.bands[band];
3900                 if (sband == NULL)
3901                         return -EINVAL;
3902                 err = nla_parse_nested(tb, NL80211_TXRATE_MAX, tx_rates,
3903                                        nl80211_txattr_policy, info->extack);
3904                 if (err)
3905                         return err;
3906                 if (tb[NL80211_TXRATE_LEGACY]) {
3907                         mask->control[band].legacy = rateset_to_mask(
3908                                 sband,
3909                                 nla_data(tb[NL80211_TXRATE_LEGACY]),
3910                                 nla_len(tb[NL80211_TXRATE_LEGACY]));
3911                         if ((mask->control[band].legacy == 0) &&
3912                             nla_len(tb[NL80211_TXRATE_LEGACY]))
3913                                 return -EINVAL;
3914                 }
3915                 if (tb[NL80211_TXRATE_HT]) {
3916                         if (!ht_rateset_to_mask(
3917                                         sband,
3918                                         nla_data(tb[NL80211_TXRATE_HT]),
3919                                         nla_len(tb[NL80211_TXRATE_HT]),
3920                                         mask->control[band].ht_mcs))
3921                                 return -EINVAL;
3922                 }
3923                 if (tb[NL80211_TXRATE_VHT]) {
3924                         if (!vht_set_mcs_mask(
3925                                         sband,
3926                                         nla_data(tb[NL80211_TXRATE_VHT]),
3927                                         mask->control[band].vht_mcs))
3928                                 return -EINVAL;
3929                 }
3930                 if (tb[NL80211_TXRATE_GI]) {
3931                         mask->control[band].gi =
3932                                 nla_get_u8(tb[NL80211_TXRATE_GI]);
3933                         if (mask->control[band].gi > NL80211_TXRATE_FORCE_LGI)
3934                                 return -EINVAL;
3935                 }
3936
3937                 if (mask->control[band].legacy == 0) {
3938                         /* don't allow empty legacy rates if HT or VHT
3939                          * are not even supported.
3940                          */
3941                         if (!(rdev->wiphy.bands[band]->ht_cap.ht_supported ||
3942                               rdev->wiphy.bands[band]->vht_cap.vht_supported))
3943                                 return -EINVAL;
3944
3945                         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++)
3946                                 if (mask->control[band].ht_mcs[i])
3947                                         goto out;
3948
3949                         for (i = 0; i < NL80211_VHT_NSS_MAX; i++)
3950                                 if (mask->control[band].vht_mcs[i])
3951                                         goto out;
3952
3953                         /* legacy and mcs rates may not be both empty */
3954                         return -EINVAL;
3955                 }
3956         }
3957
3958 out:
3959         return 0;
3960 }
3961
3962 static int validate_beacon_tx_rate(struct cfg80211_registered_device *rdev,
3963                                    enum nl80211_band band,
3964                                    struct cfg80211_bitrate_mask *beacon_rate)
3965 {
3966         u32 count_ht, count_vht, i;
3967         u32 rate = beacon_rate->control[band].legacy;
3968
3969         /* Allow only one rate */
3970         if (hweight32(rate) > 1)
3971                 return -EINVAL;
3972
3973         count_ht = 0;
3974         for (i = 0; i < IEEE80211_HT_MCS_MASK_LEN; i++) {
3975                 if (hweight8(beacon_rate->control[band].ht_mcs[i]) > 1) {
3976                         return -EINVAL;
3977                 } else if (beacon_rate->control[band].ht_mcs[i]) {
3978                         count_ht++;
3979                         if (count_ht > 1)
3980                                 return -EINVAL;
3981                 }
3982                 if (count_ht && rate)
3983                         return -EINVAL;
3984         }
3985
3986         count_vht = 0;
3987         for (i = 0; i < NL80211_VHT_NSS_MAX; i++) {
3988                 if (hweight16(beacon_rate->control[band].vht_mcs[i]) > 1) {
3989                         return -EINVAL;
3990                 } else if (beacon_rate->control[band].vht_mcs[i]) {
3991                         count_vht++;
3992                         if (count_vht > 1)
3993                                 return -EINVAL;
3994                 }
3995                 if (count_vht && rate)
3996                         return -EINVAL;
3997         }
3998
3999         if ((count_ht && count_vht) || (!rate && !count_ht && !count_vht))
4000                 return -EINVAL;
4001
4002         if (rate &&
4003             !wiphy_ext_feature_isset(&rdev->wiphy,
4004                                      NL80211_EXT_FEATURE_BEACON_RATE_LEGACY))
4005                 return -EINVAL;
4006         if (count_ht &&
4007             !wiphy_ext_feature_isset(&rdev->wiphy,
4008                                      NL80211_EXT_FEATURE_BEACON_RATE_HT))
4009                 return -EINVAL;
4010         if (count_vht &&
4011             !wiphy_ext_feature_isset(&rdev->wiphy,
4012                                      NL80211_EXT_FEATURE_BEACON_RATE_VHT))
4013                 return -EINVAL;
4014
4015         return 0;
4016 }
4017
4018 static int nl80211_parse_beacon(struct cfg80211_registered_device *rdev,
4019                                 struct nlattr *attrs[],
4020                                 struct cfg80211_beacon_data *bcn)
4021 {
4022         bool haveinfo = false;
4023         int err;
4024
4025         memset(bcn, 0, sizeof(*bcn));
4026
4027         if (attrs[NL80211_ATTR_BEACON_HEAD]) {
4028                 bcn->head = nla_data(attrs[NL80211_ATTR_BEACON_HEAD]);
4029                 bcn->head_len = nla_len(attrs[NL80211_ATTR_BEACON_HEAD]);
4030                 if (!bcn->head_len)
4031                         return -EINVAL;
4032                 haveinfo = true;
4033         }
4034
4035         if (attrs[NL80211_ATTR_BEACON_TAIL]) {
4036                 bcn->tail = nla_data(attrs[NL80211_ATTR_BEACON_TAIL]);
4037                 bcn->tail_len = nla_len(attrs[NL80211_ATTR_BEACON_TAIL]);
4038                 haveinfo = true;
4039         }
4040
4041         if (!haveinfo)
4042                 return -EINVAL;
4043
4044         if (attrs[NL80211_ATTR_IE]) {
4045                 bcn->beacon_ies = nla_data(attrs[NL80211_ATTR_IE]);
4046                 bcn->beacon_ies_len = nla_len(attrs[NL80211_ATTR_IE]);
4047         }
4048
4049         if (attrs[NL80211_ATTR_IE_PROBE_RESP]) {
4050                 bcn->proberesp_ies =
4051                         nla_data(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4052                 bcn->proberesp_ies_len =
4053                         nla_len(attrs[NL80211_ATTR_IE_PROBE_RESP]);
4054         }
4055
4056         if (attrs[NL80211_ATTR_IE_ASSOC_RESP]) {
4057                 bcn->assocresp_ies =
4058                         nla_data(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4059                 bcn->assocresp_ies_len =
4060                         nla_len(attrs[NL80211_ATTR_IE_ASSOC_RESP]);
4061         }
4062
4063         if (attrs[NL80211_ATTR_PROBE_RESP]) {
4064                 bcn->probe_resp = nla_data(attrs[NL80211_ATTR_PROBE_RESP]);
4065                 bcn->probe_resp_len = nla_len(attrs[NL80211_ATTR_PROBE_RESP]);
4066         }
4067
4068         if (attrs[NL80211_ATTR_FTM_RESPONDER]) {
4069                 struct nlattr *tb[NL80211_FTM_RESP_ATTR_MAX + 1];
4070
4071                 err = nla_parse_nested(tb, NL80211_FTM_RESP_ATTR_MAX,
4072                                        attrs[NL80211_ATTR_FTM_RESPONDER],
4073                                        NULL, NULL);
4074                 if (err)
4075                         return err;
4076
4077                 if (tb[NL80211_FTM_RESP_ATTR_ENABLED] &&
4078                     wiphy_ext_feature_isset(&rdev->wiphy,
4079                                             NL80211_EXT_FEATURE_ENABLE_FTM_RESPONDER))
4080                         bcn->ftm_responder = 1;
4081                 else
4082                         return -EOPNOTSUPP;
4083
4084                 if (tb[NL80211_FTM_RESP_ATTR_LCI]) {
4085                         bcn->lci = nla_data(tb[NL80211_FTM_RESP_ATTR_LCI]);
4086                         bcn->lci_len = nla_len(tb[NL80211_FTM_RESP_ATTR_LCI]);
4087                 }
4088
4089                 if (tb[NL80211_FTM_RESP_ATTR_CIVICLOC]) {
4090                         bcn->civicloc = nla_data(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4091                         bcn->civicloc_len = nla_len(tb[NL80211_FTM_RESP_ATTR_CIVICLOC]);
4092                 }
4093         } else {
4094                 bcn->ftm_responder = -1;
4095         }
4096
4097         return 0;
4098 }
4099
4100 static void nl80211_check_ap_rate_selectors(struct cfg80211_ap_settings *params,
4101                                             const u8 *rates)
4102 {
4103         int i;
4104
4105         if (!rates)
4106                 return;
4107
4108         for (i = 0; i < rates[1]; i++) {
4109                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_HT_PHY)
4110                         params->ht_required = true;
4111                 if (rates[2 + i] == BSS_MEMBERSHIP_SELECTOR_VHT_PHY)
4112                         params->vht_required = true;
4113         }
4114 }
4115
4116 /*
4117  * Since the nl80211 API didn't include, from the beginning, attributes about
4118  * HT/VHT requirements/capabilities, we parse them out of the IEs for the
4119  * benefit of drivers that rebuild IEs in the firmware.
4120  */
4121 static void nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
4122 {
4123         const struct cfg80211_beacon_data *bcn = &params->beacon;
4124         size_t ies_len = bcn->tail_len;
4125         const u8 *ies = bcn->tail;
4126         const u8 *rates;
4127         const u8 *cap;
4128
4129         rates = cfg80211_find_ie(WLAN_EID_SUPP_RATES, ies, ies_len);
4130         nl80211_check_ap_rate_selectors(params, rates);
4131
4132         rates = cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES, ies, ies_len);
4133         nl80211_check_ap_rate_selectors(params, rates);
4134
4135         cap = cfg80211_find_ie(WLAN_EID_HT_CAPABILITY, ies, ies_len);
4136         if (cap && cap[1] >= sizeof(*params->ht_cap))
4137                 params->ht_cap = (void *)(cap + 2);
4138         cap = cfg80211_find_ie(WLAN_EID_VHT_CAPABILITY, ies, ies_len);
4139         if (cap && cap[1] >= sizeof(*params->vht_cap))
4140                 params->vht_cap = (void *)(cap + 2);
4141         cap = cfg80211_find_ext_ie(WLAN_EID_EXT_HE_CAPABILITY, ies, ies_len);
4142         if (cap && cap[1] >= sizeof(*params->he_cap) + 1)
4143                 params->he_cap = (void *)(cap + 3);
4144 }
4145
4146 static bool nl80211_get_ap_channel(struct cfg80211_registered_device *rdev,
4147                                    struct cfg80211_ap_settings *params)
4148 {
4149         struct wireless_dev *wdev;
4150         bool ret = false;
4151
4152         list_for_each_entry(wdev, &rdev->wiphy.wdev_list, list) {
4153                 if (wdev->iftype != NL80211_IFTYPE_AP &&
4154                     wdev->iftype != NL80211_IFTYPE_P2P_GO)
4155                         continue;
4156
4157                 if (!wdev->preset_chandef.chan)
4158                         continue;
4159
4160                 params->chandef = wdev->preset_chandef;
4161                 ret = true;
4162                 break;
4163         }
4164
4165         return ret;
4166 }
4167
4168 static bool nl80211_valid_auth_type(struct cfg80211_registered_device *rdev,
4169                                     enum nl80211_auth_type auth_type,
4170                                     enum nl80211_commands cmd)
4171 {
4172         if (auth_type > NL80211_AUTHTYPE_MAX)
4173                 return false;
4174
4175         switch (cmd) {
4176         case NL80211_CMD_AUTHENTICATE:
4177                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4178                     auth_type == NL80211_AUTHTYPE_SAE)
4179                         return false;
4180                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
4181                                              NL80211_EXT_FEATURE_FILS_STA) &&
4182                     (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4183                      auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4184                      auth_type == NL80211_AUTHTYPE_FILS_PK))
4185                         return false;
4186                 return true;
4187         case NL80211_CMD_CONNECT:
4188                 if (!(rdev->wiphy.features & NL80211_FEATURE_SAE) &&
4189                     auth_type == NL80211_AUTHTYPE_SAE)
4190                         return false;
4191
4192                 /* FILS with SK PFS or PK not supported yet */
4193                 if (auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4194                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4195                         return false;
4196                 if (!wiphy_ext_feature_isset(
4197                             &rdev->wiphy,
4198                             NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
4199                     auth_type == NL80211_AUTHTYPE_FILS_SK)
4200                         return false;
4201                 return true;
4202         case NL80211_CMD_START_AP:
4203                 /* SAE not supported yet */
4204                 if (auth_type == NL80211_AUTHTYPE_SAE)
4205                         return false;
4206                 /* FILS not supported yet */
4207                 if (auth_type == NL80211_AUTHTYPE_FILS_SK ||
4208                     auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
4209                     auth_type == NL80211_AUTHTYPE_FILS_PK)
4210                         return false;
4211                 return true;
4212         default:
4213                 return false;
4214         }
4215 }
4216
4217 static int nl80211_start_ap(struct sk_buff *skb, struct genl_info *info)
4218 {
4219         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4220         struct net_device *dev = info->user_ptr[1];
4221         struct wireless_dev *wdev = dev->ieee80211_ptr;
4222         struct cfg80211_ap_settings params;
4223         int err;
4224
4225         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4226             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4227                 return -EOPNOTSUPP;
4228
4229         if (!rdev->ops->start_ap)
4230                 return -EOPNOTSUPP;
4231
4232         if (wdev->beacon_interval)
4233                 return -EALREADY;
4234
4235         memset(&params, 0, sizeof(params));
4236
4237         /* these are required for START_AP */
4238         if (!info->attrs[NL80211_ATTR_BEACON_INTERVAL] ||
4239             !info->attrs[NL80211_ATTR_DTIM_PERIOD] ||
4240             !info->attrs[NL80211_ATTR_BEACON_HEAD])
4241                 return -EINVAL;
4242
4243         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon);
4244         if (err)
4245                 return err;
4246
4247         params.beacon_interval =
4248                 nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
4249         params.dtim_period =
4250                 nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
4251
4252         err = cfg80211_validate_beacon_int(rdev, dev->ieee80211_ptr->iftype,
4253                                            params.beacon_interval);
4254         if (err)
4255                 return err;
4256
4257         /*
4258          * In theory, some of these attributes should be required here
4259          * but since they were not used when the command was originally
4260          * added, keep them optional for old user space programs to let
4261          * them continue to work with drivers that do not need the
4262          * additional information -- drivers must check!
4263          */
4264         if (info->attrs[NL80211_ATTR_SSID]) {
4265                 params.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
4266                 params.ssid_len =
4267                         nla_len(info->attrs[NL80211_ATTR_SSID]);
4268                 if (params.ssid_len == 0 ||
4269                     params.ssid_len > IEEE80211_MAX_SSID_LEN)
4270                         return -EINVAL;
4271         }
4272
4273         if (info->attrs[NL80211_ATTR_HIDDEN_SSID])
4274                 params.hidden_ssid = nla_get_u32(
4275                         info->attrs[NL80211_ATTR_HIDDEN_SSID]);
4276
4277         params.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
4278
4279         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
4280                 params.auth_type = nla_get_u32(
4281                         info->attrs[NL80211_ATTR_AUTH_TYPE]);
4282                 if (!nl80211_valid_auth_type(rdev, params.auth_type,
4283                                              NL80211_CMD_START_AP))
4284                         return -EINVAL;
4285         } else
4286                 params.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
4287
4288         err = nl80211_crypto_settings(rdev, info, &params.crypto,
4289                                       NL80211_MAX_NR_CIPHER_SUITES);
4290         if (err)
4291                 return err;
4292
4293         if (info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]) {
4294                 if (!(rdev->wiphy.features & NL80211_FEATURE_INACTIVITY_TIMER))
4295                         return -EOPNOTSUPP;
4296                 params.inactivity_timeout = nla_get_u16(
4297                         info->attrs[NL80211_ATTR_INACTIVITY_TIMEOUT]);
4298         }
4299
4300         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
4301                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4302                         return -EINVAL;
4303                 params.p2p_ctwindow =
4304                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
4305                 if (params.p2p_ctwindow != 0 &&
4306                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
4307                         return -EINVAL;
4308         }
4309
4310         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
4311                 u8 tmp;
4312
4313                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4314                         return -EINVAL;
4315                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
4316                 params.p2p_opp_ps = tmp;
4317                 if (params.p2p_opp_ps != 0 &&
4318                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
4319                         return -EINVAL;
4320         }
4321
4322         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
4323                 err = nl80211_parse_chandef(rdev, info, &params.chandef);
4324                 if (err)
4325                         return err;
4326         } else if (wdev->preset_chandef.chan) {
4327                 params.chandef = wdev->preset_chandef;
4328         } else if (!nl80211_get_ap_channel(rdev, &params))
4329                 return -EINVAL;
4330
4331         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
4332                                            wdev->iftype))
4333                 return -EINVAL;
4334
4335         if (info->attrs[NL80211_ATTR_TX_RATES]) {
4336                 err = nl80211_parse_tx_bitrate_mask(info, &params.beacon_rate);
4337                 if (err)
4338                         return err;
4339
4340                 err = validate_beacon_tx_rate(rdev, params.chandef.chan->band,
4341                                               &params.beacon_rate);
4342                 if (err)
4343                         return err;
4344         }
4345
4346         if (info->attrs[NL80211_ATTR_SMPS_MODE]) {
4347                 params.smps_mode =
4348                         nla_get_u8(info->attrs[NL80211_ATTR_SMPS_MODE]);
4349                 switch (params.smps_mode) {
4350                 case NL80211_SMPS_OFF:
4351                         break;
4352                 case NL80211_SMPS_STATIC:
4353                         if (!(rdev->wiphy.features &
4354                               NL80211_FEATURE_STATIC_SMPS))
4355                                 return -EINVAL;
4356                         break;
4357                 case NL80211_SMPS_DYNAMIC:
4358                         if (!(rdev->wiphy.features &
4359                               NL80211_FEATURE_DYNAMIC_SMPS))
4360                                 return -EINVAL;
4361                         break;
4362                 default:
4363                         return -EINVAL;
4364                 }
4365         } else {
4366                 params.smps_mode = NL80211_SMPS_OFF;
4367         }
4368
4369         params.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
4370         if (params.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ])
4371                 return -EOPNOTSUPP;
4372
4373         if (info->attrs[NL80211_ATTR_ACL_POLICY]) {
4374                 params.acl = parse_acl_data(&rdev->wiphy, info);
4375                 if (IS_ERR(params.acl))
4376                         return PTR_ERR(params.acl);
4377         }
4378
4379         nl80211_calculate_ap_params(&params);
4380
4381         wdev_lock(wdev);
4382         err = rdev_start_ap(rdev, dev, &params);
4383         if (!err) {
4384                 wdev->preset_chandef = params.chandef;
4385                 wdev->beacon_interval = params.beacon_interval;
4386                 wdev->chandef = params.chandef;
4387                 wdev->ssid_len = params.ssid_len;
4388                 memcpy(wdev->ssid, params.ssid, wdev->ssid_len);
4389
4390                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
4391                         wdev->conn_owner_nlportid = info->snd_portid;
4392         }
4393         wdev_unlock(wdev);
4394
4395         kfree(params.acl);
4396
4397         return err;
4398 }
4399
4400 static int nl80211_set_beacon(struct sk_buff *skb, struct genl_info *info)
4401 {
4402         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4403         struct net_device *dev = info->user_ptr[1];
4404         struct wireless_dev *wdev = dev->ieee80211_ptr;
4405         struct cfg80211_beacon_data params;
4406         int err;
4407
4408         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
4409             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
4410                 return -EOPNOTSUPP;
4411
4412         if (!rdev->ops->change_beacon)
4413                 return -EOPNOTSUPP;
4414
4415         if (!wdev->beacon_interval)
4416                 return -EINVAL;
4417
4418         err = nl80211_parse_beacon(rdev, info->attrs, &params);
4419         if (err)
4420                 return err;
4421
4422         wdev_lock(wdev);
4423         err = rdev_change_beacon(rdev, dev, &params);
4424         wdev_unlock(wdev);
4425
4426         return err;
4427 }
4428
4429 static int nl80211_stop_ap(struct sk_buff *skb, struct genl_info *info)
4430 {
4431         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4432         struct net_device *dev = info->user_ptr[1];
4433
4434         return cfg80211_stop_ap(rdev, dev, false);
4435 }
4436
4437 static const struct nla_policy sta_flags_policy[NL80211_STA_FLAG_MAX + 1] = {
4438         [NL80211_STA_FLAG_AUTHORIZED] = { .type = NLA_FLAG },
4439         [NL80211_STA_FLAG_SHORT_PREAMBLE] = { .type = NLA_FLAG },
4440         [NL80211_STA_FLAG_WME] = { .type = NLA_FLAG },
4441         [NL80211_STA_FLAG_MFP] = { .type = NLA_FLAG },
4442         [NL80211_STA_FLAG_AUTHENTICATED] = { .type = NLA_FLAG },
4443         [NL80211_STA_FLAG_TDLS_PEER] = { .type = NLA_FLAG },
4444 };
4445
4446 static int parse_station_flags(struct genl_info *info,
4447                                enum nl80211_iftype iftype,
4448                                struct station_parameters *params)
4449 {
4450         struct nlattr *flags[NL80211_STA_FLAG_MAX + 1];
4451         struct nlattr *nla;
4452         int flag;
4453
4454         /*
4455          * Try parsing the new attribute first so userspace
4456          * can specify both for older kernels.
4457          */
4458         nla = info->attrs[NL80211_ATTR_STA_FLAGS2];
4459         if (nla) {
4460                 struct nl80211_sta_flag_update *sta_flags;
4461
4462                 sta_flags = nla_data(nla);
4463                 params->sta_flags_mask = sta_flags->mask;
4464                 params->sta_flags_set = sta_flags->set;
4465                 params->sta_flags_set &= params->sta_flags_mask;
4466                 if ((params->sta_flags_mask |
4467                      params->sta_flags_set) & BIT(__NL80211_STA_FLAG_INVALID))
4468                         return -EINVAL;
4469                 return 0;
4470         }
4471
4472         /* if present, parse the old attribute */
4473
4474         nla = info->attrs[NL80211_ATTR_STA_FLAGS];
4475         if (!nla)
4476                 return 0;
4477
4478         if (nla_parse_nested(flags, NL80211_STA_FLAG_MAX, nla,
4479                              sta_flags_policy, info->extack))
4480                 return -EINVAL;
4481
4482         /*
4483          * Only allow certain flags for interface types so that
4484          * other attributes are silently ignored. Remember that
4485          * this is backward compatibility code with old userspace
4486          * and shouldn't be hit in other cases anyway.
4487          */
4488         switch (iftype) {
4489         case NL80211_IFTYPE_AP:
4490         case NL80211_IFTYPE_AP_VLAN:
4491         case NL80211_IFTYPE_P2P_GO:
4492                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4493                                          BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
4494                                          BIT(NL80211_STA_FLAG_WME) |
4495                                          BIT(NL80211_STA_FLAG_MFP);
4496                 break;
4497         case NL80211_IFTYPE_P2P_CLIENT:
4498         case NL80211_IFTYPE_STATION:
4499                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHORIZED) |
4500                                          BIT(NL80211_STA_FLAG_TDLS_PEER);
4501                 break;
4502         case NL80211_IFTYPE_MESH_POINT:
4503                 params->sta_flags_mask = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4504                                          BIT(NL80211_STA_FLAG_MFP) |
4505                                          BIT(NL80211_STA_FLAG_AUTHORIZED);
4506                 break;
4507         default:
4508                 return -EINVAL;
4509         }
4510
4511         for (flag = 1; flag <= NL80211_STA_FLAG_MAX; flag++) {
4512                 if (flags[flag]) {
4513                         params->sta_flags_set |= (1<<flag);
4514
4515                         /* no longer support new API additions in old API */
4516                         if (flag > NL80211_STA_FLAG_MAX_OLD_API)
4517                                 return -EINVAL;
4518                 }
4519         }
4520
4521         return 0;
4522 }
4523
4524 static bool nl80211_put_sta_rate(struct sk_buff *msg, struct rate_info *info,
4525                                  int attr)
4526 {
4527         struct nlattr *rate;
4528         u32 bitrate;
4529         u16 bitrate_compat;
4530         enum nl80211_rate_info rate_flg;
4531
4532         rate = nla_nest_start(msg, attr);
4533         if (!rate)
4534                 return false;
4535
4536         /* cfg80211_calculate_bitrate will return 0 for mcs >= 32 */
4537         bitrate = cfg80211_calculate_bitrate(info);
4538         /* report 16-bit bitrate only if we can */
4539         bitrate_compat = bitrate < (1UL << 16) ? bitrate : 0;
4540         if (bitrate > 0 &&
4541             nla_put_u32(msg, NL80211_RATE_INFO_BITRATE32, bitrate))
4542                 return false;
4543         if (bitrate_compat > 0 &&
4544             nla_put_u16(msg, NL80211_RATE_INFO_BITRATE, bitrate_compat))
4545                 return false;
4546
4547         switch (info->bw) {
4548         case RATE_INFO_BW_5:
4549                 rate_flg = NL80211_RATE_INFO_5_MHZ_WIDTH;
4550                 break;
4551         case RATE_INFO_BW_10:
4552                 rate_flg = NL80211_RATE_INFO_10_MHZ_WIDTH;
4553                 break;
4554         default:
4555                 WARN_ON(1);
4556                 /* fall through */
4557         case RATE_INFO_BW_20:
4558                 rate_flg = 0;
4559                 break;
4560         case RATE_INFO_BW_40:
4561                 rate_flg = NL80211_RATE_INFO_40_MHZ_WIDTH;
4562                 break;
4563         case RATE_INFO_BW_80:
4564                 rate_flg = NL80211_RATE_INFO_80_MHZ_WIDTH;
4565                 break;
4566         case RATE_INFO_BW_160:
4567                 rate_flg = NL80211_RATE_INFO_160_MHZ_WIDTH;
4568                 break;
4569         case RATE_INFO_BW_HE_RU:
4570                 rate_flg = 0;
4571                 WARN_ON(!(info->flags & RATE_INFO_FLAGS_HE_MCS));
4572         }
4573
4574         if (rate_flg && nla_put_flag(msg, rate_flg))
4575                 return false;
4576
4577         if (info->flags & RATE_INFO_FLAGS_MCS) {
4578                 if (nla_put_u8(msg, NL80211_RATE_INFO_MCS, info->mcs))
4579                         return false;
4580                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4581                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4582                         return false;
4583         } else if (info->flags & RATE_INFO_FLAGS_VHT_MCS) {
4584                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_MCS, info->mcs))
4585                         return false;
4586                 if (nla_put_u8(msg, NL80211_RATE_INFO_VHT_NSS, info->nss))
4587                         return false;
4588                 if (info->flags & RATE_INFO_FLAGS_SHORT_GI &&
4589                     nla_put_flag(msg, NL80211_RATE_INFO_SHORT_GI))
4590                         return false;
4591         } else if (info->flags & RATE_INFO_FLAGS_HE_MCS) {
4592                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_MCS, info->mcs))
4593                         return false;
4594                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_NSS, info->nss))
4595                         return false;
4596                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_GI, info->he_gi))
4597                         return false;
4598                 if (nla_put_u8(msg, NL80211_RATE_INFO_HE_DCM, info->he_dcm))
4599                         return false;
4600                 if (info->bw == RATE_INFO_BW_HE_RU &&
4601                     nla_put_u8(msg, NL80211_RATE_INFO_HE_RU_ALLOC,
4602                                info->he_ru_alloc))
4603                         return false;
4604         }
4605
4606         nla_nest_end(msg, rate);
4607         return true;
4608 }
4609
4610 static bool nl80211_put_signal(struct sk_buff *msg, u8 mask, s8 *signal,
4611                                int id)
4612 {
4613         void *attr;
4614         int i = 0;
4615
4616         if (!mask)
4617                 return true;
4618
4619         attr = nla_nest_start(msg, id);
4620         if (!attr)
4621                 return false;
4622
4623         for (i = 0; i < IEEE80211_MAX_CHAINS; i++) {
4624                 if (!(mask & BIT(i)))
4625                         continue;
4626
4627                 if (nla_put_u8(msg, i, signal[i]))
4628                         return false;
4629         }
4630
4631         nla_nest_end(msg, attr);
4632
4633         return true;
4634 }
4635
4636 static int nl80211_send_station(struct sk_buff *msg, u32 cmd, u32 portid,
4637                                 u32 seq, int flags,
4638                                 struct cfg80211_registered_device *rdev,
4639                                 struct net_device *dev,
4640                                 const u8 *mac_addr, struct station_info *sinfo)
4641 {
4642         void *hdr;
4643         struct nlattr *sinfoattr, *bss_param;
4644
4645         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
4646         if (!hdr)
4647                 return -1;
4648
4649         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
4650             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
4651             nla_put_u32(msg, NL80211_ATTR_GENERATION, sinfo->generation))
4652                 goto nla_put_failure;
4653
4654         sinfoattr = nla_nest_start(msg, NL80211_ATTR_STA_INFO);
4655         if (!sinfoattr)
4656                 goto nla_put_failure;
4657
4658 #define PUT_SINFO(attr, memb, type) do {                                \
4659         BUILD_BUG_ON(sizeof(type) == sizeof(u64));                      \
4660         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4661             nla_put_ ## type(msg, NL80211_STA_INFO_ ## attr,            \
4662                              sinfo->memb))                              \
4663                 goto nla_put_failure;                                   \
4664         } while (0)
4665 #define PUT_SINFO_U64(attr, memb) do {                                  \
4666         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_ ## attr) &&       \
4667             nla_put_u64_64bit(msg, NL80211_STA_INFO_ ## attr,           \
4668                               sinfo->memb, NL80211_STA_INFO_PAD))       \
4669                 goto nla_put_failure;                                   \
4670         } while (0)
4671
4672         PUT_SINFO(CONNECTED_TIME, connected_time, u32);
4673         PUT_SINFO(INACTIVE_TIME, inactive_time, u32);
4674
4675         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_RX_BYTES) |
4676                              BIT_ULL(NL80211_STA_INFO_RX_BYTES64)) &&
4677             nla_put_u32(msg, NL80211_STA_INFO_RX_BYTES,
4678                         (u32)sinfo->rx_bytes))
4679                 goto nla_put_failure;
4680
4681         if (sinfo->filled & (BIT_ULL(NL80211_STA_INFO_TX_BYTES) |
4682                              BIT_ULL(NL80211_STA_INFO_TX_BYTES64)) &&
4683             nla_put_u32(msg, NL80211_STA_INFO_TX_BYTES,
4684                         (u32)sinfo->tx_bytes))
4685                 goto nla_put_failure;
4686
4687         PUT_SINFO_U64(RX_BYTES64, rx_bytes);
4688         PUT_SINFO_U64(TX_BYTES64, tx_bytes);
4689         PUT_SINFO(LLID, llid, u16);
4690         PUT_SINFO(PLID, plid, u16);
4691         PUT_SINFO(PLINK_STATE, plink_state, u8);
4692         PUT_SINFO_U64(RX_DURATION, rx_duration);
4693
4694         switch (rdev->wiphy.signal_type) {
4695         case CFG80211_SIGNAL_TYPE_MBM:
4696                 PUT_SINFO(SIGNAL, signal, u8);
4697                 PUT_SINFO(SIGNAL_AVG, signal_avg, u8);
4698                 break;
4699         default:
4700                 break;
4701         }
4702         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL)) {
4703                 if (!nl80211_put_signal(msg, sinfo->chains,
4704                                         sinfo->chain_signal,
4705                                         NL80211_STA_INFO_CHAIN_SIGNAL))
4706                         goto nla_put_failure;
4707         }
4708         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_CHAIN_SIGNAL_AVG)) {
4709                 if (!nl80211_put_signal(msg, sinfo->chains,
4710                                         sinfo->chain_signal_avg,
4711                                         NL80211_STA_INFO_CHAIN_SIGNAL_AVG))
4712                         goto nla_put_failure;
4713         }
4714         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_TX_BITRATE)) {
4715                 if (!nl80211_put_sta_rate(msg, &sinfo->txrate,
4716                                           NL80211_STA_INFO_TX_BITRATE))
4717                         goto nla_put_failure;
4718         }
4719         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_RX_BITRATE)) {
4720                 if (!nl80211_put_sta_rate(msg, &sinfo->rxrate,
4721                                           NL80211_STA_INFO_RX_BITRATE))
4722                         goto nla_put_failure;
4723         }
4724
4725         PUT_SINFO(RX_PACKETS, rx_packets, u32);
4726         PUT_SINFO(TX_PACKETS, tx_packets, u32);
4727         PUT_SINFO(TX_RETRIES, tx_retries, u32);
4728         PUT_SINFO(TX_FAILED, tx_failed, u32);
4729         PUT_SINFO(EXPECTED_THROUGHPUT, expected_throughput, u32);
4730         PUT_SINFO(BEACON_LOSS, beacon_loss_count, u32);
4731         PUT_SINFO(LOCAL_PM, local_pm, u32);
4732         PUT_SINFO(PEER_PM, peer_pm, u32);
4733         PUT_SINFO(NONPEER_PM, nonpeer_pm, u32);
4734
4735         if (sinfo->filled & BIT_ULL(NL80211_STA_INFO_BSS_PARAM)) {
4736                 bss_param = nla_nest_start(msg, NL80211_STA_INFO_BSS_PARAM);
4737                 if (!bss_param)
4738                         goto nla_put_failure;
4739
4740                 if (((sinfo->bss_param.flags & BSS_PARAM_FLAGS_CTS_PROT) &&
4741                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_CTS_PROT)) ||
4742                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_PREAMBLE) &&
4743                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_PREAMBLE)) ||
4744                     ((sinfo->bss_param.flags & BSS_PARAM_FLAGS_SHORT_SLOT_TIME) &&
4745                      nla_put_flag(msg, NL80211_STA_BSS_PARAM_SHORT_SLOT_TIME)) ||
4746                     nla_put_u8(msg, NL80211_STA_BSS_PARAM_DTIM_PERIOD,
4747                                sinfo->bss_param.dtim_period) ||
4748                     nla_put_u16(msg, NL80211_STA_BSS_PARAM_BEACON_INTERVAL,
4749                                 sinfo->bss_param.beacon_interval))
4750                         goto nla_put_failure;
4751
4752                 nla_nest_end(msg, bss_param);
4753         }
4754         if ((sinfo->filled & BIT_ULL(NL80211_STA_INFO_STA_FLAGS)) &&
4755             nla_put(msg, NL80211_STA_INFO_STA_FLAGS,
4756                     sizeof(struct nl80211_sta_flag_update),
4757                     &sinfo->sta_flags))
4758                 goto nla_put_failure;
4759
4760         PUT_SINFO_U64(T_OFFSET, t_offset);
4761         PUT_SINFO_U64(RX_DROP_MISC, rx_dropped_misc);
4762         PUT_SINFO_U64(BEACON_RX, rx_beacon);
4763         PUT_SINFO(BEACON_SIGNAL_AVG, rx_beacon_signal_avg, u8);
4764         PUT_SINFO(RX_MPDUS, rx_mpdu_count, u32);
4765         PUT_SINFO(FCS_ERROR_COUNT, fcs_err_count, u32);
4766         if (wiphy_ext_feature_isset(&rdev->wiphy,
4767                                     NL80211_EXT_FEATURE_ACK_SIGNAL_SUPPORT)) {
4768                 PUT_SINFO(ACK_SIGNAL, ack_signal, u8);
4769                 PUT_SINFO(ACK_SIGNAL_AVG, avg_ack_signal, s8);
4770         }
4771
4772 #undef PUT_SINFO
4773 #undef PUT_SINFO_U64
4774
4775         if (sinfo->pertid) {
4776                 struct nlattr *tidsattr;
4777                 int tid;
4778
4779                 tidsattr = nla_nest_start(msg, NL80211_STA_INFO_TID_STATS);
4780                 if (!tidsattr)
4781                         goto nla_put_failure;
4782
4783                 for (tid = 0; tid < IEEE80211_NUM_TIDS + 1; tid++) {
4784                         struct cfg80211_tid_stats *tidstats;
4785                         struct nlattr *tidattr;
4786
4787                         tidstats = &sinfo->pertid[tid];
4788
4789                         if (!tidstats->filled)
4790                                 continue;
4791
4792                         tidattr = nla_nest_start(msg, tid + 1);
4793                         if (!tidattr)
4794                                 goto nla_put_failure;
4795
4796 #define PUT_TIDVAL_U64(attr, memb) do {                                 \
4797         if (tidstats->filled & BIT(NL80211_TID_STATS_ ## attr) &&       \
4798             nla_put_u64_64bit(msg, NL80211_TID_STATS_ ## attr,          \
4799                               tidstats->memb, NL80211_TID_STATS_PAD))   \
4800                 goto nla_put_failure;                                   \
4801         } while (0)
4802
4803                         PUT_TIDVAL_U64(RX_MSDU, rx_msdu);
4804                         PUT_TIDVAL_U64(TX_MSDU, tx_msdu);
4805                         PUT_TIDVAL_U64(TX_MSDU_RETRIES, tx_msdu_retries);
4806                         PUT_TIDVAL_U64(TX_MSDU_FAILED, tx_msdu_failed);
4807
4808 #undef PUT_TIDVAL_U64
4809                         if ((tidstats->filled &
4810                              BIT(NL80211_TID_STATS_TXQ_STATS)) &&
4811                             !nl80211_put_txq_stats(msg, &tidstats->txq_stats,
4812                                                    NL80211_TID_STATS_TXQ_STATS))
4813                                 goto nla_put_failure;
4814
4815                         nla_nest_end(msg, tidattr);
4816                 }
4817
4818                 nla_nest_end(msg, tidsattr);
4819         }
4820
4821         nla_nest_end(msg, sinfoattr);
4822
4823         if (sinfo->assoc_req_ies_len &&
4824             nla_put(msg, NL80211_ATTR_IE, sinfo->assoc_req_ies_len,
4825                     sinfo->assoc_req_ies))
4826                 goto nla_put_failure;
4827
4828         cfg80211_sinfo_release_content(sinfo);
4829         genlmsg_end(msg, hdr);
4830         return 0;
4831
4832  nla_put_failure:
4833         cfg80211_sinfo_release_content(sinfo);
4834         genlmsg_cancel(msg, hdr);
4835         return -EMSGSIZE;
4836 }
4837
4838 static int nl80211_dump_station(struct sk_buff *skb,
4839                                 struct netlink_callback *cb)
4840 {
4841         struct station_info sinfo;
4842         struct cfg80211_registered_device *rdev;
4843         struct wireless_dev *wdev;
4844         u8 mac_addr[ETH_ALEN];
4845         int sta_idx = cb->args[2];
4846         int err;
4847
4848         rtnl_lock();
4849         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
4850         if (err)
4851                 goto out_err;
4852
4853         if (!wdev->netdev) {
4854                 err = -EINVAL;
4855                 goto out_err;
4856         }
4857
4858         if (!rdev->ops->dump_station) {
4859                 err = -EOPNOTSUPP;
4860                 goto out_err;
4861         }
4862
4863         while (1) {
4864                 memset(&sinfo, 0, sizeof(sinfo));
4865                 err = rdev_dump_station(rdev, wdev->netdev, sta_idx,
4866                                         mac_addr, &sinfo);
4867                 if (err == -ENOENT)
4868                         break;
4869                 if (err)
4870                         goto out_err;
4871
4872                 if (nl80211_send_station(skb, NL80211_CMD_NEW_STATION,
4873                                 NETLINK_CB(cb->skb).portid,
4874                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
4875                                 rdev, wdev->netdev, mac_addr,
4876                                 &sinfo) < 0)
4877                         goto out;
4878
4879                 sta_idx++;
4880         }
4881
4882  out:
4883         cb->args[2] = sta_idx;
4884         err = skb->len;
4885  out_err:
4886         rtnl_unlock();
4887
4888         return err;
4889 }
4890
4891 static int nl80211_get_station(struct sk_buff *skb, struct genl_info *info)
4892 {
4893         struct cfg80211_registered_device *rdev = info->user_ptr[0];
4894         struct net_device *dev = info->user_ptr[1];
4895         struct station_info sinfo;
4896         struct sk_buff *msg;
4897         u8 *mac_addr = NULL;
4898         int err;
4899
4900         memset(&sinfo, 0, sizeof(sinfo));
4901
4902         if (!info->attrs[NL80211_ATTR_MAC])
4903                 return -EINVAL;
4904
4905         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
4906
4907         if (!rdev->ops->get_station)
4908                 return -EOPNOTSUPP;
4909
4910         err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
4911         if (err)
4912                 return err;
4913
4914         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
4915         if (!msg) {
4916                 cfg80211_sinfo_release_content(&sinfo);
4917                 return -ENOMEM;
4918         }
4919
4920         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION,
4921                                  info->snd_portid, info->snd_seq, 0,
4922                                  rdev, dev, mac_addr, &sinfo) < 0) {
4923                 nlmsg_free(msg);
4924                 return -ENOBUFS;
4925         }
4926
4927         return genlmsg_reply(msg, info);
4928 }
4929
4930 int cfg80211_check_station_change(struct wiphy *wiphy,
4931                                   struct station_parameters *params,
4932                                   enum cfg80211_station_type statype)
4933 {
4934         if (params->listen_interval != -1 &&
4935             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4936                 return -EINVAL;
4937
4938         if (params->support_p2p_ps != -1 &&
4939             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4940                 return -EINVAL;
4941
4942         if (params->aid &&
4943             !(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) &&
4944             statype != CFG80211_STA_AP_CLIENT_UNASSOC)
4945                 return -EINVAL;
4946
4947         /* When you run into this, adjust the code below for the new flag */
4948         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
4949
4950         switch (statype) {
4951         case CFG80211_STA_MESH_PEER_KERNEL:
4952         case CFG80211_STA_MESH_PEER_USER:
4953                 /*
4954                  * No ignoring the TDLS flag here -- the userspace mesh
4955                  * code doesn't have the bug of including TDLS in the
4956                  * mask everywhere.
4957                  */
4958                 if (params->sta_flags_mask &
4959                                 ~(BIT(NL80211_STA_FLAG_AUTHENTICATED) |
4960                                   BIT(NL80211_STA_FLAG_MFP) |
4961                                   BIT(NL80211_STA_FLAG_AUTHORIZED)))
4962                         return -EINVAL;
4963                 break;
4964         case CFG80211_STA_TDLS_PEER_SETUP:
4965         case CFG80211_STA_TDLS_PEER_ACTIVE:
4966                 if (!(params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
4967                         return -EINVAL;
4968                 /* ignore since it can't change */
4969                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4970                 break;
4971         default:
4972                 /* disallow mesh-specific things */
4973                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION)
4974                         return -EINVAL;
4975                 if (params->local_pm)
4976                         return -EINVAL;
4977                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
4978                         return -EINVAL;
4979         }
4980
4981         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4982             statype != CFG80211_STA_TDLS_PEER_ACTIVE) {
4983                 /* TDLS can't be set, ... */
4984                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER))
4985                         return -EINVAL;
4986                 /*
4987                  * ... but don't bother the driver with it. This works around
4988                  * a hostapd/wpa_supplicant issue -- it always includes the
4989                  * TLDS_PEER flag in the mask even for AP mode.
4990                  */
4991                 params->sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
4992         }
4993
4994         if (statype != CFG80211_STA_TDLS_PEER_SETUP &&
4995             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
4996                 /* reject other things that can't change */
4997                 if (params->sta_modify_mask & STATION_PARAM_APPLY_UAPSD)
4998                         return -EINVAL;
4999                 if (params->sta_modify_mask & STATION_PARAM_APPLY_CAPABILITY)
5000                         return -EINVAL;
5001                 if (params->supported_rates)
5002                         return -EINVAL;
5003                 if (params->ext_capab || params->ht_capa || params->vht_capa ||
5004                     params->he_capa)
5005                         return -EINVAL;
5006         }
5007
5008         if (statype != CFG80211_STA_AP_CLIENT &&
5009             statype != CFG80211_STA_AP_CLIENT_UNASSOC) {
5010                 if (params->vlan)
5011                         return -EINVAL;
5012         }
5013
5014         switch (statype) {
5015         case CFG80211_STA_AP_MLME_CLIENT:
5016                 /* Use this only for authorizing/unauthorizing a station */
5017                 if (!(params->sta_flags_mask & BIT(NL80211_STA_FLAG_AUTHORIZED)))
5018                         return -EOPNOTSUPP;
5019                 break;
5020         case CFG80211_STA_AP_CLIENT:
5021         case CFG80211_STA_AP_CLIENT_UNASSOC:
5022                 /* accept only the listed bits */
5023                 if (params->sta_flags_mask &
5024                                 ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5025                                   BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5026                                   BIT(NL80211_STA_FLAG_ASSOCIATED) |
5027                                   BIT(NL80211_STA_FLAG_SHORT_PREAMBLE) |
5028                                   BIT(NL80211_STA_FLAG_WME) |
5029                                   BIT(NL80211_STA_FLAG_MFP)))
5030                         return -EINVAL;
5031
5032                 /* but authenticated/associated only if driver handles it */
5033                 if (!(wiphy->features & NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5034                     params->sta_flags_mask &
5035                                 (BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5036                                  BIT(NL80211_STA_FLAG_ASSOCIATED)))
5037                         return -EINVAL;
5038                 break;
5039         case CFG80211_STA_IBSS:
5040         case CFG80211_STA_AP_STA:
5041                 /* reject any changes other than AUTHORIZED */
5042                 if (params->sta_flags_mask & ~BIT(NL80211_STA_FLAG_AUTHORIZED))
5043                         return -EINVAL;
5044                 break;
5045         case CFG80211_STA_TDLS_PEER_SETUP:
5046                 /* reject any changes other than AUTHORIZED or WME */
5047                 if (params->sta_flags_mask & ~(BIT(NL80211_STA_FLAG_AUTHORIZED) |
5048                                                BIT(NL80211_STA_FLAG_WME)))
5049                         return -EINVAL;
5050                 /* force (at least) rates when authorizing */
5051                 if (params->sta_flags_set & BIT(NL80211_STA_FLAG_AUTHORIZED) &&
5052                     !params->supported_rates)
5053                         return -EINVAL;
5054                 break;
5055         case CFG80211_STA_TDLS_PEER_ACTIVE:
5056                 /* reject any changes */
5057                 return -EINVAL;
5058         case CFG80211_STA_MESH_PEER_KERNEL:
5059                 if (params->sta_modify_mask & STATION_PARAM_APPLY_PLINK_STATE)
5060                         return -EINVAL;
5061                 break;
5062         case CFG80211_STA_MESH_PEER_USER:
5063                 if (params->plink_action != NL80211_PLINK_ACTION_NO_ACTION &&
5064                     params->plink_action != NL80211_PLINK_ACTION_BLOCK)
5065                         return -EINVAL;
5066                 break;
5067         }
5068
5069         /*
5070          * Older kernel versions ignored this attribute entirely, so don't
5071          * reject attempts to update it but mark it as unused instead so the
5072          * driver won't look at the data.
5073          */
5074         if (statype != CFG80211_STA_AP_CLIENT_UNASSOC &&
5075             statype != CFG80211_STA_TDLS_PEER_SETUP)
5076                 params->opmode_notif_used = false;
5077
5078         return 0;
5079 }
5080 EXPORT_SYMBOL(cfg80211_check_station_change);
5081
5082 /*
5083  * Get vlan interface making sure it is running and on the right wiphy.
5084  */
5085 static struct net_device *get_vlan(struct genl_info *info,
5086                                    struct cfg80211_registered_device *rdev)
5087 {
5088         struct nlattr *vlanattr = info->attrs[NL80211_ATTR_STA_VLAN];
5089         struct net_device *v;
5090         int ret;
5091
5092         if (!vlanattr)
5093                 return NULL;
5094
5095         v = dev_get_by_index(genl_info_net(info), nla_get_u32(vlanattr));
5096         if (!v)
5097                 return ERR_PTR(-ENODEV);
5098
5099         if (!v->ieee80211_ptr || v->ieee80211_ptr->wiphy != &rdev->wiphy) {
5100                 ret = -EINVAL;
5101                 goto error;
5102         }
5103
5104         if (v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5105             v->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5106             v->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO) {
5107                 ret = -EINVAL;
5108                 goto error;
5109         }
5110
5111         if (!netif_running(v)) {
5112                 ret = -ENETDOWN;
5113                 goto error;
5114         }
5115
5116         return v;
5117  error:
5118         dev_put(v);
5119         return ERR_PTR(ret);
5120 }
5121
5122 static const struct nla_policy
5123 nl80211_sta_wme_policy[NL80211_STA_WME_MAX + 1] = {
5124         [NL80211_STA_WME_UAPSD_QUEUES] = { .type = NLA_U8 },
5125         [NL80211_STA_WME_MAX_SP] = { .type = NLA_U8 },
5126 };
5127
5128 static int nl80211_parse_sta_wme(struct genl_info *info,
5129                                  struct station_parameters *params)
5130 {
5131         struct nlattr *tb[NL80211_STA_WME_MAX + 1];
5132         struct nlattr *nla;
5133         int err;
5134
5135         /* parse WME attributes if present */
5136         if (!info->attrs[NL80211_ATTR_STA_WME])
5137                 return 0;
5138
5139         nla = info->attrs[NL80211_ATTR_STA_WME];
5140         err = nla_parse_nested(tb, NL80211_STA_WME_MAX, nla,
5141                                nl80211_sta_wme_policy, info->extack);
5142         if (err)
5143                 return err;
5144
5145         if (tb[NL80211_STA_WME_UAPSD_QUEUES])
5146                 params->uapsd_queues = nla_get_u8(
5147                         tb[NL80211_STA_WME_UAPSD_QUEUES]);
5148         if (params->uapsd_queues & ~IEEE80211_WMM_IE_STA_QOSINFO_AC_MASK)
5149                 return -EINVAL;
5150
5151         if (tb[NL80211_STA_WME_MAX_SP])
5152                 params->max_sp = nla_get_u8(tb[NL80211_STA_WME_MAX_SP]);
5153
5154         if (params->max_sp & ~IEEE80211_WMM_IE_STA_QOSINFO_SP_MASK)
5155                 return -EINVAL;
5156
5157         params->sta_modify_mask |= STATION_PARAM_APPLY_UAPSD;
5158
5159         return 0;
5160 }
5161
5162 static int nl80211_parse_sta_channel_info(struct genl_info *info,
5163                                       struct station_parameters *params)
5164 {
5165         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]) {
5166                 params->supported_channels =
5167                      nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5168                 params->supported_channels_len =
5169                      nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_CHANNELS]);
5170                 /*
5171                  * Need to include at least one (first channel, number of
5172                  * channels) tuple for each subband, and must have proper
5173                  * tuples for the rest of the data as well.
5174                  */
5175                 if (params->supported_channels_len < 2)
5176                         return -EINVAL;
5177                 if (params->supported_channels_len % 2)
5178                         return -EINVAL;
5179         }
5180
5181         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]) {
5182                 params->supported_oper_classes =
5183                  nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5184                 params->supported_oper_classes_len =
5185                   nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_OPER_CLASSES]);
5186                 /*
5187                  * The value of the Length field of the Supported Operating
5188                  * Classes element is between 2 and 253.
5189                  */
5190                 if (params->supported_oper_classes_len < 2 ||
5191                     params->supported_oper_classes_len > 253)
5192                         return -EINVAL;
5193         }
5194         return 0;
5195 }
5196
5197 static int nl80211_set_station_tdls(struct genl_info *info,
5198                                     struct station_parameters *params)
5199 {
5200         int err;
5201         /* Dummy STA entry gets updated once the peer capabilities are known */
5202         if (info->attrs[NL80211_ATTR_PEER_AID])
5203                 params->aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5204         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5205                 params->ht_capa =
5206                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5207         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5208                 params->vht_capa =
5209                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5210         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5211                 params->he_capa =
5212                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5213                 params->he_capa_len =
5214                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5215
5216                 if (params->he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5217                         return -EINVAL;
5218         }
5219
5220         err = nl80211_parse_sta_channel_info(info, params);
5221         if (err)
5222                 return err;
5223
5224         return nl80211_parse_sta_wme(info, params);
5225 }
5226
5227 static int nl80211_set_station(struct sk_buff *skb, struct genl_info *info)
5228 {
5229         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5230         struct net_device *dev = info->user_ptr[1];
5231         struct station_parameters params;
5232         u8 *mac_addr;
5233         int err;
5234
5235         memset(&params, 0, sizeof(params));
5236
5237         if (!rdev->ops->change_station)
5238                 return -EOPNOTSUPP;
5239
5240         /*
5241          * AID and listen_interval properties can be set only for unassociated
5242          * station. Include these parameters here and will check them in
5243          * cfg80211_check_station_change().
5244          */
5245         if (info->attrs[NL80211_ATTR_STA_AID])
5246                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5247
5248         if (info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5249                 params.listen_interval =
5250                      nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5251         else
5252                 params.listen_interval = -1;
5253
5254         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS])
5255                 params.support_p2p_ps =
5256                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5257         else
5258                 params.support_p2p_ps = -1;
5259
5260         if (!info->attrs[NL80211_ATTR_MAC])
5261                 return -EINVAL;
5262
5263         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5264
5265         if (info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]) {
5266                 params.supported_rates =
5267                         nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5268                 params.supported_rates_len =
5269                         nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5270         }
5271
5272         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5273                 params.capability =
5274                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5275                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5276         }
5277
5278         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5279                 params.ext_capab =
5280                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5281                 params.ext_capab_len =
5282                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5283         }
5284
5285         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5286                 return -EINVAL;
5287
5288         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5289                 params.plink_action =
5290                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5291
5292         if (info->attrs[NL80211_ATTR_STA_PLINK_STATE]) {
5293                 params.plink_state =
5294                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_STATE]);
5295                 if (info->attrs[NL80211_ATTR_MESH_PEER_AID])
5296                         params.peer_aid = nla_get_u16(
5297                                 info->attrs[NL80211_ATTR_MESH_PEER_AID]);
5298                 params.sta_modify_mask |= STATION_PARAM_APPLY_PLINK_STATE;
5299         }
5300
5301         if (info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE])
5302                 params.local_pm = nla_get_u32(
5303                         info->attrs[NL80211_ATTR_LOCAL_MESH_POWER_MODE]);
5304
5305         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5306                 params.opmode_notif_used = true;
5307                 params.opmode_notif =
5308                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5309         }
5310
5311         /* Include parameters for TDLS peer (will check later) */
5312         err = nl80211_set_station_tdls(info, &params);
5313         if (err)
5314                 return err;
5315
5316         params.vlan = get_vlan(info, rdev);
5317         if (IS_ERR(params.vlan))
5318                 return PTR_ERR(params.vlan);
5319
5320         switch (dev->ieee80211_ptr->iftype) {
5321         case NL80211_IFTYPE_AP:
5322         case NL80211_IFTYPE_AP_VLAN:
5323         case NL80211_IFTYPE_P2P_GO:
5324         case NL80211_IFTYPE_P2P_CLIENT:
5325         case NL80211_IFTYPE_STATION:
5326         case NL80211_IFTYPE_ADHOC:
5327         case NL80211_IFTYPE_MESH_POINT:
5328                 break;
5329         default:
5330                 err = -EOPNOTSUPP;
5331                 goto out_put_vlan;
5332         }
5333
5334         /* driver will call cfg80211_check_station_change() */
5335         err = rdev_change_station(rdev, dev, mac_addr, &params);
5336
5337  out_put_vlan:
5338         if (params.vlan)
5339                 dev_put(params.vlan);
5340
5341         return err;
5342 }
5343
5344 static int nl80211_new_station(struct sk_buff *skb, struct genl_info *info)
5345 {
5346         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5347         int err;
5348         struct net_device *dev = info->user_ptr[1];
5349         struct station_parameters params;
5350         u8 *mac_addr = NULL;
5351         u32 auth_assoc = BIT(NL80211_STA_FLAG_AUTHENTICATED) |
5352                          BIT(NL80211_STA_FLAG_ASSOCIATED);
5353
5354         memset(&params, 0, sizeof(params));
5355
5356         if (!rdev->ops->add_station)
5357                 return -EOPNOTSUPP;
5358
5359         if (!info->attrs[NL80211_ATTR_MAC])
5360                 return -EINVAL;
5361
5362         if (!info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL])
5363                 return -EINVAL;
5364
5365         if (!info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES])
5366                 return -EINVAL;
5367
5368         if (!info->attrs[NL80211_ATTR_STA_AID] &&
5369             !info->attrs[NL80211_ATTR_PEER_AID])
5370                 return -EINVAL;
5371
5372         mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
5373         params.supported_rates =
5374                 nla_data(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5375         params.supported_rates_len =
5376                 nla_len(info->attrs[NL80211_ATTR_STA_SUPPORTED_RATES]);
5377         params.listen_interval =
5378                 nla_get_u16(info->attrs[NL80211_ATTR_STA_LISTEN_INTERVAL]);
5379
5380         if (info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]) {
5381                 params.support_p2p_ps =
5382                         nla_get_u8(info->attrs[NL80211_ATTR_STA_SUPPORT_P2P_PS]);
5383         } else {
5384                 /*
5385                  * if not specified, assume it's supported for P2P GO interface,
5386                  * and is NOT supported for AP interface
5387                  */
5388                 params.support_p2p_ps =
5389                         dev->ieee80211_ptr->iftype == NL80211_IFTYPE_P2P_GO;
5390         }
5391
5392         if (info->attrs[NL80211_ATTR_PEER_AID])
5393                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_PEER_AID]);
5394         else
5395                 params.aid = nla_get_u16(info->attrs[NL80211_ATTR_STA_AID]);
5396
5397         if (info->attrs[NL80211_ATTR_STA_CAPABILITY]) {
5398                 params.capability =
5399                         nla_get_u16(info->attrs[NL80211_ATTR_STA_CAPABILITY]);
5400                 params.sta_modify_mask |= STATION_PARAM_APPLY_CAPABILITY;
5401         }
5402
5403         if (info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]) {
5404                 params.ext_capab =
5405                         nla_data(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5406                 params.ext_capab_len =
5407                         nla_len(info->attrs[NL80211_ATTR_STA_EXT_CAPABILITY]);
5408         }
5409
5410         if (info->attrs[NL80211_ATTR_HT_CAPABILITY])
5411                 params.ht_capa =
5412                         nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]);
5413
5414         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY])
5415                 params.vht_capa =
5416                         nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]);
5417
5418         if (info->attrs[NL80211_ATTR_HE_CAPABILITY]) {
5419                 params.he_capa =
5420                         nla_data(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5421                 params.he_capa_len =
5422                         nla_len(info->attrs[NL80211_ATTR_HE_CAPABILITY]);
5423
5424                 /* max len is validated in nla policy */
5425                 if (params.he_capa_len < NL80211_HE_MIN_CAPABILITY_LEN)
5426                         return -EINVAL;
5427         }
5428
5429         if (info->attrs[NL80211_ATTR_OPMODE_NOTIF]) {
5430                 params.opmode_notif_used = true;
5431                 params.opmode_notif =
5432                         nla_get_u8(info->attrs[NL80211_ATTR_OPMODE_NOTIF]);
5433         }
5434
5435         if (info->attrs[NL80211_ATTR_STA_PLINK_ACTION])
5436                 params.plink_action =
5437                         nla_get_u8(info->attrs[NL80211_ATTR_STA_PLINK_ACTION]);
5438
5439         err = nl80211_parse_sta_channel_info(info, &params);
5440         if (err)
5441                 return err;
5442
5443         err = nl80211_parse_sta_wme(info, &params);
5444         if (err)
5445                 return err;
5446
5447         if (parse_station_flags(info, dev->ieee80211_ptr->iftype, &params))
5448                 return -EINVAL;
5449
5450         /* HT/VHT requires QoS, but if we don't have that just ignore HT/VHT
5451          * as userspace might just pass through the capabilities from the IEs
5452          * directly, rather than enforcing this restriction and returning an
5453          * error in this case.
5454          */
5455         if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME))) {
5456                 params.ht_capa = NULL;
5457                 params.vht_capa = NULL;
5458
5459                 /* HE requires WME */
5460                 if (params.he_capa_len)
5461                         return -EINVAL;
5462         }
5463
5464         /* When you run into this, adjust the code below for the new flag */
5465         BUILD_BUG_ON(NL80211_STA_FLAG_MAX != 7);
5466
5467         switch (dev->ieee80211_ptr->iftype) {
5468         case NL80211_IFTYPE_AP:
5469         case NL80211_IFTYPE_AP_VLAN:
5470         case NL80211_IFTYPE_P2P_GO:
5471                 /* ignore WME attributes if iface/sta is not capable */
5472                 if (!(rdev->wiphy.flags & WIPHY_FLAG_AP_UAPSD) ||
5473                     !(params.sta_flags_set & BIT(NL80211_STA_FLAG_WME)))
5474                         params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5475
5476                 /* TDLS peers cannot be added */
5477                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5478                     info->attrs[NL80211_ATTR_PEER_AID])
5479                         return -EINVAL;
5480                 /* but don't bother the driver with it */
5481                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_TDLS_PEER);
5482
5483                 /* allow authenticated/associated only if driver handles it */
5484                 if (!(rdev->wiphy.features &
5485                                 NL80211_FEATURE_FULL_AP_CLIENT_STATE) &&
5486                     params.sta_flags_mask & auth_assoc)
5487                         return -EINVAL;
5488
5489                 /* Older userspace, or userspace wanting to be compatible with
5490                  * !NL80211_FEATURE_FULL_AP_CLIENT_STATE, will not set the auth
5491                  * and assoc flags in the mask, but assumes the station will be
5492                  * added as associated anyway since this was the required driver
5493                  * behaviour before NL80211_FEATURE_FULL_AP_CLIENT_STATE was
5494                  * introduced.
5495                  * In order to not bother drivers with this quirk in the API
5496                  * set the flags in both the mask and set for new stations in
5497                  * this case.
5498                  */
5499                 if (!(params.sta_flags_mask & auth_assoc)) {
5500                         params.sta_flags_mask |= auth_assoc;
5501                         params.sta_flags_set |= auth_assoc;
5502                 }
5503
5504                 /* must be last in here for error handling */
5505                 params.vlan = get_vlan(info, rdev);
5506                 if (IS_ERR(params.vlan))
5507                         return PTR_ERR(params.vlan);
5508                 break;
5509         case NL80211_IFTYPE_MESH_POINT:
5510                 /* ignore uAPSD data */
5511                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5512
5513                 /* associated is disallowed */
5514                 if (params.sta_flags_mask & BIT(NL80211_STA_FLAG_ASSOCIATED))
5515                         return -EINVAL;
5516                 /* TDLS peers cannot be added */
5517                 if ((params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)) ||
5518                     info->attrs[NL80211_ATTR_PEER_AID])
5519                         return -EINVAL;
5520                 break;
5521         case NL80211_IFTYPE_STATION:
5522         case NL80211_IFTYPE_P2P_CLIENT:
5523                 /* ignore uAPSD data */
5524                 params.sta_modify_mask &= ~STATION_PARAM_APPLY_UAPSD;
5525
5526                 /* these are disallowed */
5527                 if (params.sta_flags_mask &
5528                                 (BIT(NL80211_STA_FLAG_ASSOCIATED) |
5529                                  BIT(NL80211_STA_FLAG_AUTHENTICATED)))
5530                         return -EINVAL;
5531                 /* Only TDLS peers can be added */
5532                 if (!(params.sta_flags_set & BIT(NL80211_STA_FLAG_TDLS_PEER)))
5533                         return -EINVAL;
5534                 /* Can only add if TDLS ... */
5535                 if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS))
5536                         return -EOPNOTSUPP;
5537                 /* ... with external setup is supported */
5538                 if (!(rdev->wiphy.flags & WIPHY_FLAG_TDLS_EXTERNAL_SETUP))
5539                         return -EOPNOTSUPP;
5540                 /*
5541                  * Older wpa_supplicant versions always mark the TDLS peer
5542                  * as authorized, but it shouldn't yet be.
5543                  */
5544                 params.sta_flags_mask &= ~BIT(NL80211_STA_FLAG_AUTHORIZED);
5545                 break;
5546         default:
5547                 return -EOPNOTSUPP;
5548         }
5549
5550         /* be aware of params.vlan when changing code here */
5551
5552         err = rdev_add_station(rdev, dev, mac_addr, &params);
5553
5554         if (params.vlan)
5555                 dev_put(params.vlan);
5556         return err;
5557 }
5558
5559 static int nl80211_del_station(struct sk_buff *skb, struct genl_info *info)
5560 {
5561         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5562         struct net_device *dev = info->user_ptr[1];
5563         struct station_del_parameters params;
5564
5565         memset(&params, 0, sizeof(params));
5566
5567         if (info->attrs[NL80211_ATTR_MAC])
5568                 params.mac = nla_data(info->attrs[NL80211_ATTR_MAC]);
5569
5570         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5571             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP_VLAN &&
5572             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
5573             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5574                 return -EINVAL;
5575
5576         if (!rdev->ops->del_station)
5577                 return -EOPNOTSUPP;
5578
5579         if (info->attrs[NL80211_ATTR_MGMT_SUBTYPE]) {
5580                 params.subtype =
5581                         nla_get_u8(info->attrs[NL80211_ATTR_MGMT_SUBTYPE]);
5582                 if (params.subtype != IEEE80211_STYPE_DISASSOC >> 4 &&
5583                     params.subtype != IEEE80211_STYPE_DEAUTH >> 4)
5584                         return -EINVAL;
5585         } else {
5586                 /* Default to Deauthentication frame */
5587                 params.subtype = IEEE80211_STYPE_DEAUTH >> 4;
5588         }
5589
5590         if (info->attrs[NL80211_ATTR_REASON_CODE]) {
5591                 params.reason_code =
5592                         nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
5593                 if (params.reason_code == 0)
5594                         return -EINVAL; /* 0 is reserved */
5595         } else {
5596                 /* Default to reason code 2 */
5597                 params.reason_code = WLAN_REASON_PREV_AUTH_NOT_VALID;
5598         }
5599
5600         return rdev_del_station(rdev, dev, &params);
5601 }
5602
5603 static int nl80211_send_mpath(struct sk_buff *msg, u32 portid, u32 seq,
5604                                 int flags, struct net_device *dev,
5605                                 u8 *dst, u8 *next_hop,
5606                                 struct mpath_info *pinfo)
5607 {
5608         void *hdr;
5609         struct nlattr *pinfoattr;
5610
5611         hdr = nl80211hdr_put(msg, portid, seq, flags, NL80211_CMD_NEW_MPATH);
5612         if (!hdr)
5613                 return -1;
5614
5615         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
5616             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, dst) ||
5617             nla_put(msg, NL80211_ATTR_MPATH_NEXT_HOP, ETH_ALEN, next_hop) ||
5618             nla_put_u32(msg, NL80211_ATTR_GENERATION, pinfo->generation))
5619                 goto nla_put_failure;
5620
5621         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MPATH_INFO);
5622         if (!pinfoattr)
5623                 goto nla_put_failure;
5624         if ((pinfo->filled & MPATH_INFO_FRAME_QLEN) &&
5625             nla_put_u32(msg, NL80211_MPATH_INFO_FRAME_QLEN,
5626                         pinfo->frame_qlen))
5627                 goto nla_put_failure;
5628         if (((pinfo->filled & MPATH_INFO_SN) &&
5629              nla_put_u32(msg, NL80211_MPATH_INFO_SN, pinfo->sn)) ||
5630             ((pinfo->filled & MPATH_INFO_METRIC) &&
5631              nla_put_u32(msg, NL80211_MPATH_INFO_METRIC,
5632                          pinfo->metric)) ||
5633             ((pinfo->filled & MPATH_INFO_EXPTIME) &&
5634              nla_put_u32(msg, NL80211_MPATH_INFO_EXPTIME,
5635                          pinfo->exptime)) ||
5636             ((pinfo->filled & MPATH_INFO_FLAGS) &&
5637              nla_put_u8(msg, NL80211_MPATH_INFO_FLAGS,
5638                         pinfo->flags)) ||
5639             ((pinfo->filled & MPATH_INFO_DISCOVERY_TIMEOUT) &&
5640              nla_put_u32(msg, NL80211_MPATH_INFO_DISCOVERY_TIMEOUT,
5641                          pinfo->discovery_timeout)) ||
5642             ((pinfo->filled & MPATH_INFO_DISCOVERY_RETRIES) &&
5643              nla_put_u8(msg, NL80211_MPATH_INFO_DISCOVERY_RETRIES,
5644                         pinfo->discovery_retries)))
5645                 goto nla_put_failure;
5646
5647         nla_nest_end(msg, pinfoattr);
5648
5649         genlmsg_end(msg, hdr);
5650         return 0;
5651
5652  nla_put_failure:
5653         genlmsg_cancel(msg, hdr);
5654         return -EMSGSIZE;
5655 }
5656
5657 static int nl80211_dump_mpath(struct sk_buff *skb,
5658                               struct netlink_callback *cb)
5659 {
5660         struct mpath_info pinfo;
5661         struct cfg80211_registered_device *rdev;
5662         struct wireless_dev *wdev;
5663         u8 dst[ETH_ALEN];
5664         u8 next_hop[ETH_ALEN];
5665         int path_idx = cb->args[2];
5666         int err;
5667
5668         rtnl_lock();
5669         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5670         if (err)
5671                 goto out_err;
5672
5673         if (!rdev->ops->dump_mpath) {
5674                 err = -EOPNOTSUPP;
5675                 goto out_err;
5676         }
5677
5678         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5679                 err = -EOPNOTSUPP;
5680                 goto out_err;
5681         }
5682
5683         while (1) {
5684                 err = rdev_dump_mpath(rdev, wdev->netdev, path_idx, dst,
5685                                       next_hop, &pinfo);
5686                 if (err == -ENOENT)
5687                         break;
5688                 if (err)
5689                         goto out_err;
5690
5691                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5692                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5693                                        wdev->netdev, dst, next_hop,
5694                                        &pinfo) < 0)
5695                         goto out;
5696
5697                 path_idx++;
5698         }
5699
5700  out:
5701         cb->args[2] = path_idx;
5702         err = skb->len;
5703  out_err:
5704         rtnl_unlock();
5705         return err;
5706 }
5707
5708 static int nl80211_get_mpath(struct sk_buff *skb, struct genl_info *info)
5709 {
5710         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5711         int err;
5712         struct net_device *dev = info->user_ptr[1];
5713         struct mpath_info pinfo;
5714         struct sk_buff *msg;
5715         u8 *dst = NULL;
5716         u8 next_hop[ETH_ALEN];
5717
5718         memset(&pinfo, 0, sizeof(pinfo));
5719
5720         if (!info->attrs[NL80211_ATTR_MAC])
5721                 return -EINVAL;
5722
5723         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5724
5725         if (!rdev->ops->get_mpath)
5726                 return -EOPNOTSUPP;
5727
5728         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5729                 return -EOPNOTSUPP;
5730
5731         err = rdev_get_mpath(rdev, dev, dst, next_hop, &pinfo);
5732         if (err)
5733                 return err;
5734
5735         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5736         if (!msg)
5737                 return -ENOMEM;
5738
5739         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5740                                  dev, dst, next_hop, &pinfo) < 0) {
5741                 nlmsg_free(msg);
5742                 return -ENOBUFS;
5743         }
5744
5745         return genlmsg_reply(msg, info);
5746 }
5747
5748 static int nl80211_set_mpath(struct sk_buff *skb, struct genl_info *info)
5749 {
5750         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5751         struct net_device *dev = info->user_ptr[1];
5752         u8 *dst = NULL;
5753         u8 *next_hop = NULL;
5754
5755         if (!info->attrs[NL80211_ATTR_MAC])
5756                 return -EINVAL;
5757
5758         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5759                 return -EINVAL;
5760
5761         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5762         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5763
5764         if (!rdev->ops->change_mpath)
5765                 return -EOPNOTSUPP;
5766
5767         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5768                 return -EOPNOTSUPP;
5769
5770         return rdev_change_mpath(rdev, dev, dst, next_hop);
5771 }
5772
5773 static int nl80211_new_mpath(struct sk_buff *skb, struct genl_info *info)
5774 {
5775         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5776         struct net_device *dev = info->user_ptr[1];
5777         u8 *dst = NULL;
5778         u8 *next_hop = NULL;
5779
5780         if (!info->attrs[NL80211_ATTR_MAC])
5781                 return -EINVAL;
5782
5783         if (!info->attrs[NL80211_ATTR_MPATH_NEXT_HOP])
5784                 return -EINVAL;
5785
5786         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5787         next_hop = nla_data(info->attrs[NL80211_ATTR_MPATH_NEXT_HOP]);
5788
5789         if (!rdev->ops->add_mpath)
5790                 return -EOPNOTSUPP;
5791
5792         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5793                 return -EOPNOTSUPP;
5794
5795         return rdev_add_mpath(rdev, dev, dst, next_hop);
5796 }
5797
5798 static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
5799 {
5800         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5801         struct net_device *dev = info->user_ptr[1];
5802         u8 *dst = NULL;
5803
5804         if (info->attrs[NL80211_ATTR_MAC])
5805                 dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5806
5807         if (!rdev->ops->del_mpath)
5808                 return -EOPNOTSUPP;
5809
5810         return rdev_del_mpath(rdev, dev, dst);
5811 }
5812
5813 static int nl80211_get_mpp(struct sk_buff *skb, struct genl_info *info)
5814 {
5815         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5816         int err;
5817         struct net_device *dev = info->user_ptr[1];
5818         struct mpath_info pinfo;
5819         struct sk_buff *msg;
5820         u8 *dst = NULL;
5821         u8 mpp[ETH_ALEN];
5822
5823         memset(&pinfo, 0, sizeof(pinfo));
5824
5825         if (!info->attrs[NL80211_ATTR_MAC])
5826                 return -EINVAL;
5827
5828         dst = nla_data(info->attrs[NL80211_ATTR_MAC]);
5829
5830         if (!rdev->ops->get_mpp)
5831                 return -EOPNOTSUPP;
5832
5833         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
5834                 return -EOPNOTSUPP;
5835
5836         err = rdev_get_mpp(rdev, dev, dst, mpp, &pinfo);
5837         if (err)
5838                 return err;
5839
5840         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
5841         if (!msg)
5842                 return -ENOMEM;
5843
5844         if (nl80211_send_mpath(msg, info->snd_portid, info->snd_seq, 0,
5845                                dev, dst, mpp, &pinfo) < 0) {
5846                 nlmsg_free(msg);
5847                 return -ENOBUFS;
5848         }
5849
5850         return genlmsg_reply(msg, info);
5851 }
5852
5853 static int nl80211_dump_mpp(struct sk_buff *skb,
5854                             struct netlink_callback *cb)
5855 {
5856         struct mpath_info pinfo;
5857         struct cfg80211_registered_device *rdev;
5858         struct wireless_dev *wdev;
5859         u8 dst[ETH_ALEN];
5860         u8 mpp[ETH_ALEN];
5861         int path_idx = cb->args[2];
5862         int err;
5863
5864         rtnl_lock();
5865         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
5866         if (err)
5867                 goto out_err;
5868
5869         if (!rdev->ops->dump_mpp) {
5870                 err = -EOPNOTSUPP;
5871                 goto out_err;
5872         }
5873
5874         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT) {
5875                 err = -EOPNOTSUPP;
5876                 goto out_err;
5877         }
5878
5879         while (1) {
5880                 err = rdev_dump_mpp(rdev, wdev->netdev, path_idx, dst,
5881                                     mpp, &pinfo);
5882                 if (err == -ENOENT)
5883                         break;
5884                 if (err)
5885                         goto out_err;
5886
5887                 if (nl80211_send_mpath(skb, NETLINK_CB(cb->skb).portid,
5888                                        cb->nlh->nlmsg_seq, NLM_F_MULTI,
5889                                        wdev->netdev, dst, mpp,
5890                                        &pinfo) < 0)
5891                         goto out;
5892
5893                 path_idx++;
5894         }
5895
5896  out:
5897         cb->args[2] = path_idx;
5898         err = skb->len;
5899  out_err:
5900         rtnl_unlock();
5901         return err;
5902 }
5903
5904 static int nl80211_set_bss(struct sk_buff *skb, struct genl_info *info)
5905 {
5906         struct cfg80211_registered_device *rdev = info->user_ptr[0];
5907         struct net_device *dev = info->user_ptr[1];
5908         struct wireless_dev *wdev = dev->ieee80211_ptr;
5909         struct bss_parameters params;
5910         int err;
5911
5912         memset(&params, 0, sizeof(params));
5913         /* default to not changing parameters */
5914         params.use_cts_prot = -1;
5915         params.use_short_preamble = -1;
5916         params.use_short_slot_time = -1;
5917         params.ap_isolate = -1;
5918         params.ht_opmode = -1;
5919         params.p2p_ctwindow = -1;
5920         params.p2p_opp_ps = -1;
5921
5922         if (info->attrs[NL80211_ATTR_BSS_CTS_PROT])
5923                 params.use_cts_prot =
5924                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_CTS_PROT]);
5925         if (info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE])
5926                 params.use_short_preamble =
5927                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_PREAMBLE]);
5928         if (info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME])
5929                 params.use_short_slot_time =
5930                     nla_get_u8(info->attrs[NL80211_ATTR_BSS_SHORT_SLOT_TIME]);
5931         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
5932                 params.basic_rates =
5933                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5934                 params.basic_rates_len =
5935                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
5936         }
5937         if (info->attrs[NL80211_ATTR_AP_ISOLATE])
5938                 params.ap_isolate = !!nla_get_u8(info->attrs[NL80211_ATTR_AP_ISOLATE]);
5939         if (info->attrs[NL80211_ATTR_BSS_HT_OPMODE])
5940                 params.ht_opmode =
5941                         nla_get_u16(info->attrs[NL80211_ATTR_BSS_HT_OPMODE]);
5942
5943         if (info->attrs[NL80211_ATTR_P2P_CTWINDOW]) {
5944                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5945                         return -EINVAL;
5946                 params.p2p_ctwindow =
5947                         nla_get_u8(info->attrs[NL80211_ATTR_P2P_CTWINDOW]);
5948                 if (params.p2p_ctwindow != 0 &&
5949                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_CTWIN))
5950                         return -EINVAL;
5951         }
5952
5953         if (info->attrs[NL80211_ATTR_P2P_OPPPS]) {
5954                 u8 tmp;
5955
5956                 if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5957                         return -EINVAL;
5958                 tmp = nla_get_u8(info->attrs[NL80211_ATTR_P2P_OPPPS]);
5959                 params.p2p_opp_ps = tmp;
5960                 if (params.p2p_opp_ps &&
5961                     !(rdev->wiphy.features & NL80211_FEATURE_P2P_GO_OPPPS))
5962                         return -EINVAL;
5963         }
5964
5965         if (!rdev->ops->change_bss)
5966                 return -EOPNOTSUPP;
5967
5968         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_AP &&
5969             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_GO)
5970                 return -EOPNOTSUPP;
5971
5972         wdev_lock(wdev);
5973         err = rdev_change_bss(rdev, dev, &params);
5974         wdev_unlock(wdev);
5975
5976         return err;
5977 }
5978
5979 static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info)
5980 {
5981         char *data = NULL;
5982         bool is_indoor;
5983         enum nl80211_user_reg_hint_type user_reg_hint_type;
5984         u32 owner_nlportid;
5985
5986         /*
5987          * You should only get this when cfg80211 hasn't yet initialized
5988          * completely when built-in to the kernel right between the time
5989          * window between nl80211_init() and regulatory_init(), if that is
5990          * even possible.
5991          */
5992         if (unlikely(!rcu_access_pointer(cfg80211_regdomain)))
5993                 return -EINPROGRESS;
5994
5995         if (info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE])
5996                 user_reg_hint_type =
5997                   nla_get_u32(info->attrs[NL80211_ATTR_USER_REG_HINT_TYPE]);
5998         else
5999                 user_reg_hint_type = NL80211_USER_REG_HINT_USER;
6000
6001         switch (user_reg_hint_type) {
6002         case NL80211_USER_REG_HINT_USER:
6003         case NL80211_USER_REG_HINT_CELL_BASE:
6004                 if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6005                         return -EINVAL;
6006
6007                 data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6008                 return regulatory_hint_user(data, user_reg_hint_type);
6009         case NL80211_USER_REG_HINT_INDOOR:
6010                 if (info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
6011                         owner_nlportid = info->snd_portid;
6012                         is_indoor = !!info->attrs[NL80211_ATTR_REG_INDOOR];
6013                 } else {
6014                         owner_nlportid = 0;
6015                         is_indoor = true;
6016                 }
6017
6018                 return regulatory_hint_indoor(is_indoor, owner_nlportid);
6019         default:
6020                 return -EINVAL;
6021         }
6022 }
6023
6024 static int nl80211_reload_regdb(struct sk_buff *skb, struct genl_info *info)
6025 {
6026         return reg_reload_regdb();
6027 }
6028
6029 static int nl80211_get_mesh_config(struct sk_buff *skb,
6030                                    struct genl_info *info)
6031 {
6032         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6033         struct net_device *dev = info->user_ptr[1];
6034         struct wireless_dev *wdev = dev->ieee80211_ptr;
6035         struct mesh_config cur_params;
6036         int err = 0;
6037         void *hdr;
6038         struct nlattr *pinfoattr;
6039         struct sk_buff *msg;
6040
6041         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6042                 return -EOPNOTSUPP;
6043
6044         if (!rdev->ops->get_mesh_config)
6045                 return -EOPNOTSUPP;
6046
6047         wdev_lock(wdev);
6048         /* If not connected, get default parameters */
6049         if (!wdev->mesh_id_len)
6050                 memcpy(&cur_params, &default_mesh_config, sizeof(cur_params));
6051         else
6052                 err = rdev_get_mesh_config(rdev, dev, &cur_params);
6053         wdev_unlock(wdev);
6054
6055         if (err)
6056                 return err;
6057
6058         /* Draw up a netlink message to send back */
6059         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6060         if (!msg)
6061                 return -ENOMEM;
6062         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6063                              NL80211_CMD_GET_MESH_CONFIG);
6064         if (!hdr)
6065                 goto out;
6066         pinfoattr = nla_nest_start(msg, NL80211_ATTR_MESH_CONFIG);
6067         if (!pinfoattr)
6068                 goto nla_put_failure;
6069         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
6070             nla_put_u16(msg, NL80211_MESHCONF_RETRY_TIMEOUT,
6071                         cur_params.dot11MeshRetryTimeout) ||
6072             nla_put_u16(msg, NL80211_MESHCONF_CONFIRM_TIMEOUT,
6073                         cur_params.dot11MeshConfirmTimeout) ||
6074             nla_put_u16(msg, NL80211_MESHCONF_HOLDING_TIMEOUT,
6075                         cur_params.dot11MeshHoldingTimeout) ||
6076             nla_put_u16(msg, NL80211_MESHCONF_MAX_PEER_LINKS,
6077                         cur_params.dot11MeshMaxPeerLinks) ||
6078             nla_put_u8(msg, NL80211_MESHCONF_MAX_RETRIES,
6079                        cur_params.dot11MeshMaxRetries) ||
6080             nla_put_u8(msg, NL80211_MESHCONF_TTL,
6081                        cur_params.dot11MeshTTL) ||
6082             nla_put_u8(msg, NL80211_MESHCONF_ELEMENT_TTL,
6083                        cur_params.element_ttl) ||
6084             nla_put_u8(msg, NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6085                        cur_params.auto_open_plinks) ||
6086             nla_put_u32(msg, NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6087                         cur_params.dot11MeshNbrOffsetMaxNeighbor) ||
6088             nla_put_u8(msg, NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6089                        cur_params.dot11MeshHWMPmaxPREQretries) ||
6090             nla_put_u32(msg, NL80211_MESHCONF_PATH_REFRESH_TIME,
6091                         cur_params.path_refresh_time) ||
6092             nla_put_u16(msg, NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6093                         cur_params.min_discovery_timeout) ||
6094             nla_put_u32(msg, NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6095                         cur_params.dot11MeshHWMPactivePathTimeout) ||
6096             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6097                         cur_params.dot11MeshHWMPpreqMinInterval) ||
6098             nla_put_u16(msg, NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6099                         cur_params.dot11MeshHWMPperrMinInterval) ||
6100             nla_put_u16(msg, NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6101                         cur_params.dot11MeshHWMPnetDiameterTraversalTime) ||
6102             nla_put_u8(msg, NL80211_MESHCONF_HWMP_ROOTMODE,
6103                        cur_params.dot11MeshHWMPRootMode) ||
6104             nla_put_u16(msg, NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6105                         cur_params.dot11MeshHWMPRannInterval) ||
6106             nla_put_u8(msg, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6107                        cur_params.dot11MeshGateAnnouncementProtocol) ||
6108             nla_put_u8(msg, NL80211_MESHCONF_FORWARDING,
6109                        cur_params.dot11MeshForwarding) ||
6110             nla_put_s32(msg, NL80211_MESHCONF_RSSI_THRESHOLD,
6111                         cur_params.rssi_threshold) ||
6112             nla_put_u32(msg, NL80211_MESHCONF_HT_OPMODE,
6113                         cur_params.ht_opmode) ||
6114             nla_put_u32(msg, NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6115                         cur_params.dot11MeshHWMPactivePathToRootTimeout) ||
6116             nla_put_u16(msg, NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6117                         cur_params.dot11MeshHWMProotInterval) ||
6118             nla_put_u16(msg, NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6119                         cur_params.dot11MeshHWMPconfirmationInterval) ||
6120             nla_put_u32(msg, NL80211_MESHCONF_POWER_MODE,
6121                         cur_params.power_mode) ||
6122             nla_put_u16(msg, NL80211_MESHCONF_AWAKE_WINDOW,
6123                         cur_params.dot11MeshAwakeWindowDuration) ||
6124             nla_put_u32(msg, NL80211_MESHCONF_PLINK_TIMEOUT,
6125                         cur_params.plink_timeout))
6126                 goto nla_put_failure;
6127         nla_nest_end(msg, pinfoattr);
6128         genlmsg_end(msg, hdr);
6129         return genlmsg_reply(msg, info);
6130
6131  nla_put_failure:
6132  out:
6133         nlmsg_free(msg);
6134         return -ENOBUFS;
6135 }
6136
6137 static const struct nla_policy
6138 nl80211_meshconf_params_policy[NL80211_MESHCONF_ATTR_MAX+1] = {
6139         [NL80211_MESHCONF_RETRY_TIMEOUT] =
6140                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6141         [NL80211_MESHCONF_CONFIRM_TIMEOUT] =
6142                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6143         [NL80211_MESHCONF_HOLDING_TIMEOUT] =
6144                 NLA_POLICY_RANGE(NLA_U16, 1, 255),
6145         [NL80211_MESHCONF_MAX_PEER_LINKS] =
6146                 NLA_POLICY_RANGE(NLA_U16, 0, 255),
6147         [NL80211_MESHCONF_MAX_RETRIES] = NLA_POLICY_MAX(NLA_U8, 16),
6148         [NL80211_MESHCONF_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6149         [NL80211_MESHCONF_ELEMENT_TTL] = NLA_POLICY_MIN(NLA_U8, 1),
6150         [NL80211_MESHCONF_AUTO_OPEN_PLINKS] = NLA_POLICY_MAX(NLA_U8, 1),
6151         [NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR] =
6152                 NLA_POLICY_RANGE(NLA_U32, 1, 255),
6153         [NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES] = { .type = NLA_U8 },
6154         [NL80211_MESHCONF_PATH_REFRESH_TIME] = { .type = NLA_U32 },
6155         [NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT] = NLA_POLICY_MIN(NLA_U16, 1),
6156         [NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT] = { .type = NLA_U32 },
6157         [NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL] =
6158                 NLA_POLICY_MIN(NLA_U16, 1),
6159         [NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL] =
6160                 NLA_POLICY_MIN(NLA_U16, 1),
6161         [NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME] =
6162                 NLA_POLICY_MIN(NLA_U16, 1),
6163         [NL80211_MESHCONF_HWMP_ROOTMODE] = NLA_POLICY_MAX(NLA_U8, 4),
6164         [NL80211_MESHCONF_HWMP_RANN_INTERVAL] =
6165                 NLA_POLICY_MIN(NLA_U16, 1),
6166         [NL80211_MESHCONF_GATE_ANNOUNCEMENTS] = NLA_POLICY_MAX(NLA_U8, 1),
6167         [NL80211_MESHCONF_FORWARDING] = NLA_POLICY_MAX(NLA_U8, 1),
6168         [NL80211_MESHCONF_RSSI_THRESHOLD] =
6169                 NLA_POLICY_RANGE(NLA_S32, -255, 0),
6170         [NL80211_MESHCONF_HT_OPMODE] = { .type = NLA_U16 },
6171         [NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT] = { .type = NLA_U32 },
6172         [NL80211_MESHCONF_HWMP_ROOT_INTERVAL] =
6173                 NLA_POLICY_MIN(NLA_U16, 1),
6174         [NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL] =
6175                 NLA_POLICY_MIN(NLA_U16, 1),
6176         [NL80211_MESHCONF_POWER_MODE] =
6177                 NLA_POLICY_RANGE(NLA_U32,
6178                                  NL80211_MESH_POWER_ACTIVE,
6179                                  NL80211_MESH_POWER_MAX),
6180         [NL80211_MESHCONF_AWAKE_WINDOW] = { .type = NLA_U16 },
6181         [NL80211_MESHCONF_PLINK_TIMEOUT] = { .type = NLA_U32 },
6182 };
6183
6184 static const struct nla_policy
6185         nl80211_mesh_setup_params_policy[NL80211_MESH_SETUP_ATTR_MAX+1] = {
6186         [NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC] = { .type = NLA_U8 },
6187         [NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL] = { .type = NLA_U8 },
6188         [NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC] = { .type = NLA_U8 },
6189         [NL80211_MESH_SETUP_USERSPACE_AUTH] = { .type = NLA_FLAG },
6190         [NL80211_MESH_SETUP_AUTH_PROTOCOL] = { .type = NLA_U8 },
6191         [NL80211_MESH_SETUP_USERSPACE_MPM] = { .type = NLA_FLAG },
6192         [NL80211_MESH_SETUP_IE] =
6193                 NLA_POLICY_VALIDATE_FN(NLA_BINARY, validate_ie_attr,
6194                                        IEEE80211_MAX_DATA_LEN),
6195         [NL80211_MESH_SETUP_USERSPACE_AMPE] = { .type = NLA_FLAG },
6196 };
6197
6198 static int nl80211_parse_mesh_config(struct genl_info *info,
6199                                      struct mesh_config *cfg,
6200                                      u32 *mask_out)
6201 {
6202         struct nlattr *tb[NL80211_MESHCONF_ATTR_MAX + 1];
6203         u32 mask = 0;
6204         u16 ht_opmode;
6205
6206 #define FILL_IN_MESH_PARAM_IF_SET(tb, cfg, param, mask, attr, fn)       \
6207 do {                                                                    \
6208         if (tb[attr]) {                                                 \
6209                 cfg->param = fn(tb[attr]);                              \
6210                 mask |= BIT((attr) - 1);                                \
6211         }                                                               \
6212 } while (0)
6213
6214         if (!info->attrs[NL80211_ATTR_MESH_CONFIG])
6215                 return -EINVAL;
6216         if (nla_parse_nested(tb, NL80211_MESHCONF_ATTR_MAX,
6217                              info->attrs[NL80211_ATTR_MESH_CONFIG],
6218                              nl80211_meshconf_params_policy, info->extack))
6219                 return -EINVAL;
6220
6221         /* This makes sure that there aren't more than 32 mesh config
6222          * parameters (otherwise our bitfield scheme would not work.) */
6223         BUILD_BUG_ON(NL80211_MESHCONF_ATTR_MAX > 32);
6224
6225         /* Fill in the params struct */
6226         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshRetryTimeout, mask,
6227                                   NL80211_MESHCONF_RETRY_TIMEOUT, nla_get_u16);
6228         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshConfirmTimeout, mask,
6229                                   NL80211_MESHCONF_CONFIRM_TIMEOUT,
6230                                   nla_get_u16);
6231         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHoldingTimeout, mask,
6232                                   NL80211_MESHCONF_HOLDING_TIMEOUT,
6233                                   nla_get_u16);
6234         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxPeerLinks, mask,
6235                                   NL80211_MESHCONF_MAX_PEER_LINKS,
6236                                   nla_get_u16);
6237         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshMaxRetries, mask,
6238                                   NL80211_MESHCONF_MAX_RETRIES, nla_get_u8);
6239         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshTTL, mask,
6240                                   NL80211_MESHCONF_TTL, nla_get_u8);
6241         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, element_ttl, mask,
6242                                   NL80211_MESHCONF_ELEMENT_TTL, nla_get_u8);
6243         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, auto_open_plinks, mask,
6244                                   NL80211_MESHCONF_AUTO_OPEN_PLINKS,
6245                                   nla_get_u8);
6246         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshNbrOffsetMaxNeighbor,
6247                                   mask,
6248                                   NL80211_MESHCONF_SYNC_OFFSET_MAX_NEIGHBOR,
6249                                   nla_get_u32);
6250         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPmaxPREQretries, mask,
6251                                   NL80211_MESHCONF_HWMP_MAX_PREQ_RETRIES,
6252                                   nla_get_u8);
6253         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, path_refresh_time, mask,
6254                                   NL80211_MESHCONF_PATH_REFRESH_TIME,
6255                                   nla_get_u32);
6256         if (mask & BIT(NL80211_MESHCONF_PATH_REFRESH_TIME) &&
6257             (cfg->path_refresh_time < 1 || cfg->path_refresh_time > 65535))
6258                 return -EINVAL;
6259         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, min_discovery_timeout, mask,
6260                                   NL80211_MESHCONF_MIN_DISCOVERY_TIMEOUT,
6261                                   nla_get_u16);
6262         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPactivePathTimeout,
6263                                   mask,
6264                                   NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT,
6265                                   nla_get_u32);
6266         if (mask & BIT(NL80211_MESHCONF_HWMP_ACTIVE_PATH_TIMEOUT) &&
6267             (cfg->dot11MeshHWMPactivePathTimeout < 1 ||
6268              cfg->dot11MeshHWMPactivePathTimeout > 65535))
6269                 return -EINVAL;
6270         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPpreqMinInterval, mask,
6271                                   NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL,
6272                                   nla_get_u16);
6273         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPperrMinInterval, mask,
6274                                   NL80211_MESHCONF_HWMP_PERR_MIN_INTERVAL,
6275                                   nla_get_u16);
6276         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6277                                   dot11MeshHWMPnetDiameterTraversalTime, mask,
6278                                   NL80211_MESHCONF_HWMP_NET_DIAM_TRVS_TIME,
6279                                   nla_get_u16);
6280         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRootMode, mask,
6281                                   NL80211_MESHCONF_HWMP_ROOTMODE, nla_get_u8);
6282         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPRannInterval, mask,
6283                                   NL80211_MESHCONF_HWMP_RANN_INTERVAL,
6284                                   nla_get_u16);
6285         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshGateAnnouncementProtocol,
6286                                   mask, NL80211_MESHCONF_GATE_ANNOUNCEMENTS,
6287                                   nla_get_u8);
6288         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshForwarding, mask,
6289                                   NL80211_MESHCONF_FORWARDING, nla_get_u8);
6290         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, rssi_threshold, mask,
6291                                   NL80211_MESHCONF_RSSI_THRESHOLD,
6292                                   nla_get_s32);
6293         /*
6294          * Check HT operation mode based on
6295          * IEEE 802.11-2016 9.4.2.57 HT Operation element.
6296          */
6297         if (tb[NL80211_MESHCONF_HT_OPMODE]) {
6298                 ht_opmode = nla_get_u16(tb[NL80211_MESHCONF_HT_OPMODE]);
6299
6300                 if (ht_opmode & ~(IEEE80211_HT_OP_MODE_PROTECTION |
6301                                   IEEE80211_HT_OP_MODE_NON_GF_STA_PRSNT |
6302                                   IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT))
6303                         return -EINVAL;
6304
6305                 /* NON_HT_STA bit is reserved, but some programs set it */
6306                 ht_opmode &= ~IEEE80211_HT_OP_MODE_NON_HT_STA_PRSNT;
6307
6308                 cfg->ht_opmode = ht_opmode;
6309                 mask |= (1 << (NL80211_MESHCONF_HT_OPMODE - 1));
6310         }
6311         FILL_IN_MESH_PARAM_IF_SET(tb, cfg,
6312                                   dot11MeshHWMPactivePathToRootTimeout, mask,
6313                                   NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT,
6314                                   nla_get_u32);
6315         if (mask & BIT(NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT) &&
6316             (cfg->dot11MeshHWMPactivePathToRootTimeout < 1 ||
6317              cfg->dot11MeshHWMPactivePathToRootTimeout > 65535))
6318                 return -EINVAL;
6319         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMProotInterval, mask,
6320                                   NL80211_MESHCONF_HWMP_ROOT_INTERVAL,
6321                                   nla_get_u16);
6322         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshHWMPconfirmationInterval,
6323                                   mask,
6324                                   NL80211_MESHCONF_HWMP_CONFIRMATION_INTERVAL,
6325                                   nla_get_u16);
6326         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, power_mode, mask,
6327                                   NL80211_MESHCONF_POWER_MODE, nla_get_u32);
6328         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, dot11MeshAwakeWindowDuration, mask,
6329                                   NL80211_MESHCONF_AWAKE_WINDOW, nla_get_u16);
6330         FILL_IN_MESH_PARAM_IF_SET(tb, cfg, plink_timeout, mask,
6331                                   NL80211_MESHCONF_PLINK_TIMEOUT, nla_get_u32);
6332         if (mask_out)
6333                 *mask_out = mask;
6334
6335         return 0;
6336
6337 #undef FILL_IN_MESH_PARAM_IF_SET
6338 }
6339
6340 static int nl80211_parse_mesh_setup(struct genl_info *info,
6341                                      struct mesh_setup *setup)
6342 {
6343         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6344         struct nlattr *tb[NL80211_MESH_SETUP_ATTR_MAX + 1];
6345
6346         if (!info->attrs[NL80211_ATTR_MESH_SETUP])
6347                 return -EINVAL;
6348         if (nla_parse_nested(tb, NL80211_MESH_SETUP_ATTR_MAX,
6349                              info->attrs[NL80211_ATTR_MESH_SETUP],
6350                              nl80211_mesh_setup_params_policy, info->extack))
6351                 return -EINVAL;
6352
6353         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])
6354                 setup->sync_method =
6355                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC])) ?
6356                  IEEE80211_SYNC_METHOD_VENDOR :
6357                  IEEE80211_SYNC_METHOD_NEIGHBOR_OFFSET;
6358
6359         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])
6360                 setup->path_sel_proto =
6361                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL])) ?
6362                  IEEE80211_PATH_PROTOCOL_VENDOR :
6363                  IEEE80211_PATH_PROTOCOL_HWMP;
6364
6365         if (tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])
6366                 setup->path_metric =
6367                 (nla_get_u8(tb[NL80211_MESH_SETUP_ENABLE_VENDOR_METRIC])) ?
6368                  IEEE80211_PATH_METRIC_VENDOR :
6369                  IEEE80211_PATH_METRIC_AIRTIME;
6370
6371         if (tb[NL80211_MESH_SETUP_IE]) {
6372                 struct nlattr *ieattr =
6373                         tb[NL80211_MESH_SETUP_IE];
6374                 setup->ie = nla_data(ieattr);
6375                 setup->ie_len = nla_len(ieattr);
6376         }
6377         if (tb[NL80211_MESH_SETUP_USERSPACE_MPM] &&
6378             !(rdev->wiphy.features & NL80211_FEATURE_USERSPACE_MPM))
6379                 return -EINVAL;
6380         setup->user_mpm = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_MPM]);
6381         setup->is_authenticated = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AUTH]);
6382         setup->is_secure = nla_get_flag(tb[NL80211_MESH_SETUP_USERSPACE_AMPE]);
6383         if (setup->is_secure)
6384                 setup->user_mpm = true;
6385
6386         if (tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]) {
6387                 if (!setup->user_mpm)
6388                         return -EINVAL;
6389                 setup->auth_id =
6390                         nla_get_u8(tb[NL80211_MESH_SETUP_AUTH_PROTOCOL]);
6391         }
6392
6393         return 0;
6394 }
6395
6396 static int nl80211_update_mesh_config(struct sk_buff *skb,
6397                                       struct genl_info *info)
6398 {
6399         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6400         struct net_device *dev = info->user_ptr[1];
6401         struct wireless_dev *wdev = dev->ieee80211_ptr;
6402         struct mesh_config cfg;
6403         u32 mask;
6404         int err;
6405
6406         if (wdev->iftype != NL80211_IFTYPE_MESH_POINT)
6407                 return -EOPNOTSUPP;
6408
6409         if (!rdev->ops->update_mesh_config)
6410                 return -EOPNOTSUPP;
6411
6412         err = nl80211_parse_mesh_config(info, &cfg, &mask);
6413         if (err)
6414                 return err;
6415
6416         wdev_lock(wdev);
6417         if (!wdev->mesh_id_len)
6418                 err = -ENOLINK;
6419
6420         if (!err)
6421                 err = rdev_update_mesh_config(rdev, dev, mask, &cfg);
6422
6423         wdev_unlock(wdev);
6424
6425         return err;
6426 }
6427
6428 static int nl80211_put_regdom(const struct ieee80211_regdomain *regdom,
6429                               struct sk_buff *msg)
6430 {
6431         struct nlattr *nl_reg_rules;
6432         unsigned int i;
6433
6434         if (nla_put_string(msg, NL80211_ATTR_REG_ALPHA2, regdom->alpha2) ||
6435             (regdom->dfs_region &&
6436              nla_put_u8(msg, NL80211_ATTR_DFS_REGION, regdom->dfs_region)))
6437                 goto nla_put_failure;
6438
6439         nl_reg_rules = nla_nest_start(msg, NL80211_ATTR_REG_RULES);
6440         if (!nl_reg_rules)
6441                 goto nla_put_failure;
6442
6443         for (i = 0; i < regdom->n_reg_rules; i++) {
6444                 struct nlattr *nl_reg_rule;
6445                 const struct ieee80211_reg_rule *reg_rule;
6446                 const struct ieee80211_freq_range *freq_range;
6447                 const struct ieee80211_power_rule *power_rule;
6448                 unsigned int max_bandwidth_khz;
6449
6450                 reg_rule = &regdom->reg_rules[i];
6451                 freq_range = &reg_rule->freq_range;
6452                 power_rule = &reg_rule->power_rule;
6453
6454                 nl_reg_rule = nla_nest_start(msg, i);
6455                 if (!nl_reg_rule)
6456                         goto nla_put_failure;
6457
6458                 max_bandwidth_khz = freq_range->max_bandwidth_khz;
6459                 if (!max_bandwidth_khz)
6460                         max_bandwidth_khz = reg_get_max_bandwidth(regdom,
6461                                                                   reg_rule);
6462
6463                 if (nla_put_u32(msg, NL80211_ATTR_REG_RULE_FLAGS,
6464                                 reg_rule->flags) ||
6465                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_START,
6466                                 freq_range->start_freq_khz) ||
6467                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_END,
6468                                 freq_range->end_freq_khz) ||
6469                     nla_put_u32(msg, NL80211_ATTR_FREQ_RANGE_MAX_BW,
6470                                 max_bandwidth_khz) ||
6471                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN,
6472                                 power_rule->max_antenna_gain) ||
6473                     nla_put_u32(msg, NL80211_ATTR_POWER_RULE_MAX_EIRP,
6474                                 power_rule->max_eirp) ||
6475                     nla_put_u32(msg, NL80211_ATTR_DFS_CAC_TIME,
6476                                 reg_rule->dfs_cac_ms))
6477                         goto nla_put_failure;
6478
6479                 nla_nest_end(msg, nl_reg_rule);
6480         }
6481
6482         nla_nest_end(msg, nl_reg_rules);
6483         return 0;
6484
6485 nla_put_failure:
6486         return -EMSGSIZE;
6487 }
6488
6489 static int nl80211_get_reg_do(struct sk_buff *skb, struct genl_info *info)
6490 {
6491         const struct ieee80211_regdomain *regdom = NULL;
6492         struct cfg80211_registered_device *rdev;
6493         struct wiphy *wiphy = NULL;
6494         struct sk_buff *msg;
6495         void *hdr;
6496
6497         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
6498         if (!msg)
6499                 return -ENOBUFS;
6500
6501         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
6502                              NL80211_CMD_GET_REG);
6503         if (!hdr)
6504                 goto put_failure;
6505
6506         if (info->attrs[NL80211_ATTR_WIPHY]) {
6507                 bool self_managed;
6508
6509                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
6510                 if (IS_ERR(rdev)) {
6511                         nlmsg_free(msg);
6512                         return PTR_ERR(rdev);
6513                 }
6514
6515                 wiphy = &rdev->wiphy;
6516                 self_managed = wiphy->regulatory_flags &
6517                                REGULATORY_WIPHY_SELF_MANAGED;
6518                 regdom = get_wiphy_regdom(wiphy);
6519
6520                 /* a self-managed-reg device must have a private regdom */
6521                 if (WARN_ON(!regdom && self_managed)) {
6522                         nlmsg_free(msg);
6523                         return -EINVAL;
6524                 }
6525
6526                 if (regdom &&
6527                     nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6528                         goto nla_put_failure;
6529         }
6530
6531         if (!wiphy && reg_last_request_cell_base() &&
6532             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6533                         NL80211_USER_REG_HINT_CELL_BASE))
6534                 goto nla_put_failure;
6535
6536         rcu_read_lock();
6537
6538         if (!regdom)
6539                 regdom = rcu_dereference(cfg80211_regdomain);
6540
6541         if (nl80211_put_regdom(regdom, msg))
6542                 goto nla_put_failure_rcu;
6543
6544         rcu_read_unlock();
6545
6546         genlmsg_end(msg, hdr);
6547         return genlmsg_reply(msg, info);
6548
6549 nla_put_failure_rcu:
6550         rcu_read_unlock();
6551 nla_put_failure:
6552 put_failure:
6553         nlmsg_free(msg);
6554         return -EMSGSIZE;
6555 }
6556
6557 static int nl80211_send_regdom(struct sk_buff *msg, struct netlink_callback *cb,
6558                                u32 seq, int flags, struct wiphy *wiphy,
6559                                const struct ieee80211_regdomain *regdom)
6560 {
6561         void *hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
6562                                    NL80211_CMD_GET_REG);
6563
6564         if (!hdr)
6565                 return -1;
6566
6567         genl_dump_check_consistent(cb, hdr);
6568
6569         if (nl80211_put_regdom(regdom, msg))
6570                 goto nla_put_failure;
6571
6572         if (!wiphy && reg_last_request_cell_base() &&
6573             nla_put_u32(msg, NL80211_ATTR_USER_REG_HINT_TYPE,
6574                         NL80211_USER_REG_HINT_CELL_BASE))
6575                 goto nla_put_failure;
6576
6577         if (wiphy &&
6578             nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
6579                 goto nla_put_failure;
6580
6581         if (wiphy && wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
6582             nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
6583                 goto nla_put_failure;
6584
6585         genlmsg_end(msg, hdr);
6586         return 0;
6587
6588 nla_put_failure:
6589         genlmsg_cancel(msg, hdr);
6590         return -EMSGSIZE;
6591 }
6592
6593 static int nl80211_get_reg_dump(struct sk_buff *skb,
6594                                 struct netlink_callback *cb)
6595 {
6596         const struct ieee80211_regdomain *regdom = NULL;
6597         struct cfg80211_registered_device *rdev;
6598         int err, reg_idx, start = cb->args[2];
6599
6600         rtnl_lock();
6601
6602         if (cfg80211_regdomain && start == 0) {
6603                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6604                                           NLM_F_MULTI, NULL,
6605                                           rtnl_dereference(cfg80211_regdomain));
6606                 if (err < 0)
6607                         goto out_err;
6608         }
6609
6610         /* the global regdom is idx 0 */
6611         reg_idx = 1;
6612         list_for_each_entry(rdev, &cfg80211_rdev_list, list) {
6613                 regdom = get_wiphy_regdom(&rdev->wiphy);
6614                 if (!regdom)
6615                         continue;
6616
6617                 if (++reg_idx <= start)
6618                         continue;
6619
6620                 err = nl80211_send_regdom(skb, cb, cb->nlh->nlmsg_seq,
6621                                           NLM_F_MULTI, &rdev->wiphy, regdom);
6622                 if (err < 0) {
6623                         reg_idx--;
6624                         break;
6625                 }
6626         }
6627
6628         cb->args[2] = reg_idx;
6629         err = skb->len;
6630 out_err:
6631         rtnl_unlock();
6632         return err;
6633 }
6634
6635 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
6636 static const struct nla_policy reg_rule_policy[NL80211_REG_RULE_ATTR_MAX + 1] = {
6637         [NL80211_ATTR_REG_RULE_FLAGS]           = { .type = NLA_U32 },
6638         [NL80211_ATTR_FREQ_RANGE_START]         = { .type = NLA_U32 },
6639         [NL80211_ATTR_FREQ_RANGE_END]           = { .type = NLA_U32 },
6640         [NL80211_ATTR_FREQ_RANGE_MAX_BW]        = { .type = NLA_U32 },
6641         [NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]  = { .type = NLA_U32 },
6642         [NL80211_ATTR_POWER_RULE_MAX_EIRP]      = { .type = NLA_U32 },
6643         [NL80211_ATTR_DFS_CAC_TIME]             = { .type = NLA_U32 },
6644 };
6645
6646 static int parse_reg_rule(struct nlattr *tb[],
6647         struct ieee80211_reg_rule *reg_rule)
6648 {
6649         struct ieee80211_freq_range *freq_range = &reg_rule->freq_range;
6650         struct ieee80211_power_rule *power_rule = &reg_rule->power_rule;
6651
6652         if (!tb[NL80211_ATTR_REG_RULE_FLAGS])
6653                 return -EINVAL;
6654         if (!tb[NL80211_ATTR_FREQ_RANGE_START])
6655                 return -EINVAL;
6656         if (!tb[NL80211_ATTR_FREQ_RANGE_END])
6657                 return -EINVAL;
6658         if (!tb[NL80211_ATTR_FREQ_RANGE_MAX_BW])
6659                 return -EINVAL;
6660         if (!tb[NL80211_ATTR_POWER_RULE_MAX_EIRP])
6661                 return -EINVAL;
6662
6663         reg_rule->flags = nla_get_u32(tb[NL80211_ATTR_REG_RULE_FLAGS]);
6664
6665         freq_range->start_freq_khz =
6666                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_START]);
6667         freq_range->end_freq_khz =
6668                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_END]);
6669         freq_range->max_bandwidth_khz =
6670                 nla_get_u32(tb[NL80211_ATTR_FREQ_RANGE_MAX_BW]);
6671
6672         power_rule->max_eirp =
6673                 nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_EIRP]);
6674
6675         if (tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN])
6676                 power_rule->max_antenna_gain =
6677                         nla_get_u32(tb[NL80211_ATTR_POWER_RULE_MAX_ANT_GAIN]);
6678
6679         if (tb[NL80211_ATTR_DFS_CAC_TIME])
6680                 reg_rule->dfs_cac_ms =
6681                         nla_get_u32(tb[NL80211_ATTR_DFS_CAC_TIME]);
6682
6683         return 0;
6684 }
6685
6686 static int nl80211_set_reg(struct sk_buff *skb, struct genl_info *info)
6687 {
6688         struct nlattr *tb[NL80211_REG_RULE_ATTR_MAX + 1];
6689         struct nlattr *nl_reg_rule;
6690         char *alpha2;
6691         int rem_reg_rules, r;
6692         u32 num_rules = 0, rule_idx = 0, size_of_regd;
6693         enum nl80211_dfs_regions dfs_region = NL80211_DFS_UNSET;
6694         struct ieee80211_regdomain *rd;
6695
6696         if (!info->attrs[NL80211_ATTR_REG_ALPHA2])
6697                 return -EINVAL;
6698
6699         if (!info->attrs[NL80211_ATTR_REG_RULES])
6700                 return -EINVAL;
6701
6702         alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]);
6703
6704         if (info->attrs[NL80211_ATTR_DFS_REGION])
6705                 dfs_region = nla_get_u8(info->attrs[NL80211_ATTR_DFS_REGION]);
6706
6707         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6708                             rem_reg_rules) {
6709                 num_rules++;
6710                 if (num_rules > NL80211_MAX_SUPP_REG_RULES)
6711                         return -EINVAL;
6712         }
6713
6714         if (!reg_is_valid_request(alpha2))
6715                 return -EINVAL;
6716
6717         size_of_regd = sizeof(struct ieee80211_regdomain) +
6718                        num_rules * sizeof(struct ieee80211_reg_rule);
6719
6720         rd = kzalloc(size_of_regd, GFP_KERNEL);
6721         if (!rd)
6722                 return -ENOMEM;
6723
6724         rd->n_reg_rules = num_rules;
6725         rd->alpha2[0] = alpha2[0];
6726         rd->alpha2[1] = alpha2[1];
6727
6728         /*
6729          * Disable DFS master mode if the DFS region was
6730          * not supported or known on this kernel.
6731          */
6732         if (reg_supported_dfs_region(dfs_region))
6733                 rd->dfs_region = dfs_region;
6734
6735         nla_for_each_nested(nl_reg_rule, info->attrs[NL80211_ATTR_REG_RULES],
6736                             rem_reg_rules) {
6737                 r = nla_parse_nested(tb, NL80211_REG_RULE_ATTR_MAX,
6738                                      nl_reg_rule, reg_rule_policy,
6739                                      info->extack);
6740                 if (r)
6741                         goto bad_reg;
6742                 r = parse_reg_rule(tb, &rd->reg_rules[rule_idx]);
6743                 if (r)
6744                         goto bad_reg;
6745
6746                 rule_idx++;
6747
6748                 if (rule_idx > NL80211_MAX_SUPP_REG_RULES) {
6749                         r = -EINVAL;
6750                         goto bad_reg;
6751                 }
6752         }
6753
6754         /* set_regdom takes ownership of rd */
6755         return set_regdom(rd, REGD_SOURCE_CRDA);
6756  bad_reg:
6757         kfree(rd);
6758         return r;
6759 }
6760 #endif /* CONFIG_CFG80211_CRDA_SUPPORT */
6761
6762 static int validate_scan_freqs(struct nlattr *freqs)
6763 {
6764         struct nlattr *attr1, *attr2;
6765         int n_channels = 0, tmp1, tmp2;
6766
6767         nla_for_each_nested(attr1, freqs, tmp1)
6768                 if (nla_len(attr1) != sizeof(u32))
6769                         return 0;
6770
6771         nla_for_each_nested(attr1, freqs, tmp1) {
6772                 n_channels++;
6773                 /*
6774                  * Some hardware has a limited channel list for
6775                  * scanning, and it is pretty much nonsensical
6776                  * to scan for a channel twice, so disallow that
6777                  * and don't require drivers to check that the
6778                  * channel list they get isn't longer than what
6779                  * they can scan, as long as they can scan all
6780                  * the channels they registered at once.
6781                  */
6782                 nla_for_each_nested(attr2, freqs, tmp2)
6783                         if (attr1 != attr2 &&
6784                             nla_get_u32(attr1) == nla_get_u32(attr2))
6785                                 return 0;
6786         }
6787
6788         return n_channels;
6789 }
6790
6791 static bool is_band_valid(struct wiphy *wiphy, enum nl80211_band b)
6792 {
6793         return b < NUM_NL80211_BANDS && wiphy->bands[b];
6794 }
6795
6796 static int parse_bss_select(struct nlattr *nla, struct wiphy *wiphy,
6797                             struct cfg80211_bss_selection *bss_select)
6798 {
6799         struct nlattr *attr[NL80211_BSS_SELECT_ATTR_MAX + 1];
6800         struct nlattr *nest;
6801         int err;
6802         bool found = false;
6803         int i;
6804
6805         /* only process one nested attribute */
6806         nest = nla_data(nla);
6807         if (!nla_ok(nest, nla_len(nest)))
6808                 return -EINVAL;
6809
6810         err = nla_parse_nested(attr, NL80211_BSS_SELECT_ATTR_MAX, nest,
6811                                nl80211_bss_select_policy, NULL);
6812         if (err)
6813                 return err;
6814
6815         /* only one attribute may be given */
6816         for (i = 0; i <= NL80211_BSS_SELECT_ATTR_MAX; i++) {
6817                 if (attr[i]) {
6818                         if (found)
6819                                 return -EINVAL;
6820                         found = true;
6821                 }
6822         }
6823
6824         bss_select->behaviour = __NL80211_BSS_SELECT_ATTR_INVALID;
6825
6826         if (attr[NL80211_BSS_SELECT_ATTR_RSSI])
6827                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI;
6828
6829         if (attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]) {
6830                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_BAND_PREF;
6831                 bss_select->param.band_pref =
6832                         nla_get_u32(attr[NL80211_BSS_SELECT_ATTR_BAND_PREF]);
6833                 if (!is_band_valid(wiphy, bss_select->param.band_pref))
6834                         return -EINVAL;
6835         }
6836
6837         if (attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]) {
6838                 struct nl80211_bss_select_rssi_adjust *adj_param;
6839
6840                 adj_param = nla_data(attr[NL80211_BSS_SELECT_ATTR_RSSI_ADJUST]);
6841                 bss_select->behaviour = NL80211_BSS_SELECT_ATTR_RSSI_ADJUST;
6842                 bss_select->param.adjust.band = adj_param->band;
6843                 bss_select->param.adjust.delta = adj_param->delta;
6844                 if (!is_band_valid(wiphy, bss_select->param.adjust.band))
6845                         return -EINVAL;
6846         }
6847
6848         /* user-space did not provide behaviour attribute */
6849         if (bss_select->behaviour == __NL80211_BSS_SELECT_ATTR_INVALID)
6850                 return -EINVAL;
6851
6852         if (!(wiphy->bss_select_support & BIT(bss_select->behaviour)))
6853                 return -EINVAL;
6854
6855         return 0;
6856 }
6857
6858 static int nl80211_parse_random_mac(struct nlattr **attrs,
6859                                     u8 *mac_addr, u8 *mac_addr_mask)
6860 {
6861         int i;
6862
6863         if (!attrs[NL80211_ATTR_MAC] && !attrs[NL80211_ATTR_MAC_MASK]) {
6864                 eth_zero_addr(mac_addr);
6865                 eth_zero_addr(mac_addr_mask);
6866                 mac_addr[0] = 0x2;
6867                 mac_addr_mask[0] = 0x3;
6868
6869                 return 0;
6870         }
6871
6872         /* need both or none */
6873         if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_MAC_MASK])
6874                 return -EINVAL;
6875
6876         memcpy(mac_addr, nla_data(attrs[NL80211_ATTR_MAC]), ETH_ALEN);
6877         memcpy(mac_addr_mask, nla_data(attrs[NL80211_ATTR_MAC_MASK]), ETH_ALEN);
6878
6879         /* don't allow or configure an mcast address */
6880         if (!is_multicast_ether_addr(mac_addr_mask) ||
6881             is_multicast_ether_addr(mac_addr))
6882                 return -EINVAL;
6883
6884         /*
6885          * allow users to pass a MAC address that has bits set outside
6886          * of the mask, but don't bother drivers with having to deal
6887          * with such bits
6888          */
6889         for (i = 0; i < ETH_ALEN; i++)
6890                 mac_addr[i] &= mac_addr_mask[i];
6891
6892         return 0;
6893 }
6894
6895 static bool cfg80211_off_channel_oper_allowed(struct wireless_dev *wdev)
6896 {
6897         ASSERT_WDEV_LOCK(wdev);
6898
6899         if (!cfg80211_beaconing_iface_active(wdev))
6900                 return true;
6901
6902         if (!(wdev->chandef.chan->flags & IEEE80211_CHAN_RADAR))
6903                 return true;
6904
6905         return regulatory_pre_cac_allowed(wdev->wiphy);
6906 }
6907
6908 static bool nl80211_check_scan_feat(struct wiphy *wiphy, u32 flags, u32 flag,
6909                                     enum nl80211_ext_feature_index feat)
6910 {
6911         if (!(flags & flag))
6912                 return true;
6913         if (wiphy_ext_feature_isset(wiphy, feat))
6914                 return true;
6915         return false;
6916 }
6917
6918 static int
6919 nl80211_check_scan_flags(struct wiphy *wiphy, struct wireless_dev *wdev,
6920                          void *request, struct nlattr **attrs,
6921                          bool is_sched_scan)
6922 {
6923         u8 *mac_addr, *mac_addr_mask;
6924         u32 *flags;
6925         enum nl80211_feature_flags randomness_flag;
6926
6927         if (!attrs[NL80211_ATTR_SCAN_FLAGS])
6928                 return 0;
6929
6930         if (is_sched_scan) {
6931                 struct cfg80211_sched_scan_request *req = request;
6932
6933                 randomness_flag = wdev ?
6934                                   NL80211_FEATURE_SCHED_SCAN_RANDOM_MAC_ADDR :
6935                                   NL80211_FEATURE_ND_RANDOM_MAC_ADDR;
6936                 flags = &req->flags;
6937                 mac_addr = req->mac_addr;
6938                 mac_addr_mask = req->mac_addr_mask;
6939         } else {
6940                 struct cfg80211_scan_request *req = request;
6941
6942                 randomness_flag = NL80211_FEATURE_SCAN_RANDOM_MAC_ADDR;
6943                 flags = &req->flags;
6944                 mac_addr = req->mac_addr;
6945                 mac_addr_mask = req->mac_addr_mask;
6946         }
6947
6948         *flags = nla_get_u32(attrs[NL80211_ATTR_SCAN_FLAGS]);
6949
6950         if (((*flags & NL80211_SCAN_FLAG_LOW_PRIORITY) &&
6951              !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) ||
6952             !nl80211_check_scan_feat(wiphy, *flags,
6953                                      NL80211_SCAN_FLAG_LOW_SPAN,
6954                                      NL80211_EXT_FEATURE_LOW_SPAN_SCAN) ||
6955             !nl80211_check_scan_feat(wiphy, *flags,
6956                                      NL80211_SCAN_FLAG_LOW_POWER,
6957                                      NL80211_EXT_FEATURE_LOW_POWER_SCAN) ||
6958             !nl80211_check_scan_feat(wiphy, *flags,
6959                                      NL80211_SCAN_FLAG_HIGH_ACCURACY,
6960                                      NL80211_EXT_FEATURE_HIGH_ACCURACY_SCAN) ||
6961             !nl80211_check_scan_feat(wiphy, *flags,
6962                                      NL80211_SCAN_FLAG_FILS_MAX_CHANNEL_TIME,
6963                                      NL80211_EXT_FEATURE_FILS_MAX_CHANNEL_TIME) ||
6964             !nl80211_check_scan_feat(wiphy, *flags,
6965                                      NL80211_SCAN_FLAG_ACCEPT_BCAST_PROBE_RESP,
6966                                      NL80211_EXT_FEATURE_ACCEPT_BCAST_PROBE_RESP) ||
6967             !nl80211_check_scan_feat(wiphy, *flags,
6968                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION,
6969                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_DEFERRAL_SUPPRESSION) ||
6970             !nl80211_check_scan_feat(wiphy, *flags,
6971                                      NL80211_SCAN_FLAG_OCE_PROBE_REQ_HIGH_TX_RATE,
6972                                      NL80211_EXT_FEATURE_OCE_PROBE_REQ_HIGH_TX_RATE) ||
6973             !nl80211_check_scan_feat(wiphy, *flags,
6974                                      NL80211_SCAN_FLAG_RANDOM_SN,
6975                                      NL80211_EXT_FEATURE_SCAN_RANDOM_SN) ||
6976             !nl80211_check_scan_feat(wiphy, *flags,
6977                                      NL80211_SCAN_FLAG_MIN_PREQ_CONTENT,
6978                                      NL80211_EXT_FEATURE_SCAN_MIN_PREQ_CONTENT))
6979                 return -EOPNOTSUPP;
6980
6981         if (*flags & NL80211_SCAN_FLAG_RANDOM_ADDR) {
6982                 int err;
6983
6984                 if (!(wiphy->features & randomness_flag) ||
6985                     (wdev && wdev->current_bss))
6986                         return -EOPNOTSUPP;
6987
6988                 err = nl80211_parse_random_mac(attrs, mac_addr, mac_addr_mask);
6989                 if (err)
6990                         return err;
6991         }
6992
6993         return 0;
6994 }
6995
6996 static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info)
6997 {
6998         struct cfg80211_registered_device *rdev = info->user_ptr[0];
6999         struct wireless_dev *wdev = info->user_ptr[1];
7000         struct cfg80211_scan_request *request;
7001         struct nlattr *attr;
7002         struct wiphy *wiphy;
7003         int err, tmp, n_ssids = 0, n_channels, i;
7004         size_t ie_len;
7005
7006         wiphy = &rdev->wiphy;
7007
7008         if (wdev->iftype == NL80211_IFTYPE_NAN)
7009                 return -EOPNOTSUPP;
7010
7011         if (!rdev->ops->scan)
7012                 return -EOPNOTSUPP;
7013
7014         if (rdev->scan_req || rdev->scan_msg) {
7015                 err = -EBUSY;
7016                 goto unlock;
7017         }
7018
7019         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7020                 n_channels = validate_scan_freqs(
7021                                 info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7022                 if (!n_channels) {
7023                         err = -EINVAL;
7024                         goto unlock;
7025                 }
7026         } else {
7027                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7028         }
7029
7030         if (info->attrs[NL80211_ATTR_SCAN_SSIDS])
7031                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp)
7032                         n_ssids++;
7033
7034         if (n_ssids > wiphy->max_scan_ssids) {
7035                 err = -EINVAL;
7036                 goto unlock;
7037         }
7038
7039         if (info->attrs[NL80211_ATTR_IE])
7040                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7041         else
7042                 ie_len = 0;
7043
7044         if (ie_len > wiphy->max_scan_ie_len) {
7045                 err = -EINVAL;
7046                 goto unlock;
7047         }
7048
7049         request = kzalloc(sizeof(*request)
7050                         + sizeof(*request->ssids) * n_ssids
7051                         + sizeof(*request->channels) * n_channels
7052                         + ie_len, GFP_KERNEL);
7053         if (!request) {
7054                 err = -ENOMEM;
7055                 goto unlock;
7056         }
7057
7058         if (n_ssids)
7059                 request->ssids = (void *)&request->channels[n_channels];
7060         request->n_ssids = n_ssids;
7061         if (ie_len) {
7062                 if (n_ssids)
7063                         request->ie = (void *)(request->ssids + n_ssids);
7064                 else
7065                         request->ie = (void *)(request->channels + n_channels);
7066         }
7067
7068         i = 0;
7069         if (info->attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7070                 /* user specified, bail out if channel not found */
7071                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_FREQUENCIES], tmp) {
7072                         struct ieee80211_channel *chan;
7073
7074                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7075
7076                         if (!chan) {
7077                                 err = -EINVAL;
7078                                 goto out_free;
7079                         }
7080
7081                         /* ignore disabled channels */
7082                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7083                                 continue;
7084
7085                         request->channels[i] = chan;
7086                         i++;
7087                 }
7088         } else {
7089                 enum nl80211_band band;
7090
7091                 /* all channels */
7092                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7093                         int j;
7094
7095                         if (!wiphy->bands[band])
7096                                 continue;
7097                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7098                                 struct ieee80211_channel *chan;
7099
7100                                 chan = &wiphy->bands[band]->channels[j];
7101
7102                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7103                                         continue;
7104
7105                                 request->channels[i] = chan;
7106                                 i++;
7107                         }
7108                 }
7109         }
7110
7111         if (!i) {
7112                 err = -EINVAL;
7113                 goto out_free;
7114         }
7115
7116         request->n_channels = i;
7117
7118         wdev_lock(wdev);
7119         if (!cfg80211_off_channel_oper_allowed(wdev)) {
7120                 struct ieee80211_channel *chan;
7121
7122                 if (request->n_channels != 1) {
7123                         wdev_unlock(wdev);
7124                         err = -EBUSY;
7125                         goto out_free;
7126                 }
7127
7128                 chan = request->channels[0];
7129                 if (chan->center_freq != wdev->chandef.chan->center_freq) {
7130                         wdev_unlock(wdev);
7131                         err = -EBUSY;
7132                         goto out_free;
7133                 }
7134         }
7135         wdev_unlock(wdev);
7136
7137         i = 0;
7138         if (n_ssids) {
7139                 nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) {
7140                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7141                                 err = -EINVAL;
7142                                 goto out_free;
7143                         }
7144                         request->ssids[i].ssid_len = nla_len(attr);
7145                         memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr));
7146                         i++;
7147                 }
7148         }
7149
7150         if (info->attrs[NL80211_ATTR_IE]) {
7151                 request->ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
7152                 memcpy((void *)request->ie,
7153                        nla_data(info->attrs[NL80211_ATTR_IE]),
7154                        request->ie_len);
7155         }
7156
7157         for (i = 0; i < NUM_NL80211_BANDS; i++)
7158                 if (wiphy->bands[i])
7159                         request->rates[i] =
7160                                 (1 << wiphy->bands[i]->n_bitrates) - 1;
7161
7162         if (info->attrs[NL80211_ATTR_SCAN_SUPP_RATES]) {
7163                 nla_for_each_nested(attr,
7164                                     info->attrs[NL80211_ATTR_SCAN_SUPP_RATES],
7165                                     tmp) {
7166                         enum nl80211_band band = nla_type(attr);
7167
7168                         if (band < 0 || band >= NUM_NL80211_BANDS) {
7169                                 err = -EINVAL;
7170                                 goto out_free;
7171                         }
7172
7173                         if (!wiphy->bands[band])
7174                                 continue;
7175
7176                         err = ieee80211_get_ratemask(wiphy->bands[band],
7177                                                      nla_data(attr),
7178                                                      nla_len(attr),
7179                                                      &request->rates[band]);
7180                         if (err)
7181                                 goto out_free;
7182                 }
7183         }
7184
7185         if (info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]) {
7186                 if (!wiphy_ext_feature_isset(wiphy,
7187                                         NL80211_EXT_FEATURE_SET_SCAN_DWELL)) {
7188                         err = -EOPNOTSUPP;
7189                         goto out_free;
7190                 }
7191
7192                 request->duration =
7193                         nla_get_u16(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION]);
7194                 request->duration_mandatory =
7195                         nla_get_flag(info->attrs[NL80211_ATTR_MEASUREMENT_DURATION_MANDATORY]);
7196         }
7197
7198         err = nl80211_check_scan_flags(wiphy, wdev, request, info->attrs,
7199                                        false);
7200         if (err)
7201                 goto out_free;
7202
7203         request->no_cck =
7204                 nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
7205
7206         /* Initial implementation used NL80211_ATTR_MAC to set the specific
7207          * BSSID to scan for. This was problematic because that same attribute
7208          * was already used for another purpose (local random MAC address). The
7209          * NL80211_ATTR_BSSID attribute was added to fix this. For backwards
7210          * compatibility with older userspace components, also use the
7211          * NL80211_ATTR_MAC value here if it can be determined to be used for
7212          * the specific BSSID use case instead of the random MAC address
7213          * (NL80211_ATTR_SCAN_FLAGS is used to enable random MAC address use).
7214          */
7215         if (info->attrs[NL80211_ATTR_BSSID])
7216                 memcpy(request->bssid,
7217                        nla_data(info->attrs[NL80211_ATTR_BSSID]), ETH_ALEN);
7218         else if (!(request->flags & NL80211_SCAN_FLAG_RANDOM_ADDR) &&
7219                  info->attrs[NL80211_ATTR_MAC])
7220                 memcpy(request->bssid, nla_data(info->attrs[NL80211_ATTR_MAC]),
7221                        ETH_ALEN);
7222         else
7223                 eth_broadcast_addr(request->bssid);
7224
7225         request->wdev = wdev;
7226         request->wiphy = &rdev->wiphy;
7227         request->scan_start = jiffies;
7228
7229         rdev->scan_req = request;
7230         err = rdev_scan(rdev, request);
7231
7232         if (!err) {
7233                 nl80211_send_scan_start(rdev, wdev);
7234                 if (wdev->netdev)
7235                         dev_hold(wdev->netdev);
7236         } else {
7237  out_free:
7238                 rdev->scan_req = NULL;
7239                 kfree(request);
7240         }
7241
7242  unlock:
7243         return err;
7244 }
7245
7246 static int nl80211_abort_scan(struct sk_buff *skb, struct genl_info *info)
7247 {
7248         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7249         struct wireless_dev *wdev = info->user_ptr[1];
7250
7251         if (!rdev->ops->abort_scan)
7252                 return -EOPNOTSUPP;
7253
7254         if (rdev->scan_msg)
7255                 return 0;
7256
7257         if (!rdev->scan_req)
7258                 return -ENOENT;
7259
7260         rdev_abort_scan(rdev, wdev);
7261         return 0;
7262 }
7263
7264 static int
7265 nl80211_parse_sched_scan_plans(struct wiphy *wiphy, int n_plans,
7266                                struct cfg80211_sched_scan_request *request,
7267                                struct nlattr **attrs)
7268 {
7269         int tmp, err, i = 0;
7270         struct nlattr *attr;
7271
7272         if (!attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7273                 u32 interval;
7274
7275                 /*
7276                  * If scan plans are not specified,
7277                  * %NL80211_ATTR_SCHED_SCAN_INTERVAL will be specified. In this
7278                  * case one scan plan will be set with the specified scan
7279                  * interval and infinite number of iterations.
7280                  */
7281                 interval = nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL]);
7282                 if (!interval)
7283                         return -EINVAL;
7284
7285                 request->scan_plans[0].interval =
7286                         DIV_ROUND_UP(interval, MSEC_PER_SEC);
7287                 if (!request->scan_plans[0].interval)
7288                         return -EINVAL;
7289
7290                 if (request->scan_plans[0].interval >
7291                     wiphy->max_sched_scan_plan_interval)
7292                         request->scan_plans[0].interval =
7293                                 wiphy->max_sched_scan_plan_interval;
7294
7295                 return 0;
7296         }
7297
7298         nla_for_each_nested(attr, attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp) {
7299                 struct nlattr *plan[NL80211_SCHED_SCAN_PLAN_MAX + 1];
7300
7301                 if (WARN_ON(i >= n_plans))
7302                         return -EINVAL;
7303
7304                 err = nla_parse_nested(plan, NL80211_SCHED_SCAN_PLAN_MAX,
7305                                        attr, nl80211_plan_policy, NULL);
7306                 if (err)
7307                         return err;
7308
7309                 if (!plan[NL80211_SCHED_SCAN_PLAN_INTERVAL])
7310                         return -EINVAL;
7311
7312                 request->scan_plans[i].interval =
7313                         nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_INTERVAL]);
7314                 if (!request->scan_plans[i].interval ||
7315                     request->scan_plans[i].interval >
7316                     wiphy->max_sched_scan_plan_interval)
7317                         return -EINVAL;
7318
7319                 if (plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]) {
7320                         request->scan_plans[i].iterations =
7321                                 nla_get_u32(plan[NL80211_SCHED_SCAN_PLAN_ITERATIONS]);
7322                         if (!request->scan_plans[i].iterations ||
7323                             (request->scan_plans[i].iterations >
7324                              wiphy->max_sched_scan_plan_iterations))
7325                                 return -EINVAL;
7326                 } else if (i < n_plans - 1) {
7327                         /*
7328                          * All scan plans but the last one must specify
7329                          * a finite number of iterations
7330                          */
7331                         return -EINVAL;
7332                 }
7333
7334                 i++;
7335         }
7336
7337         /*
7338          * The last scan plan must not specify the number of
7339          * iterations, it is supposed to run infinitely
7340          */
7341         if (request->scan_plans[n_plans - 1].iterations)
7342                 return  -EINVAL;
7343
7344         return 0;
7345 }
7346
7347 static struct cfg80211_sched_scan_request *
7348 nl80211_parse_sched_scan(struct wiphy *wiphy, struct wireless_dev *wdev,
7349                          struct nlattr **attrs, int max_match_sets)
7350 {
7351         struct cfg80211_sched_scan_request *request;
7352         struct nlattr *attr;
7353         int err, tmp, n_ssids = 0, n_match_sets = 0, n_channels, i, n_plans = 0;
7354         enum nl80211_band band;
7355         size_t ie_len;
7356         struct nlattr *tb[NL80211_SCHED_SCAN_MATCH_ATTR_MAX + 1];
7357         s32 default_match_rssi = NL80211_SCAN_RSSI_THOLD_OFF;
7358
7359         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7360                 n_channels = validate_scan_freqs(
7361                                 attrs[NL80211_ATTR_SCAN_FREQUENCIES]);
7362                 if (!n_channels)
7363                         return ERR_PTR(-EINVAL);
7364         } else {
7365                 n_channels = ieee80211_get_num_supported_channels(wiphy);
7366         }
7367
7368         if (attrs[NL80211_ATTR_SCAN_SSIDS])
7369                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7370                                     tmp)
7371                         n_ssids++;
7372
7373         if (n_ssids > wiphy->max_sched_scan_ssids)
7374                 return ERR_PTR(-EINVAL);
7375
7376         /*
7377          * First, count the number of 'real' matchsets. Due to an issue with
7378          * the old implementation, matchsets containing only the RSSI attribute
7379          * (NL80211_SCHED_SCAN_MATCH_ATTR_RSSI) are considered as the 'default'
7380          * RSSI for all matchsets, rather than their own matchset for reporting
7381          * all APs with a strong RSSI. This is needed to be compatible with
7382          * older userspace that treated a matchset with only the RSSI as the
7383          * global RSSI for all other matchsets - if there are other matchsets.
7384          */
7385         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7386                 nla_for_each_nested(attr,
7387                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7388                                     tmp) {
7389                         struct nlattr *rssi;
7390
7391                         err = nla_parse_nested(tb,
7392                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7393                                                attr, nl80211_match_policy,
7394                                                NULL);
7395                         if (err)
7396                                 return ERR_PTR(err);
7397
7398                         /* SSID and BSSID are mutually exclusive */
7399                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] &&
7400                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID])
7401                                 return ERR_PTR(-EINVAL);
7402
7403                         /* add other standalone attributes here */
7404                         if (tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID] ||
7405                             tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID]) {
7406                                 n_match_sets++;
7407                                 continue;
7408                         }
7409                         rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7410                         if (rssi)
7411                                 default_match_rssi = nla_get_s32(rssi);
7412                 }
7413         }
7414
7415         /* However, if there's no other matchset, add the RSSI one */
7416         if (!n_match_sets && default_match_rssi != NL80211_SCAN_RSSI_THOLD_OFF)
7417                 n_match_sets = 1;
7418
7419         if (n_match_sets > max_match_sets)
7420                 return ERR_PTR(-EINVAL);
7421
7422         if (attrs[NL80211_ATTR_IE])
7423                 ie_len = nla_len(attrs[NL80211_ATTR_IE]);
7424         else
7425                 ie_len = 0;
7426
7427         if (ie_len > wiphy->max_sched_scan_ie_len)
7428                 return ERR_PTR(-EINVAL);
7429
7430         if (attrs[NL80211_ATTR_SCHED_SCAN_PLANS]) {
7431                 /*
7432                  * NL80211_ATTR_SCHED_SCAN_INTERVAL must not be specified since
7433                  * each scan plan already specifies its own interval
7434                  */
7435                 if (attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7436                         return ERR_PTR(-EINVAL);
7437
7438                 nla_for_each_nested(attr,
7439                                     attrs[NL80211_ATTR_SCHED_SCAN_PLANS], tmp)
7440                         n_plans++;
7441         } else {
7442                 /*
7443                  * The scan interval attribute is kept for backward
7444                  * compatibility. If no scan plans are specified and sched scan
7445                  * interval is specified, one scan plan will be set with this
7446                  * scan interval and infinite number of iterations.
7447                  */
7448                 if (!attrs[NL80211_ATTR_SCHED_SCAN_INTERVAL])
7449                         return ERR_PTR(-EINVAL);
7450
7451                 n_plans = 1;
7452         }
7453
7454         if (!n_plans || n_plans > wiphy->max_sched_scan_plans)
7455                 return ERR_PTR(-EINVAL);
7456
7457         if (!wiphy_ext_feature_isset(
7458                     wiphy, NL80211_EXT_FEATURE_SCHED_SCAN_RELATIVE_RSSI) &&
7459             (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI] ||
7460              attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]))
7461                 return ERR_PTR(-EINVAL);
7462
7463         request = kzalloc(sizeof(*request)
7464                         + sizeof(*request->ssids) * n_ssids
7465                         + sizeof(*request->match_sets) * n_match_sets
7466                         + sizeof(*request->scan_plans) * n_plans
7467                         + sizeof(*request->channels) * n_channels
7468                         + ie_len, GFP_KERNEL);
7469         if (!request)
7470                 return ERR_PTR(-ENOMEM);
7471
7472         if (n_ssids)
7473                 request->ssids = (void *)&request->channels[n_channels];
7474         request->n_ssids = n_ssids;
7475         if (ie_len) {
7476                 if (n_ssids)
7477                         request->ie = (void *)(request->ssids + n_ssids);
7478                 else
7479                         request->ie = (void *)(request->channels + n_channels);
7480         }
7481
7482         if (n_match_sets) {
7483                 if (request->ie)
7484                         request->match_sets = (void *)(request->ie + ie_len);
7485                 else if (n_ssids)
7486                         request->match_sets =
7487                                 (void *)(request->ssids + n_ssids);
7488                 else
7489                         request->match_sets =
7490                                 (void *)(request->channels + n_channels);
7491         }
7492         request->n_match_sets = n_match_sets;
7493
7494         if (n_match_sets)
7495                 request->scan_plans = (void *)(request->match_sets +
7496                                                n_match_sets);
7497         else if (request->ie)
7498                 request->scan_plans = (void *)(request->ie + ie_len);
7499         else if (n_ssids)
7500                 request->scan_plans = (void *)(request->ssids + n_ssids);
7501         else
7502                 request->scan_plans = (void *)(request->channels + n_channels);
7503
7504         request->n_scan_plans = n_plans;
7505
7506         i = 0;
7507         if (attrs[NL80211_ATTR_SCAN_FREQUENCIES]) {
7508                 /* user specified, bail out if channel not found */
7509                 nla_for_each_nested(attr,
7510                                     attrs[NL80211_ATTR_SCAN_FREQUENCIES],
7511                                     tmp) {
7512                         struct ieee80211_channel *chan;
7513
7514                         chan = ieee80211_get_channel(wiphy, nla_get_u32(attr));
7515
7516                         if (!chan) {
7517                                 err = -EINVAL;
7518                                 goto out_free;
7519                         }
7520
7521                         /* ignore disabled channels */
7522                         if (chan->flags & IEEE80211_CHAN_DISABLED)
7523                                 continue;
7524
7525                         request->channels[i] = chan;
7526                         i++;
7527                 }
7528         } else {
7529                 /* all channels */
7530                 for (band = 0; band < NUM_NL80211_BANDS; band++) {
7531                         int j;
7532
7533                         if (!wiphy->bands[band])
7534                                 continue;
7535                         for (j = 0; j < wiphy->bands[band]->n_channels; j++) {
7536                                 struct ieee80211_channel *chan;
7537
7538                                 chan = &wiphy->bands[band]->channels[j];
7539
7540                                 if (chan->flags & IEEE80211_CHAN_DISABLED)
7541                                         continue;
7542
7543                                 request->channels[i] = chan;
7544                                 i++;
7545                         }
7546                 }
7547         }
7548
7549         if (!i) {
7550                 err = -EINVAL;
7551                 goto out_free;
7552         }
7553
7554         request->n_channels = i;
7555
7556         i = 0;
7557         if (n_ssids) {
7558                 nla_for_each_nested(attr, attrs[NL80211_ATTR_SCAN_SSIDS],
7559                                     tmp) {
7560                         if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) {
7561                                 err = -EINVAL;
7562                                 goto out_free;
7563                         }
7564                         request->ssids[i].ssid_len = nla_len(attr);
7565                         memcpy(request->ssids[i].ssid, nla_data(attr),
7566                                nla_len(attr));
7567                         i++;
7568                 }
7569         }
7570
7571         i = 0;
7572         if (attrs[NL80211_ATTR_SCHED_SCAN_MATCH]) {
7573                 nla_for_each_nested(attr,
7574                                     attrs[NL80211_ATTR_SCHED_SCAN_MATCH],
7575                                     tmp) {
7576                         struct nlattr *ssid, *bssid, *rssi;
7577
7578                         err = nla_parse_nested(tb,
7579                                                NL80211_SCHED_SCAN_MATCH_ATTR_MAX,
7580                                                attr, nl80211_match_policy,
7581                                                NULL);
7582                         if (err)
7583                                 goto out_free;
7584                         ssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_SSID];
7585                         bssid = tb[NL80211_SCHED_SCAN_MATCH_ATTR_BSSID];
7586                         if (ssid || bssid) {
7587                                 if (WARN_ON(i >= n_match_sets)) {
7588                                         /* this indicates a programming error,
7589                                          * the loop above should have verified
7590                                          * things properly
7591                                          */
7592                                         err = -EINVAL;
7593                                         goto out_free;
7594                                 }
7595
7596                                 if (ssid) {
7597                                         if (nla_len(ssid) > IEEE80211_MAX_SSID_LEN) {
7598                                                 err = -EINVAL;
7599                                                 goto out_free;
7600                                         }
7601                                         memcpy(request->match_sets[i].ssid.ssid,
7602                                                nla_data(ssid), nla_len(ssid));
7603                                         request->match_sets[i].ssid.ssid_len =
7604                                                 nla_len(ssid);
7605                                 }
7606                                 if (bssid) {
7607                                         if (nla_len(bssid) != ETH_ALEN) {
7608                                                 err = -EINVAL;
7609                                                 goto out_free;
7610                                         }
7611                                         memcpy(request->match_sets[i].bssid,
7612                                                nla_data(bssid), ETH_ALEN);
7613                                 }
7614
7615                                 /* special attribute - old implementation w/a */
7616                                 request->match_sets[i].rssi_thold =
7617                                         default_match_rssi;
7618                                 rssi = tb[NL80211_SCHED_SCAN_MATCH_ATTR_RSSI];
7619                                 if (rssi)
7620                                         request->match_sets[i].rssi_thold =
7621                                                 nla_get_s32(rssi);
7622                         }
7623                         i++;
7624                 }
7625
7626                 /* there was no other matchset, so the RSSI one is alone */
7627                 if (i == 0 && n_match_sets)
7628                         request->match_sets[0].rssi_thold = default_match_rssi;
7629
7630                 request->min_rssi_thold = INT_MAX;
7631                 for (i = 0; i < n_match_sets; i++)
7632                         request->min_rssi_thold =
7633                                 min(request->match_sets[i].rssi_thold,
7634                                     request->min_rssi_thold);
7635         } else {
7636                 request->min_rssi_thold = NL80211_SCAN_RSSI_THOLD_OFF;
7637         }
7638
7639         if (ie_len) {
7640                 request->ie_len = ie_len;
7641                 memcpy((void *)request->ie,
7642                        nla_data(attrs[NL80211_ATTR_IE]),
7643                        request->ie_len);
7644         }
7645
7646         err = nl80211_check_scan_flags(wiphy, wdev, request, attrs, true);
7647         if (err)
7648                 goto out_free;
7649
7650         if (attrs[NL80211_ATTR_SCHED_SCAN_DELAY])
7651                 request->delay =
7652                         nla_get_u32(attrs[NL80211_ATTR_SCHED_SCAN_DELAY]);
7653
7654         if (attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]) {
7655                 request->relative_rssi = nla_get_s8(
7656                         attrs[NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI]);
7657                 request->relative_rssi_set = true;
7658         }
7659
7660         if (request->relative_rssi_set &&
7661             attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]) {
7662                 struct nl80211_bss_select_rssi_adjust *rssi_adjust;
7663
7664                 rssi_adjust = nla_data(
7665                         attrs[NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST]);
7666                 request->rssi_adjust.band = rssi_adjust->band;
7667                 request->rssi_adjust.delta = rssi_adjust->delta;
7668                 if (!is_band_valid(wiphy, request->rssi_adjust.band)) {
7669                         err = -EINVAL;
7670                         goto out_free;
7671                 }
7672         }
7673
7674         err = nl80211_parse_sched_scan_plans(wiphy, n_plans, request, attrs);
7675         if (err)
7676                 goto out_free;
7677
7678         request->scan_start = jiffies;
7679
7680         return request;
7681
7682 out_free:
7683         kfree(request);
7684         return ERR_PTR(err);
7685 }
7686
7687 static int nl80211_start_sched_scan(struct sk_buff *skb,
7688                                     struct genl_info *info)
7689 {
7690         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7691         struct net_device *dev = info->user_ptr[1];
7692         struct wireless_dev *wdev = dev->ieee80211_ptr;
7693         struct cfg80211_sched_scan_request *sched_scan_req;
7694         bool want_multi;
7695         int err;
7696
7697         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_start)
7698                 return -EOPNOTSUPP;
7699
7700         want_multi = info->attrs[NL80211_ATTR_SCHED_SCAN_MULTI];
7701         err = cfg80211_sched_scan_req_possible(rdev, want_multi);
7702         if (err)
7703                 return err;
7704
7705         sched_scan_req = nl80211_parse_sched_scan(&rdev->wiphy, wdev,
7706                                                   info->attrs,
7707                                                   rdev->wiphy.max_match_sets);
7708
7709         err = PTR_ERR_OR_ZERO(sched_scan_req);
7710         if (err)
7711                 goto out_err;
7712
7713         /* leave request id zero for legacy request
7714          * or if driver does not support multi-scheduled scan
7715          */
7716         if (want_multi && rdev->wiphy.max_sched_scan_reqs > 1) {
7717                 while (!sched_scan_req->reqid)
7718                         sched_scan_req->reqid = cfg80211_assign_cookie(rdev);
7719         }
7720
7721         err = rdev_sched_scan_start(rdev, dev, sched_scan_req);
7722         if (err)
7723                 goto out_free;
7724
7725         sched_scan_req->dev = dev;
7726         sched_scan_req->wiphy = &rdev->wiphy;
7727
7728         if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
7729                 sched_scan_req->owner_nlportid = info->snd_portid;
7730
7731         cfg80211_add_sched_scan_req(rdev, sched_scan_req);
7732
7733         nl80211_send_sched_scan(sched_scan_req, NL80211_CMD_START_SCHED_SCAN);
7734         return 0;
7735
7736 out_free:
7737         kfree(sched_scan_req);
7738 out_err:
7739         return err;
7740 }
7741
7742 static int nl80211_stop_sched_scan(struct sk_buff *skb,
7743                                    struct genl_info *info)
7744 {
7745         struct cfg80211_sched_scan_request *req;
7746         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7747         u64 cookie;
7748
7749         if (!rdev->wiphy.max_sched_scan_reqs || !rdev->ops->sched_scan_stop)
7750                 return -EOPNOTSUPP;
7751
7752         if (info->attrs[NL80211_ATTR_COOKIE]) {
7753                 cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
7754                 return __cfg80211_stop_sched_scan(rdev, cookie, false);
7755         }
7756
7757         req = list_first_or_null_rcu(&rdev->sched_scan_req_list,
7758                                      struct cfg80211_sched_scan_request,
7759                                      list);
7760         if (!req || req->reqid ||
7761             (req->owner_nlportid &&
7762              req->owner_nlportid != info->snd_portid))
7763                 return -ENOENT;
7764
7765         return cfg80211_stop_sched_scan_req(rdev, req, false);
7766 }
7767
7768 static int nl80211_start_radar_detection(struct sk_buff *skb,
7769                                          struct genl_info *info)
7770 {
7771         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7772         struct net_device *dev = info->user_ptr[1];
7773         struct wireless_dev *wdev = dev->ieee80211_ptr;
7774         struct wiphy *wiphy = wdev->wiphy;
7775         struct cfg80211_chan_def chandef;
7776         enum nl80211_dfs_regions dfs_region;
7777         unsigned int cac_time_ms;
7778         int err;
7779
7780         dfs_region = reg_get_dfs_region(wiphy);
7781         if (dfs_region == NL80211_DFS_UNSET)
7782                 return -EINVAL;
7783
7784         err = nl80211_parse_chandef(rdev, info, &chandef);
7785         if (err)
7786                 return err;
7787
7788         if (netif_carrier_ok(dev))
7789                 return -EBUSY;
7790
7791         if (wdev->cac_started)
7792                 return -EBUSY;
7793
7794         err = cfg80211_chandef_dfs_required(wiphy, &chandef, wdev->iftype);
7795         if (err < 0)
7796                 return err;
7797
7798         if (err == 0)
7799                 return -EINVAL;
7800
7801         if (!cfg80211_chandef_dfs_usable(wiphy, &chandef))
7802                 return -EINVAL;
7803
7804         /* CAC start is offloaded to HW and can't be started manually */
7805         if (wiphy_ext_feature_isset(wiphy, NL80211_EXT_FEATURE_DFS_OFFLOAD))
7806                 return -EOPNOTSUPP;
7807
7808         if (!rdev->ops->start_radar_detection)
7809                 return -EOPNOTSUPP;
7810
7811         cac_time_ms = cfg80211_chandef_dfs_cac_time(&rdev->wiphy, &chandef);
7812         if (WARN_ON(!cac_time_ms))
7813                 cac_time_ms = IEEE80211_DFS_MIN_CAC_TIME_MS;
7814
7815         err = rdev_start_radar_detection(rdev, dev, &chandef, cac_time_ms);
7816         if (!err) {
7817                 wdev->chandef = chandef;
7818                 wdev->cac_started = true;
7819                 wdev->cac_start_time = jiffies;
7820                 wdev->cac_time_ms = cac_time_ms;
7821         }
7822         return err;
7823 }
7824
7825 static int nl80211_channel_switch(struct sk_buff *skb, struct genl_info *info)
7826 {
7827         struct cfg80211_registered_device *rdev = info->user_ptr[0];
7828         struct net_device *dev = info->user_ptr[1];
7829         struct wireless_dev *wdev = dev->ieee80211_ptr;
7830         struct cfg80211_csa_settings params;
7831         /* csa_attrs is defined static to avoid waste of stack size - this
7832          * function is called under RTNL lock, so this should not be a problem.
7833          */
7834         static struct nlattr *csa_attrs[NL80211_ATTR_MAX+1];
7835         int err;
7836         bool need_new_beacon = false;
7837         bool need_handle_dfs_flag = true;
7838         int len, i;
7839         u32 cs_count;
7840
7841         if (!rdev->ops->channel_switch ||
7842             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_CHANNEL_SWITCH))
7843                 return -EOPNOTSUPP;
7844
7845         switch (dev->ieee80211_ptr->iftype) {
7846         case NL80211_IFTYPE_AP:
7847         case NL80211_IFTYPE_P2P_GO:
7848                 need_new_beacon = true;
7849                 /* For all modes except AP the handle_dfs flag needs to be
7850                  * supplied to tell the kernel that userspace will handle radar
7851                  * events when they happen. Otherwise a switch to a channel
7852                  * requiring DFS will be rejected.
7853                  */
7854                 need_handle_dfs_flag = false;
7855
7856                 /* useless if AP is not running */
7857                 if (!wdev->beacon_interval)
7858                         return -ENOTCONN;
7859                 break;
7860         case NL80211_IFTYPE_ADHOC:
7861                 if (!wdev->ssid_len)
7862                         return -ENOTCONN;
7863                 break;
7864         case NL80211_IFTYPE_MESH_POINT:
7865                 if (!wdev->mesh_id_len)
7866                         return -ENOTCONN;
7867                 break;
7868         default:
7869                 return -EOPNOTSUPP;
7870         }
7871
7872         memset(&params, 0, sizeof(params));
7873         params.beacon_csa.ftm_responder = -1;
7874
7875         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
7876             !info->attrs[NL80211_ATTR_CH_SWITCH_COUNT])
7877                 return -EINVAL;
7878
7879         /* only important for AP, IBSS and mesh create IEs internally */
7880         if (need_new_beacon && !info->attrs[NL80211_ATTR_CSA_IES])
7881                 return -EINVAL;
7882
7883         /* Even though the attribute is u32, the specification says
7884          * u8, so let's make sure we don't overflow.
7885          */
7886         cs_count = nla_get_u32(info->attrs[NL80211_ATTR_CH_SWITCH_COUNT]);
7887         if (cs_count > 255)
7888                 return -EINVAL;
7889
7890         params.count = cs_count;
7891
7892         if (!need_new_beacon)
7893                 goto skip_beacons;
7894
7895         err = nl80211_parse_beacon(rdev, info->attrs, &params.beacon_after);
7896         if (err)
7897                 return err;
7898
7899         err = nla_parse_nested(csa_attrs, NL80211_ATTR_MAX,
7900                                info->attrs[NL80211_ATTR_CSA_IES],
7901                                nl80211_policy, info->extack);
7902         if (err)
7903                 return err;
7904
7905         err = nl80211_parse_beacon(rdev, csa_attrs, &params.beacon_csa);
7906         if (err)
7907                 return err;
7908
7909         if (!csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON])
7910                 return -EINVAL;
7911
7912         len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7913         if (!len || (len % sizeof(u16)))
7914                 return -EINVAL;
7915
7916         params.n_counter_offsets_beacon = len / sizeof(u16);
7917         if (rdev->wiphy.max_num_csa_counters &&
7918             (params.n_counter_offsets_beacon >
7919              rdev->wiphy.max_num_csa_counters))
7920                 return -EINVAL;
7921
7922         params.counter_offsets_beacon =
7923                 nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_BEACON]);
7924
7925         /* sanity checks - counters should fit and be the same */
7926         for (i = 0; i < params.n_counter_offsets_beacon; i++) {
7927                 u16 offset = params.counter_offsets_beacon[i];
7928
7929                 if (offset >= params.beacon_csa.tail_len)
7930                         return -EINVAL;
7931
7932                 if (params.beacon_csa.tail[offset] != params.count)
7933                         return -EINVAL;
7934         }
7935
7936         if (csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]) {
7937                 len = nla_len(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7938                 if (!len || (len % sizeof(u16)))
7939                         return -EINVAL;
7940
7941                 params.n_counter_offsets_presp = len / sizeof(u16);
7942                 if (rdev->wiphy.max_num_csa_counters &&
7943                     (params.n_counter_offsets_presp >
7944                      rdev->wiphy.max_num_csa_counters))
7945                         return -EINVAL;
7946
7947                 params.counter_offsets_presp =
7948                         nla_data(csa_attrs[NL80211_ATTR_CSA_C_OFF_PRESP]);
7949
7950                 /* sanity checks - counters should fit and be the same */
7951                 for (i = 0; i < params.n_counter_offsets_presp; i++) {
7952                         u16 offset = params.counter_offsets_presp[i];
7953
7954                         if (offset >= params.beacon_csa.probe_resp_len)
7955                                 return -EINVAL;
7956
7957                         if (params.beacon_csa.probe_resp[offset] !=
7958                             params.count)
7959                                 return -EINVAL;
7960                 }
7961         }
7962
7963 skip_beacons:
7964         err = nl80211_parse_chandef(rdev, info, &params.chandef);
7965         if (err)
7966                 return err;
7967
7968         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &params.chandef,
7969                                            wdev->iftype))
7970                 return -EINVAL;
7971
7972         err = cfg80211_chandef_dfs_required(wdev->wiphy,
7973                                             &params.chandef,
7974                                             wdev->iftype);
7975         if (err < 0)
7976                 return err;
7977
7978         if (err > 0) {
7979                 params.radar_required = true;
7980                 if (need_handle_dfs_flag &&
7981                     !nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS])) {
7982                         return -EINVAL;
7983                 }
7984         }
7985
7986         if (info->attrs[NL80211_ATTR_CH_SWITCH_BLOCK_TX])
7987                 params.block_tx = true;
7988
7989         wdev_lock(wdev);
7990         err = rdev_channel_switch(rdev, dev, &params);
7991         wdev_unlock(wdev);
7992
7993         return err;
7994 }
7995
7996 static int nl80211_send_bss(struct sk_buff *msg, struct netlink_callback *cb,
7997                             u32 seq, int flags,
7998                             struct cfg80211_registered_device *rdev,
7999                             struct wireless_dev *wdev,
8000                             struct cfg80211_internal_bss *intbss)
8001 {
8002         struct cfg80211_bss *res = &intbss->pub;
8003         const struct cfg80211_bss_ies *ies;
8004         void *hdr;
8005         struct nlattr *bss;
8006
8007         ASSERT_WDEV_LOCK(wdev);
8008
8009         hdr = nl80211hdr_put(msg, NETLINK_CB(cb->skb).portid, seq, flags,
8010                              NL80211_CMD_NEW_SCAN_RESULTS);
8011         if (!hdr)
8012                 return -1;
8013
8014         genl_dump_check_consistent(cb, hdr);
8015
8016         if (nla_put_u32(msg, NL80211_ATTR_GENERATION, rdev->bss_generation))
8017                 goto nla_put_failure;
8018         if (wdev->netdev &&
8019             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex))
8020                 goto nla_put_failure;
8021         if (nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
8022                               NL80211_ATTR_PAD))
8023                 goto nla_put_failure;
8024
8025         bss = nla_nest_start(msg, NL80211_ATTR_BSS);
8026         if (!bss)
8027                 goto nla_put_failure;
8028         if ((!is_zero_ether_addr(res->bssid) &&
8029              nla_put(msg, NL80211_BSS_BSSID, ETH_ALEN, res->bssid)))
8030                 goto nla_put_failure;
8031
8032         rcu_read_lock();
8033         /* indicate whether we have probe response data or not */
8034         if (rcu_access_pointer(res->proberesp_ies) &&
8035             nla_put_flag(msg, NL80211_BSS_PRESP_DATA))
8036                 goto fail_unlock_rcu;
8037
8038         /* this pointer prefers to be pointed to probe response data
8039          * but is always valid
8040          */
8041         ies = rcu_dereference(res->ies);
8042         if (ies) {
8043                 if (nla_put_u64_64bit(msg, NL80211_BSS_TSF, ies->tsf,
8044                                       NL80211_BSS_PAD))
8045                         goto fail_unlock_rcu;
8046                 if (ies->len && nla_put(msg, NL80211_BSS_INFORMATION_ELEMENTS,
8047                                         ies->len, ies->data))
8048                         goto fail_unlock_rcu;
8049         }
8050
8051         /* and this pointer is always (unless driver didn't know) beacon data */
8052         ies = rcu_dereference(res->beacon_ies);
8053         if (ies && ies->from_beacon) {
8054                 if (nla_put_u64_64bit(msg, NL80211_BSS_BEACON_TSF, ies->tsf,
8055                                       NL80211_BSS_PAD))
8056                         goto fail_unlock_rcu;
8057                 if (ies->len && nla_put(msg, NL80211_BSS_BEACON_IES,
8058                                         ies->len, ies->data))
8059                         goto fail_unlock_rcu;
8060         }
8061         rcu_read_unlock();
8062
8063         if (res->beacon_interval &&
8064             nla_put_u16(msg, NL80211_BSS_BEACON_INTERVAL, res->beacon_interval))
8065                 goto nla_put_failure;
8066         if (nla_put_u16(msg, NL80211_BSS_CAPABILITY, res->capability) ||
8067             nla_put_u32(msg, NL80211_BSS_FREQUENCY, res->channel->center_freq) ||
8068             nla_put_u32(msg, NL80211_BSS_CHAN_WIDTH, res->scan_width) ||
8069             nla_put_u32(msg, NL80211_BSS_SEEN_MS_AGO,
8070                         jiffies_to_msecs(jiffies - intbss->ts)))
8071                 goto nla_put_failure;
8072
8073         if (intbss->parent_tsf &&
8074             (nla_put_u64_64bit(msg, NL80211_BSS_PARENT_TSF,
8075                                intbss->parent_tsf, NL80211_BSS_PAD) ||
8076              nla_put(msg, NL80211_BSS_PARENT_BSSID, ETH_ALEN,
8077                      intbss->parent_bssid)))
8078                 goto nla_put_failure;
8079
8080         if (intbss->ts_boottime &&
8081             nla_put_u64_64bit(msg, NL80211_BSS_LAST_SEEN_BOOTTIME,
8082                               intbss->ts_boottime, NL80211_BSS_PAD))
8083                 goto nla_put_failure;
8084
8085         if (!nl80211_put_signal(msg, intbss->pub.chains,
8086                                 intbss->pub.chain_signal,
8087                                 NL80211_BSS_CHAIN_SIGNAL))
8088                 goto nla_put_failure;
8089
8090         switch (rdev->wiphy.signal_type) {
8091         case CFG80211_SIGNAL_TYPE_MBM:
8092                 if (nla_put_u32(msg, NL80211_BSS_SIGNAL_MBM, res->signal))
8093                         goto nla_put_failure;
8094                 break;
8095         case CFG80211_SIGNAL_TYPE_UNSPEC:
8096                 if (nla_put_u8(msg, NL80211_BSS_SIGNAL_UNSPEC, res->signal))
8097                         goto nla_put_failure;
8098                 break;
8099         default:
8100                 break;
8101         }
8102
8103         switch (wdev->iftype) {
8104         case NL80211_IFTYPE_P2P_CLIENT:
8105         case NL80211_IFTYPE_STATION:
8106                 if (intbss == wdev->current_bss &&
8107                     nla_put_u32(msg, NL80211_BSS_STATUS,
8108                                 NL80211_BSS_STATUS_ASSOCIATED))
8109                         goto nla_put_failure;
8110                 break;
8111         case NL80211_IFTYPE_ADHOC:
8112                 if (intbss == wdev->current_bss &&
8113                     nla_put_u32(msg, NL80211_BSS_STATUS,
8114                                 NL80211_BSS_STATUS_IBSS_JOINED))
8115                         goto nla_put_failure;
8116                 break;
8117         default:
8118                 break;
8119         }
8120
8121         nla_nest_end(msg, bss);
8122
8123         genlmsg_end(msg, hdr);
8124         return 0;
8125
8126  fail_unlock_rcu:
8127         rcu_read_unlock();
8128  nla_put_failure:
8129         genlmsg_cancel(msg, hdr);
8130         return -EMSGSIZE;
8131 }
8132
8133 static int nl80211_dump_scan(struct sk_buff *skb, struct netlink_callback *cb)
8134 {
8135         struct cfg80211_registered_device *rdev;
8136         struct cfg80211_internal_bss *scan;
8137         struct wireless_dev *wdev;
8138         int start = cb->args[2], idx = 0;
8139         int err;
8140
8141         rtnl_lock();
8142         err = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8143         if (err) {
8144                 rtnl_unlock();
8145                 return err;
8146         }
8147
8148         wdev_lock(wdev);
8149         spin_lock_bh(&rdev->bss_lock);
8150
8151         /*
8152          * dump_scan will be called multiple times to break up the scan results
8153          * into multiple messages.  It is unlikely that any more bss-es will be
8154          * expired after the first call, so only call only call this on the
8155          * first dump_scan invocation.
8156          */
8157         if (start == 0)
8158                 cfg80211_bss_expire(rdev);
8159
8160         cb->seq = rdev->bss_generation;
8161
8162         list_for_each_entry(scan, &rdev->bss_list, list) {
8163                 if (++idx <= start)
8164                         continue;
8165                 if (nl80211_send_bss(skb, cb,
8166                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8167                                 rdev, wdev, scan) < 0) {
8168                         idx--;
8169                         break;
8170                 }
8171         }
8172
8173         spin_unlock_bh(&rdev->bss_lock);
8174         wdev_unlock(wdev);
8175
8176         cb->args[2] = idx;
8177         rtnl_unlock();
8178
8179         return skb->len;
8180 }
8181
8182 static int nl80211_send_survey(struct sk_buff *msg, u32 portid, u32 seq,
8183                                int flags, struct net_device *dev,
8184                                bool allow_radio_stats,
8185                                struct survey_info *survey)
8186 {
8187         void *hdr;
8188         struct nlattr *infoattr;
8189
8190         /* skip radio stats if userspace didn't request them */
8191         if (!survey->channel && !allow_radio_stats)
8192                 return 0;
8193
8194         hdr = nl80211hdr_put(msg, portid, seq, flags,
8195                              NL80211_CMD_NEW_SURVEY_RESULTS);
8196         if (!hdr)
8197                 return -ENOMEM;
8198
8199         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
8200                 goto nla_put_failure;
8201
8202         infoattr = nla_nest_start(msg, NL80211_ATTR_SURVEY_INFO);
8203         if (!infoattr)
8204                 goto nla_put_failure;
8205
8206         if (survey->channel &&
8207             nla_put_u32(msg, NL80211_SURVEY_INFO_FREQUENCY,
8208                         survey->channel->center_freq))
8209                 goto nla_put_failure;
8210
8211         if ((survey->filled & SURVEY_INFO_NOISE_DBM) &&
8212             nla_put_u8(msg, NL80211_SURVEY_INFO_NOISE, survey->noise))
8213                 goto nla_put_failure;
8214         if ((survey->filled & SURVEY_INFO_IN_USE) &&
8215             nla_put_flag(msg, NL80211_SURVEY_INFO_IN_USE))
8216                 goto nla_put_failure;
8217         if ((survey->filled & SURVEY_INFO_TIME) &&
8218             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME,
8219                         survey->time, NL80211_SURVEY_INFO_PAD))
8220                 goto nla_put_failure;
8221         if ((survey->filled & SURVEY_INFO_TIME_BUSY) &&
8222             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_BUSY,
8223                               survey->time_busy, NL80211_SURVEY_INFO_PAD))
8224                 goto nla_put_failure;
8225         if ((survey->filled & SURVEY_INFO_TIME_EXT_BUSY) &&
8226             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_EXT_BUSY,
8227                               survey->time_ext_busy, NL80211_SURVEY_INFO_PAD))
8228                 goto nla_put_failure;
8229         if ((survey->filled & SURVEY_INFO_TIME_RX) &&
8230             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_RX,
8231                               survey->time_rx, NL80211_SURVEY_INFO_PAD))
8232                 goto nla_put_failure;
8233         if ((survey->filled & SURVEY_INFO_TIME_TX) &&
8234             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_TX,
8235                               survey->time_tx, NL80211_SURVEY_INFO_PAD))
8236                 goto nla_put_failure;
8237         if ((survey->filled & SURVEY_INFO_TIME_SCAN) &&
8238             nla_put_u64_64bit(msg, NL80211_SURVEY_INFO_TIME_SCAN,
8239                               survey->time_scan, NL80211_SURVEY_INFO_PAD))
8240                 goto nla_put_failure;
8241
8242         nla_nest_end(msg, infoattr);
8243
8244         genlmsg_end(msg, hdr);
8245         return 0;
8246
8247  nla_put_failure:
8248         genlmsg_cancel(msg, hdr);
8249         return -EMSGSIZE;
8250 }
8251
8252 static int nl80211_dump_survey(struct sk_buff *skb, struct netlink_callback *cb)
8253 {
8254         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
8255         struct survey_info survey;
8256         struct cfg80211_registered_device *rdev;
8257         struct wireless_dev *wdev;
8258         int survey_idx = cb->args[2];
8259         int res;
8260         bool radio_stats;
8261
8262         rtnl_lock();
8263         res = nl80211_prepare_wdev_dump(cb, &rdev, &wdev);
8264         if (res)
8265                 goto out_err;
8266
8267         /* prepare_wdev_dump parsed the attributes */
8268         radio_stats = attrbuf[NL80211_ATTR_SURVEY_RADIO_STATS];
8269
8270         if (!wdev->netdev) {
8271                 res = -EINVAL;
8272                 goto out_err;
8273         }
8274
8275         if (!rdev->ops->dump_survey) {
8276                 res = -EOPNOTSUPP;
8277                 goto out_err;
8278         }
8279
8280         while (1) {
8281                 res = rdev_dump_survey(rdev, wdev->netdev, survey_idx, &survey);
8282                 if (res == -ENOENT)
8283                         break;
8284                 if (res)
8285                         goto out_err;
8286
8287                 /* don't send disabled channels, but do send non-channel data */
8288                 if (survey.channel &&
8289                     survey.channel->flags & IEEE80211_CHAN_DISABLED) {
8290                         survey_idx++;
8291                         continue;
8292                 }
8293
8294                 if (nl80211_send_survey(skb,
8295                                 NETLINK_CB(cb->skb).portid,
8296                                 cb->nlh->nlmsg_seq, NLM_F_MULTI,
8297                                 wdev->netdev, radio_stats, &survey) < 0)
8298                         goto out;
8299                 survey_idx++;
8300         }
8301
8302  out:
8303         cb->args[2] = survey_idx;
8304         res = skb->len;
8305  out_err:
8306         rtnl_unlock();
8307         return res;
8308 }
8309
8310 static bool nl80211_valid_wpa_versions(u32 wpa_versions)
8311 {
8312         return !(wpa_versions & ~(NL80211_WPA_VERSION_1 |
8313                                   NL80211_WPA_VERSION_2));
8314 }
8315
8316 static int nl80211_authenticate(struct sk_buff *skb, struct genl_info *info)
8317 {
8318         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8319         struct net_device *dev = info->user_ptr[1];
8320         struct ieee80211_channel *chan;
8321         const u8 *bssid, *ssid, *ie = NULL, *auth_data = NULL;
8322         int err, ssid_len, ie_len = 0, auth_data_len = 0;
8323         enum nl80211_auth_type auth_type;
8324         struct key_parse key;
8325         bool local_state_change;
8326
8327         if (!info->attrs[NL80211_ATTR_MAC])
8328                 return -EINVAL;
8329
8330         if (!info->attrs[NL80211_ATTR_AUTH_TYPE])
8331                 return -EINVAL;
8332
8333         if (!info->attrs[NL80211_ATTR_SSID])
8334                 return -EINVAL;
8335
8336         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
8337                 return -EINVAL;
8338
8339         err = nl80211_parse_key(info, &key);
8340         if (err)
8341                 return err;
8342
8343         if (key.idx >= 0) {
8344                 if (key.type != -1 && key.type != NL80211_KEYTYPE_GROUP)
8345                         return -EINVAL;
8346                 if (!key.p.key || !key.p.key_len)
8347                         return -EINVAL;
8348                 if ((key.p.cipher != WLAN_CIPHER_SUITE_WEP40 ||
8349                      key.p.key_len != WLAN_KEY_LEN_WEP40) &&
8350                     (key.p.cipher != WLAN_CIPHER_SUITE_WEP104 ||
8351                      key.p.key_len != WLAN_KEY_LEN_WEP104))
8352                         return -EINVAL;
8353                 if (key.idx > 3)
8354                         return -EINVAL;
8355         } else {
8356                 key.p.key_len = 0;
8357                 key.p.key = NULL;
8358         }
8359
8360         if (key.idx >= 0) {
8361                 int i;
8362                 bool ok = false;
8363
8364                 for (i = 0; i < rdev->wiphy.n_cipher_suites; i++) {
8365                         if (key.p.cipher == rdev->wiphy.cipher_suites[i]) {
8366                                 ok = true;
8367                                 break;
8368                         }
8369                 }
8370                 if (!ok)
8371                         return -EINVAL;
8372         }
8373
8374         if (!rdev->ops->auth)
8375                 return -EOPNOTSUPP;
8376
8377         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8378             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8379                 return -EOPNOTSUPP;
8380
8381         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8382         chan = nl80211_get_valid_chan(&rdev->wiphy,
8383                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8384         if (!chan)
8385                 return -EINVAL;
8386
8387         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8388         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8389
8390         if (info->attrs[NL80211_ATTR_IE]) {
8391                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8392                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8393         }
8394
8395         auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
8396         if (!nl80211_valid_auth_type(rdev, auth_type, NL80211_CMD_AUTHENTICATE))
8397                 return -EINVAL;
8398
8399         if ((auth_type == NL80211_AUTHTYPE_SAE ||
8400              auth_type == NL80211_AUTHTYPE_FILS_SK ||
8401              auth_type == NL80211_AUTHTYPE_FILS_SK_PFS ||
8402              auth_type == NL80211_AUTHTYPE_FILS_PK) &&
8403             !info->attrs[NL80211_ATTR_AUTH_DATA])
8404                 return -EINVAL;
8405
8406         if (info->attrs[NL80211_ATTR_AUTH_DATA]) {
8407                 if (auth_type != NL80211_AUTHTYPE_SAE &&
8408                     auth_type != NL80211_AUTHTYPE_FILS_SK &&
8409                     auth_type != NL80211_AUTHTYPE_FILS_SK_PFS &&
8410                     auth_type != NL80211_AUTHTYPE_FILS_PK)
8411                         return -EINVAL;
8412                 auth_data = nla_data(info->attrs[NL80211_ATTR_AUTH_DATA]);
8413                 auth_data_len = nla_len(info->attrs[NL80211_ATTR_AUTH_DATA]);
8414                 /* need to include at least Auth Transaction and Status Code */
8415                 if (auth_data_len < 4)
8416                         return -EINVAL;
8417         }
8418
8419         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8420
8421         /*
8422          * Since we no longer track auth state, ignore
8423          * requests to only change local state.
8424          */
8425         if (local_state_change)
8426                 return 0;
8427
8428         wdev_lock(dev->ieee80211_ptr);
8429         err = cfg80211_mlme_auth(rdev, dev, chan, auth_type, bssid,
8430                                  ssid, ssid_len, ie, ie_len,
8431                                  key.p.key, key.p.key_len, key.idx,
8432                                  auth_data, auth_data_len);
8433         wdev_unlock(dev->ieee80211_ptr);
8434         return err;
8435 }
8436
8437 static int validate_pae_over_nl80211(struct cfg80211_registered_device *rdev,
8438                                      struct genl_info *info)
8439 {
8440         if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8441                 GENL_SET_ERR_MSG(info, "SOCKET_OWNER not set");
8442                 return -EINVAL;
8443         }
8444
8445         if (!rdev->ops->tx_control_port ||
8446             !wiphy_ext_feature_isset(&rdev->wiphy,
8447                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
8448                 return -EOPNOTSUPP;
8449
8450         return 0;
8451 }
8452
8453 static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
8454                                    struct genl_info *info,
8455                                    struct cfg80211_crypto_settings *settings,
8456                                    int cipher_limit)
8457 {
8458         memset(settings, 0, sizeof(*settings));
8459
8460         settings->control_port = info->attrs[NL80211_ATTR_CONTROL_PORT];
8461
8462         if (info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
8463                 u16 proto;
8464
8465                 proto = nla_get_u16(
8466                         info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
8467                 settings->control_port_ethertype = cpu_to_be16(proto);
8468                 if (!(rdev->wiphy.flags & WIPHY_FLAG_CONTROL_PORT_PROTOCOL) &&
8469                     proto != ETH_P_PAE)
8470                         return -EINVAL;
8471                 if (info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT])
8472                         settings->control_port_no_encrypt = true;
8473         } else
8474                 settings->control_port_ethertype = cpu_to_be16(ETH_P_PAE);
8475
8476         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8477                 int r = validate_pae_over_nl80211(rdev, info);
8478
8479                 if (r < 0)
8480                         return r;
8481
8482                 settings->control_port_over_nl80211 = true;
8483         }
8484
8485         if (info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]) {
8486                 void *data;
8487                 int len, i;
8488
8489                 data = nla_data(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8490                 len = nla_len(info->attrs[NL80211_ATTR_CIPHER_SUITES_PAIRWISE]);
8491                 settings->n_ciphers_pairwise = len / sizeof(u32);
8492
8493                 if (len % sizeof(u32))
8494                         return -EINVAL;
8495
8496                 if (settings->n_ciphers_pairwise > cipher_limit)
8497                         return -EINVAL;
8498
8499                 memcpy(settings->ciphers_pairwise, data, len);
8500
8501                 for (i = 0; i < settings->n_ciphers_pairwise; i++)
8502                         if (!cfg80211_supported_cipher_suite(
8503                                         &rdev->wiphy,
8504                                         settings->ciphers_pairwise[i]))
8505                                 return -EINVAL;
8506         }
8507
8508         if (info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]) {
8509                 settings->cipher_group =
8510                         nla_get_u32(info->attrs[NL80211_ATTR_CIPHER_SUITE_GROUP]);
8511                 if (!cfg80211_supported_cipher_suite(&rdev->wiphy,
8512                                                      settings->cipher_group))
8513                         return -EINVAL;
8514         }
8515
8516         if (info->attrs[NL80211_ATTR_WPA_VERSIONS]) {
8517                 settings->wpa_versions =
8518                         nla_get_u32(info->attrs[NL80211_ATTR_WPA_VERSIONS]);
8519                 if (!nl80211_valid_wpa_versions(settings->wpa_versions))
8520                         return -EINVAL;
8521         }
8522
8523         if (info->attrs[NL80211_ATTR_AKM_SUITES]) {
8524                 void *data;
8525                 int len;
8526
8527                 data = nla_data(info->attrs[NL80211_ATTR_AKM_SUITES]);
8528                 len = nla_len(info->attrs[NL80211_ATTR_AKM_SUITES]);
8529                 settings->n_akm_suites = len / sizeof(u32);
8530
8531                 if (len % sizeof(u32))
8532                         return -EINVAL;
8533
8534                 if (settings->n_akm_suites > NL80211_MAX_NR_AKM_SUITES)
8535                         return -EINVAL;
8536
8537                 memcpy(settings->akm_suites, data, len);
8538         }
8539
8540         if (info->attrs[NL80211_ATTR_PMK]) {
8541                 if (nla_len(info->attrs[NL80211_ATTR_PMK]) != WLAN_PMK_LEN)
8542                         return -EINVAL;
8543                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8544                                              NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_PSK))
8545                         return -EINVAL;
8546                 settings->psk = nla_data(info->attrs[NL80211_ATTR_PMK]);
8547         }
8548
8549         return 0;
8550 }
8551
8552 static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
8553 {
8554         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8555         struct net_device *dev = info->user_ptr[1];
8556         struct ieee80211_channel *chan;
8557         struct cfg80211_assoc_request req = {};
8558         const u8 *bssid, *ssid;
8559         int err, ssid_len = 0;
8560
8561         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8562             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8563                 return -EPERM;
8564
8565         if (!info->attrs[NL80211_ATTR_MAC] ||
8566             !info->attrs[NL80211_ATTR_SSID] ||
8567             !info->attrs[NL80211_ATTR_WIPHY_FREQ])
8568                 return -EINVAL;
8569
8570         if (!rdev->ops->assoc)
8571                 return -EOPNOTSUPP;
8572
8573         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8574             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8575                 return -EOPNOTSUPP;
8576
8577         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8578
8579         chan = nl80211_get_valid_chan(&rdev->wiphy,
8580                                       info->attrs[NL80211_ATTR_WIPHY_FREQ]);
8581         if (!chan)
8582                 return -EINVAL;
8583
8584         ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8585         ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8586
8587         if (info->attrs[NL80211_ATTR_IE]) {
8588                 req.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8589                 req.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8590         }
8591
8592         if (info->attrs[NL80211_ATTR_USE_MFP]) {
8593                 enum nl80211_mfp mfp =
8594                         nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
8595                 if (mfp == NL80211_MFP_REQUIRED)
8596                         req.use_mfp = true;
8597                 else if (mfp != NL80211_MFP_NO)
8598                         return -EINVAL;
8599         }
8600
8601         if (info->attrs[NL80211_ATTR_PREV_BSSID])
8602                 req.prev_bssid = nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
8603
8604         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
8605                 req.flags |= ASSOC_REQ_DISABLE_HT;
8606
8607         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8608                 memcpy(&req.ht_capa_mask,
8609                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8610                        sizeof(req.ht_capa_mask));
8611
8612         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8613                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8614                         return -EINVAL;
8615                 memcpy(&req.ht_capa,
8616                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8617                        sizeof(req.ht_capa));
8618         }
8619
8620         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
8621                 req.flags |= ASSOC_REQ_DISABLE_VHT;
8622
8623         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8624                 memcpy(&req.vht_capa_mask,
8625                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
8626                        sizeof(req.vht_capa_mask));
8627
8628         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
8629                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
8630                         return -EINVAL;
8631                 memcpy(&req.vht_capa,
8632                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
8633                        sizeof(req.vht_capa));
8634         }
8635
8636         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
8637                 if (!((rdev->wiphy.features &
8638                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
8639                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
8640                     !wiphy_ext_feature_isset(&rdev->wiphy,
8641                                              NL80211_EXT_FEATURE_RRM))
8642                         return -EINVAL;
8643                 req.flags |= ASSOC_REQ_USE_RRM;
8644         }
8645
8646         if (info->attrs[NL80211_ATTR_FILS_KEK]) {
8647                 req.fils_kek = nla_data(info->attrs[NL80211_ATTR_FILS_KEK]);
8648                 req.fils_kek_len = nla_len(info->attrs[NL80211_ATTR_FILS_KEK]);
8649                 if (!info->attrs[NL80211_ATTR_FILS_NONCES])
8650                         return -EINVAL;
8651                 req.fils_nonces =
8652                         nla_data(info->attrs[NL80211_ATTR_FILS_NONCES]);
8653         }
8654
8655         err = nl80211_crypto_settings(rdev, info, &req.crypto, 1);
8656         if (!err) {
8657                 wdev_lock(dev->ieee80211_ptr);
8658
8659                 err = cfg80211_mlme_assoc(rdev, dev, chan, bssid,
8660                                           ssid, ssid_len, &req);
8661
8662                 if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
8663                         dev->ieee80211_ptr->conn_owner_nlportid =
8664                                 info->snd_portid;
8665                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
8666                                bssid, ETH_ALEN);
8667                 }
8668
8669                 wdev_unlock(dev->ieee80211_ptr);
8670         }
8671
8672         return err;
8673 }
8674
8675 static int nl80211_deauthenticate(struct sk_buff *skb, struct genl_info *info)
8676 {
8677         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8678         struct net_device *dev = info->user_ptr[1];
8679         const u8 *ie = NULL, *bssid;
8680         int ie_len = 0, err;
8681         u16 reason_code;
8682         bool local_state_change;
8683
8684         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8685             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8686                 return -EPERM;
8687
8688         if (!info->attrs[NL80211_ATTR_MAC])
8689                 return -EINVAL;
8690
8691         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8692                 return -EINVAL;
8693
8694         if (!rdev->ops->deauth)
8695                 return -EOPNOTSUPP;
8696
8697         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8698             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8699                 return -EOPNOTSUPP;
8700
8701         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8702
8703         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8704         if (reason_code == 0) {
8705                 /* Reason Code 0 is reserved */
8706                 return -EINVAL;
8707         }
8708
8709         if (info->attrs[NL80211_ATTR_IE]) {
8710                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8711                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8712         }
8713
8714         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8715
8716         wdev_lock(dev->ieee80211_ptr);
8717         err = cfg80211_mlme_deauth(rdev, dev, bssid, ie, ie_len, reason_code,
8718                                    local_state_change);
8719         wdev_unlock(dev->ieee80211_ptr);
8720         return err;
8721 }
8722
8723 static int nl80211_disassociate(struct sk_buff *skb, struct genl_info *info)
8724 {
8725         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8726         struct net_device *dev = info->user_ptr[1];
8727         const u8 *ie = NULL, *bssid;
8728         int ie_len = 0, err;
8729         u16 reason_code;
8730         bool local_state_change;
8731
8732         if (dev->ieee80211_ptr->conn_owner_nlportid &&
8733             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
8734                 return -EPERM;
8735
8736         if (!info->attrs[NL80211_ATTR_MAC])
8737                 return -EINVAL;
8738
8739         if (!info->attrs[NL80211_ATTR_REASON_CODE])
8740                 return -EINVAL;
8741
8742         if (!rdev->ops->disassoc)
8743                 return -EOPNOTSUPP;
8744
8745         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
8746             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
8747                 return -EOPNOTSUPP;
8748
8749         bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8750
8751         reason_code = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
8752         if (reason_code == 0) {
8753                 /* Reason Code 0 is reserved */
8754                 return -EINVAL;
8755         }
8756
8757         if (info->attrs[NL80211_ATTR_IE]) {
8758                 ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8759                 ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8760         }
8761
8762         local_state_change = !!info->attrs[NL80211_ATTR_LOCAL_STATE_CHANGE];
8763
8764         wdev_lock(dev->ieee80211_ptr);
8765         err = cfg80211_mlme_disassoc(rdev, dev, bssid, ie, ie_len, reason_code,
8766                                      local_state_change);
8767         wdev_unlock(dev->ieee80211_ptr);
8768         return err;
8769 }
8770
8771 static bool
8772 nl80211_parse_mcast_rate(struct cfg80211_registered_device *rdev,
8773                          int mcast_rate[NUM_NL80211_BANDS],
8774                          int rateval)
8775 {
8776         struct wiphy *wiphy = &rdev->wiphy;
8777         bool found = false;
8778         int band, i;
8779
8780         for (band = 0; band < NUM_NL80211_BANDS; band++) {
8781                 struct ieee80211_supported_band *sband;
8782
8783                 sband = wiphy->bands[band];
8784                 if (!sband)
8785                         continue;
8786
8787                 for (i = 0; i < sband->n_bitrates; i++) {
8788                         if (sband->bitrates[i].bitrate == rateval) {
8789                                 mcast_rate[band] = i + 1;
8790                                 found = true;
8791                                 break;
8792                         }
8793                 }
8794         }
8795
8796         return found;
8797 }
8798
8799 static int nl80211_join_ibss(struct sk_buff *skb, struct genl_info *info)
8800 {
8801         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8802         struct net_device *dev = info->user_ptr[1];
8803         struct cfg80211_ibss_params ibss;
8804         struct wiphy *wiphy;
8805         struct cfg80211_cached_keys *connkeys = NULL;
8806         int err;
8807
8808         memset(&ibss, 0, sizeof(ibss));
8809
8810         if (!info->attrs[NL80211_ATTR_SSID] ||
8811             !nla_len(info->attrs[NL80211_ATTR_SSID]))
8812                 return -EINVAL;
8813
8814         ibss.beacon_interval = 100;
8815
8816         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL])
8817                 ibss.beacon_interval =
8818                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
8819
8820         err = cfg80211_validate_beacon_int(rdev, NL80211_IFTYPE_ADHOC,
8821                                            ibss.beacon_interval);
8822         if (err)
8823                 return err;
8824
8825         if (!rdev->ops->join_ibss)
8826                 return -EOPNOTSUPP;
8827
8828         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8829                 return -EOPNOTSUPP;
8830
8831         wiphy = &rdev->wiphy;
8832
8833         if (info->attrs[NL80211_ATTR_MAC]) {
8834                 ibss.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
8835
8836                 if (!is_valid_ether_addr(ibss.bssid))
8837                         return -EINVAL;
8838         }
8839         ibss.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
8840         ibss.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
8841
8842         if (info->attrs[NL80211_ATTR_IE]) {
8843                 ibss.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
8844                 ibss.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
8845         }
8846
8847         err = nl80211_parse_chandef(rdev, info, &ibss.chandef);
8848         if (err)
8849                 return err;
8850
8851         if (!cfg80211_reg_can_beacon(&rdev->wiphy, &ibss.chandef,
8852                                      NL80211_IFTYPE_ADHOC))
8853                 return -EINVAL;
8854
8855         switch (ibss.chandef.width) {
8856         case NL80211_CHAN_WIDTH_5:
8857         case NL80211_CHAN_WIDTH_10:
8858         case NL80211_CHAN_WIDTH_20_NOHT:
8859                 break;
8860         case NL80211_CHAN_WIDTH_20:
8861         case NL80211_CHAN_WIDTH_40:
8862                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8863                         return -EINVAL;
8864                 break;
8865         case NL80211_CHAN_WIDTH_80:
8866         case NL80211_CHAN_WIDTH_80P80:
8867         case NL80211_CHAN_WIDTH_160:
8868                 if (!(rdev->wiphy.features & NL80211_FEATURE_HT_IBSS))
8869                         return -EINVAL;
8870                 if (!wiphy_ext_feature_isset(&rdev->wiphy,
8871                                              NL80211_EXT_FEATURE_VHT_IBSS))
8872                         return -EINVAL;
8873                 break;
8874         default:
8875                 return -EINVAL;
8876         }
8877
8878         ibss.channel_fixed = !!info->attrs[NL80211_ATTR_FREQ_FIXED];
8879         ibss.privacy = !!info->attrs[NL80211_ATTR_PRIVACY];
8880
8881         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
8882                 u8 *rates =
8883                         nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8884                 int n_rates =
8885                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
8886                 struct ieee80211_supported_band *sband =
8887                         wiphy->bands[ibss.chandef.chan->band];
8888
8889                 err = ieee80211_get_ratemask(sband, rates, n_rates,
8890                                              &ibss.basic_rates);
8891                 if (err)
8892                         return err;
8893         }
8894
8895         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8896                 memcpy(&ibss.ht_capa_mask,
8897                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
8898                        sizeof(ibss.ht_capa_mask));
8899
8900         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
8901                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
8902                         return -EINVAL;
8903                 memcpy(&ibss.ht_capa,
8904                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
8905                        sizeof(ibss.ht_capa));
8906         }
8907
8908         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
8909             !nl80211_parse_mcast_rate(rdev, ibss.mcast_rate,
8910                         nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
8911                 return -EINVAL;
8912
8913         if (ibss.privacy && info->attrs[NL80211_ATTR_KEYS]) {
8914                 bool no_ht = false;
8915
8916                 connkeys = nl80211_parse_connkeys(rdev, info, &no_ht);
8917                 if (IS_ERR(connkeys))
8918                         return PTR_ERR(connkeys);
8919
8920                 if ((ibss.chandef.width != NL80211_CHAN_WIDTH_20_NOHT) &&
8921                     no_ht) {
8922                         kzfree(connkeys);
8923                         return -EINVAL;
8924                 }
8925         }
8926
8927         ibss.control_port =
8928                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT]);
8929
8930         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
8931                 int r = validate_pae_over_nl80211(rdev, info);
8932
8933                 if (r < 0) {
8934                         kzfree(connkeys);
8935                         return r;
8936                 }
8937
8938                 ibss.control_port_over_nl80211 = true;
8939         }
8940
8941         ibss.userspace_handles_dfs =
8942                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
8943
8944         wdev_lock(dev->ieee80211_ptr);
8945         err = __cfg80211_join_ibss(rdev, dev, &ibss, connkeys);
8946         if (err)
8947                 kzfree(connkeys);
8948         else if (info->attrs[NL80211_ATTR_SOCKET_OWNER])
8949                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
8950         wdev_unlock(dev->ieee80211_ptr);
8951
8952         return err;
8953 }
8954
8955 static int nl80211_leave_ibss(struct sk_buff *skb, struct genl_info *info)
8956 {
8957         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8958         struct net_device *dev = info->user_ptr[1];
8959
8960         if (!rdev->ops->leave_ibss)
8961                 return -EOPNOTSUPP;
8962
8963         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC)
8964                 return -EOPNOTSUPP;
8965
8966         return cfg80211_leave_ibss(rdev, dev, false);
8967 }
8968
8969 static int nl80211_set_mcast_rate(struct sk_buff *skb, struct genl_info *info)
8970 {
8971         struct cfg80211_registered_device *rdev = info->user_ptr[0];
8972         struct net_device *dev = info->user_ptr[1];
8973         int mcast_rate[NUM_NL80211_BANDS];
8974         u32 nla_rate;
8975         int err;
8976
8977         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_ADHOC &&
8978             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT &&
8979             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_OCB)
8980                 return -EOPNOTSUPP;
8981
8982         if (!rdev->ops->set_mcast_rate)
8983                 return -EOPNOTSUPP;
8984
8985         memset(mcast_rate, 0, sizeof(mcast_rate));
8986
8987         if (!info->attrs[NL80211_ATTR_MCAST_RATE])
8988                 return -EINVAL;
8989
8990         nla_rate = nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE]);
8991         if (!nl80211_parse_mcast_rate(rdev, mcast_rate, nla_rate))
8992                 return -EINVAL;
8993
8994         err = rdev_set_mcast_rate(rdev, dev, mcast_rate);
8995
8996         return err;
8997 }
8998
8999 static struct sk_buff *
9000 __cfg80211_alloc_vendor_skb(struct cfg80211_registered_device *rdev,
9001                             struct wireless_dev *wdev, int approxlen,
9002                             u32 portid, u32 seq, enum nl80211_commands cmd,
9003                             enum nl80211_attrs attr,
9004                             const struct nl80211_vendor_cmd_info *info,
9005                             gfp_t gfp)
9006 {
9007         struct sk_buff *skb;
9008         void *hdr;
9009         struct nlattr *data;
9010
9011         skb = nlmsg_new(approxlen + 100, gfp);
9012         if (!skb)
9013                 return NULL;
9014
9015         hdr = nl80211hdr_put(skb, portid, seq, 0, cmd);
9016         if (!hdr) {
9017                 kfree_skb(skb);
9018                 return NULL;
9019         }
9020
9021         if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
9022                 goto nla_put_failure;
9023
9024         if (info) {
9025                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_ID,
9026                                 info->vendor_id))
9027                         goto nla_put_failure;
9028                 if (nla_put_u32(skb, NL80211_ATTR_VENDOR_SUBCMD,
9029                                 info->subcmd))
9030                         goto nla_put_failure;
9031         }
9032
9033         if (wdev) {
9034                 if (nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
9035                                       wdev_id(wdev), NL80211_ATTR_PAD))
9036                         goto nla_put_failure;
9037                 if (wdev->netdev &&
9038                     nla_put_u32(skb, NL80211_ATTR_IFINDEX,
9039                                 wdev->netdev->ifindex))
9040                         goto nla_put_failure;
9041         }
9042
9043         data = nla_nest_start(skb, attr);
9044         if (!data)
9045                 goto nla_put_failure;
9046
9047         ((void **)skb->cb)[0] = rdev;
9048         ((void **)skb->cb)[1] = hdr;
9049         ((void **)skb->cb)[2] = data;
9050
9051         return skb;
9052
9053  nla_put_failure:
9054         kfree_skb(skb);
9055         return NULL;
9056 }
9057
9058 struct sk_buff *__cfg80211_alloc_event_skb(struct wiphy *wiphy,
9059                                            struct wireless_dev *wdev,
9060                                            enum nl80211_commands cmd,
9061                                            enum nl80211_attrs attr,
9062                                            int vendor_event_idx,
9063                                            int approxlen, gfp_t gfp)
9064 {
9065         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
9066         const struct nl80211_vendor_cmd_info *info;
9067
9068         switch (cmd) {
9069         case NL80211_CMD_TESTMODE:
9070                 if (WARN_ON(vendor_event_idx != -1))
9071                         return NULL;
9072                 info = NULL;
9073                 break;
9074         case NL80211_CMD_VENDOR:
9075                 if (WARN_ON(vendor_event_idx < 0 ||
9076                             vendor_event_idx >= wiphy->n_vendor_events))
9077                         return NULL;
9078                 info = &wiphy->vendor_events[vendor_event_idx];
9079                 break;
9080         default:
9081                 WARN_ON(1);
9082                 return NULL;
9083         }
9084
9085         return __cfg80211_alloc_vendor_skb(rdev, wdev, approxlen, 0, 0,
9086                                            cmd, attr, info, gfp);
9087 }
9088 EXPORT_SYMBOL(__cfg80211_alloc_event_skb);
9089
9090 void __cfg80211_send_event_skb(struct sk_buff *skb, gfp_t gfp)
9091 {
9092         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
9093         void *hdr = ((void **)skb->cb)[1];
9094         struct nlattr *data = ((void **)skb->cb)[2];
9095         enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
9096
9097         /* clear CB data for netlink core to own from now on */
9098         memset(skb->cb, 0, sizeof(skb->cb));
9099
9100         nla_nest_end(skb, data);
9101         genlmsg_end(skb, hdr);
9102
9103         if (data->nla_type == NL80211_ATTR_VENDOR_DATA)
9104                 mcgrp = NL80211_MCGRP_VENDOR;
9105
9106         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), skb, 0,
9107                                 mcgrp, gfp);
9108 }
9109 EXPORT_SYMBOL(__cfg80211_send_event_skb);
9110
9111 #ifdef CONFIG_NL80211_TESTMODE
9112 static int nl80211_testmode_do(struct sk_buff *skb, struct genl_info *info)
9113 {
9114         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9115         struct wireless_dev *wdev =
9116                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
9117         int err;
9118
9119         if (!rdev->ops->testmode_cmd)
9120                 return -EOPNOTSUPP;
9121
9122         if (IS_ERR(wdev)) {
9123                 err = PTR_ERR(wdev);
9124                 if (err != -EINVAL)
9125                         return err;
9126                 wdev = NULL;
9127         } else if (wdev->wiphy != &rdev->wiphy) {
9128                 return -EINVAL;
9129         }
9130
9131         if (!info->attrs[NL80211_ATTR_TESTDATA])
9132                 return -EINVAL;
9133
9134         rdev->cur_cmd_info = info;
9135         err = rdev_testmode_cmd(rdev, wdev,
9136                                 nla_data(info->attrs[NL80211_ATTR_TESTDATA]),
9137                                 nla_len(info->attrs[NL80211_ATTR_TESTDATA]));
9138         rdev->cur_cmd_info = NULL;
9139
9140         return err;
9141 }
9142
9143 static int nl80211_testmode_dump(struct sk_buff *skb,
9144                                  struct netlink_callback *cb)
9145 {
9146         struct cfg80211_registered_device *rdev;
9147         int err;
9148         long phy_idx;
9149         void *data = NULL;
9150         int data_len = 0;
9151
9152         rtnl_lock();
9153
9154         if (cb->args[0]) {
9155                 /*
9156                  * 0 is a valid index, but not valid for args[0],
9157                  * so we need to offset by 1.
9158                  */
9159                 phy_idx = cb->args[0] - 1;
9160
9161                 rdev = cfg80211_rdev_by_wiphy_idx(phy_idx);
9162                 if (!rdev) {
9163                         err = -ENOENT;
9164                         goto out_err;
9165                 }
9166         } else {
9167                 struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
9168
9169                 err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize,
9170                                   attrbuf, nl80211_fam.maxattr,
9171                                   nl80211_policy, NULL);
9172                 if (err)
9173                         goto out_err;
9174
9175                 rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
9176                 if (IS_ERR(rdev)) {
9177                         err = PTR_ERR(rdev);
9178                         goto out_err;
9179                 }
9180                 phy_idx = rdev->wiphy_idx;
9181
9182                 if (attrbuf[NL80211_ATTR_TESTDATA])
9183                         cb->args[1] = (long)attrbuf[NL80211_ATTR_TESTDATA];
9184         }
9185
9186         if (cb->args[1]) {
9187                 data = nla_data((void *)cb->args[1]);
9188                 data_len = nla_len((void *)cb->args[1]);
9189         }
9190
9191         if (!rdev->ops->testmode_dump) {
9192                 err = -EOPNOTSUPP;
9193                 goto out_err;
9194         }
9195
9196         while (1) {
9197                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
9198                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
9199                                            NL80211_CMD_TESTMODE);
9200                 struct nlattr *tmdata;
9201
9202                 if (!hdr)
9203                         break;
9204
9205                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, phy_idx)) {
9206                         genlmsg_cancel(skb, hdr);
9207                         break;
9208                 }
9209
9210                 tmdata = nla_nest_start(skb, NL80211_ATTR_TESTDATA);
9211                 if (!tmdata) {
9212                         genlmsg_cancel(skb, hdr);
9213                         break;
9214                 }
9215                 err = rdev_testmode_dump(rdev, skb, cb, data, data_len);
9216                 nla_nest_end(skb, tmdata);
9217
9218                 if (err == -ENOBUFS || err == -ENOENT) {
9219                         genlmsg_cancel(skb, hdr);
9220                         break;
9221                 } else if (err) {
9222                         genlmsg_cancel(skb, hdr);
9223                         goto out_err;
9224                 }
9225
9226                 genlmsg_end(skb, hdr);
9227         }
9228
9229         err = skb->len;
9230         /* see above */
9231         cb->args[0] = phy_idx + 1;
9232  out_err:
9233         rtnl_unlock();
9234         return err;
9235 }
9236 #endif
9237
9238 static int nl80211_connect(struct sk_buff *skb, struct genl_info *info)
9239 {
9240         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9241         struct net_device *dev = info->user_ptr[1];
9242         struct cfg80211_connect_params connect;
9243         struct wiphy *wiphy;
9244         struct cfg80211_cached_keys *connkeys = NULL;
9245         int err;
9246
9247         memset(&connect, 0, sizeof(connect));
9248
9249         if (!info->attrs[NL80211_ATTR_SSID] ||
9250             !nla_len(info->attrs[NL80211_ATTR_SSID]))
9251                 return -EINVAL;
9252
9253         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9254                 connect.auth_type =
9255                         nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9256                 if (!nl80211_valid_auth_type(rdev, connect.auth_type,
9257                                              NL80211_CMD_CONNECT))
9258                         return -EINVAL;
9259         } else
9260                 connect.auth_type = NL80211_AUTHTYPE_AUTOMATIC;
9261
9262         connect.privacy = info->attrs[NL80211_ATTR_PRIVACY];
9263
9264         if (info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS] &&
9265             !wiphy_ext_feature_isset(&rdev->wiphy,
9266                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
9267                 return -EINVAL;
9268         connect.want_1x = info->attrs[NL80211_ATTR_WANT_1X_4WAY_HS];
9269
9270         err = nl80211_crypto_settings(rdev, info, &connect.crypto,
9271                                       NL80211_MAX_NR_CIPHER_SUITES);
9272         if (err)
9273                 return err;
9274
9275         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9276             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9277                 return -EOPNOTSUPP;
9278
9279         wiphy = &rdev->wiphy;
9280
9281         connect.bg_scan_period = -1;
9282         if (info->attrs[NL80211_ATTR_BG_SCAN_PERIOD] &&
9283                 (wiphy->flags & WIPHY_FLAG_SUPPORTS_FW_ROAM)) {
9284                 connect.bg_scan_period =
9285                         nla_get_u16(info->attrs[NL80211_ATTR_BG_SCAN_PERIOD]);
9286         }
9287
9288         if (info->attrs[NL80211_ATTR_MAC])
9289                 connect.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9290         else if (info->attrs[NL80211_ATTR_MAC_HINT])
9291                 connect.bssid_hint =
9292                         nla_data(info->attrs[NL80211_ATTR_MAC_HINT]);
9293         connect.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9294         connect.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9295
9296         if (info->attrs[NL80211_ATTR_IE]) {
9297                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9298                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9299         }
9300
9301         if (info->attrs[NL80211_ATTR_USE_MFP]) {
9302                 connect.mfp = nla_get_u32(info->attrs[NL80211_ATTR_USE_MFP]);
9303                 if (connect.mfp == NL80211_MFP_OPTIONAL &&
9304                     !wiphy_ext_feature_isset(&rdev->wiphy,
9305                                              NL80211_EXT_FEATURE_MFP_OPTIONAL))
9306                         return -EOPNOTSUPP;
9307         } else {
9308                 connect.mfp = NL80211_MFP_NO;
9309         }
9310
9311         if (info->attrs[NL80211_ATTR_PREV_BSSID])
9312                 connect.prev_bssid =
9313                         nla_data(info->attrs[NL80211_ATTR_PREV_BSSID]);
9314
9315         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9316                 connect.channel = nl80211_get_valid_chan(
9317                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ]);
9318                 if (!connect.channel)
9319                         return -EINVAL;
9320         } else if (info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]) {
9321                 connect.channel_hint = nl80211_get_valid_chan(
9322                         wiphy, info->attrs[NL80211_ATTR_WIPHY_FREQ_HINT]);
9323                 if (!connect.channel_hint)
9324                         return -EINVAL;
9325         }
9326
9327         if (connect.privacy && info->attrs[NL80211_ATTR_KEYS]) {
9328                 connkeys = nl80211_parse_connkeys(rdev, info, NULL);
9329                 if (IS_ERR(connkeys))
9330                         return PTR_ERR(connkeys);
9331         }
9332
9333         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_HT]))
9334                 connect.flags |= ASSOC_REQ_DISABLE_HT;
9335
9336         if (info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK])
9337                 memcpy(&connect.ht_capa_mask,
9338                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]),
9339                        sizeof(connect.ht_capa_mask));
9340
9341         if (info->attrs[NL80211_ATTR_HT_CAPABILITY]) {
9342                 if (!info->attrs[NL80211_ATTR_HT_CAPABILITY_MASK]) {
9343                         kzfree(connkeys);
9344                         return -EINVAL;
9345                 }
9346                 memcpy(&connect.ht_capa,
9347                        nla_data(info->attrs[NL80211_ATTR_HT_CAPABILITY]),
9348                        sizeof(connect.ht_capa));
9349         }
9350
9351         if (nla_get_flag(info->attrs[NL80211_ATTR_DISABLE_VHT]))
9352                 connect.flags |= ASSOC_REQ_DISABLE_VHT;
9353
9354         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK])
9355                 memcpy(&connect.vht_capa_mask,
9356                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]),
9357                        sizeof(connect.vht_capa_mask));
9358
9359         if (info->attrs[NL80211_ATTR_VHT_CAPABILITY]) {
9360                 if (!info->attrs[NL80211_ATTR_VHT_CAPABILITY_MASK]) {
9361                         kzfree(connkeys);
9362                         return -EINVAL;
9363                 }
9364                 memcpy(&connect.vht_capa,
9365                        nla_data(info->attrs[NL80211_ATTR_VHT_CAPABILITY]),
9366                        sizeof(connect.vht_capa));
9367         }
9368
9369         if (nla_get_flag(info->attrs[NL80211_ATTR_USE_RRM])) {
9370                 if (!((rdev->wiphy.features &
9371                         NL80211_FEATURE_DS_PARAM_SET_IE_IN_PROBES) &&
9372                        (rdev->wiphy.features & NL80211_FEATURE_QUIET)) &&
9373                     !wiphy_ext_feature_isset(&rdev->wiphy,
9374                                              NL80211_EXT_FEATURE_RRM)) {
9375                         kzfree(connkeys);
9376                         return -EINVAL;
9377                 }
9378                 connect.flags |= ASSOC_REQ_USE_RRM;
9379         }
9380
9381         connect.pbss = nla_get_flag(info->attrs[NL80211_ATTR_PBSS]);
9382         if (connect.pbss && !rdev->wiphy.bands[NL80211_BAND_60GHZ]) {
9383                 kzfree(connkeys);
9384                 return -EOPNOTSUPP;
9385         }
9386
9387         if (info->attrs[NL80211_ATTR_BSS_SELECT]) {
9388                 /* bss selection makes no sense if bssid is set */
9389                 if (connect.bssid) {
9390                         kzfree(connkeys);
9391                         return -EINVAL;
9392                 }
9393
9394                 err = parse_bss_select(info->attrs[NL80211_ATTR_BSS_SELECT],
9395                                        wiphy, &connect.bss_select);
9396                 if (err) {
9397                         kzfree(connkeys);
9398                         return err;
9399                 }
9400         }
9401
9402         if (wiphy_ext_feature_isset(&rdev->wiphy,
9403                                     NL80211_EXT_FEATURE_FILS_SK_OFFLOAD) &&
9404             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9405             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9406             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9407             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9408                 connect.fils_erp_username =
9409                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9410                 connect.fils_erp_username_len =
9411                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9412                 connect.fils_erp_realm =
9413                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9414                 connect.fils_erp_realm_len =
9415                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9416                 connect.fils_erp_next_seq_num =
9417                         nla_get_u16(
9418                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9419                 connect.fils_erp_rrk =
9420                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9421                 connect.fils_erp_rrk_len =
9422                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9423         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9424                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9425                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9426                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9427                 kzfree(connkeys);
9428                 return -EINVAL;
9429         }
9430
9431         if (nla_get_flag(info->attrs[NL80211_ATTR_EXTERNAL_AUTH_SUPPORT])) {
9432                 if (!info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9433                         kzfree(connkeys);
9434                         GENL_SET_ERR_MSG(info,
9435                                          "external auth requires connection ownership");
9436                         return -EINVAL;
9437                 }
9438                 connect.flags |= CONNECT_REQ_EXTERNAL_AUTH_SUPPORT;
9439         }
9440
9441         wdev_lock(dev->ieee80211_ptr);
9442
9443         err = cfg80211_connect(rdev, dev, &connect, connkeys,
9444                                connect.prev_bssid);
9445         if (err)
9446                 kzfree(connkeys);
9447
9448         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER]) {
9449                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
9450                 if (connect.bssid)
9451                         memcpy(dev->ieee80211_ptr->disconnect_bssid,
9452                                connect.bssid, ETH_ALEN);
9453                 else
9454                         memset(dev->ieee80211_ptr->disconnect_bssid,
9455                                0, ETH_ALEN);
9456         }
9457
9458         wdev_unlock(dev->ieee80211_ptr);
9459
9460         return err;
9461 }
9462
9463 static int nl80211_update_connect_params(struct sk_buff *skb,
9464                                          struct genl_info *info)
9465 {
9466         struct cfg80211_connect_params connect = {};
9467         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9468         struct net_device *dev = info->user_ptr[1];
9469         struct wireless_dev *wdev = dev->ieee80211_ptr;
9470         bool fils_sk_offload;
9471         u32 auth_type;
9472         u32 changed = 0;
9473         int ret;
9474
9475         if (!rdev->ops->update_connect_params)
9476                 return -EOPNOTSUPP;
9477
9478         if (info->attrs[NL80211_ATTR_IE]) {
9479                 connect.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
9480                 connect.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
9481                 changed |= UPDATE_ASSOC_IES;
9482         }
9483
9484         fils_sk_offload = wiphy_ext_feature_isset(&rdev->wiphy,
9485                                                   NL80211_EXT_FEATURE_FILS_SK_OFFLOAD);
9486
9487         /*
9488          * when driver supports fils-sk offload all attributes must be
9489          * provided. So the else covers "fils-sk-not-all" and
9490          * "no-fils-sk-any".
9491          */
9492         if (fils_sk_offload &&
9493             info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] &&
9494             info->attrs[NL80211_ATTR_FILS_ERP_REALM] &&
9495             info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] &&
9496             info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9497                 connect.fils_erp_username =
9498                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9499                 connect.fils_erp_username_len =
9500                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_USERNAME]);
9501                 connect.fils_erp_realm =
9502                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9503                 connect.fils_erp_realm_len =
9504                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_REALM]);
9505                 connect.fils_erp_next_seq_num =
9506                         nla_get_u16(
9507                            info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM]);
9508                 connect.fils_erp_rrk =
9509                         nla_data(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9510                 connect.fils_erp_rrk_len =
9511                         nla_len(info->attrs[NL80211_ATTR_FILS_ERP_RRK]);
9512                 changed |= UPDATE_FILS_ERP_INFO;
9513         } else if (info->attrs[NL80211_ATTR_FILS_ERP_USERNAME] ||
9514                    info->attrs[NL80211_ATTR_FILS_ERP_REALM] ||
9515                    info->attrs[NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM] ||
9516                    info->attrs[NL80211_ATTR_FILS_ERP_RRK]) {
9517                 return -EINVAL;
9518         }
9519
9520         if (info->attrs[NL80211_ATTR_AUTH_TYPE]) {
9521                 auth_type = nla_get_u32(info->attrs[NL80211_ATTR_AUTH_TYPE]);
9522                 if (!nl80211_valid_auth_type(rdev, auth_type,
9523                                              NL80211_CMD_CONNECT))
9524                         return -EINVAL;
9525
9526                 if (auth_type == NL80211_AUTHTYPE_FILS_SK &&
9527                     fils_sk_offload && !(changed & UPDATE_FILS_ERP_INFO))
9528                         return -EINVAL;
9529
9530                 connect.auth_type = auth_type;
9531                 changed |= UPDATE_AUTH_TYPE;
9532         }
9533
9534         wdev_lock(dev->ieee80211_ptr);
9535         if (!wdev->current_bss)
9536                 ret = -ENOLINK;
9537         else
9538                 ret = rdev_update_connect_params(rdev, dev, &connect, changed);
9539         wdev_unlock(dev->ieee80211_ptr);
9540
9541         return ret;
9542 }
9543
9544 static int nl80211_disconnect(struct sk_buff *skb, struct genl_info *info)
9545 {
9546         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9547         struct net_device *dev = info->user_ptr[1];
9548         u16 reason;
9549         int ret;
9550
9551         if (dev->ieee80211_ptr->conn_owner_nlportid &&
9552             dev->ieee80211_ptr->conn_owner_nlportid != info->snd_portid)
9553                 return -EPERM;
9554
9555         if (!info->attrs[NL80211_ATTR_REASON_CODE])
9556                 reason = WLAN_REASON_DEAUTH_LEAVING;
9557         else
9558                 reason = nla_get_u16(info->attrs[NL80211_ATTR_REASON_CODE]);
9559
9560         if (reason == 0)
9561                 return -EINVAL;
9562
9563         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9564             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9565                 return -EOPNOTSUPP;
9566
9567         wdev_lock(dev->ieee80211_ptr);
9568         ret = cfg80211_disconnect(rdev, dev, reason, true);
9569         wdev_unlock(dev->ieee80211_ptr);
9570         return ret;
9571 }
9572
9573 static int nl80211_wiphy_netns(struct sk_buff *skb, struct genl_info *info)
9574 {
9575         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9576         struct net *net;
9577         int err;
9578
9579         if (info->attrs[NL80211_ATTR_PID]) {
9580                 u32 pid = nla_get_u32(info->attrs[NL80211_ATTR_PID]);
9581
9582                 net = get_net_ns_by_pid(pid);
9583         } else if (info->attrs[NL80211_ATTR_NETNS_FD]) {
9584                 u32 fd = nla_get_u32(info->attrs[NL80211_ATTR_NETNS_FD]);
9585
9586                 net = get_net_ns_by_fd(fd);
9587         } else {
9588                 return -EINVAL;
9589         }
9590
9591         if (IS_ERR(net))
9592                 return PTR_ERR(net);
9593
9594         err = 0;
9595
9596         /* check if anything to do */
9597         if (!net_eq(wiphy_net(&rdev->wiphy), net))
9598                 err = cfg80211_switch_netns(rdev, net);
9599
9600         put_net(net);
9601         return err;
9602 }
9603
9604 static int nl80211_setdel_pmksa(struct sk_buff *skb, struct genl_info *info)
9605 {
9606         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9607         int (*rdev_ops)(struct wiphy *wiphy, struct net_device *dev,
9608                         struct cfg80211_pmksa *pmksa) = NULL;
9609         struct net_device *dev = info->user_ptr[1];
9610         struct cfg80211_pmksa pmksa;
9611
9612         memset(&pmksa, 0, sizeof(struct cfg80211_pmksa));
9613
9614         if (!info->attrs[NL80211_ATTR_PMKID])
9615                 return -EINVAL;
9616
9617         pmksa.pmkid = nla_data(info->attrs[NL80211_ATTR_PMKID]);
9618
9619         if (info->attrs[NL80211_ATTR_MAC]) {
9620                 pmksa.bssid = nla_data(info->attrs[NL80211_ATTR_MAC]);
9621         } else if (info->attrs[NL80211_ATTR_SSID] &&
9622                    info->attrs[NL80211_ATTR_FILS_CACHE_ID] &&
9623                    (info->genlhdr->cmd == NL80211_CMD_DEL_PMKSA ||
9624                     info->attrs[NL80211_ATTR_PMK])) {
9625                 pmksa.ssid = nla_data(info->attrs[NL80211_ATTR_SSID]);
9626                 pmksa.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
9627                 pmksa.cache_id =
9628                         nla_data(info->attrs[NL80211_ATTR_FILS_CACHE_ID]);
9629         } else {
9630                 return -EINVAL;
9631         }
9632         if (info->attrs[NL80211_ATTR_PMK]) {
9633                 pmksa.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
9634                 pmksa.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
9635         }
9636
9637         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9638             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9639                 return -EOPNOTSUPP;
9640
9641         switch (info->genlhdr->cmd) {
9642         case NL80211_CMD_SET_PMKSA:
9643                 rdev_ops = rdev->ops->set_pmksa;
9644                 break;
9645         case NL80211_CMD_DEL_PMKSA:
9646                 rdev_ops = rdev->ops->del_pmksa;
9647                 break;
9648         default:
9649                 WARN_ON(1);
9650                 break;
9651         }
9652
9653         if (!rdev_ops)
9654                 return -EOPNOTSUPP;
9655
9656         return rdev_ops(&rdev->wiphy, dev, &pmksa);
9657 }
9658
9659 static int nl80211_flush_pmksa(struct sk_buff *skb, struct genl_info *info)
9660 {
9661         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9662         struct net_device *dev = info->user_ptr[1];
9663
9664         if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_STATION &&
9665             dev->ieee80211_ptr->iftype != NL80211_IFTYPE_P2P_CLIENT)
9666                 return -EOPNOTSUPP;
9667
9668         if (!rdev->ops->flush_pmksa)
9669                 return -EOPNOTSUPP;
9670
9671         return rdev_flush_pmksa(rdev, dev);
9672 }
9673
9674 static int nl80211_tdls_mgmt(struct sk_buff *skb, struct genl_info *info)
9675 {
9676         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9677         struct net_device *dev = info->user_ptr[1];
9678         u8 action_code, dialog_token;
9679         u32 peer_capability = 0;
9680         u16 status_code;
9681         u8 *peer;
9682         bool initiator;
9683
9684         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9685             !rdev->ops->tdls_mgmt)
9686                 return -EOPNOTSUPP;
9687
9688         if (!info->attrs[NL80211_ATTR_TDLS_ACTION] ||
9689             !info->attrs[NL80211_ATTR_STATUS_CODE] ||
9690             !info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN] ||
9691             !info->attrs[NL80211_ATTR_IE] ||
9692             !info->attrs[NL80211_ATTR_MAC])
9693                 return -EINVAL;
9694
9695         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9696         action_code = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_ACTION]);
9697         status_code = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
9698         dialog_token = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_DIALOG_TOKEN]);
9699         initiator = nla_get_flag(info->attrs[NL80211_ATTR_TDLS_INITIATOR]);
9700         if (info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY])
9701                 peer_capability =
9702                         nla_get_u32(info->attrs[NL80211_ATTR_TDLS_PEER_CAPABILITY]);
9703
9704         return rdev_tdls_mgmt(rdev, dev, peer, action_code,
9705                               dialog_token, status_code, peer_capability,
9706                               initiator,
9707                               nla_data(info->attrs[NL80211_ATTR_IE]),
9708                               nla_len(info->attrs[NL80211_ATTR_IE]));
9709 }
9710
9711 static int nl80211_tdls_oper(struct sk_buff *skb, struct genl_info *info)
9712 {
9713         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9714         struct net_device *dev = info->user_ptr[1];
9715         enum nl80211_tdls_operation operation;
9716         u8 *peer;
9717
9718         if (!(rdev->wiphy.flags & WIPHY_FLAG_SUPPORTS_TDLS) ||
9719             !rdev->ops->tdls_oper)
9720                 return -EOPNOTSUPP;
9721
9722         if (!info->attrs[NL80211_ATTR_TDLS_OPERATION] ||
9723             !info->attrs[NL80211_ATTR_MAC])
9724                 return -EINVAL;
9725
9726         operation = nla_get_u8(info->attrs[NL80211_ATTR_TDLS_OPERATION]);
9727         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
9728
9729         return rdev_tdls_oper(rdev, dev, peer, operation);
9730 }
9731
9732 static int nl80211_remain_on_channel(struct sk_buff *skb,
9733                                      struct genl_info *info)
9734 {
9735         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9736         struct wireless_dev *wdev = info->user_ptr[1];
9737         struct cfg80211_chan_def chandef;
9738         const struct cfg80211_chan_def *compat_chandef;
9739         struct sk_buff *msg;
9740         void *hdr;
9741         u64 cookie;
9742         u32 duration;
9743         int err;
9744
9745         if (!info->attrs[NL80211_ATTR_WIPHY_FREQ] ||
9746             !info->attrs[NL80211_ATTR_DURATION])
9747                 return -EINVAL;
9748
9749         duration = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9750
9751         if (!rdev->ops->remain_on_channel ||
9752             !(rdev->wiphy.flags & WIPHY_FLAG_HAS_REMAIN_ON_CHANNEL))
9753                 return -EOPNOTSUPP;
9754
9755         /*
9756          * We should be on that channel for at least a minimum amount of
9757          * time (10ms) but no longer than the driver supports.
9758          */
9759         if (duration < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9760             duration > rdev->wiphy.max_remain_on_channel_duration)
9761                 return -EINVAL;
9762
9763         err = nl80211_parse_chandef(rdev, info, &chandef);
9764         if (err)
9765                 return err;
9766
9767         wdev_lock(wdev);
9768         if (!cfg80211_off_channel_oper_allowed(wdev) &&
9769             !cfg80211_chandef_identical(&wdev->chandef, &chandef)) {
9770                 compat_chandef = cfg80211_chandef_compatible(&wdev->chandef,
9771                                                              &chandef);
9772                 if (compat_chandef != &chandef) {
9773                         wdev_unlock(wdev);
9774                         return -EBUSY;
9775                 }
9776         }
9777         wdev_unlock(wdev);
9778
9779         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9780         if (!msg)
9781                 return -ENOMEM;
9782
9783         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9784                              NL80211_CMD_REMAIN_ON_CHANNEL);
9785         if (!hdr) {
9786                 err = -ENOBUFS;
9787                 goto free_msg;
9788         }
9789
9790         err = rdev_remain_on_channel(rdev, wdev, chandef.chan,
9791                                      duration, &cookie);
9792
9793         if (err)
9794                 goto free_msg;
9795
9796         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
9797                               NL80211_ATTR_PAD))
9798                 goto nla_put_failure;
9799
9800         genlmsg_end(msg, hdr);
9801
9802         return genlmsg_reply(msg, info);
9803
9804  nla_put_failure:
9805         err = -ENOBUFS;
9806  free_msg:
9807         nlmsg_free(msg);
9808         return err;
9809 }
9810
9811 static int nl80211_cancel_remain_on_channel(struct sk_buff *skb,
9812                                             struct genl_info *info)
9813 {
9814         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9815         struct wireless_dev *wdev = info->user_ptr[1];
9816         u64 cookie;
9817
9818         if (!info->attrs[NL80211_ATTR_COOKIE])
9819                 return -EINVAL;
9820
9821         if (!rdev->ops->cancel_remain_on_channel)
9822                 return -EOPNOTSUPP;
9823
9824         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
9825
9826         return rdev_cancel_remain_on_channel(rdev, wdev, cookie);
9827 }
9828
9829 static int nl80211_set_tx_bitrate_mask(struct sk_buff *skb,
9830                                        struct genl_info *info)
9831 {
9832         struct cfg80211_bitrate_mask mask;
9833         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9834         struct net_device *dev = info->user_ptr[1];
9835         int err;
9836
9837         if (!rdev->ops->set_bitrate_mask)
9838                 return -EOPNOTSUPP;
9839
9840         err = nl80211_parse_tx_bitrate_mask(info, &mask);
9841         if (err)
9842                 return err;
9843
9844         return rdev_set_bitrate_mask(rdev, dev, NULL, &mask);
9845 }
9846
9847 static int nl80211_register_mgmt(struct sk_buff *skb, struct genl_info *info)
9848 {
9849         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9850         struct wireless_dev *wdev = info->user_ptr[1];
9851         u16 frame_type = IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_ACTION;
9852
9853         if (!info->attrs[NL80211_ATTR_FRAME_MATCH])
9854                 return -EINVAL;
9855
9856         if (info->attrs[NL80211_ATTR_FRAME_TYPE])
9857                 frame_type = nla_get_u16(info->attrs[NL80211_ATTR_FRAME_TYPE]);
9858
9859         switch (wdev->iftype) {
9860         case NL80211_IFTYPE_STATION:
9861         case NL80211_IFTYPE_ADHOC:
9862         case NL80211_IFTYPE_P2P_CLIENT:
9863         case NL80211_IFTYPE_AP:
9864         case NL80211_IFTYPE_AP_VLAN:
9865         case NL80211_IFTYPE_MESH_POINT:
9866         case NL80211_IFTYPE_P2P_GO:
9867         case NL80211_IFTYPE_P2P_DEVICE:
9868                 break;
9869         case NL80211_IFTYPE_NAN:
9870         default:
9871                 return -EOPNOTSUPP;
9872         }
9873
9874         /* not much point in registering if we can't reply */
9875         if (!rdev->ops->mgmt_tx)
9876                 return -EOPNOTSUPP;
9877
9878         return cfg80211_mlme_register_mgmt(wdev, info->snd_portid, frame_type,
9879                         nla_data(info->attrs[NL80211_ATTR_FRAME_MATCH]),
9880                         nla_len(info->attrs[NL80211_ATTR_FRAME_MATCH]));
9881 }
9882
9883 static int nl80211_tx_mgmt(struct sk_buff *skb, struct genl_info *info)
9884 {
9885         struct cfg80211_registered_device *rdev = info->user_ptr[0];
9886         struct wireless_dev *wdev = info->user_ptr[1];
9887         struct cfg80211_chan_def chandef;
9888         int err;
9889         void *hdr = NULL;
9890         u64 cookie;
9891         struct sk_buff *msg = NULL;
9892         struct cfg80211_mgmt_tx_params params = {
9893                 .dont_wait_for_ack =
9894                         info->attrs[NL80211_ATTR_DONT_WAIT_FOR_ACK],
9895         };
9896
9897         if (!info->attrs[NL80211_ATTR_FRAME])
9898                 return -EINVAL;
9899
9900         if (!rdev->ops->mgmt_tx)
9901                 return -EOPNOTSUPP;
9902
9903         switch (wdev->iftype) {
9904         case NL80211_IFTYPE_P2P_DEVICE:
9905                 if (!info->attrs[NL80211_ATTR_WIPHY_FREQ])
9906                         return -EINVAL;
9907         case NL80211_IFTYPE_STATION:
9908         case NL80211_IFTYPE_ADHOC:
9909         case NL80211_IFTYPE_P2P_CLIENT:
9910         case NL80211_IFTYPE_AP:
9911         case NL80211_IFTYPE_AP_VLAN:
9912         case NL80211_IFTYPE_MESH_POINT:
9913         case NL80211_IFTYPE_P2P_GO:
9914                 break;
9915         case NL80211_IFTYPE_NAN:
9916         default:
9917                 return -EOPNOTSUPP;
9918         }
9919
9920         if (info->attrs[NL80211_ATTR_DURATION]) {
9921                 if (!(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9922                         return -EINVAL;
9923                 params.wait = nla_get_u32(info->attrs[NL80211_ATTR_DURATION]);
9924
9925                 /*
9926                  * We should wait on the channel for at least a minimum amount
9927                  * of time (10ms) but no longer than the driver supports.
9928                  */
9929                 if (params.wait < NL80211_MIN_REMAIN_ON_CHANNEL_TIME ||
9930                     params.wait > rdev->wiphy.max_remain_on_channel_duration)
9931                         return -EINVAL;
9932         }
9933
9934         params.offchan = info->attrs[NL80211_ATTR_OFFCHANNEL_TX_OK];
9935
9936         if (params.offchan && !(rdev->wiphy.flags & WIPHY_FLAG_OFFCHAN_TX))
9937                 return -EINVAL;
9938
9939         params.no_cck = nla_get_flag(info->attrs[NL80211_ATTR_TX_NO_CCK_RATE]);
9940
9941         /* get the channel if any has been specified, otherwise pass NULL to
9942          * the driver. The latter will use the current one
9943          */
9944         chandef.chan = NULL;
9945         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
9946                 err = nl80211_parse_chandef(rdev, info, &chandef);
9947                 if (err)
9948                         return err;
9949         }
9950
9951         if (!chandef.chan && params.offchan)
9952                 return -EINVAL;
9953
9954         wdev_lock(wdev);
9955         if (params.offchan && !cfg80211_off_channel_oper_allowed(wdev)) {
9956                 wdev_unlock(wdev);
9957                 return -EBUSY;
9958         }
9959         wdev_unlock(wdev);
9960
9961         params.buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
9962         params.len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
9963
9964         if (info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]) {
9965                 int len = nla_len(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9966                 int i;
9967
9968                 if (len % sizeof(u16))
9969                         return -EINVAL;
9970
9971                 params.n_csa_offsets = len / sizeof(u16);
9972                 params.csa_offsets =
9973                         nla_data(info->attrs[NL80211_ATTR_CSA_C_OFFSETS_TX]);
9974
9975                 /* check that all the offsets fit the frame */
9976                 for (i = 0; i < params.n_csa_offsets; i++) {
9977                         if (params.csa_offsets[i] >= params.len)
9978                                 return -EINVAL;
9979                 }
9980         }
9981
9982         if (!params.dont_wait_for_ack) {
9983                 msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
9984                 if (!msg)
9985                         return -ENOMEM;
9986
9987                 hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
9988                                      NL80211_CMD_FRAME);
9989                 if (!hdr) {
9990                         err = -ENOBUFS;
9991                         goto free_msg;
9992                 }
9993         }
9994
9995         params.chan = chandef.chan;
9996         err = cfg80211_mlme_mgmt_tx(rdev, wdev, &params, &cookie);
9997         if (err)
9998                 goto free_msg;
9999
10000         if (msg) {
10001                 if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
10002                                       NL80211_ATTR_PAD))
10003                         goto nla_put_failure;
10004
10005                 genlmsg_end(msg, hdr);
10006                 return genlmsg_reply(msg, info);
10007         }
10008
10009         return 0;
10010
10011  nla_put_failure:
10012         err = -ENOBUFS;
10013  free_msg:
10014         nlmsg_free(msg);
10015         return err;
10016 }
10017
10018 static int nl80211_tx_mgmt_cancel_wait(struct sk_buff *skb, struct genl_info *info)
10019 {
10020         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10021         struct wireless_dev *wdev = info->user_ptr[1];
10022         u64 cookie;
10023
10024         if (!info->attrs[NL80211_ATTR_COOKIE])
10025                 return -EINVAL;
10026
10027         if (!rdev->ops->mgmt_tx_cancel_wait)
10028                 return -EOPNOTSUPP;
10029
10030         switch (wdev->iftype) {
10031         case NL80211_IFTYPE_STATION:
10032         case NL80211_IFTYPE_ADHOC:
10033         case NL80211_IFTYPE_P2P_CLIENT:
10034         case NL80211_IFTYPE_AP:
10035         case NL80211_IFTYPE_AP_VLAN:
10036         case NL80211_IFTYPE_P2P_GO:
10037         case NL80211_IFTYPE_P2P_DEVICE:
10038                 break;
10039         case NL80211_IFTYPE_NAN:
10040         default:
10041                 return -EOPNOTSUPP;
10042         }
10043
10044         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
10045
10046         return rdev_mgmt_tx_cancel_wait(rdev, wdev, cookie);
10047 }
10048
10049 static int nl80211_set_power_save(struct sk_buff *skb, struct genl_info *info)
10050 {
10051         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10052         struct wireless_dev *wdev;
10053         struct net_device *dev = info->user_ptr[1];
10054         u8 ps_state;
10055         bool state;
10056         int err;
10057
10058         if (!info->attrs[NL80211_ATTR_PS_STATE])
10059                 return -EINVAL;
10060
10061         ps_state = nla_get_u32(info->attrs[NL80211_ATTR_PS_STATE]);
10062
10063         wdev = dev->ieee80211_ptr;
10064
10065         if (!rdev->ops->set_power_mgmt)
10066                 return -EOPNOTSUPP;
10067
10068         state = (ps_state == NL80211_PS_ENABLED) ? true : false;
10069
10070         if (state == wdev->ps)
10071                 return 0;
10072
10073         err = rdev_set_power_mgmt(rdev, dev, state, wdev->ps_timeout);
10074         if (!err)
10075                 wdev->ps = state;
10076         return err;
10077 }
10078
10079 static int nl80211_get_power_save(struct sk_buff *skb, struct genl_info *info)
10080 {
10081         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10082         enum nl80211_ps_state ps_state;
10083         struct wireless_dev *wdev;
10084         struct net_device *dev = info->user_ptr[1];
10085         struct sk_buff *msg;
10086         void *hdr;
10087         int err;
10088
10089         wdev = dev->ieee80211_ptr;
10090
10091         if (!rdev->ops->set_power_mgmt)
10092                 return -EOPNOTSUPP;
10093
10094         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
10095         if (!msg)
10096                 return -ENOMEM;
10097
10098         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10099                              NL80211_CMD_GET_POWER_SAVE);
10100         if (!hdr) {
10101                 err = -ENOBUFS;
10102                 goto free_msg;
10103         }
10104
10105         if (wdev->ps)
10106                 ps_state = NL80211_PS_ENABLED;
10107         else
10108                 ps_state = NL80211_PS_DISABLED;
10109
10110         if (nla_put_u32(msg, NL80211_ATTR_PS_STATE, ps_state))
10111                 goto nla_put_failure;
10112
10113         genlmsg_end(msg, hdr);
10114         return genlmsg_reply(msg, info);
10115
10116  nla_put_failure:
10117         err = -ENOBUFS;
10118  free_msg:
10119         nlmsg_free(msg);
10120         return err;
10121 }
10122
10123 static const struct nla_policy
10124 nl80211_attr_cqm_policy[NL80211_ATTR_CQM_MAX + 1] = {
10125         [NL80211_ATTR_CQM_RSSI_THOLD] = { .type = NLA_BINARY },
10126         [NL80211_ATTR_CQM_RSSI_HYST] = { .type = NLA_U32 },
10127         [NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT] = { .type = NLA_U32 },
10128         [NL80211_ATTR_CQM_TXE_RATE] = { .type = NLA_U32 },
10129         [NL80211_ATTR_CQM_TXE_PKTS] = { .type = NLA_U32 },
10130         [NL80211_ATTR_CQM_TXE_INTVL] = { .type = NLA_U32 },
10131         [NL80211_ATTR_CQM_RSSI_LEVEL] = { .type = NLA_S32 },
10132 };
10133
10134 static int nl80211_set_cqm_txe(struct genl_info *info,
10135                                u32 rate, u32 pkts, u32 intvl)
10136 {
10137         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10138         struct net_device *dev = info->user_ptr[1];
10139         struct wireless_dev *wdev = dev->ieee80211_ptr;
10140
10141         if (rate > 100 || intvl > NL80211_CQM_TXE_MAX_INTVL)
10142                 return -EINVAL;
10143
10144         if (!rdev->ops->set_cqm_txe_config)
10145                 return -EOPNOTSUPP;
10146
10147         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10148             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10149                 return -EOPNOTSUPP;
10150
10151         return rdev_set_cqm_txe_config(rdev, dev, rate, pkts, intvl);
10152 }
10153
10154 static int cfg80211_cqm_rssi_update(struct cfg80211_registered_device *rdev,
10155                                     struct net_device *dev)
10156 {
10157         struct wireless_dev *wdev = dev->ieee80211_ptr;
10158         s32 last, low, high;
10159         u32 hyst;
10160         int i, n, low_index;
10161         int err;
10162
10163         /* RSSI reporting disabled? */
10164         if (!wdev->cqm_config)
10165                 return rdev_set_cqm_rssi_range_config(rdev, dev, 0, 0);
10166
10167         /*
10168          * Obtain current RSSI value if possible, if not and no RSSI threshold
10169          * event has been received yet, we should receive an event after a
10170          * connection is established and enough beacons received to calculate
10171          * the average.
10172          */
10173         if (!wdev->cqm_config->last_rssi_event_value && wdev->current_bss &&
10174             rdev->ops->get_station) {
10175                 struct station_info sinfo = {};
10176                 u8 *mac_addr;
10177
10178                 mac_addr = wdev->current_bss->pub.bssid;
10179
10180                 err = rdev_get_station(rdev, dev, mac_addr, &sinfo);
10181                 if (err)
10182                         return err;
10183
10184                 if (sinfo.filled & BIT_ULL(NL80211_STA_INFO_BEACON_SIGNAL_AVG))
10185                         wdev->cqm_config->last_rssi_event_value =
10186                                 (s8) sinfo.rx_beacon_signal_avg;
10187         }
10188
10189         last = wdev->cqm_config->last_rssi_event_value;
10190         hyst = wdev->cqm_config->rssi_hyst;
10191         n = wdev->cqm_config->n_rssi_thresholds;
10192
10193         for (i = 0; i < n; i++)
10194                 if (last < wdev->cqm_config->rssi_thresholds[i])
10195                         break;
10196
10197         low_index = i - 1;
10198         if (low_index >= 0) {
10199                 low_index = array_index_nospec(low_index, n);
10200                 low = wdev->cqm_config->rssi_thresholds[low_index] - hyst;
10201         } else {
10202                 low = S32_MIN;
10203         }
10204         if (i < n) {
10205                 i = array_index_nospec(i, n);
10206                 high = wdev->cqm_config->rssi_thresholds[i] + hyst - 1;
10207         } else {
10208                 high = S32_MAX;
10209         }
10210
10211         return rdev_set_cqm_rssi_range_config(rdev, dev, low, high);
10212 }
10213
10214 static int nl80211_set_cqm_rssi(struct genl_info *info,
10215                                 const s32 *thresholds, int n_thresholds,
10216                                 u32 hysteresis)
10217 {
10218         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10219         struct net_device *dev = info->user_ptr[1];
10220         struct wireless_dev *wdev = dev->ieee80211_ptr;
10221         int i, err;
10222         s32 prev = S32_MIN;
10223
10224         /* Check all values negative and sorted */
10225         for (i = 0; i < n_thresholds; i++) {
10226                 if (thresholds[i] > 0 || thresholds[i] <= prev)
10227                         return -EINVAL;
10228
10229                 prev = thresholds[i];
10230         }
10231
10232         if (wdev->iftype != NL80211_IFTYPE_STATION &&
10233             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
10234                 return -EOPNOTSUPP;
10235
10236         wdev_lock(wdev);
10237         cfg80211_cqm_config_free(wdev);
10238         wdev_unlock(wdev);
10239
10240         if (n_thresholds <= 1 && rdev->ops->set_cqm_rssi_config) {
10241                 if (n_thresholds == 0 || thresholds[0] == 0) /* Disabling */
10242                         return rdev_set_cqm_rssi_config(rdev, dev, 0, 0);
10243
10244                 return rdev_set_cqm_rssi_config(rdev, dev,
10245                                                 thresholds[0], hysteresis);
10246         }
10247
10248         if (!wiphy_ext_feature_isset(&rdev->wiphy,
10249                                      NL80211_EXT_FEATURE_CQM_RSSI_LIST))
10250                 return -EOPNOTSUPP;
10251
10252         if (n_thresholds == 1 && thresholds[0] == 0) /* Disabling */
10253                 n_thresholds = 0;
10254
10255         wdev_lock(wdev);
10256         if (n_thresholds) {
10257                 struct cfg80211_cqm_config *cqm_config;
10258
10259                 cqm_config = kzalloc(sizeof(struct cfg80211_cqm_config) +
10260                                      n_thresholds * sizeof(s32), GFP_KERNEL);
10261                 if (!cqm_config) {
10262                         err = -ENOMEM;
10263                         goto unlock;
10264                 }
10265
10266                 cqm_config->rssi_hyst = hysteresis;
10267                 cqm_config->n_rssi_thresholds = n_thresholds;
10268                 memcpy(cqm_config->rssi_thresholds, thresholds,
10269                        n_thresholds * sizeof(s32));
10270
10271                 wdev->cqm_config = cqm_config;
10272         }
10273
10274         err = cfg80211_cqm_rssi_update(rdev, dev);
10275
10276 unlock:
10277         wdev_unlock(wdev);
10278
10279         return err;
10280 }
10281
10282 static int nl80211_set_cqm(struct sk_buff *skb, struct genl_info *info)
10283 {
10284         struct nlattr *attrs[NL80211_ATTR_CQM_MAX + 1];
10285         struct nlattr *cqm;
10286         int err;
10287
10288         cqm = info->attrs[NL80211_ATTR_CQM];
10289         if (!cqm)
10290                 return -EINVAL;
10291
10292         err = nla_parse_nested(attrs, NL80211_ATTR_CQM_MAX, cqm,
10293                                nl80211_attr_cqm_policy, info->extack);
10294         if (err)
10295                 return err;
10296
10297         if (attrs[NL80211_ATTR_CQM_RSSI_THOLD] &&
10298             attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
10299                 const s32 *thresholds =
10300                         nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10301                 int len = nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
10302                 u32 hysteresis = nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
10303
10304                 if (len % 4)
10305                         return -EINVAL;
10306
10307                 return nl80211_set_cqm_rssi(info, thresholds, len / 4,
10308                                             hysteresis);
10309         }
10310
10311         if (attrs[NL80211_ATTR_CQM_TXE_RATE] &&
10312             attrs[NL80211_ATTR_CQM_TXE_PKTS] &&
10313             attrs[NL80211_ATTR_CQM_TXE_INTVL]) {
10314                 u32 rate = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_RATE]);
10315                 u32 pkts = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_PKTS]);
10316                 u32 intvl = nla_get_u32(attrs[NL80211_ATTR_CQM_TXE_INTVL]);
10317
10318                 return nl80211_set_cqm_txe(info, rate, pkts, intvl);
10319         }
10320
10321         return -EINVAL;
10322 }
10323
10324 static int nl80211_join_ocb(struct sk_buff *skb, struct genl_info *info)
10325 {
10326         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10327         struct net_device *dev = info->user_ptr[1];
10328         struct ocb_setup setup = {};
10329         int err;
10330
10331         err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10332         if (err)
10333                 return err;
10334
10335         return cfg80211_join_ocb(rdev, dev, &setup);
10336 }
10337
10338 static int nl80211_leave_ocb(struct sk_buff *skb, struct genl_info *info)
10339 {
10340         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10341         struct net_device *dev = info->user_ptr[1];
10342
10343         return cfg80211_leave_ocb(rdev, dev);
10344 }
10345
10346 static int nl80211_join_mesh(struct sk_buff *skb, struct genl_info *info)
10347 {
10348         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10349         struct net_device *dev = info->user_ptr[1];
10350         struct mesh_config cfg;
10351         struct mesh_setup setup;
10352         int err;
10353
10354         /* start with default */
10355         memcpy(&cfg, &default_mesh_config, sizeof(cfg));
10356         memcpy(&setup, &default_mesh_setup, sizeof(setup));
10357
10358         if (info->attrs[NL80211_ATTR_MESH_CONFIG]) {
10359                 /* and parse parameters if given */
10360                 err = nl80211_parse_mesh_config(info, &cfg, NULL);
10361                 if (err)
10362                         return err;
10363         }
10364
10365         if (!info->attrs[NL80211_ATTR_MESH_ID] ||
10366             !nla_len(info->attrs[NL80211_ATTR_MESH_ID]))
10367                 return -EINVAL;
10368
10369         setup.mesh_id = nla_data(info->attrs[NL80211_ATTR_MESH_ID]);
10370         setup.mesh_id_len = nla_len(info->attrs[NL80211_ATTR_MESH_ID]);
10371
10372         if (info->attrs[NL80211_ATTR_MCAST_RATE] &&
10373             !nl80211_parse_mcast_rate(rdev, setup.mcast_rate,
10374                             nla_get_u32(info->attrs[NL80211_ATTR_MCAST_RATE])))
10375                         return -EINVAL;
10376
10377         if (info->attrs[NL80211_ATTR_BEACON_INTERVAL]) {
10378                 setup.beacon_interval =
10379                         nla_get_u32(info->attrs[NL80211_ATTR_BEACON_INTERVAL]);
10380
10381                 err = cfg80211_validate_beacon_int(rdev,
10382                                                    NL80211_IFTYPE_MESH_POINT,
10383                                                    setup.beacon_interval);
10384                 if (err)
10385                         return err;
10386         }
10387
10388         if (info->attrs[NL80211_ATTR_DTIM_PERIOD]) {
10389                 setup.dtim_period =
10390                         nla_get_u32(info->attrs[NL80211_ATTR_DTIM_PERIOD]);
10391                 if (setup.dtim_period < 1 || setup.dtim_period > 100)
10392                         return -EINVAL;
10393         }
10394
10395         if (info->attrs[NL80211_ATTR_MESH_SETUP]) {
10396                 /* parse additional setup parameters if given */
10397                 err = nl80211_parse_mesh_setup(info, &setup);
10398                 if (err)
10399                         return err;
10400         }
10401
10402         if (setup.user_mpm)
10403                 cfg.auto_open_plinks = false;
10404
10405         if (info->attrs[NL80211_ATTR_WIPHY_FREQ]) {
10406                 err = nl80211_parse_chandef(rdev, info, &setup.chandef);
10407                 if (err)
10408                         return err;
10409         } else {
10410                 /* __cfg80211_join_mesh() will sort it out */
10411                 setup.chandef.chan = NULL;
10412         }
10413
10414         if (info->attrs[NL80211_ATTR_BSS_BASIC_RATES]) {
10415                 u8 *rates = nla_data(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10416                 int n_rates =
10417                         nla_len(info->attrs[NL80211_ATTR_BSS_BASIC_RATES]);
10418                 struct ieee80211_supported_band *sband;
10419
10420                 if (!setup.chandef.chan)
10421                         return -EINVAL;
10422
10423                 sband = rdev->wiphy.bands[setup.chandef.chan->band];
10424
10425                 err = ieee80211_get_ratemask(sband, rates, n_rates,
10426                                              &setup.basic_rates);
10427                 if (err)
10428                         return err;
10429         }
10430
10431         if (info->attrs[NL80211_ATTR_TX_RATES]) {
10432                 err = nl80211_parse_tx_bitrate_mask(info, &setup.beacon_rate);
10433                 if (err)
10434                         return err;
10435
10436                 if (!setup.chandef.chan)
10437                         return -EINVAL;
10438
10439                 err = validate_beacon_tx_rate(rdev, setup.chandef.chan->band,
10440                                               &setup.beacon_rate);
10441                 if (err)
10442                         return err;
10443         }
10444
10445         setup.userspace_handles_dfs =
10446                 nla_get_flag(info->attrs[NL80211_ATTR_HANDLE_DFS]);
10447
10448         if (info->attrs[NL80211_ATTR_CONTROL_PORT_OVER_NL80211]) {
10449                 int r = validate_pae_over_nl80211(rdev, info);
10450
10451                 if (r < 0)
10452                         return r;
10453
10454                 setup.control_port_over_nl80211 = true;
10455         }
10456
10457         wdev_lock(dev->ieee80211_ptr);
10458         err = __cfg80211_join_mesh(rdev, dev, &setup, &cfg);
10459         if (!err && info->attrs[NL80211_ATTR_SOCKET_OWNER])
10460                 dev->ieee80211_ptr->conn_owner_nlportid = info->snd_portid;
10461         wdev_unlock(dev->ieee80211_ptr);
10462
10463         return err;
10464 }
10465
10466 static int nl80211_leave_mesh(struct sk_buff *skb, struct genl_info *info)
10467 {
10468         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10469         struct net_device *dev = info->user_ptr[1];
10470
10471         return cfg80211_leave_mesh(rdev, dev);
10472 }
10473
10474 #ifdef CONFIG_PM
10475 static int nl80211_send_wowlan_patterns(struct sk_buff *msg,
10476                                         struct cfg80211_registered_device *rdev)
10477 {
10478         struct cfg80211_wowlan *wowlan = rdev->wiphy.wowlan_config;
10479         struct nlattr *nl_pats, *nl_pat;
10480         int i, pat_len;
10481
10482         if (!wowlan->n_patterns)
10483                 return 0;
10484
10485         nl_pats = nla_nest_start(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN);
10486         if (!nl_pats)
10487                 return -ENOBUFS;
10488
10489         for (i = 0; i < wowlan->n_patterns; i++) {
10490                 nl_pat = nla_nest_start(msg, i + 1);
10491                 if (!nl_pat)
10492                         return -ENOBUFS;
10493                 pat_len = wowlan->patterns[i].pattern_len;
10494                 if (nla_put(msg, NL80211_PKTPAT_MASK, DIV_ROUND_UP(pat_len, 8),
10495                             wowlan->patterns[i].mask) ||
10496                     nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
10497                             wowlan->patterns[i].pattern) ||
10498                     nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
10499                                 wowlan->patterns[i].pkt_offset))
10500                         return -ENOBUFS;
10501                 nla_nest_end(msg, nl_pat);
10502         }
10503         nla_nest_end(msg, nl_pats);
10504
10505         return 0;
10506 }
10507
10508 static int nl80211_send_wowlan_tcp(struct sk_buff *msg,
10509                                    struct cfg80211_wowlan_tcp *tcp)
10510 {
10511         struct nlattr *nl_tcp;
10512
10513         if (!tcp)
10514                 return 0;
10515
10516         nl_tcp = nla_nest_start(msg, NL80211_WOWLAN_TRIG_TCP_CONNECTION);
10517         if (!nl_tcp)
10518                 return -ENOBUFS;
10519
10520         if (nla_put_in_addr(msg, NL80211_WOWLAN_TCP_SRC_IPV4, tcp->src) ||
10521             nla_put_in_addr(msg, NL80211_WOWLAN_TCP_DST_IPV4, tcp->dst) ||
10522             nla_put(msg, NL80211_WOWLAN_TCP_DST_MAC, ETH_ALEN, tcp->dst_mac) ||
10523             nla_put_u16(msg, NL80211_WOWLAN_TCP_SRC_PORT, tcp->src_port) ||
10524             nla_put_u16(msg, NL80211_WOWLAN_TCP_DST_PORT, tcp->dst_port) ||
10525             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD,
10526                     tcp->payload_len, tcp->payload) ||
10527             nla_put_u32(msg, NL80211_WOWLAN_TCP_DATA_INTERVAL,
10528                         tcp->data_interval) ||
10529             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_PAYLOAD,
10530                     tcp->wake_len, tcp->wake_data) ||
10531             nla_put(msg, NL80211_WOWLAN_TCP_WAKE_MASK,
10532                     DIV_ROUND_UP(tcp->wake_len, 8), tcp->wake_mask))
10533                 return -ENOBUFS;
10534
10535         if (tcp->payload_seq.len &&
10536             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ,
10537                     sizeof(tcp->payload_seq), &tcp->payload_seq))
10538                 return -ENOBUFS;
10539
10540         if (tcp->payload_tok.len &&
10541             nla_put(msg, NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN,
10542                     sizeof(tcp->payload_tok) + tcp->tokens_size,
10543                     &tcp->payload_tok))
10544                 return -ENOBUFS;
10545
10546         nla_nest_end(msg, nl_tcp);
10547
10548         return 0;
10549 }
10550
10551 static int nl80211_send_wowlan_nd(struct sk_buff *msg,
10552                                   struct cfg80211_sched_scan_request *req)
10553 {
10554         struct nlattr *nd, *freqs, *matches, *match, *scan_plans, *scan_plan;
10555         int i;
10556
10557         if (!req)
10558                 return 0;
10559
10560         nd = nla_nest_start(msg, NL80211_WOWLAN_TRIG_NET_DETECT);
10561         if (!nd)
10562                 return -ENOBUFS;
10563
10564         if (req->n_scan_plans == 1 &&
10565             nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_INTERVAL,
10566                         req->scan_plans[0].interval * 1000))
10567                 return -ENOBUFS;
10568
10569         if (nla_put_u32(msg, NL80211_ATTR_SCHED_SCAN_DELAY, req->delay))
10570                 return -ENOBUFS;
10571
10572         if (req->relative_rssi_set) {
10573                 struct nl80211_bss_select_rssi_adjust rssi_adjust;
10574
10575                 if (nla_put_s8(msg, NL80211_ATTR_SCHED_SCAN_RELATIVE_RSSI,
10576                                req->relative_rssi))
10577                         return -ENOBUFS;
10578
10579                 rssi_adjust.band = req->rssi_adjust.band;
10580                 rssi_adjust.delta = req->rssi_adjust.delta;
10581                 if (nla_put(msg, NL80211_ATTR_SCHED_SCAN_RSSI_ADJUST,
10582                             sizeof(rssi_adjust), &rssi_adjust))
10583                         return -ENOBUFS;
10584         }
10585
10586         freqs = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
10587         if (!freqs)
10588                 return -ENOBUFS;
10589
10590         for (i = 0; i < req->n_channels; i++) {
10591                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
10592                         return -ENOBUFS;
10593         }
10594
10595         nla_nest_end(msg, freqs);
10596
10597         if (req->n_match_sets) {
10598                 matches = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_MATCH);
10599                 if (!matches)
10600                         return -ENOBUFS;
10601
10602                 for (i = 0; i < req->n_match_sets; i++) {
10603                         match = nla_nest_start(msg, i);
10604                         if (!match)
10605                                 return -ENOBUFS;
10606
10607                         if (nla_put(msg, NL80211_SCHED_SCAN_MATCH_ATTR_SSID,
10608                                     req->match_sets[i].ssid.ssid_len,
10609                                     req->match_sets[i].ssid.ssid))
10610                                 return -ENOBUFS;
10611                         nla_nest_end(msg, match);
10612                 }
10613                 nla_nest_end(msg, matches);
10614         }
10615
10616         scan_plans = nla_nest_start(msg, NL80211_ATTR_SCHED_SCAN_PLANS);
10617         if (!scan_plans)
10618                 return -ENOBUFS;
10619
10620         for (i = 0; i < req->n_scan_plans; i++) {
10621                 scan_plan = nla_nest_start(msg, i + 1);
10622                 if (!scan_plan)
10623                         return -ENOBUFS;
10624
10625                 if (nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_INTERVAL,
10626                                 req->scan_plans[i].interval) ||
10627                     (req->scan_plans[i].iterations &&
10628                      nla_put_u32(msg, NL80211_SCHED_SCAN_PLAN_ITERATIONS,
10629                                  req->scan_plans[i].iterations)))
10630                         return -ENOBUFS;
10631                 nla_nest_end(msg, scan_plan);
10632         }
10633         nla_nest_end(msg, scan_plans);
10634
10635         nla_nest_end(msg, nd);
10636
10637         return 0;
10638 }
10639
10640 static int nl80211_get_wowlan(struct sk_buff *skb, struct genl_info *info)
10641 {
10642         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10643         struct sk_buff *msg;
10644         void *hdr;
10645         u32 size = NLMSG_DEFAULT_SIZE;
10646
10647         if (!rdev->wiphy.wowlan)
10648                 return -EOPNOTSUPP;
10649
10650         if (rdev->wiphy.wowlan_config && rdev->wiphy.wowlan_config->tcp) {
10651                 /* adjust size to have room for all the data */
10652                 size += rdev->wiphy.wowlan_config->tcp->tokens_size +
10653                         rdev->wiphy.wowlan_config->tcp->payload_len +
10654                         rdev->wiphy.wowlan_config->tcp->wake_len +
10655                         rdev->wiphy.wowlan_config->tcp->wake_len / 8;
10656         }
10657
10658         msg = nlmsg_new(size, GFP_KERNEL);
10659         if (!msg)
10660                 return -ENOMEM;
10661
10662         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
10663                              NL80211_CMD_GET_WOWLAN);
10664         if (!hdr)
10665                 goto nla_put_failure;
10666
10667         if (rdev->wiphy.wowlan_config) {
10668                 struct nlattr *nl_wowlan;
10669
10670                 nl_wowlan = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
10671                 if (!nl_wowlan)
10672                         goto nla_put_failure;
10673
10674                 if ((rdev->wiphy.wowlan_config->any &&
10675                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_ANY)) ||
10676                     (rdev->wiphy.wowlan_config->disconnect &&
10677                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT)) ||
10678                     (rdev->wiphy.wowlan_config->magic_pkt &&
10679                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT)) ||
10680                     (rdev->wiphy.wowlan_config->gtk_rekey_failure &&
10681                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE)) ||
10682                     (rdev->wiphy.wowlan_config->eap_identity_req &&
10683                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST)) ||
10684                     (rdev->wiphy.wowlan_config->four_way_handshake &&
10685                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE)) ||
10686                     (rdev->wiphy.wowlan_config->rfkill_release &&
10687                      nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE)))
10688                         goto nla_put_failure;
10689
10690                 if (nl80211_send_wowlan_patterns(msg, rdev))
10691                         goto nla_put_failure;
10692
10693                 if (nl80211_send_wowlan_tcp(msg,
10694                                             rdev->wiphy.wowlan_config->tcp))
10695                         goto nla_put_failure;
10696
10697                 if (nl80211_send_wowlan_nd(
10698                             msg,
10699                             rdev->wiphy.wowlan_config->nd_config))
10700                         goto nla_put_failure;
10701
10702                 nla_nest_end(msg, nl_wowlan);
10703         }
10704
10705         genlmsg_end(msg, hdr);
10706         return genlmsg_reply(msg, info);
10707
10708 nla_put_failure:
10709         nlmsg_free(msg);
10710         return -ENOBUFS;
10711 }
10712
10713 static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
10714                                     struct nlattr *attr,
10715                                     struct cfg80211_wowlan *trig)
10716 {
10717         struct nlattr *tb[NUM_NL80211_WOWLAN_TCP];
10718         struct cfg80211_wowlan_tcp *cfg;
10719         struct nl80211_wowlan_tcp_data_token *tok = NULL;
10720         struct nl80211_wowlan_tcp_data_seq *seq = NULL;
10721         u32 size;
10722         u32 data_size, wake_size, tokens_size = 0, wake_mask_size;
10723         int err, port;
10724
10725         if (!rdev->wiphy.wowlan->tcp)
10726                 return -EINVAL;
10727
10728         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TCP, attr,
10729                                nl80211_wowlan_tcp_policy, NULL);
10730         if (err)
10731                 return err;
10732
10733         if (!tb[NL80211_WOWLAN_TCP_SRC_IPV4] ||
10734             !tb[NL80211_WOWLAN_TCP_DST_IPV4] ||
10735             !tb[NL80211_WOWLAN_TCP_DST_MAC] ||
10736             !tb[NL80211_WOWLAN_TCP_DST_PORT] ||
10737             !tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD] ||
10738             !tb[NL80211_WOWLAN_TCP_DATA_INTERVAL] ||
10739             !tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD] ||
10740             !tb[NL80211_WOWLAN_TCP_WAKE_MASK])
10741                 return -EINVAL;
10742
10743         data_size = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]);
10744         if (data_size > rdev->wiphy.wowlan->tcp->data_payload_max)
10745                 return -EINVAL;
10746
10747         if (nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) >
10748                         rdev->wiphy.wowlan->tcp->data_interval_max ||
10749             nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]) == 0)
10750                 return -EINVAL;
10751
10752         wake_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]);
10753         if (wake_size > rdev->wiphy.wowlan->tcp->wake_payload_max)
10754                 return -EINVAL;
10755
10756         wake_mask_size = nla_len(tb[NL80211_WOWLAN_TCP_WAKE_MASK]);
10757         if (wake_mask_size != DIV_ROUND_UP(wake_size, 8))
10758                 return -EINVAL;
10759
10760         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]) {
10761                 u32 tokln = nla_len(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10762
10763                 tok = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_TOKEN]);
10764                 tokens_size = tokln - sizeof(*tok);
10765
10766                 if (!tok->len || tokens_size % tok->len)
10767                         return -EINVAL;
10768                 if (!rdev->wiphy.wowlan->tcp->tok)
10769                         return -EINVAL;
10770                 if (tok->len > rdev->wiphy.wowlan->tcp->tok->max_len)
10771                         return -EINVAL;
10772                 if (tok->len < rdev->wiphy.wowlan->tcp->tok->min_len)
10773                         return -EINVAL;
10774                 if (tokens_size > rdev->wiphy.wowlan->tcp->tok->bufsize)
10775                         return -EINVAL;
10776                 if (tok->offset + tok->len > data_size)
10777                         return -EINVAL;
10778         }
10779
10780         if (tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]) {
10781                 seq = nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD_SEQ]);
10782                 if (!rdev->wiphy.wowlan->tcp->seq)
10783                         return -EINVAL;
10784                 if (seq->len == 0 || seq->len > 4)
10785                         return -EINVAL;
10786                 if (seq->len + seq->offset > data_size)
10787                         return -EINVAL;
10788         }
10789
10790         size = sizeof(*cfg);
10791         size += data_size;
10792         size += wake_size + wake_mask_size;
10793         size += tokens_size;
10794
10795         cfg = kzalloc(size, GFP_KERNEL);
10796         if (!cfg)
10797                 return -ENOMEM;
10798         cfg->src = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_SRC_IPV4]);
10799         cfg->dst = nla_get_in_addr(tb[NL80211_WOWLAN_TCP_DST_IPV4]);
10800         memcpy(cfg->dst_mac, nla_data(tb[NL80211_WOWLAN_TCP_DST_MAC]),
10801                ETH_ALEN);
10802         if (tb[NL80211_WOWLAN_TCP_SRC_PORT])
10803                 port = nla_get_u16(tb[NL80211_WOWLAN_TCP_SRC_PORT]);
10804         else
10805                 port = 0;
10806 #ifdef CONFIG_INET
10807         /* allocate a socket and port for it and use it */
10808         err = __sock_create(wiphy_net(&rdev->wiphy), PF_INET, SOCK_STREAM,
10809                             IPPROTO_TCP, &cfg->sock, 1);
10810         if (err) {
10811                 kfree(cfg);
10812                 return err;
10813         }
10814         if (inet_csk_get_port(cfg->sock->sk, port)) {
10815                 sock_release(cfg->sock);
10816                 kfree(cfg);
10817                 return -EADDRINUSE;
10818         }
10819         cfg->src_port = inet_sk(cfg->sock->sk)->inet_num;
10820 #else
10821         if (!port) {
10822                 kfree(cfg);
10823                 return -EINVAL;
10824         }
10825         cfg->src_port = port;
10826 #endif
10827
10828         cfg->dst_port = nla_get_u16(tb[NL80211_WOWLAN_TCP_DST_PORT]);
10829         cfg->payload_len = data_size;
10830         cfg->payload = (u8 *)cfg + sizeof(*cfg) + tokens_size;
10831         memcpy((void *)cfg->payload,
10832                nla_data(tb[NL80211_WOWLAN_TCP_DATA_PAYLOAD]),
10833                data_size);
10834         if (seq)
10835                 cfg->payload_seq = *seq;
10836         cfg->data_interval = nla_get_u32(tb[NL80211_WOWLAN_TCP_DATA_INTERVAL]);
10837         cfg->wake_len = wake_size;
10838         cfg->wake_data = (u8 *)cfg + sizeof(*cfg) + tokens_size + data_size;
10839         memcpy((void *)cfg->wake_data,
10840                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_PAYLOAD]),
10841                wake_size);
10842         cfg->wake_mask = (u8 *)cfg + sizeof(*cfg) + tokens_size +
10843                          data_size + wake_size;
10844         memcpy((void *)cfg->wake_mask,
10845                nla_data(tb[NL80211_WOWLAN_TCP_WAKE_MASK]),
10846                wake_mask_size);
10847         if (tok) {
10848                 cfg->tokens_size = tokens_size;
10849                 memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
10850         }
10851
10852         trig->tcp = cfg;
10853
10854         return 0;
10855 }
10856
10857 static int nl80211_parse_wowlan_nd(struct cfg80211_registered_device *rdev,
10858                                    const struct wiphy_wowlan_support *wowlan,
10859                                    struct nlattr *attr,
10860                                    struct cfg80211_wowlan *trig)
10861 {
10862         struct nlattr **tb;
10863         int err;
10864
10865         tb = kcalloc(NUM_NL80211_ATTR, sizeof(*tb), GFP_KERNEL);
10866         if (!tb)
10867                 return -ENOMEM;
10868
10869         if (!(wowlan->flags & WIPHY_WOWLAN_NET_DETECT)) {
10870                 err = -EOPNOTSUPP;
10871                 goto out;
10872         }
10873
10874         err = nla_parse_nested(tb, NL80211_ATTR_MAX, attr, nl80211_policy,
10875                                NULL);
10876         if (err)
10877                 goto out;
10878
10879         trig->nd_config = nl80211_parse_sched_scan(&rdev->wiphy, NULL, tb,
10880                                                    wowlan->max_nd_match_sets);
10881         err = PTR_ERR_OR_ZERO(trig->nd_config);
10882         if (err)
10883                 trig->nd_config = NULL;
10884
10885 out:
10886         kfree(tb);
10887         return err;
10888 }
10889
10890 static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
10891 {
10892         struct cfg80211_registered_device *rdev = info->user_ptr[0];
10893         struct nlattr *tb[NUM_NL80211_WOWLAN_TRIG];
10894         struct cfg80211_wowlan new_triggers = {};
10895         struct cfg80211_wowlan *ntrig;
10896         const struct wiphy_wowlan_support *wowlan = rdev->wiphy.wowlan;
10897         int err, i;
10898         bool prev_enabled = rdev->wiphy.wowlan_config;
10899         bool regular = false;
10900
10901         if (!wowlan)
10902                 return -EOPNOTSUPP;
10903
10904         if (!info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS]) {
10905                 cfg80211_rdev_free_wowlan(rdev);
10906                 rdev->wiphy.wowlan_config = NULL;
10907                 goto set_wakeup;
10908         }
10909
10910         err = nla_parse_nested(tb, MAX_NL80211_WOWLAN_TRIG,
10911                                info->attrs[NL80211_ATTR_WOWLAN_TRIGGERS],
10912                                nl80211_wowlan_policy, info->extack);
10913         if (err)
10914                 return err;
10915
10916         if (tb[NL80211_WOWLAN_TRIG_ANY]) {
10917                 if (!(wowlan->flags & WIPHY_WOWLAN_ANY))
10918                         return -EINVAL;
10919                 new_triggers.any = true;
10920         }
10921
10922         if (tb[NL80211_WOWLAN_TRIG_DISCONNECT]) {
10923                 if (!(wowlan->flags & WIPHY_WOWLAN_DISCONNECT))
10924                         return -EINVAL;
10925                 new_triggers.disconnect = true;
10926                 regular = true;
10927         }
10928
10929         if (tb[NL80211_WOWLAN_TRIG_MAGIC_PKT]) {
10930                 if (!(wowlan->flags & WIPHY_WOWLAN_MAGIC_PKT))
10931                         return -EINVAL;
10932                 new_triggers.magic_pkt = true;
10933                 regular = true;
10934         }
10935
10936         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_SUPPORTED])
10937                 return -EINVAL;
10938
10939         if (tb[NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE]) {
10940                 if (!(wowlan->flags & WIPHY_WOWLAN_GTK_REKEY_FAILURE))
10941                         return -EINVAL;
10942                 new_triggers.gtk_rekey_failure = true;
10943                 regular = true;
10944         }
10945
10946         if (tb[NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST]) {
10947                 if (!(wowlan->flags & WIPHY_WOWLAN_EAP_IDENTITY_REQ))
10948                         return -EINVAL;
10949                 new_triggers.eap_identity_req = true;
10950                 regular = true;
10951         }
10952
10953         if (tb[NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE]) {
10954                 if (!(wowlan->flags & WIPHY_WOWLAN_4WAY_HANDSHAKE))
10955                         return -EINVAL;
10956                 new_triggers.four_way_handshake = true;
10957                 regular = true;
10958         }
10959
10960         if (tb[NL80211_WOWLAN_TRIG_RFKILL_RELEASE]) {
10961                 if (!(wowlan->flags & WIPHY_WOWLAN_RFKILL_RELEASE))
10962                         return -EINVAL;
10963                 new_triggers.rfkill_release = true;
10964                 regular = true;
10965         }
10966
10967         if (tb[NL80211_WOWLAN_TRIG_PKT_PATTERN]) {
10968                 struct nlattr *pat;
10969                 int n_patterns = 0;
10970                 int rem, pat_len, mask_len, pkt_offset;
10971                 struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
10972
10973                 regular = true;
10974
10975                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10976                                     rem)
10977                         n_patterns++;
10978                 if (n_patterns > wowlan->n_patterns)
10979                         return -EINVAL;
10980
10981                 new_triggers.patterns = kcalloc(n_patterns,
10982                                                 sizeof(new_triggers.patterns[0]),
10983                                                 GFP_KERNEL);
10984                 if (!new_triggers.patterns)
10985                         return -ENOMEM;
10986
10987                 new_triggers.n_patterns = n_patterns;
10988                 i = 0;
10989
10990                 nla_for_each_nested(pat, tb[NL80211_WOWLAN_TRIG_PKT_PATTERN],
10991                                     rem) {
10992                         u8 *mask_pat;
10993
10994                         err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
10995                                                nl80211_packet_pattern_policy,
10996                                                info->extack);
10997                         if (err)
10998                                 goto error;
10999
11000                         err = -EINVAL;
11001                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
11002                             !pat_tb[NL80211_PKTPAT_PATTERN])
11003                                 goto error;
11004                         pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11005                         mask_len = DIV_ROUND_UP(pat_len, 8);
11006                         if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11007                                 goto error;
11008                         if (pat_len > wowlan->pattern_max_len ||
11009                             pat_len < wowlan->pattern_min_len)
11010                                 goto error;
11011
11012                         if (!pat_tb[NL80211_PKTPAT_OFFSET])
11013                                 pkt_offset = 0;
11014                         else
11015                                 pkt_offset = nla_get_u32(
11016                                         pat_tb[NL80211_PKTPAT_OFFSET]);
11017                         if (pkt_offset > wowlan->max_pkt_offset)
11018                                 goto error;
11019                         new_triggers.patterns[i].pkt_offset = pkt_offset;
11020
11021                         mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11022                         if (!mask_pat) {
11023                                 err = -ENOMEM;
11024                                 goto error;
11025                         }
11026                         new_triggers.patterns[i].mask = mask_pat;
11027                         memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11028                                mask_len);
11029                         mask_pat += mask_len;
11030                         new_triggers.patterns[i].pattern = mask_pat;
11031                         new_triggers.patterns[i].pattern_len = pat_len;
11032                         memcpy(mask_pat,
11033                                nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11034                                pat_len);
11035                         i++;
11036                 }
11037         }
11038
11039         if (tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION]) {
11040                 regular = true;
11041                 err = nl80211_parse_wowlan_tcp(
11042                         rdev, tb[NL80211_WOWLAN_TRIG_TCP_CONNECTION],
11043                         &new_triggers);
11044                 if (err)
11045                         goto error;
11046         }
11047
11048         if (tb[NL80211_WOWLAN_TRIG_NET_DETECT]) {
11049                 regular = true;
11050                 err = nl80211_parse_wowlan_nd(
11051                         rdev, wowlan, tb[NL80211_WOWLAN_TRIG_NET_DETECT],
11052                         &new_triggers);
11053                 if (err)
11054                         goto error;
11055         }
11056
11057         /* The 'any' trigger means the device continues operating more or less
11058          * as in its normal operation mode and wakes up the host on most of the
11059          * normal interrupts (like packet RX, ...)
11060          * It therefore makes little sense to combine with the more constrained
11061          * wakeup trigger modes.
11062          */
11063         if (new_triggers.any && regular) {
11064                 err = -EINVAL;
11065                 goto error;
11066         }
11067
11068         ntrig = kmemdup(&new_triggers, sizeof(new_triggers), GFP_KERNEL);
11069         if (!ntrig) {
11070                 err = -ENOMEM;
11071                 goto error;
11072         }
11073         cfg80211_rdev_free_wowlan(rdev);
11074         rdev->wiphy.wowlan_config = ntrig;
11075
11076  set_wakeup:
11077         if (rdev->ops->set_wakeup &&
11078             prev_enabled != !!rdev->wiphy.wowlan_config)
11079                 rdev_set_wakeup(rdev, rdev->wiphy.wowlan_config);
11080
11081         return 0;
11082  error:
11083         for (i = 0; i < new_triggers.n_patterns; i++)
11084                 kfree(new_triggers.patterns[i].mask);
11085         kfree(new_triggers.patterns);
11086         if (new_triggers.tcp && new_triggers.tcp->sock)
11087                 sock_release(new_triggers.tcp->sock);
11088         kfree(new_triggers.tcp);
11089         kfree(new_triggers.nd_config);
11090         return err;
11091 }
11092 #endif
11093
11094 static int nl80211_send_coalesce_rules(struct sk_buff *msg,
11095                                        struct cfg80211_registered_device *rdev)
11096 {
11097         struct nlattr *nl_pats, *nl_pat, *nl_rule, *nl_rules;
11098         int i, j, pat_len;
11099         struct cfg80211_coalesce_rules *rule;
11100
11101         if (!rdev->coalesce->n_rules)
11102                 return 0;
11103
11104         nl_rules = nla_nest_start(msg, NL80211_ATTR_COALESCE_RULE);
11105         if (!nl_rules)
11106                 return -ENOBUFS;
11107
11108         for (i = 0; i < rdev->coalesce->n_rules; i++) {
11109                 nl_rule = nla_nest_start(msg, i + 1);
11110                 if (!nl_rule)
11111                         return -ENOBUFS;
11112
11113                 rule = &rdev->coalesce->rules[i];
11114                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_DELAY,
11115                                 rule->delay))
11116                         return -ENOBUFS;
11117
11118                 if (nla_put_u32(msg, NL80211_ATTR_COALESCE_RULE_CONDITION,
11119                                 rule->condition))
11120                         return -ENOBUFS;
11121
11122                 nl_pats = nla_nest_start(msg,
11123                                 NL80211_ATTR_COALESCE_RULE_PKT_PATTERN);
11124                 if (!nl_pats)
11125                         return -ENOBUFS;
11126
11127                 for (j = 0; j < rule->n_patterns; j++) {
11128                         nl_pat = nla_nest_start(msg, j + 1);
11129                         if (!nl_pat)
11130                                 return -ENOBUFS;
11131                         pat_len = rule->patterns[j].pattern_len;
11132                         if (nla_put(msg, NL80211_PKTPAT_MASK,
11133                                     DIV_ROUND_UP(pat_len, 8),
11134                                     rule->patterns[j].mask) ||
11135                             nla_put(msg, NL80211_PKTPAT_PATTERN, pat_len,
11136                                     rule->patterns[j].pattern) ||
11137                             nla_put_u32(msg, NL80211_PKTPAT_OFFSET,
11138                                         rule->patterns[j].pkt_offset))
11139                                 return -ENOBUFS;
11140                         nla_nest_end(msg, nl_pat);
11141                 }
11142                 nla_nest_end(msg, nl_pats);
11143                 nla_nest_end(msg, nl_rule);
11144         }
11145         nla_nest_end(msg, nl_rules);
11146
11147         return 0;
11148 }
11149
11150 static int nl80211_get_coalesce(struct sk_buff *skb, struct genl_info *info)
11151 {
11152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11153         struct sk_buff *msg;
11154         void *hdr;
11155
11156         if (!rdev->wiphy.coalesce)
11157                 return -EOPNOTSUPP;
11158
11159         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11160         if (!msg)
11161                 return -ENOMEM;
11162
11163         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11164                              NL80211_CMD_GET_COALESCE);
11165         if (!hdr)
11166                 goto nla_put_failure;
11167
11168         if (rdev->coalesce && nl80211_send_coalesce_rules(msg, rdev))
11169                 goto nla_put_failure;
11170
11171         genlmsg_end(msg, hdr);
11172         return genlmsg_reply(msg, info);
11173
11174 nla_put_failure:
11175         nlmsg_free(msg);
11176         return -ENOBUFS;
11177 }
11178
11179 void cfg80211_rdev_free_coalesce(struct cfg80211_registered_device *rdev)
11180 {
11181         struct cfg80211_coalesce *coalesce = rdev->coalesce;
11182         int i, j;
11183         struct cfg80211_coalesce_rules *rule;
11184
11185         if (!coalesce)
11186                 return;
11187
11188         for (i = 0; i < coalesce->n_rules; i++) {
11189                 rule = &coalesce->rules[i];
11190                 for (j = 0; j < rule->n_patterns; j++)
11191                         kfree(rule->patterns[j].mask);
11192                 kfree(rule->patterns);
11193         }
11194         kfree(coalesce->rules);
11195         kfree(coalesce);
11196         rdev->coalesce = NULL;
11197 }
11198
11199 static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
11200                                        struct nlattr *rule,
11201                                        struct cfg80211_coalesce_rules *new_rule)
11202 {
11203         int err, i;
11204         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11205         struct nlattr *tb[NUM_NL80211_ATTR_COALESCE_RULE], *pat;
11206         int rem, pat_len, mask_len, pkt_offset, n_patterns = 0;
11207         struct nlattr *pat_tb[NUM_NL80211_PKTPAT];
11208
11209         err = nla_parse_nested(tb, NL80211_ATTR_COALESCE_RULE_MAX, rule,
11210                                nl80211_coalesce_policy, NULL);
11211         if (err)
11212                 return err;
11213
11214         if (tb[NL80211_ATTR_COALESCE_RULE_DELAY])
11215                 new_rule->delay =
11216                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_DELAY]);
11217         if (new_rule->delay > coalesce->max_delay)
11218                 return -EINVAL;
11219
11220         if (tb[NL80211_ATTR_COALESCE_RULE_CONDITION])
11221                 new_rule->condition =
11222                         nla_get_u32(tb[NL80211_ATTR_COALESCE_RULE_CONDITION]);
11223
11224         if (!tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN])
11225                 return -EINVAL;
11226
11227         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11228                             rem)
11229                 n_patterns++;
11230         if (n_patterns > coalesce->n_patterns)
11231                 return -EINVAL;
11232
11233         new_rule->patterns = kcalloc(n_patterns, sizeof(new_rule->patterns[0]),
11234                                      GFP_KERNEL);
11235         if (!new_rule->patterns)
11236                 return -ENOMEM;
11237
11238         new_rule->n_patterns = n_patterns;
11239         i = 0;
11240
11241         nla_for_each_nested(pat, tb[NL80211_ATTR_COALESCE_RULE_PKT_PATTERN],
11242                             rem) {
11243                 u8 *mask_pat;
11244
11245                 err = nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
11246                                        nl80211_packet_pattern_policy, NULL);
11247                 if (err)
11248                         return err;
11249
11250                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
11251                     !pat_tb[NL80211_PKTPAT_PATTERN])
11252                         return -EINVAL;
11253                 pat_len = nla_len(pat_tb[NL80211_PKTPAT_PATTERN]);
11254                 mask_len = DIV_ROUND_UP(pat_len, 8);
11255                 if (nla_len(pat_tb[NL80211_PKTPAT_MASK]) != mask_len)
11256                         return -EINVAL;
11257                 if (pat_len > coalesce->pattern_max_len ||
11258                     pat_len < coalesce->pattern_min_len)
11259                         return -EINVAL;
11260
11261                 if (!pat_tb[NL80211_PKTPAT_OFFSET])
11262                         pkt_offset = 0;
11263                 else
11264                         pkt_offset = nla_get_u32(pat_tb[NL80211_PKTPAT_OFFSET]);
11265                 if (pkt_offset > coalesce->max_pkt_offset)
11266                         return -EINVAL;
11267                 new_rule->patterns[i].pkt_offset = pkt_offset;
11268
11269                 mask_pat = kmalloc(mask_len + pat_len, GFP_KERNEL);
11270                 if (!mask_pat)
11271                         return -ENOMEM;
11272
11273                 new_rule->patterns[i].mask = mask_pat;
11274                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_MASK]),
11275                        mask_len);
11276
11277                 mask_pat += mask_len;
11278                 new_rule->patterns[i].pattern = mask_pat;
11279                 new_rule->patterns[i].pattern_len = pat_len;
11280                 memcpy(mask_pat, nla_data(pat_tb[NL80211_PKTPAT_PATTERN]),
11281                        pat_len);
11282                 i++;
11283         }
11284
11285         return 0;
11286 }
11287
11288 static int nl80211_set_coalesce(struct sk_buff *skb, struct genl_info *info)
11289 {
11290         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11291         const struct wiphy_coalesce_support *coalesce = rdev->wiphy.coalesce;
11292         struct cfg80211_coalesce new_coalesce = {};
11293         struct cfg80211_coalesce *n_coalesce;
11294         int err, rem_rule, n_rules = 0, i, j;
11295         struct nlattr *rule;
11296         struct cfg80211_coalesce_rules *tmp_rule;
11297
11298         if (!rdev->wiphy.coalesce || !rdev->ops->set_coalesce)
11299                 return -EOPNOTSUPP;
11300
11301         if (!info->attrs[NL80211_ATTR_COALESCE_RULE]) {
11302                 cfg80211_rdev_free_coalesce(rdev);
11303                 rdev_set_coalesce(rdev, NULL);
11304                 return 0;
11305         }
11306
11307         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11308                             rem_rule)
11309                 n_rules++;
11310         if (n_rules > coalesce->n_rules)
11311                 return -EINVAL;
11312
11313         new_coalesce.rules = kcalloc(n_rules, sizeof(new_coalesce.rules[0]),
11314                                      GFP_KERNEL);
11315         if (!new_coalesce.rules)
11316                 return -ENOMEM;
11317
11318         new_coalesce.n_rules = n_rules;
11319         i = 0;
11320
11321         nla_for_each_nested(rule, info->attrs[NL80211_ATTR_COALESCE_RULE],
11322                             rem_rule) {
11323                 err = nl80211_parse_coalesce_rule(rdev, rule,
11324                                                   &new_coalesce.rules[i]);
11325                 if (err)
11326                         goto error;
11327
11328                 i++;
11329         }
11330
11331         err = rdev_set_coalesce(rdev, &new_coalesce);
11332         if (err)
11333                 goto error;
11334
11335         n_coalesce = kmemdup(&new_coalesce, sizeof(new_coalesce), GFP_KERNEL);
11336         if (!n_coalesce) {
11337                 err = -ENOMEM;
11338                 goto error;
11339         }
11340         cfg80211_rdev_free_coalesce(rdev);
11341         rdev->coalesce = n_coalesce;
11342
11343         return 0;
11344 error:
11345         for (i = 0; i < new_coalesce.n_rules; i++) {
11346                 tmp_rule = &new_coalesce.rules[i];
11347                 for (j = 0; j < tmp_rule->n_patterns; j++)
11348                         kfree(tmp_rule->patterns[j].mask);
11349                 kfree(tmp_rule->patterns);
11350         }
11351         kfree(new_coalesce.rules);
11352
11353         return err;
11354 }
11355
11356 static int nl80211_set_rekey_data(struct sk_buff *skb, struct genl_info *info)
11357 {
11358         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11359         struct net_device *dev = info->user_ptr[1];
11360         struct wireless_dev *wdev = dev->ieee80211_ptr;
11361         struct nlattr *tb[NUM_NL80211_REKEY_DATA];
11362         struct cfg80211_gtk_rekey_data rekey_data;
11363         int err;
11364
11365         if (!info->attrs[NL80211_ATTR_REKEY_DATA])
11366                 return -EINVAL;
11367
11368         err = nla_parse_nested(tb, MAX_NL80211_REKEY_DATA,
11369                                info->attrs[NL80211_ATTR_REKEY_DATA],
11370                                nl80211_rekey_policy, info->extack);
11371         if (err)
11372                 return err;
11373
11374         if (!tb[NL80211_REKEY_DATA_REPLAY_CTR] || !tb[NL80211_REKEY_DATA_KEK] ||
11375             !tb[NL80211_REKEY_DATA_KCK])
11376                 return -EINVAL;
11377         if (nla_len(tb[NL80211_REKEY_DATA_REPLAY_CTR]) != NL80211_REPLAY_CTR_LEN)
11378                 return -ERANGE;
11379         if (nla_len(tb[NL80211_REKEY_DATA_KEK]) != NL80211_KEK_LEN)
11380                 return -ERANGE;
11381         if (nla_len(tb[NL80211_REKEY_DATA_KCK]) != NL80211_KCK_LEN)
11382                 return -ERANGE;
11383
11384         rekey_data.kek = nla_data(tb[NL80211_REKEY_DATA_KEK]);
11385         rekey_data.kck = nla_data(tb[NL80211_REKEY_DATA_KCK]);
11386         rekey_data.replay_ctr = nla_data(tb[NL80211_REKEY_DATA_REPLAY_CTR]);
11387
11388         wdev_lock(wdev);
11389         if (!wdev->current_bss) {
11390                 err = -ENOTCONN;
11391                 goto out;
11392         }
11393
11394         if (!rdev->ops->set_rekey_data) {
11395                 err = -EOPNOTSUPP;
11396                 goto out;
11397         }
11398
11399         err = rdev_set_rekey_data(rdev, dev, &rekey_data);
11400  out:
11401         wdev_unlock(wdev);
11402         return err;
11403 }
11404
11405 static int nl80211_register_unexpected_frame(struct sk_buff *skb,
11406                                              struct genl_info *info)
11407 {
11408         struct net_device *dev = info->user_ptr[1];
11409         struct wireless_dev *wdev = dev->ieee80211_ptr;
11410
11411         if (wdev->iftype != NL80211_IFTYPE_AP &&
11412             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11413                 return -EINVAL;
11414
11415         if (wdev->ap_unexpected_nlportid)
11416                 return -EBUSY;
11417
11418         wdev->ap_unexpected_nlportid = info->snd_portid;
11419         return 0;
11420 }
11421
11422 static int nl80211_probe_client(struct sk_buff *skb,
11423                                 struct genl_info *info)
11424 {
11425         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11426         struct net_device *dev = info->user_ptr[1];
11427         struct wireless_dev *wdev = dev->ieee80211_ptr;
11428         struct sk_buff *msg;
11429         void *hdr;
11430         const u8 *addr;
11431         u64 cookie;
11432         int err;
11433
11434         if (wdev->iftype != NL80211_IFTYPE_AP &&
11435             wdev->iftype != NL80211_IFTYPE_P2P_GO)
11436                 return -EOPNOTSUPP;
11437
11438         if (!info->attrs[NL80211_ATTR_MAC])
11439                 return -EINVAL;
11440
11441         if (!rdev->ops->probe_client)
11442                 return -EOPNOTSUPP;
11443
11444         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11445         if (!msg)
11446                 return -ENOMEM;
11447
11448         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11449                              NL80211_CMD_PROBE_CLIENT);
11450         if (!hdr) {
11451                 err = -ENOBUFS;
11452                 goto free_msg;
11453         }
11454
11455         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
11456
11457         err = rdev_probe_client(rdev, dev, addr, &cookie);
11458         if (err)
11459                 goto free_msg;
11460
11461         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
11462                               NL80211_ATTR_PAD))
11463                 goto nla_put_failure;
11464
11465         genlmsg_end(msg, hdr);
11466
11467         return genlmsg_reply(msg, info);
11468
11469  nla_put_failure:
11470         err = -ENOBUFS;
11471  free_msg:
11472         nlmsg_free(msg);
11473         return err;
11474 }
11475
11476 static int nl80211_register_beacons(struct sk_buff *skb, struct genl_info *info)
11477 {
11478         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11479         struct cfg80211_beacon_registration *reg, *nreg;
11480         int rv;
11481
11482         if (!(rdev->wiphy.flags & WIPHY_FLAG_REPORTS_OBSS))
11483                 return -EOPNOTSUPP;
11484
11485         nreg = kzalloc(sizeof(*nreg), GFP_KERNEL);
11486         if (!nreg)
11487                 return -ENOMEM;
11488
11489         /* First, check if already registered. */
11490         spin_lock_bh(&rdev->beacon_registrations_lock);
11491         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
11492                 if (reg->nlportid == info->snd_portid) {
11493                         rv = -EALREADY;
11494                         goto out_err;
11495                 }
11496         }
11497         /* Add it to the list */
11498         nreg->nlportid = info->snd_portid;
11499         list_add(&nreg->list, &rdev->beacon_registrations);
11500
11501         spin_unlock_bh(&rdev->beacon_registrations_lock);
11502
11503         return 0;
11504 out_err:
11505         spin_unlock_bh(&rdev->beacon_registrations_lock);
11506         kfree(nreg);
11507         return rv;
11508 }
11509
11510 static int nl80211_start_p2p_device(struct sk_buff *skb, struct genl_info *info)
11511 {
11512         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11513         struct wireless_dev *wdev = info->user_ptr[1];
11514         int err;
11515
11516         if (!rdev->ops->start_p2p_device)
11517                 return -EOPNOTSUPP;
11518
11519         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11520                 return -EOPNOTSUPP;
11521
11522         if (wdev_running(wdev))
11523                 return 0;
11524
11525         if (rfkill_blocked(rdev->rfkill))
11526                 return -ERFKILL;
11527
11528         err = rdev_start_p2p_device(rdev, wdev);
11529         if (err)
11530                 return err;
11531
11532         wdev->is_running = true;
11533         rdev->opencount++;
11534
11535         return 0;
11536 }
11537
11538 static int nl80211_stop_p2p_device(struct sk_buff *skb, struct genl_info *info)
11539 {
11540         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11541         struct wireless_dev *wdev = info->user_ptr[1];
11542
11543         if (wdev->iftype != NL80211_IFTYPE_P2P_DEVICE)
11544                 return -EOPNOTSUPP;
11545
11546         if (!rdev->ops->stop_p2p_device)
11547                 return -EOPNOTSUPP;
11548
11549         cfg80211_stop_p2p_device(rdev, wdev);
11550
11551         return 0;
11552 }
11553
11554 static int nl80211_start_nan(struct sk_buff *skb, struct genl_info *info)
11555 {
11556         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11557         struct wireless_dev *wdev = info->user_ptr[1];
11558         struct cfg80211_nan_conf conf = {};
11559         int err;
11560
11561         if (wdev->iftype != NL80211_IFTYPE_NAN)
11562                 return -EOPNOTSUPP;
11563
11564         if (wdev_running(wdev))
11565                 return -EEXIST;
11566
11567         if (rfkill_blocked(rdev->rfkill))
11568                 return -ERFKILL;
11569
11570         if (!info->attrs[NL80211_ATTR_NAN_MASTER_PREF])
11571                 return -EINVAL;
11572
11573         conf.master_pref =
11574                 nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11575
11576         if (info->attrs[NL80211_ATTR_BANDS]) {
11577                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11578
11579                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11580                         return -EOPNOTSUPP;
11581
11582                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11583                         return -EINVAL;
11584
11585                 conf.bands = bands;
11586         }
11587
11588         err = rdev_start_nan(rdev, wdev, &conf);
11589         if (err)
11590                 return err;
11591
11592         wdev->is_running = true;
11593         rdev->opencount++;
11594
11595         return 0;
11596 }
11597
11598 static int nl80211_stop_nan(struct sk_buff *skb, struct genl_info *info)
11599 {
11600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11601         struct wireless_dev *wdev = info->user_ptr[1];
11602
11603         if (wdev->iftype != NL80211_IFTYPE_NAN)
11604                 return -EOPNOTSUPP;
11605
11606         cfg80211_stop_nan(rdev, wdev);
11607
11608         return 0;
11609 }
11610
11611 static int validate_nan_filter(struct nlattr *filter_attr)
11612 {
11613         struct nlattr *attr;
11614         int len = 0, n_entries = 0, rem;
11615
11616         nla_for_each_nested(attr, filter_attr, rem) {
11617                 len += nla_len(attr);
11618                 n_entries++;
11619         }
11620
11621         if (len >= U8_MAX)
11622                 return -EINVAL;
11623
11624         return n_entries;
11625 }
11626
11627 static int handle_nan_filter(struct nlattr *attr_filter,
11628                              struct cfg80211_nan_func *func,
11629                              bool tx)
11630 {
11631         struct nlattr *attr;
11632         int n_entries, rem, i;
11633         struct cfg80211_nan_func_filter *filter;
11634
11635         n_entries = validate_nan_filter(attr_filter);
11636         if (n_entries < 0)
11637                 return n_entries;
11638
11639         BUILD_BUG_ON(sizeof(*func->rx_filters) != sizeof(*func->tx_filters));
11640
11641         filter = kcalloc(n_entries, sizeof(*func->rx_filters), GFP_KERNEL);
11642         if (!filter)
11643                 return -ENOMEM;
11644
11645         i = 0;
11646         nla_for_each_nested(attr, attr_filter, rem) {
11647                 filter[i].filter = nla_memdup(attr, GFP_KERNEL);
11648                 filter[i].len = nla_len(attr);
11649                 i++;
11650         }
11651         if (tx) {
11652                 func->num_tx_filters = n_entries;
11653                 func->tx_filters = filter;
11654         } else {
11655                 func->num_rx_filters = n_entries;
11656                 func->rx_filters = filter;
11657         }
11658
11659         return 0;
11660 }
11661
11662 static int nl80211_nan_add_func(struct sk_buff *skb,
11663                                 struct genl_info *info)
11664 {
11665         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11666         struct wireless_dev *wdev = info->user_ptr[1];
11667         struct nlattr *tb[NUM_NL80211_NAN_FUNC_ATTR], *func_attr;
11668         struct cfg80211_nan_func *func;
11669         struct sk_buff *msg = NULL;
11670         void *hdr = NULL;
11671         int err = 0;
11672
11673         if (wdev->iftype != NL80211_IFTYPE_NAN)
11674                 return -EOPNOTSUPP;
11675
11676         if (!wdev_running(wdev))
11677                 return -ENOTCONN;
11678
11679         if (!info->attrs[NL80211_ATTR_NAN_FUNC])
11680                 return -EINVAL;
11681
11682         err = nla_parse_nested(tb, NL80211_NAN_FUNC_ATTR_MAX,
11683                                info->attrs[NL80211_ATTR_NAN_FUNC],
11684                                nl80211_nan_func_policy, info->extack);
11685         if (err)
11686                 return err;
11687
11688         func = kzalloc(sizeof(*func), GFP_KERNEL);
11689         if (!func)
11690                 return -ENOMEM;
11691
11692         func->cookie = cfg80211_assign_cookie(rdev);
11693
11694         if (!tb[NL80211_NAN_FUNC_TYPE] ||
11695             nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]) > NL80211_NAN_FUNC_MAX_TYPE) {
11696                 err = -EINVAL;
11697                 goto out;
11698         }
11699
11700
11701         func->type = nla_get_u8(tb[NL80211_NAN_FUNC_TYPE]);
11702
11703         if (!tb[NL80211_NAN_FUNC_SERVICE_ID]) {
11704                 err = -EINVAL;
11705                 goto out;
11706         }
11707
11708         memcpy(func->service_id, nla_data(tb[NL80211_NAN_FUNC_SERVICE_ID]),
11709                sizeof(func->service_id));
11710
11711         func->close_range =
11712                 nla_get_flag(tb[NL80211_NAN_FUNC_CLOSE_RANGE]);
11713
11714         if (tb[NL80211_NAN_FUNC_SERVICE_INFO]) {
11715                 func->serv_spec_info_len =
11716                         nla_len(tb[NL80211_NAN_FUNC_SERVICE_INFO]);
11717                 func->serv_spec_info =
11718                         kmemdup(nla_data(tb[NL80211_NAN_FUNC_SERVICE_INFO]),
11719                                 func->serv_spec_info_len,
11720                                 GFP_KERNEL);
11721                 if (!func->serv_spec_info) {
11722                         err = -ENOMEM;
11723                         goto out;
11724                 }
11725         }
11726
11727         if (tb[NL80211_NAN_FUNC_TTL])
11728                 func->ttl = nla_get_u32(tb[NL80211_NAN_FUNC_TTL]);
11729
11730         switch (func->type) {
11731         case NL80211_NAN_FUNC_PUBLISH:
11732                 if (!tb[NL80211_NAN_FUNC_PUBLISH_TYPE]) {
11733                         err = -EINVAL;
11734                         goto out;
11735                 }
11736
11737                 func->publish_type =
11738                         nla_get_u8(tb[NL80211_NAN_FUNC_PUBLISH_TYPE]);
11739                 func->publish_bcast =
11740                         nla_get_flag(tb[NL80211_NAN_FUNC_PUBLISH_BCAST]);
11741
11742                 if ((!(func->publish_type & NL80211_NAN_SOLICITED_PUBLISH)) &&
11743                         func->publish_bcast) {
11744                         err = -EINVAL;
11745                         goto out;
11746                 }
11747                 break;
11748         case NL80211_NAN_FUNC_SUBSCRIBE:
11749                 func->subscribe_active =
11750                         nla_get_flag(tb[NL80211_NAN_FUNC_SUBSCRIBE_ACTIVE]);
11751                 break;
11752         case NL80211_NAN_FUNC_FOLLOW_UP:
11753                 if (!tb[NL80211_NAN_FUNC_FOLLOW_UP_ID] ||
11754                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID] ||
11755                     !tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]) {
11756                         err = -EINVAL;
11757                         goto out;
11758                 }
11759
11760                 func->followup_id =
11761                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_ID]);
11762                 func->followup_reqid =
11763                         nla_get_u8(tb[NL80211_NAN_FUNC_FOLLOW_UP_REQ_ID]);
11764                 memcpy(func->followup_dest.addr,
11765                        nla_data(tb[NL80211_NAN_FUNC_FOLLOW_UP_DEST]),
11766                        sizeof(func->followup_dest.addr));
11767                 if (func->ttl) {
11768                         err = -EINVAL;
11769                         goto out;
11770                 }
11771                 break;
11772         default:
11773                 err = -EINVAL;
11774                 goto out;
11775         }
11776
11777         if (tb[NL80211_NAN_FUNC_SRF]) {
11778                 struct nlattr *srf_tb[NUM_NL80211_NAN_SRF_ATTR];
11779
11780                 err = nla_parse_nested(srf_tb, NL80211_NAN_SRF_ATTR_MAX,
11781                                        tb[NL80211_NAN_FUNC_SRF],
11782                                        nl80211_nan_srf_policy, info->extack);
11783                 if (err)
11784                         goto out;
11785
11786                 func->srf_include =
11787                         nla_get_flag(srf_tb[NL80211_NAN_SRF_INCLUDE]);
11788
11789                 if (srf_tb[NL80211_NAN_SRF_BF]) {
11790                         if (srf_tb[NL80211_NAN_SRF_MAC_ADDRS] ||
11791                             !srf_tb[NL80211_NAN_SRF_BF_IDX]) {
11792                                 err = -EINVAL;
11793                                 goto out;
11794                         }
11795
11796                         func->srf_bf_len =
11797                                 nla_len(srf_tb[NL80211_NAN_SRF_BF]);
11798                         func->srf_bf =
11799                                 kmemdup(nla_data(srf_tb[NL80211_NAN_SRF_BF]),
11800                                         func->srf_bf_len, GFP_KERNEL);
11801                         if (!func->srf_bf) {
11802                                 err = -ENOMEM;
11803                                 goto out;
11804                         }
11805
11806                         func->srf_bf_idx =
11807                                 nla_get_u8(srf_tb[NL80211_NAN_SRF_BF_IDX]);
11808                 } else {
11809                         struct nlattr *attr, *mac_attr =
11810                                 srf_tb[NL80211_NAN_SRF_MAC_ADDRS];
11811                         int n_entries, rem, i = 0;
11812
11813                         if (!mac_attr) {
11814                                 err = -EINVAL;
11815                                 goto out;
11816                         }
11817
11818                         n_entries = validate_acl_mac_addrs(mac_attr);
11819                         if (n_entries <= 0) {
11820                                 err = -EINVAL;
11821                                 goto out;
11822                         }
11823
11824                         func->srf_num_macs = n_entries;
11825                         func->srf_macs =
11826                                 kcalloc(n_entries, sizeof(*func->srf_macs),
11827                                         GFP_KERNEL);
11828                         if (!func->srf_macs) {
11829                                 err = -ENOMEM;
11830                                 goto out;
11831                         }
11832
11833                         nla_for_each_nested(attr, mac_attr, rem)
11834                                 memcpy(func->srf_macs[i++].addr, nla_data(attr),
11835                                        sizeof(*func->srf_macs));
11836                 }
11837         }
11838
11839         if (tb[NL80211_NAN_FUNC_TX_MATCH_FILTER]) {
11840                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_TX_MATCH_FILTER],
11841                                         func, true);
11842                 if (err)
11843                         goto out;
11844         }
11845
11846         if (tb[NL80211_NAN_FUNC_RX_MATCH_FILTER]) {
11847                 err = handle_nan_filter(tb[NL80211_NAN_FUNC_RX_MATCH_FILTER],
11848                                         func, false);
11849                 if (err)
11850                         goto out;
11851         }
11852
11853         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
11854         if (!msg) {
11855                 err = -ENOMEM;
11856                 goto out;
11857         }
11858
11859         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
11860                              NL80211_CMD_ADD_NAN_FUNCTION);
11861         /* This can't really happen - we just allocated 4KB */
11862         if (WARN_ON(!hdr)) {
11863                 err = -ENOMEM;
11864                 goto out;
11865         }
11866
11867         err = rdev_add_nan_func(rdev, wdev, func);
11868 out:
11869         if (err < 0) {
11870                 cfg80211_free_nan_func(func);
11871                 nlmsg_free(msg);
11872                 return err;
11873         }
11874
11875         /* propagate the instance id and cookie to userspace  */
11876         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, func->cookie,
11877                               NL80211_ATTR_PAD))
11878                 goto nla_put_failure;
11879
11880         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
11881         if (!func_attr)
11882                 goto nla_put_failure;
11883
11884         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID,
11885                        func->instance_id))
11886                 goto nla_put_failure;
11887
11888         nla_nest_end(msg, func_attr);
11889
11890         genlmsg_end(msg, hdr);
11891         return genlmsg_reply(msg, info);
11892
11893 nla_put_failure:
11894         nlmsg_free(msg);
11895         return -ENOBUFS;
11896 }
11897
11898 static int nl80211_nan_del_func(struct sk_buff *skb,
11899                                struct genl_info *info)
11900 {
11901         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11902         struct wireless_dev *wdev = info->user_ptr[1];
11903         u64 cookie;
11904
11905         if (wdev->iftype != NL80211_IFTYPE_NAN)
11906                 return -EOPNOTSUPP;
11907
11908         if (!wdev_running(wdev))
11909                 return -ENOTCONN;
11910
11911         if (!info->attrs[NL80211_ATTR_COOKIE])
11912                 return -EINVAL;
11913
11914         cookie = nla_get_u64(info->attrs[NL80211_ATTR_COOKIE]);
11915
11916         rdev_del_nan_func(rdev, wdev, cookie);
11917
11918         return 0;
11919 }
11920
11921 static int nl80211_nan_change_config(struct sk_buff *skb,
11922                                      struct genl_info *info)
11923 {
11924         struct cfg80211_registered_device *rdev = info->user_ptr[0];
11925         struct wireless_dev *wdev = info->user_ptr[1];
11926         struct cfg80211_nan_conf conf = {};
11927         u32 changed = 0;
11928
11929         if (wdev->iftype != NL80211_IFTYPE_NAN)
11930                 return -EOPNOTSUPP;
11931
11932         if (!wdev_running(wdev))
11933                 return -ENOTCONN;
11934
11935         if (info->attrs[NL80211_ATTR_NAN_MASTER_PREF]) {
11936                 conf.master_pref =
11937                         nla_get_u8(info->attrs[NL80211_ATTR_NAN_MASTER_PREF]);
11938                 if (conf.master_pref <= 1 || conf.master_pref == 255)
11939                         return -EINVAL;
11940
11941                 changed |= CFG80211_NAN_CONF_CHANGED_PREF;
11942         }
11943
11944         if (info->attrs[NL80211_ATTR_BANDS]) {
11945                 u32 bands = nla_get_u32(info->attrs[NL80211_ATTR_BANDS]);
11946
11947                 if (bands & ~(u32)wdev->wiphy->nan_supported_bands)
11948                         return -EOPNOTSUPP;
11949
11950                 if (bands && !(bands & BIT(NL80211_BAND_2GHZ)))
11951                         return -EINVAL;
11952
11953                 conf.bands = bands;
11954                 changed |= CFG80211_NAN_CONF_CHANGED_BANDS;
11955         }
11956
11957         if (!changed)
11958                 return -EINVAL;
11959
11960         return rdev_nan_change_conf(rdev, wdev, &conf, changed);
11961 }
11962
11963 void cfg80211_nan_match(struct wireless_dev *wdev,
11964                         struct cfg80211_nan_match_params *match, gfp_t gfp)
11965 {
11966         struct wiphy *wiphy = wdev->wiphy;
11967         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
11968         struct nlattr *match_attr, *local_func_attr, *peer_func_attr;
11969         struct sk_buff *msg;
11970         void *hdr;
11971
11972         if (WARN_ON(!match->inst_id || !match->peer_inst_id || !match->addr))
11973                 return;
11974
11975         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
11976         if (!msg)
11977                 return;
11978
11979         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NAN_MATCH);
11980         if (!hdr) {
11981                 nlmsg_free(msg);
11982                 return;
11983         }
11984
11985         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
11986             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
11987                                          wdev->netdev->ifindex)) ||
11988             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
11989                               NL80211_ATTR_PAD))
11990                 goto nla_put_failure;
11991
11992         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, match->cookie,
11993                               NL80211_ATTR_PAD) ||
11994             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, match->addr))
11995                 goto nla_put_failure;
11996
11997         match_attr = nla_nest_start(msg, NL80211_ATTR_NAN_MATCH);
11998         if (!match_attr)
11999                 goto nla_put_failure;
12000
12001         local_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_LOCAL);
12002         if (!local_func_attr)
12003                 goto nla_put_failure;
12004
12005         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->inst_id))
12006                 goto nla_put_failure;
12007
12008         nla_nest_end(msg, local_func_attr);
12009
12010         peer_func_attr = nla_nest_start(msg, NL80211_NAN_MATCH_FUNC_PEER);
12011         if (!peer_func_attr)
12012                 goto nla_put_failure;
12013
12014         if (nla_put_u8(msg, NL80211_NAN_FUNC_TYPE, match->type) ||
12015             nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, match->peer_inst_id))
12016                 goto nla_put_failure;
12017
12018         if (match->info && match->info_len &&
12019             nla_put(msg, NL80211_NAN_FUNC_SERVICE_INFO, match->info_len,
12020                     match->info))
12021                 goto nla_put_failure;
12022
12023         nla_nest_end(msg, peer_func_attr);
12024         nla_nest_end(msg, match_attr);
12025         genlmsg_end(msg, hdr);
12026
12027         if (!wdev->owner_nlportid)
12028                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12029                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12030         else
12031                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12032                                 wdev->owner_nlportid);
12033
12034         return;
12035
12036 nla_put_failure:
12037         nlmsg_free(msg);
12038 }
12039 EXPORT_SYMBOL(cfg80211_nan_match);
12040
12041 void cfg80211_nan_func_terminated(struct wireless_dev *wdev,
12042                                   u8 inst_id,
12043                                   enum nl80211_nan_func_term_reason reason,
12044                                   u64 cookie, gfp_t gfp)
12045 {
12046         struct wiphy *wiphy = wdev->wiphy;
12047         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12048         struct sk_buff *msg;
12049         struct nlattr *func_attr;
12050         void *hdr;
12051
12052         if (WARN_ON(!inst_id))
12053                 return;
12054
12055         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
12056         if (!msg)
12057                 return;
12058
12059         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DEL_NAN_FUNCTION);
12060         if (!hdr) {
12061                 nlmsg_free(msg);
12062                 return;
12063         }
12064
12065         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12066             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
12067                                          wdev->netdev->ifindex)) ||
12068             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
12069                               NL80211_ATTR_PAD))
12070                 goto nla_put_failure;
12071
12072         if (nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
12073                               NL80211_ATTR_PAD))
12074                 goto nla_put_failure;
12075
12076         func_attr = nla_nest_start(msg, NL80211_ATTR_NAN_FUNC);
12077         if (!func_attr)
12078                 goto nla_put_failure;
12079
12080         if (nla_put_u8(msg, NL80211_NAN_FUNC_INSTANCE_ID, inst_id) ||
12081             nla_put_u8(msg, NL80211_NAN_FUNC_TERM_REASON, reason))
12082                 goto nla_put_failure;
12083
12084         nla_nest_end(msg, func_attr);
12085         genlmsg_end(msg, hdr);
12086
12087         if (!wdev->owner_nlportid)
12088                 genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy),
12089                                         msg, 0, NL80211_MCGRP_NAN, gfp);
12090         else
12091                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
12092                                 wdev->owner_nlportid);
12093
12094         return;
12095
12096 nla_put_failure:
12097         nlmsg_free(msg);
12098 }
12099 EXPORT_SYMBOL(cfg80211_nan_func_terminated);
12100
12101 static int nl80211_get_protocol_features(struct sk_buff *skb,
12102                                          struct genl_info *info)
12103 {
12104         void *hdr;
12105         struct sk_buff *msg;
12106
12107         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12108         if (!msg)
12109                 return -ENOMEM;
12110
12111         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12112                              NL80211_CMD_GET_PROTOCOL_FEATURES);
12113         if (!hdr)
12114                 goto nla_put_failure;
12115
12116         if (nla_put_u32(msg, NL80211_ATTR_PROTOCOL_FEATURES,
12117                         NL80211_PROTOCOL_FEATURE_SPLIT_WIPHY_DUMP))
12118                 goto nla_put_failure;
12119
12120         genlmsg_end(msg, hdr);
12121         return genlmsg_reply(msg, info);
12122
12123  nla_put_failure:
12124         kfree_skb(msg);
12125         return -ENOBUFS;
12126 }
12127
12128 static int nl80211_update_ft_ies(struct sk_buff *skb, struct genl_info *info)
12129 {
12130         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12131         struct cfg80211_update_ft_ies_params ft_params;
12132         struct net_device *dev = info->user_ptr[1];
12133
12134         if (!rdev->ops->update_ft_ies)
12135                 return -EOPNOTSUPP;
12136
12137         if (!info->attrs[NL80211_ATTR_MDID] ||
12138             !info->attrs[NL80211_ATTR_IE])
12139                 return -EINVAL;
12140
12141         memset(&ft_params, 0, sizeof(ft_params));
12142         ft_params.md = nla_get_u16(info->attrs[NL80211_ATTR_MDID]);
12143         ft_params.ie = nla_data(info->attrs[NL80211_ATTR_IE]);
12144         ft_params.ie_len = nla_len(info->attrs[NL80211_ATTR_IE]);
12145
12146         return rdev_update_ft_ies(rdev, dev, &ft_params);
12147 }
12148
12149 static int nl80211_crit_protocol_start(struct sk_buff *skb,
12150                                        struct genl_info *info)
12151 {
12152         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12153         struct wireless_dev *wdev = info->user_ptr[1];
12154         enum nl80211_crit_proto_id proto = NL80211_CRIT_PROTO_UNSPEC;
12155         u16 duration;
12156         int ret;
12157
12158         if (!rdev->ops->crit_proto_start)
12159                 return -EOPNOTSUPP;
12160
12161         if (WARN_ON(!rdev->ops->crit_proto_stop))
12162                 return -EINVAL;
12163
12164         if (rdev->crit_proto_nlportid)
12165                 return -EBUSY;
12166
12167         /* determine protocol if provided */
12168         if (info->attrs[NL80211_ATTR_CRIT_PROT_ID])
12169                 proto = nla_get_u16(info->attrs[NL80211_ATTR_CRIT_PROT_ID]);
12170
12171         if (proto >= NUM_NL80211_CRIT_PROTO)
12172                 return -EINVAL;
12173
12174         /* timeout must be provided */
12175         if (!info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION])
12176                 return -EINVAL;
12177
12178         duration =
12179                 nla_get_u16(info->attrs[NL80211_ATTR_MAX_CRIT_PROT_DURATION]);
12180
12181         if (duration > NL80211_CRIT_PROTO_MAX_DURATION)
12182                 return -ERANGE;
12183
12184         ret = rdev_crit_proto_start(rdev, wdev, proto, duration);
12185         if (!ret)
12186                 rdev->crit_proto_nlportid = info->snd_portid;
12187
12188         return ret;
12189 }
12190
12191 static int nl80211_crit_protocol_stop(struct sk_buff *skb,
12192                                       struct genl_info *info)
12193 {
12194         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12195         struct wireless_dev *wdev = info->user_ptr[1];
12196
12197         if (!rdev->ops->crit_proto_stop)
12198                 return -EOPNOTSUPP;
12199
12200         if (rdev->crit_proto_nlportid) {
12201                 rdev->crit_proto_nlportid = 0;
12202                 rdev_crit_proto_stop(rdev, wdev);
12203         }
12204         return 0;
12205 }
12206
12207 static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
12208 {
12209         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12210         struct wireless_dev *wdev =
12211                 __cfg80211_wdev_from_attrs(genl_info_net(info), info->attrs);
12212         int i, err;
12213         u32 vid, subcmd;
12214
12215         if (!rdev->wiphy.vendor_commands)
12216                 return -EOPNOTSUPP;
12217
12218         if (IS_ERR(wdev)) {
12219                 err = PTR_ERR(wdev);
12220                 if (err != -EINVAL)
12221                         return err;
12222                 wdev = NULL;
12223         } else if (wdev->wiphy != &rdev->wiphy) {
12224                 return -EINVAL;
12225         }
12226
12227         if (!info->attrs[NL80211_ATTR_VENDOR_ID] ||
12228             !info->attrs[NL80211_ATTR_VENDOR_SUBCMD])
12229                 return -EINVAL;
12230
12231         vid = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_ID]);
12232         subcmd = nla_get_u32(info->attrs[NL80211_ATTR_VENDOR_SUBCMD]);
12233         for (i = 0; i < rdev->wiphy.n_vendor_commands; i++) {
12234                 const struct wiphy_vendor_command *vcmd;
12235                 void *data = NULL;
12236                 int len = 0;
12237
12238                 vcmd = &rdev->wiphy.vendor_commands[i];
12239
12240                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12241                         continue;
12242
12243                 if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12244                                    WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12245                         if (!wdev)
12246                                 return -EINVAL;
12247                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12248                             !wdev->netdev)
12249                                 return -EINVAL;
12250
12251                         if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12252                                 if (!wdev_running(wdev))
12253                                         return -ENETDOWN;
12254                         }
12255
12256                         if (!vcmd->doit)
12257                                 return -EOPNOTSUPP;
12258                 } else {
12259                         wdev = NULL;
12260                 }
12261
12262                 if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
12263                         data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12264                         len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
12265                 }
12266
12267                 rdev->cur_cmd_info = info;
12268                 err = rdev->wiphy.vendor_commands[i].doit(&rdev->wiphy, wdev,
12269                                                           data, len);
12270                 rdev->cur_cmd_info = NULL;
12271                 return err;
12272         }
12273
12274         return -EOPNOTSUPP;
12275 }
12276
12277 static int nl80211_prepare_vendor_dump(struct sk_buff *skb,
12278                                        struct netlink_callback *cb,
12279                                        struct cfg80211_registered_device **rdev,
12280                                        struct wireless_dev **wdev)
12281 {
12282         struct nlattr **attrbuf = genl_family_attrbuf(&nl80211_fam);
12283         u32 vid, subcmd;
12284         unsigned int i;
12285         int vcmd_idx = -1;
12286         int err;
12287         void *data = NULL;
12288         unsigned int data_len = 0;
12289
12290         if (cb->args[0]) {
12291                 /* subtract the 1 again here */
12292                 struct wiphy *wiphy = wiphy_idx_to_wiphy(cb->args[0] - 1);
12293                 struct wireless_dev *tmp;
12294
12295                 if (!wiphy)
12296                         return -ENODEV;
12297                 *rdev = wiphy_to_rdev(wiphy);
12298                 *wdev = NULL;
12299
12300                 if (cb->args[1]) {
12301                         list_for_each_entry(tmp, &wiphy->wdev_list, list) {
12302                                 if (tmp->identifier == cb->args[1] - 1) {
12303                                         *wdev = tmp;
12304                                         break;
12305                                 }
12306                         }
12307                 }
12308
12309                 /* keep rtnl locked in successful case */
12310                 return 0;
12311         }
12312
12313         err = nlmsg_parse(cb->nlh, GENL_HDRLEN + nl80211_fam.hdrsize, attrbuf,
12314                           nl80211_fam.maxattr, nl80211_policy, NULL);
12315         if (err)
12316                 return err;
12317
12318         if (!attrbuf[NL80211_ATTR_VENDOR_ID] ||
12319             !attrbuf[NL80211_ATTR_VENDOR_SUBCMD])
12320                 return -EINVAL;
12321
12322         *wdev = __cfg80211_wdev_from_attrs(sock_net(skb->sk), attrbuf);
12323         if (IS_ERR(*wdev))
12324                 *wdev = NULL;
12325
12326         *rdev = __cfg80211_rdev_from_attrs(sock_net(skb->sk), attrbuf);
12327         if (IS_ERR(*rdev))
12328                 return PTR_ERR(*rdev);
12329
12330         vid = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_ID]);
12331         subcmd = nla_get_u32(attrbuf[NL80211_ATTR_VENDOR_SUBCMD]);
12332
12333         for (i = 0; i < (*rdev)->wiphy.n_vendor_commands; i++) {
12334                 const struct wiphy_vendor_command *vcmd;
12335
12336                 vcmd = &(*rdev)->wiphy.vendor_commands[i];
12337
12338                 if (vcmd->info.vendor_id != vid || vcmd->info.subcmd != subcmd)
12339                         continue;
12340
12341                 if (!vcmd->dumpit)
12342                         return -EOPNOTSUPP;
12343
12344                 vcmd_idx = i;
12345                 break;
12346         }
12347
12348         if (vcmd_idx < 0)
12349                 return -EOPNOTSUPP;
12350
12351         if (attrbuf[NL80211_ATTR_VENDOR_DATA]) {
12352                 data = nla_data(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12353                 data_len = nla_len(attrbuf[NL80211_ATTR_VENDOR_DATA]);
12354         }
12355
12356         /* 0 is the first index - add 1 to parse only once */
12357         cb->args[0] = (*rdev)->wiphy_idx + 1;
12358         /* add 1 to know if it was NULL */
12359         cb->args[1] = *wdev ? (*wdev)->identifier + 1 : 0;
12360         cb->args[2] = vcmd_idx;
12361         cb->args[3] = (unsigned long)data;
12362         cb->args[4] = data_len;
12363
12364         /* keep rtnl locked in successful case */
12365         return 0;
12366 }
12367
12368 static int nl80211_vendor_cmd_dump(struct sk_buff *skb,
12369                                    struct netlink_callback *cb)
12370 {
12371         struct cfg80211_registered_device *rdev;
12372         struct wireless_dev *wdev;
12373         unsigned int vcmd_idx;
12374         const struct wiphy_vendor_command *vcmd;
12375         void *data;
12376         int data_len;
12377         int err;
12378         struct nlattr *vendor_data;
12379
12380         rtnl_lock();
12381         err = nl80211_prepare_vendor_dump(skb, cb, &rdev, &wdev);
12382         if (err)
12383                 goto out;
12384
12385         vcmd_idx = cb->args[2];
12386         data = (void *)cb->args[3];
12387         data_len = cb->args[4];
12388         vcmd = &rdev->wiphy.vendor_commands[vcmd_idx];
12389
12390         if (vcmd->flags & (WIPHY_VENDOR_CMD_NEED_WDEV |
12391                            WIPHY_VENDOR_CMD_NEED_NETDEV)) {
12392                 if (!wdev) {
12393                         err = -EINVAL;
12394                         goto out;
12395                 }
12396                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_NETDEV &&
12397                     !wdev->netdev) {
12398                         err = -EINVAL;
12399                         goto out;
12400                 }
12401
12402                 if (vcmd->flags & WIPHY_VENDOR_CMD_NEED_RUNNING) {
12403                         if (!wdev_running(wdev)) {
12404                                 err = -ENETDOWN;
12405                                 goto out;
12406                         }
12407                 }
12408         }
12409
12410         while (1) {
12411                 void *hdr = nl80211hdr_put(skb, NETLINK_CB(cb->skb).portid,
12412                                            cb->nlh->nlmsg_seq, NLM_F_MULTI,
12413                                            NL80211_CMD_VENDOR);
12414                 if (!hdr)
12415                         break;
12416
12417                 if (nla_put_u32(skb, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
12418                     (wdev && nla_put_u64_64bit(skb, NL80211_ATTR_WDEV,
12419                                                wdev_id(wdev),
12420                                                NL80211_ATTR_PAD))) {
12421                         genlmsg_cancel(skb, hdr);
12422                         break;
12423                 }
12424
12425                 vendor_data = nla_nest_start(skb, NL80211_ATTR_VENDOR_DATA);
12426                 if (!vendor_data) {
12427                         genlmsg_cancel(skb, hdr);
12428                         break;
12429                 }
12430
12431                 err = vcmd->dumpit(&rdev->wiphy, wdev, skb, data, data_len,
12432                                    (unsigned long *)&cb->args[5]);
12433                 nla_nest_end(skb, vendor_data);
12434
12435                 if (err == -ENOBUFS || err == -ENOENT) {
12436                         genlmsg_cancel(skb, hdr);
12437                         break;
12438                 } else if (err) {
12439                         genlmsg_cancel(skb, hdr);
12440                         goto out;
12441                 }
12442
12443                 genlmsg_end(skb, hdr);
12444         }
12445
12446         err = skb->len;
12447  out:
12448         rtnl_unlock();
12449         return err;
12450 }
12451
12452 struct sk_buff *__cfg80211_alloc_reply_skb(struct wiphy *wiphy,
12453                                            enum nl80211_commands cmd,
12454                                            enum nl80211_attrs attr,
12455                                            int approxlen)
12456 {
12457         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
12458
12459         if (WARN_ON(!rdev->cur_cmd_info))
12460                 return NULL;
12461
12462         return __cfg80211_alloc_vendor_skb(rdev, NULL, approxlen,
12463                                            rdev->cur_cmd_info->snd_portid,
12464                                            rdev->cur_cmd_info->snd_seq,
12465                                            cmd, attr, NULL, GFP_KERNEL);
12466 }
12467 EXPORT_SYMBOL(__cfg80211_alloc_reply_skb);
12468
12469 int cfg80211_vendor_cmd_reply(struct sk_buff *skb)
12470 {
12471         struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
12472         void *hdr = ((void **)skb->cb)[1];
12473         struct nlattr *data = ((void **)skb->cb)[2];
12474
12475         /* clear CB data for netlink core to own from now on */
12476         memset(skb->cb, 0, sizeof(skb->cb));
12477
12478         if (WARN_ON(!rdev->cur_cmd_info)) {
12479                 kfree_skb(skb);
12480                 return -EINVAL;
12481         }
12482
12483         nla_nest_end(skb, data);
12484         genlmsg_end(skb, hdr);
12485         return genlmsg_reply(skb, rdev->cur_cmd_info);
12486 }
12487 EXPORT_SYMBOL_GPL(cfg80211_vendor_cmd_reply);
12488
12489 static int nl80211_set_qos_map(struct sk_buff *skb,
12490                                struct genl_info *info)
12491 {
12492         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12493         struct cfg80211_qos_map *qos_map = NULL;
12494         struct net_device *dev = info->user_ptr[1];
12495         u8 *pos, len, num_des, des_len, des;
12496         int ret;
12497
12498         if (!rdev->ops->set_qos_map)
12499                 return -EOPNOTSUPP;
12500
12501         if (info->attrs[NL80211_ATTR_QOS_MAP]) {
12502                 pos = nla_data(info->attrs[NL80211_ATTR_QOS_MAP]);
12503                 len = nla_len(info->attrs[NL80211_ATTR_QOS_MAP]);
12504
12505                 if (len % 2 || len < IEEE80211_QOS_MAP_LEN_MIN ||
12506                     len > IEEE80211_QOS_MAP_LEN_MAX)
12507                         return -EINVAL;
12508
12509                 qos_map = kzalloc(sizeof(struct cfg80211_qos_map), GFP_KERNEL);
12510                 if (!qos_map)
12511                         return -ENOMEM;
12512
12513                 num_des = (len - IEEE80211_QOS_MAP_LEN_MIN) >> 1;
12514                 if (num_des) {
12515                         des_len = num_des *
12516                                 sizeof(struct cfg80211_dscp_exception);
12517                         memcpy(qos_map->dscp_exception, pos, des_len);
12518                         qos_map->num_des = num_des;
12519                         for (des = 0; des < num_des; des++) {
12520                                 if (qos_map->dscp_exception[des].up > 7) {
12521                                         kfree(qos_map);
12522                                         return -EINVAL;
12523                                 }
12524                         }
12525                         pos += des_len;
12526                 }
12527                 memcpy(qos_map->up, pos, IEEE80211_QOS_MAP_LEN_MIN);
12528         }
12529
12530         wdev_lock(dev->ieee80211_ptr);
12531         ret = nl80211_key_allowed(dev->ieee80211_ptr);
12532         if (!ret)
12533                 ret = rdev_set_qos_map(rdev, dev, qos_map);
12534         wdev_unlock(dev->ieee80211_ptr);
12535
12536         kfree(qos_map);
12537         return ret;
12538 }
12539
12540 static int nl80211_add_tx_ts(struct sk_buff *skb, struct genl_info *info)
12541 {
12542         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12543         struct net_device *dev = info->user_ptr[1];
12544         struct wireless_dev *wdev = dev->ieee80211_ptr;
12545         const u8 *peer;
12546         u8 tsid, up;
12547         u16 admitted_time = 0;
12548         int err;
12549
12550         if (!(rdev->wiphy.features & NL80211_FEATURE_SUPPORTS_WMM_ADMISSION))
12551                 return -EOPNOTSUPP;
12552
12553         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC] ||
12554             !info->attrs[NL80211_ATTR_USER_PRIO])
12555                 return -EINVAL;
12556
12557         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12558         up = nla_get_u8(info->attrs[NL80211_ATTR_USER_PRIO]);
12559
12560         /* WMM uses TIDs 0-7 even for TSPEC */
12561         if (tsid >= IEEE80211_FIRST_TSPEC_TSID) {
12562                 /* TODO: handle 802.11 TSPEC/admission control
12563                  * need more attributes for that (e.g. BA session requirement);
12564                  * change the WMM adminssion test above to allow both then
12565                  */
12566                 return -EINVAL;
12567         }
12568
12569         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12570
12571         if (info->attrs[NL80211_ATTR_ADMITTED_TIME]) {
12572                 admitted_time =
12573                         nla_get_u16(info->attrs[NL80211_ATTR_ADMITTED_TIME]);
12574                 if (!admitted_time)
12575                         return -EINVAL;
12576         }
12577
12578         wdev_lock(wdev);
12579         switch (wdev->iftype) {
12580         case NL80211_IFTYPE_STATION:
12581         case NL80211_IFTYPE_P2P_CLIENT:
12582                 if (wdev->current_bss)
12583                         break;
12584                 err = -ENOTCONN;
12585                 goto out;
12586         default:
12587                 err = -EOPNOTSUPP;
12588                 goto out;
12589         }
12590
12591         err = rdev_add_tx_ts(rdev, dev, tsid, peer, up, admitted_time);
12592
12593  out:
12594         wdev_unlock(wdev);
12595         return err;
12596 }
12597
12598 static int nl80211_del_tx_ts(struct sk_buff *skb, struct genl_info *info)
12599 {
12600         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12601         struct net_device *dev = info->user_ptr[1];
12602         struct wireless_dev *wdev = dev->ieee80211_ptr;
12603         const u8 *peer;
12604         u8 tsid;
12605         int err;
12606
12607         if (!info->attrs[NL80211_ATTR_TSID] || !info->attrs[NL80211_ATTR_MAC])
12608                 return -EINVAL;
12609
12610         tsid = nla_get_u8(info->attrs[NL80211_ATTR_TSID]);
12611         peer = nla_data(info->attrs[NL80211_ATTR_MAC]);
12612
12613         wdev_lock(wdev);
12614         err = rdev_del_tx_ts(rdev, dev, tsid, peer);
12615         wdev_unlock(wdev);
12616
12617         return err;
12618 }
12619
12620 static int nl80211_tdls_channel_switch(struct sk_buff *skb,
12621                                        struct genl_info *info)
12622 {
12623         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12624         struct net_device *dev = info->user_ptr[1];
12625         struct wireless_dev *wdev = dev->ieee80211_ptr;
12626         struct cfg80211_chan_def chandef = {};
12627         const u8 *addr;
12628         u8 oper_class;
12629         int err;
12630
12631         if (!rdev->ops->tdls_channel_switch ||
12632             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12633                 return -EOPNOTSUPP;
12634
12635         switch (dev->ieee80211_ptr->iftype) {
12636         case NL80211_IFTYPE_STATION:
12637         case NL80211_IFTYPE_P2P_CLIENT:
12638                 break;
12639         default:
12640                 return -EOPNOTSUPP;
12641         }
12642
12643         if (!info->attrs[NL80211_ATTR_MAC] ||
12644             !info->attrs[NL80211_ATTR_OPER_CLASS])
12645                 return -EINVAL;
12646
12647         err = nl80211_parse_chandef(rdev, info, &chandef);
12648         if (err)
12649                 return err;
12650
12651         /*
12652          * Don't allow wide channels on the 2.4Ghz band, as per IEEE802.11-2012
12653          * section 10.22.6.2.1. Disallow 5/10Mhz channels as well for now, the
12654          * specification is not defined for them.
12655          */
12656         if (chandef.chan->band == NL80211_BAND_2GHZ &&
12657             chandef.width != NL80211_CHAN_WIDTH_20_NOHT &&
12658             chandef.width != NL80211_CHAN_WIDTH_20)
12659                 return -EINVAL;
12660
12661         /* we will be active on the TDLS link */
12662         if (!cfg80211_reg_can_beacon_relax(&rdev->wiphy, &chandef,
12663                                            wdev->iftype))
12664                 return -EINVAL;
12665
12666         /* don't allow switching to DFS channels */
12667         if (cfg80211_chandef_dfs_required(wdev->wiphy, &chandef, wdev->iftype))
12668                 return -EINVAL;
12669
12670         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12671         oper_class = nla_get_u8(info->attrs[NL80211_ATTR_OPER_CLASS]);
12672
12673         wdev_lock(wdev);
12674         err = rdev_tdls_channel_switch(rdev, dev, addr, oper_class, &chandef);
12675         wdev_unlock(wdev);
12676
12677         return err;
12678 }
12679
12680 static int nl80211_tdls_cancel_channel_switch(struct sk_buff *skb,
12681                                               struct genl_info *info)
12682 {
12683         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12684         struct net_device *dev = info->user_ptr[1];
12685         struct wireless_dev *wdev = dev->ieee80211_ptr;
12686         const u8 *addr;
12687
12688         if (!rdev->ops->tdls_channel_switch ||
12689             !rdev->ops->tdls_cancel_channel_switch ||
12690             !(rdev->wiphy.features & NL80211_FEATURE_TDLS_CHANNEL_SWITCH))
12691                 return -EOPNOTSUPP;
12692
12693         switch (dev->ieee80211_ptr->iftype) {
12694         case NL80211_IFTYPE_STATION:
12695         case NL80211_IFTYPE_P2P_CLIENT:
12696                 break;
12697         default:
12698                 return -EOPNOTSUPP;
12699         }
12700
12701         if (!info->attrs[NL80211_ATTR_MAC])
12702                 return -EINVAL;
12703
12704         addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
12705
12706         wdev_lock(wdev);
12707         rdev_tdls_cancel_channel_switch(rdev, dev, addr);
12708         wdev_unlock(wdev);
12709
12710         return 0;
12711 }
12712
12713 static int nl80211_set_multicast_to_unicast(struct sk_buff *skb,
12714                                             struct genl_info *info)
12715 {
12716         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12717         struct net_device *dev = info->user_ptr[1];
12718         struct wireless_dev *wdev = dev->ieee80211_ptr;
12719         const struct nlattr *nla;
12720         bool enabled;
12721
12722         if (!rdev->ops->set_multicast_to_unicast)
12723                 return -EOPNOTSUPP;
12724
12725         if (wdev->iftype != NL80211_IFTYPE_AP &&
12726             wdev->iftype != NL80211_IFTYPE_P2P_GO)
12727                 return -EOPNOTSUPP;
12728
12729         nla = info->attrs[NL80211_ATTR_MULTICAST_TO_UNICAST_ENABLED];
12730         enabled = nla_get_flag(nla);
12731
12732         return rdev_set_multicast_to_unicast(rdev, dev, enabled);
12733 }
12734
12735 static int nl80211_set_pmk(struct sk_buff *skb, struct genl_info *info)
12736 {
12737         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12738         struct net_device *dev = info->user_ptr[1];
12739         struct wireless_dev *wdev = dev->ieee80211_ptr;
12740         struct cfg80211_pmk_conf pmk_conf = {};
12741         int ret;
12742
12743         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12744             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12745                 return -EOPNOTSUPP;
12746
12747         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12748                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12749                 return -EOPNOTSUPP;
12750
12751         if (!info->attrs[NL80211_ATTR_MAC] || !info->attrs[NL80211_ATTR_PMK])
12752                 return -EINVAL;
12753
12754         wdev_lock(wdev);
12755         if (!wdev->current_bss) {
12756                 ret = -ENOTCONN;
12757                 goto out;
12758         }
12759
12760         pmk_conf.aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12761         if (memcmp(pmk_conf.aa, wdev->current_bss->pub.bssid, ETH_ALEN)) {
12762                 ret = -EINVAL;
12763                 goto out;
12764         }
12765
12766         pmk_conf.pmk = nla_data(info->attrs[NL80211_ATTR_PMK]);
12767         pmk_conf.pmk_len = nla_len(info->attrs[NL80211_ATTR_PMK]);
12768         if (pmk_conf.pmk_len != WLAN_PMK_LEN &&
12769             pmk_conf.pmk_len != WLAN_PMK_LEN_SUITE_B_192) {
12770                 ret = -EINVAL;
12771                 goto out;
12772         }
12773
12774         if (info->attrs[NL80211_ATTR_PMKR0_NAME]) {
12775                 int r0_name_len = nla_len(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12776
12777                 if (r0_name_len != WLAN_PMK_NAME_LEN) {
12778                         ret = -EINVAL;
12779                         goto out;
12780                 }
12781
12782                 pmk_conf.pmk_r0_name =
12783                         nla_data(info->attrs[NL80211_ATTR_PMKR0_NAME]);
12784         }
12785
12786         ret = rdev_set_pmk(rdev, dev, &pmk_conf);
12787 out:
12788         wdev_unlock(wdev);
12789         return ret;
12790 }
12791
12792 static int nl80211_del_pmk(struct sk_buff *skb, struct genl_info *info)
12793 {
12794         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12795         struct net_device *dev = info->user_ptr[1];
12796         struct wireless_dev *wdev = dev->ieee80211_ptr;
12797         const u8 *aa;
12798         int ret;
12799
12800         if (wdev->iftype != NL80211_IFTYPE_STATION &&
12801             wdev->iftype != NL80211_IFTYPE_P2P_CLIENT)
12802                 return -EOPNOTSUPP;
12803
12804         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12805                                      NL80211_EXT_FEATURE_4WAY_HANDSHAKE_STA_1X))
12806                 return -EOPNOTSUPP;
12807
12808         if (!info->attrs[NL80211_ATTR_MAC])
12809                 return -EINVAL;
12810
12811         wdev_lock(wdev);
12812         aa = nla_data(info->attrs[NL80211_ATTR_MAC]);
12813         ret = rdev_del_pmk(rdev, dev, aa);
12814         wdev_unlock(wdev);
12815
12816         return ret;
12817 }
12818
12819 static int nl80211_external_auth(struct sk_buff *skb, struct genl_info *info)
12820 {
12821         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12822         struct net_device *dev = info->user_ptr[1];
12823         struct cfg80211_external_auth_params params;
12824
12825         if (!rdev->ops->external_auth)
12826                 return -EOPNOTSUPP;
12827
12828         if (!info->attrs[NL80211_ATTR_SSID])
12829                 return -EINVAL;
12830
12831         if (!info->attrs[NL80211_ATTR_BSSID])
12832                 return -EINVAL;
12833
12834         if (!info->attrs[NL80211_ATTR_STATUS_CODE])
12835                 return -EINVAL;
12836
12837         memset(&params, 0, sizeof(params));
12838
12839         params.ssid.ssid_len = nla_len(info->attrs[NL80211_ATTR_SSID]);
12840         if (params.ssid.ssid_len == 0 ||
12841             params.ssid.ssid_len > IEEE80211_MAX_SSID_LEN)
12842                 return -EINVAL;
12843         memcpy(params.ssid.ssid, nla_data(info->attrs[NL80211_ATTR_SSID]),
12844                params.ssid.ssid_len);
12845
12846         memcpy(params.bssid, nla_data(info->attrs[NL80211_ATTR_BSSID]),
12847                ETH_ALEN);
12848
12849         params.status = nla_get_u16(info->attrs[NL80211_ATTR_STATUS_CODE]);
12850
12851         return rdev_external_auth(rdev, dev, &params);
12852 }
12853
12854 static int nl80211_tx_control_port(struct sk_buff *skb, struct genl_info *info)
12855 {
12856         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12857         struct net_device *dev = info->user_ptr[1];
12858         struct wireless_dev *wdev = dev->ieee80211_ptr;
12859         const u8 *buf;
12860         size_t len;
12861         u8 *dest;
12862         u16 proto;
12863         bool noencrypt;
12864         int err;
12865
12866         if (!wiphy_ext_feature_isset(&rdev->wiphy,
12867                                      NL80211_EXT_FEATURE_CONTROL_PORT_OVER_NL80211))
12868                 return -EOPNOTSUPP;
12869
12870         if (!rdev->ops->tx_control_port)
12871                 return -EOPNOTSUPP;
12872
12873         if (!info->attrs[NL80211_ATTR_FRAME] ||
12874             !info->attrs[NL80211_ATTR_MAC] ||
12875             !info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]) {
12876                 GENL_SET_ERR_MSG(info, "Frame, MAC or ethertype missing");
12877                 return -EINVAL;
12878         }
12879
12880         wdev_lock(wdev);
12881
12882         switch (wdev->iftype) {
12883         case NL80211_IFTYPE_AP:
12884         case NL80211_IFTYPE_P2P_GO:
12885         case NL80211_IFTYPE_MESH_POINT:
12886                 break;
12887         case NL80211_IFTYPE_ADHOC:
12888         case NL80211_IFTYPE_STATION:
12889         case NL80211_IFTYPE_P2P_CLIENT:
12890                 if (wdev->current_bss)
12891                         break;
12892                 err = -ENOTCONN;
12893                 goto out;
12894         default:
12895                 err = -EOPNOTSUPP;
12896                 goto out;
12897         }
12898
12899         wdev_unlock(wdev);
12900
12901         buf = nla_data(info->attrs[NL80211_ATTR_FRAME]);
12902         len = nla_len(info->attrs[NL80211_ATTR_FRAME]);
12903         dest = nla_data(info->attrs[NL80211_ATTR_MAC]);
12904         proto = nla_get_u16(info->attrs[NL80211_ATTR_CONTROL_PORT_ETHERTYPE]);
12905         noencrypt =
12906                 nla_get_flag(info->attrs[NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT]);
12907
12908         return rdev_tx_control_port(rdev, dev, buf, len,
12909                                     dest, cpu_to_be16(proto), noencrypt);
12910
12911  out:
12912         wdev_unlock(wdev);
12913         return err;
12914 }
12915
12916 static int nl80211_get_ftm_responder_stats(struct sk_buff *skb,
12917                                            struct genl_info *info)
12918 {
12919         struct cfg80211_registered_device *rdev = info->user_ptr[0];
12920         struct net_device *dev = info->user_ptr[1];
12921         struct wireless_dev *wdev = dev->ieee80211_ptr;
12922         struct cfg80211_ftm_responder_stats ftm_stats = {};
12923         struct sk_buff *msg;
12924         void *hdr;
12925         struct nlattr *ftm_stats_attr;
12926         int err;
12927
12928         if (wdev->iftype != NL80211_IFTYPE_AP || !wdev->beacon_interval)
12929                 return -EOPNOTSUPP;
12930
12931         err = rdev_get_ftm_responder_stats(rdev, dev, &ftm_stats);
12932         if (err)
12933                 return err;
12934
12935         if (!ftm_stats.filled)
12936                 return -ENODATA;
12937
12938         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
12939         if (!msg)
12940                 return -ENOMEM;
12941
12942         hdr = nl80211hdr_put(msg, info->snd_portid, info->snd_seq, 0,
12943                              NL80211_CMD_GET_FTM_RESPONDER_STATS);
12944         if (!hdr)
12945                 return -ENOBUFS;
12946
12947         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
12948                 goto nla_put_failure;
12949
12950         ftm_stats_attr = nla_nest_start(msg, NL80211_ATTR_FTM_RESPONDER_STATS);
12951         if (!ftm_stats_attr)
12952                 goto nla_put_failure;
12953
12954 #define SET_FTM(field, name, type)                                       \
12955         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
12956             nla_put_ ## type(msg, NL80211_FTM_STATS_ ## name,            \
12957                              ftm_stats.field))                           \
12958                 goto nla_put_failure; } while (0)
12959 #define SET_FTM_U64(field, name)                                         \
12960         do { if ((ftm_stats.filled & BIT(NL80211_FTM_STATS_ ## name)) && \
12961             nla_put_u64_64bit(msg, NL80211_FTM_STATS_ ## name,           \
12962                               ftm_stats.field, NL80211_FTM_STATS_PAD))   \
12963                 goto nla_put_failure; } while (0)
12964
12965         SET_FTM(success_num, SUCCESS_NUM, u32);
12966         SET_FTM(partial_num, PARTIAL_NUM, u32);
12967         SET_FTM(failed_num, FAILED_NUM, u32);
12968         SET_FTM(asap_num, ASAP_NUM, u32);
12969         SET_FTM(non_asap_num, NON_ASAP_NUM, u32);
12970         SET_FTM_U64(total_duration_ms, TOTAL_DURATION_MSEC);
12971         SET_FTM(unknown_triggers_num, UNKNOWN_TRIGGERS_NUM, u32);
12972         SET_FTM(reschedule_requests_num, RESCHEDULE_REQUESTS_NUM, u32);
12973         SET_FTM(out_of_window_triggers_num, OUT_OF_WINDOW_TRIGGERS_NUM, u32);
12974 #undef SET_FTM
12975
12976         nla_nest_end(msg, ftm_stats_attr);
12977
12978         genlmsg_end(msg, hdr);
12979         return genlmsg_reply(msg, info);
12980
12981 nla_put_failure:
12982         nlmsg_free(msg);
12983         return -ENOBUFS;
12984 }
12985
12986 #define NL80211_FLAG_NEED_WIPHY         0x01
12987 #define NL80211_FLAG_NEED_NETDEV        0x02
12988 #define NL80211_FLAG_NEED_RTNL          0x04
12989 #define NL80211_FLAG_CHECK_NETDEV_UP    0x08
12990 #define NL80211_FLAG_NEED_NETDEV_UP     (NL80211_FLAG_NEED_NETDEV |\
12991                                          NL80211_FLAG_CHECK_NETDEV_UP)
12992 #define NL80211_FLAG_NEED_WDEV          0x10
12993 /* If a netdev is associated, it must be UP, P2P must be started */
12994 #define NL80211_FLAG_NEED_WDEV_UP       (NL80211_FLAG_NEED_WDEV |\
12995                                          NL80211_FLAG_CHECK_NETDEV_UP)
12996 #define NL80211_FLAG_CLEAR_SKB          0x20
12997
12998 static int nl80211_pre_doit(const struct genl_ops *ops, struct sk_buff *skb,
12999                             struct genl_info *info)
13000 {
13001         struct cfg80211_registered_device *rdev;
13002         struct wireless_dev *wdev;
13003         struct net_device *dev;
13004         bool rtnl = ops->internal_flags & NL80211_FLAG_NEED_RTNL;
13005
13006         if (rtnl)
13007                 rtnl_lock();
13008
13009         if (ops->internal_flags & NL80211_FLAG_NEED_WIPHY) {
13010                 rdev = cfg80211_get_dev_from_info(genl_info_net(info), info);
13011                 if (IS_ERR(rdev)) {
13012                         if (rtnl)
13013                                 rtnl_unlock();
13014                         return PTR_ERR(rdev);
13015                 }
13016                 info->user_ptr[0] = rdev;
13017         } else if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV ||
13018                    ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13019                 ASSERT_RTNL();
13020
13021                 wdev = __cfg80211_wdev_from_attrs(genl_info_net(info),
13022                                                   info->attrs);
13023                 if (IS_ERR(wdev)) {
13024                         if (rtnl)
13025                                 rtnl_unlock();
13026                         return PTR_ERR(wdev);
13027                 }
13028
13029                 dev = wdev->netdev;
13030                 rdev = wiphy_to_rdev(wdev->wiphy);
13031
13032                 if (ops->internal_flags & NL80211_FLAG_NEED_NETDEV) {
13033                         if (!dev) {
13034                                 if (rtnl)
13035                                         rtnl_unlock();
13036                                 return -EINVAL;
13037                         }
13038
13039                         info->user_ptr[1] = dev;
13040                 } else {
13041                         info->user_ptr[1] = wdev;
13042                 }
13043
13044                 if (ops->internal_flags & NL80211_FLAG_CHECK_NETDEV_UP &&
13045                     !wdev_running(wdev)) {
13046                         if (rtnl)
13047                                 rtnl_unlock();
13048                         return -ENETDOWN;
13049                 }
13050
13051                 if (dev)
13052                         dev_hold(dev);
13053
13054                 info->user_ptr[0] = rdev;
13055         }
13056
13057         return 0;
13058 }
13059
13060 static void nl80211_post_doit(const struct genl_ops *ops, struct sk_buff *skb,
13061                               struct genl_info *info)
13062 {
13063         if (info->user_ptr[1]) {
13064                 if (ops->internal_flags & NL80211_FLAG_NEED_WDEV) {
13065                         struct wireless_dev *wdev = info->user_ptr[1];
13066
13067                         if (wdev->netdev)
13068                                 dev_put(wdev->netdev);
13069                 } else {
13070                         dev_put(info->user_ptr[1]);
13071                 }
13072         }
13073
13074         if (ops->internal_flags & NL80211_FLAG_NEED_RTNL)
13075                 rtnl_unlock();
13076
13077         /* If needed, clear the netlink message payload from the SKB
13078          * as it might contain key data that shouldn't stick around on
13079          * the heap after the SKB is freed. The netlink message header
13080          * is still needed for further processing, so leave it intact.
13081          */
13082         if (ops->internal_flags & NL80211_FLAG_CLEAR_SKB) {
13083                 struct nlmsghdr *nlh = nlmsg_hdr(skb);
13084
13085                 memset(nlmsg_data(nlh), 0, nlmsg_len(nlh));
13086         }
13087 }
13088
13089 static const struct genl_ops nl80211_ops[] = {
13090         {
13091                 .cmd = NL80211_CMD_GET_WIPHY,
13092                 .doit = nl80211_get_wiphy,
13093                 .dumpit = nl80211_dump_wiphy,
13094                 .done = nl80211_dump_wiphy_done,
13095                 .policy = nl80211_policy,
13096                 /* can be retrieved by unprivileged users */
13097                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13098                                   NL80211_FLAG_NEED_RTNL,
13099         },
13100         {
13101                 .cmd = NL80211_CMD_SET_WIPHY,
13102                 .doit = nl80211_set_wiphy,
13103                 .policy = nl80211_policy,
13104                 .flags = GENL_UNS_ADMIN_PERM,
13105                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13106         },
13107         {
13108                 .cmd = NL80211_CMD_GET_INTERFACE,
13109                 .doit = nl80211_get_interface,
13110                 .dumpit = nl80211_dump_interface,
13111                 .policy = nl80211_policy,
13112                 /* can be retrieved by unprivileged users */
13113                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13114                                   NL80211_FLAG_NEED_RTNL,
13115         },
13116         {
13117                 .cmd = NL80211_CMD_SET_INTERFACE,
13118                 .doit = nl80211_set_interface,
13119                 .policy = nl80211_policy,
13120                 .flags = GENL_UNS_ADMIN_PERM,
13121                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13122                                   NL80211_FLAG_NEED_RTNL,
13123         },
13124         {
13125                 .cmd = NL80211_CMD_NEW_INTERFACE,
13126                 .doit = nl80211_new_interface,
13127                 .policy = nl80211_policy,
13128                 .flags = GENL_UNS_ADMIN_PERM,
13129                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13130                                   NL80211_FLAG_NEED_RTNL,
13131         },
13132         {
13133                 .cmd = NL80211_CMD_DEL_INTERFACE,
13134                 .doit = nl80211_del_interface,
13135                 .policy = nl80211_policy,
13136                 .flags = GENL_UNS_ADMIN_PERM,
13137                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13138                                   NL80211_FLAG_NEED_RTNL,
13139         },
13140         {
13141                 .cmd = NL80211_CMD_GET_KEY,
13142                 .doit = nl80211_get_key,
13143                 .policy = nl80211_policy,
13144                 .flags = GENL_UNS_ADMIN_PERM,
13145                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13146                                   NL80211_FLAG_NEED_RTNL,
13147         },
13148         {
13149                 .cmd = NL80211_CMD_SET_KEY,
13150                 .doit = nl80211_set_key,
13151                 .policy = nl80211_policy,
13152                 .flags = GENL_UNS_ADMIN_PERM,
13153                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13154                                   NL80211_FLAG_NEED_RTNL |
13155                                   NL80211_FLAG_CLEAR_SKB,
13156         },
13157         {
13158                 .cmd = NL80211_CMD_NEW_KEY,
13159                 .doit = nl80211_new_key,
13160                 .policy = nl80211_policy,
13161                 .flags = GENL_UNS_ADMIN_PERM,
13162                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13163                                   NL80211_FLAG_NEED_RTNL |
13164                                   NL80211_FLAG_CLEAR_SKB,
13165         },
13166         {
13167                 .cmd = NL80211_CMD_DEL_KEY,
13168                 .doit = nl80211_del_key,
13169                 .policy = nl80211_policy,
13170                 .flags = GENL_UNS_ADMIN_PERM,
13171                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13172                                   NL80211_FLAG_NEED_RTNL,
13173         },
13174         {
13175                 .cmd = NL80211_CMD_SET_BEACON,
13176                 .policy = nl80211_policy,
13177                 .flags = GENL_UNS_ADMIN_PERM,
13178                 .doit = nl80211_set_beacon,
13179                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13180                                   NL80211_FLAG_NEED_RTNL,
13181         },
13182         {
13183                 .cmd = NL80211_CMD_START_AP,
13184                 .policy = nl80211_policy,
13185                 .flags = GENL_UNS_ADMIN_PERM,
13186                 .doit = nl80211_start_ap,
13187                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13188                                   NL80211_FLAG_NEED_RTNL,
13189         },
13190         {
13191                 .cmd = NL80211_CMD_STOP_AP,
13192                 .policy = nl80211_policy,
13193                 .flags = GENL_UNS_ADMIN_PERM,
13194                 .doit = nl80211_stop_ap,
13195                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13196                                   NL80211_FLAG_NEED_RTNL,
13197         },
13198         {
13199                 .cmd = NL80211_CMD_GET_STATION,
13200                 .doit = nl80211_get_station,
13201                 .dumpit = nl80211_dump_station,
13202                 .policy = nl80211_policy,
13203                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13204                                   NL80211_FLAG_NEED_RTNL,
13205         },
13206         {
13207                 .cmd = NL80211_CMD_SET_STATION,
13208                 .doit = nl80211_set_station,
13209                 .policy = nl80211_policy,
13210                 .flags = GENL_UNS_ADMIN_PERM,
13211                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13212                                   NL80211_FLAG_NEED_RTNL,
13213         },
13214         {
13215                 .cmd = NL80211_CMD_NEW_STATION,
13216                 .doit = nl80211_new_station,
13217                 .policy = nl80211_policy,
13218                 .flags = GENL_UNS_ADMIN_PERM,
13219                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13220                                   NL80211_FLAG_NEED_RTNL,
13221         },
13222         {
13223                 .cmd = NL80211_CMD_DEL_STATION,
13224                 .doit = nl80211_del_station,
13225                 .policy = nl80211_policy,
13226                 .flags = GENL_UNS_ADMIN_PERM,
13227                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13228                                   NL80211_FLAG_NEED_RTNL,
13229         },
13230         {
13231                 .cmd = NL80211_CMD_GET_MPATH,
13232                 .doit = nl80211_get_mpath,
13233                 .dumpit = nl80211_dump_mpath,
13234                 .policy = nl80211_policy,
13235                 .flags = GENL_UNS_ADMIN_PERM,
13236                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13237                                   NL80211_FLAG_NEED_RTNL,
13238         },
13239         {
13240                 .cmd = NL80211_CMD_GET_MPP,
13241                 .doit = nl80211_get_mpp,
13242                 .dumpit = nl80211_dump_mpp,
13243                 .policy = nl80211_policy,
13244                 .flags = GENL_UNS_ADMIN_PERM,
13245                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13246                                   NL80211_FLAG_NEED_RTNL,
13247         },
13248         {
13249                 .cmd = NL80211_CMD_SET_MPATH,
13250                 .doit = nl80211_set_mpath,
13251                 .policy = nl80211_policy,
13252                 .flags = GENL_UNS_ADMIN_PERM,
13253                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13254                                   NL80211_FLAG_NEED_RTNL,
13255         },
13256         {
13257                 .cmd = NL80211_CMD_NEW_MPATH,
13258                 .doit = nl80211_new_mpath,
13259                 .policy = nl80211_policy,
13260                 .flags = GENL_UNS_ADMIN_PERM,
13261                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13262                                   NL80211_FLAG_NEED_RTNL,
13263         },
13264         {
13265                 .cmd = NL80211_CMD_DEL_MPATH,
13266                 .doit = nl80211_del_mpath,
13267                 .policy = nl80211_policy,
13268                 .flags = GENL_UNS_ADMIN_PERM,
13269                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13270                                   NL80211_FLAG_NEED_RTNL,
13271         },
13272         {
13273                 .cmd = NL80211_CMD_SET_BSS,
13274                 .doit = nl80211_set_bss,
13275                 .policy = nl80211_policy,
13276                 .flags = GENL_UNS_ADMIN_PERM,
13277                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13278                                   NL80211_FLAG_NEED_RTNL,
13279         },
13280         {
13281                 .cmd = NL80211_CMD_GET_REG,
13282                 .doit = nl80211_get_reg_do,
13283                 .dumpit = nl80211_get_reg_dump,
13284                 .policy = nl80211_policy,
13285                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13286                 /* can be retrieved by unprivileged users */
13287         },
13288 #ifdef CONFIG_CFG80211_CRDA_SUPPORT
13289         {
13290                 .cmd = NL80211_CMD_SET_REG,
13291                 .doit = nl80211_set_reg,
13292                 .policy = nl80211_policy,
13293                 .flags = GENL_ADMIN_PERM,
13294                 .internal_flags = NL80211_FLAG_NEED_RTNL,
13295         },
13296 #endif
13297         {
13298                 .cmd = NL80211_CMD_REQ_SET_REG,
13299                 .doit = nl80211_req_set_reg,
13300                 .policy = nl80211_policy,
13301                 .flags = GENL_ADMIN_PERM,
13302         },
13303         {
13304                 .cmd = NL80211_CMD_RELOAD_REGDB,
13305                 .doit = nl80211_reload_regdb,
13306                 .policy = nl80211_policy,
13307                 .flags = GENL_ADMIN_PERM,
13308         },
13309         {
13310                 .cmd = NL80211_CMD_GET_MESH_CONFIG,
13311                 .doit = nl80211_get_mesh_config,
13312                 .policy = nl80211_policy,
13313                 /* can be retrieved by unprivileged users */
13314                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13315                                   NL80211_FLAG_NEED_RTNL,
13316         },
13317         {
13318                 .cmd = NL80211_CMD_SET_MESH_CONFIG,
13319                 .doit = nl80211_update_mesh_config,
13320                 .policy = nl80211_policy,
13321                 .flags = GENL_UNS_ADMIN_PERM,
13322                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13323                                   NL80211_FLAG_NEED_RTNL,
13324         },
13325         {
13326                 .cmd = NL80211_CMD_TRIGGER_SCAN,
13327                 .doit = nl80211_trigger_scan,
13328                 .policy = nl80211_policy,
13329                 .flags = GENL_UNS_ADMIN_PERM,
13330                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13331                                   NL80211_FLAG_NEED_RTNL,
13332         },
13333         {
13334                 .cmd = NL80211_CMD_ABORT_SCAN,
13335                 .doit = nl80211_abort_scan,
13336                 .policy = nl80211_policy,
13337                 .flags = GENL_UNS_ADMIN_PERM,
13338                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13339                                   NL80211_FLAG_NEED_RTNL,
13340         },
13341         {
13342                 .cmd = NL80211_CMD_GET_SCAN,
13343                 .policy = nl80211_policy,
13344                 .dumpit = nl80211_dump_scan,
13345         },
13346         {
13347                 .cmd = NL80211_CMD_START_SCHED_SCAN,
13348                 .doit = nl80211_start_sched_scan,
13349                 .policy = nl80211_policy,
13350                 .flags = GENL_UNS_ADMIN_PERM,
13351                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13352                                   NL80211_FLAG_NEED_RTNL,
13353         },
13354         {
13355                 .cmd = NL80211_CMD_STOP_SCHED_SCAN,
13356                 .doit = nl80211_stop_sched_scan,
13357                 .policy = nl80211_policy,
13358                 .flags = GENL_UNS_ADMIN_PERM,
13359                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13360                                   NL80211_FLAG_NEED_RTNL,
13361         },
13362         {
13363                 .cmd = NL80211_CMD_AUTHENTICATE,
13364                 .doit = nl80211_authenticate,
13365                 .policy = nl80211_policy,
13366                 .flags = GENL_UNS_ADMIN_PERM,
13367                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13368                                   NL80211_FLAG_NEED_RTNL |
13369                                   NL80211_FLAG_CLEAR_SKB,
13370         },
13371         {
13372                 .cmd = NL80211_CMD_ASSOCIATE,
13373                 .doit = nl80211_associate,
13374                 .policy = nl80211_policy,
13375                 .flags = GENL_UNS_ADMIN_PERM,
13376                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13377                                   NL80211_FLAG_NEED_RTNL,
13378         },
13379         {
13380                 .cmd = NL80211_CMD_DEAUTHENTICATE,
13381                 .doit = nl80211_deauthenticate,
13382                 .policy = nl80211_policy,
13383                 .flags = GENL_UNS_ADMIN_PERM,
13384                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13385                                   NL80211_FLAG_NEED_RTNL,
13386         },
13387         {
13388                 .cmd = NL80211_CMD_DISASSOCIATE,
13389                 .doit = nl80211_disassociate,
13390                 .policy = nl80211_policy,
13391                 .flags = GENL_UNS_ADMIN_PERM,
13392                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13393                                   NL80211_FLAG_NEED_RTNL,
13394         },
13395         {
13396                 .cmd = NL80211_CMD_JOIN_IBSS,
13397                 .doit = nl80211_join_ibss,
13398                 .policy = nl80211_policy,
13399                 .flags = GENL_UNS_ADMIN_PERM,
13400                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13401                                   NL80211_FLAG_NEED_RTNL,
13402         },
13403         {
13404                 .cmd = NL80211_CMD_LEAVE_IBSS,
13405                 .doit = nl80211_leave_ibss,
13406                 .policy = nl80211_policy,
13407                 .flags = GENL_UNS_ADMIN_PERM,
13408                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13409                                   NL80211_FLAG_NEED_RTNL,
13410         },
13411 #ifdef CONFIG_NL80211_TESTMODE
13412         {
13413                 .cmd = NL80211_CMD_TESTMODE,
13414                 .doit = nl80211_testmode_do,
13415                 .dumpit = nl80211_testmode_dump,
13416                 .policy = nl80211_policy,
13417                 .flags = GENL_UNS_ADMIN_PERM,
13418                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13419                                   NL80211_FLAG_NEED_RTNL,
13420         },
13421 #endif
13422         {
13423                 .cmd = NL80211_CMD_CONNECT,
13424                 .doit = nl80211_connect,
13425                 .policy = nl80211_policy,
13426                 .flags = GENL_UNS_ADMIN_PERM,
13427                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13428                                   NL80211_FLAG_NEED_RTNL,
13429         },
13430         {
13431                 .cmd = NL80211_CMD_UPDATE_CONNECT_PARAMS,
13432                 .doit = nl80211_update_connect_params,
13433                 .policy = nl80211_policy,
13434                 .flags = GENL_ADMIN_PERM,
13435                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13436                                   NL80211_FLAG_NEED_RTNL,
13437         },
13438         {
13439                 .cmd = NL80211_CMD_DISCONNECT,
13440                 .doit = nl80211_disconnect,
13441                 .policy = nl80211_policy,
13442                 .flags = GENL_UNS_ADMIN_PERM,
13443                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13444                                   NL80211_FLAG_NEED_RTNL,
13445         },
13446         {
13447                 .cmd = NL80211_CMD_SET_WIPHY_NETNS,
13448                 .doit = nl80211_wiphy_netns,
13449                 .policy = nl80211_policy,
13450                 .flags = GENL_UNS_ADMIN_PERM,
13451                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13452                                   NL80211_FLAG_NEED_RTNL,
13453         },
13454         {
13455                 .cmd = NL80211_CMD_GET_SURVEY,
13456                 .policy = nl80211_policy,
13457                 .dumpit = nl80211_dump_survey,
13458         },
13459         {
13460                 .cmd = NL80211_CMD_SET_PMKSA,
13461                 .doit = nl80211_setdel_pmksa,
13462                 .policy = nl80211_policy,
13463                 .flags = GENL_UNS_ADMIN_PERM,
13464                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13465                                   NL80211_FLAG_NEED_RTNL,
13466         },
13467         {
13468                 .cmd = NL80211_CMD_DEL_PMKSA,
13469                 .doit = nl80211_setdel_pmksa,
13470                 .policy = nl80211_policy,
13471                 .flags = GENL_UNS_ADMIN_PERM,
13472                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13473                                   NL80211_FLAG_NEED_RTNL,
13474         },
13475         {
13476                 .cmd = NL80211_CMD_FLUSH_PMKSA,
13477                 .doit = nl80211_flush_pmksa,
13478                 .policy = nl80211_policy,
13479                 .flags = GENL_UNS_ADMIN_PERM,
13480                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13481                                   NL80211_FLAG_NEED_RTNL,
13482         },
13483         {
13484                 .cmd = NL80211_CMD_REMAIN_ON_CHANNEL,
13485                 .doit = nl80211_remain_on_channel,
13486                 .policy = nl80211_policy,
13487                 .flags = GENL_UNS_ADMIN_PERM,
13488                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13489                                   NL80211_FLAG_NEED_RTNL,
13490         },
13491         {
13492                 .cmd = NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
13493                 .doit = nl80211_cancel_remain_on_channel,
13494                 .policy = nl80211_policy,
13495                 .flags = GENL_UNS_ADMIN_PERM,
13496                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13497                                   NL80211_FLAG_NEED_RTNL,
13498         },
13499         {
13500                 .cmd = NL80211_CMD_SET_TX_BITRATE_MASK,
13501                 .doit = nl80211_set_tx_bitrate_mask,
13502                 .policy = nl80211_policy,
13503                 .flags = GENL_UNS_ADMIN_PERM,
13504                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13505                                   NL80211_FLAG_NEED_RTNL,
13506         },
13507         {
13508                 .cmd = NL80211_CMD_REGISTER_FRAME,
13509                 .doit = nl80211_register_mgmt,
13510                 .policy = nl80211_policy,
13511                 .flags = GENL_UNS_ADMIN_PERM,
13512                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13513                                   NL80211_FLAG_NEED_RTNL,
13514         },
13515         {
13516                 .cmd = NL80211_CMD_FRAME,
13517                 .doit = nl80211_tx_mgmt,
13518                 .policy = nl80211_policy,
13519                 .flags = GENL_UNS_ADMIN_PERM,
13520                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13521                                   NL80211_FLAG_NEED_RTNL,
13522         },
13523         {
13524                 .cmd = NL80211_CMD_FRAME_WAIT_CANCEL,
13525                 .doit = nl80211_tx_mgmt_cancel_wait,
13526                 .policy = nl80211_policy,
13527                 .flags = GENL_UNS_ADMIN_PERM,
13528                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13529                                   NL80211_FLAG_NEED_RTNL,
13530         },
13531         {
13532                 .cmd = NL80211_CMD_SET_POWER_SAVE,
13533                 .doit = nl80211_set_power_save,
13534                 .policy = nl80211_policy,
13535                 .flags = GENL_UNS_ADMIN_PERM,
13536                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13537                                   NL80211_FLAG_NEED_RTNL,
13538         },
13539         {
13540                 .cmd = NL80211_CMD_GET_POWER_SAVE,
13541                 .doit = nl80211_get_power_save,
13542                 .policy = nl80211_policy,
13543                 /* can be retrieved by unprivileged users */
13544                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13545                                   NL80211_FLAG_NEED_RTNL,
13546         },
13547         {
13548                 .cmd = NL80211_CMD_SET_CQM,
13549                 .doit = nl80211_set_cqm,
13550                 .policy = nl80211_policy,
13551                 .flags = GENL_UNS_ADMIN_PERM,
13552                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13553                                   NL80211_FLAG_NEED_RTNL,
13554         },
13555         {
13556                 .cmd = NL80211_CMD_SET_CHANNEL,
13557                 .doit = nl80211_set_channel,
13558                 .policy = nl80211_policy,
13559                 .flags = GENL_UNS_ADMIN_PERM,
13560                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13561                                   NL80211_FLAG_NEED_RTNL,
13562         },
13563         {
13564                 .cmd = NL80211_CMD_SET_WDS_PEER,
13565                 .doit = nl80211_set_wds_peer,
13566                 .policy = nl80211_policy,
13567                 .flags = GENL_UNS_ADMIN_PERM,
13568                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13569                                   NL80211_FLAG_NEED_RTNL,
13570         },
13571         {
13572                 .cmd = NL80211_CMD_JOIN_MESH,
13573                 .doit = nl80211_join_mesh,
13574                 .policy = nl80211_policy,
13575                 .flags = GENL_UNS_ADMIN_PERM,
13576                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13577                                   NL80211_FLAG_NEED_RTNL,
13578         },
13579         {
13580                 .cmd = NL80211_CMD_LEAVE_MESH,
13581                 .doit = nl80211_leave_mesh,
13582                 .policy = nl80211_policy,
13583                 .flags = GENL_UNS_ADMIN_PERM,
13584                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13585                                   NL80211_FLAG_NEED_RTNL,
13586         },
13587         {
13588                 .cmd = NL80211_CMD_JOIN_OCB,
13589                 .doit = nl80211_join_ocb,
13590                 .policy = nl80211_policy,
13591                 .flags = GENL_UNS_ADMIN_PERM,
13592                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13593                                   NL80211_FLAG_NEED_RTNL,
13594         },
13595         {
13596                 .cmd = NL80211_CMD_LEAVE_OCB,
13597                 .doit = nl80211_leave_ocb,
13598                 .policy = nl80211_policy,
13599                 .flags = GENL_UNS_ADMIN_PERM,
13600                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13601                                   NL80211_FLAG_NEED_RTNL,
13602         },
13603 #ifdef CONFIG_PM
13604         {
13605                 .cmd = NL80211_CMD_GET_WOWLAN,
13606                 .doit = nl80211_get_wowlan,
13607                 .policy = nl80211_policy,
13608                 /* can be retrieved by unprivileged users */
13609                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13610                                   NL80211_FLAG_NEED_RTNL,
13611         },
13612         {
13613                 .cmd = NL80211_CMD_SET_WOWLAN,
13614                 .doit = nl80211_set_wowlan,
13615                 .policy = nl80211_policy,
13616                 .flags = GENL_UNS_ADMIN_PERM,
13617                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13618                                   NL80211_FLAG_NEED_RTNL,
13619         },
13620 #endif
13621         {
13622                 .cmd = NL80211_CMD_SET_REKEY_OFFLOAD,
13623                 .doit = nl80211_set_rekey_data,
13624                 .policy = nl80211_policy,
13625                 .flags = GENL_UNS_ADMIN_PERM,
13626                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13627                                   NL80211_FLAG_NEED_RTNL |
13628                                   NL80211_FLAG_CLEAR_SKB,
13629         },
13630         {
13631                 .cmd = NL80211_CMD_TDLS_MGMT,
13632                 .doit = nl80211_tdls_mgmt,
13633                 .policy = nl80211_policy,
13634                 .flags = GENL_UNS_ADMIN_PERM,
13635                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13636                                   NL80211_FLAG_NEED_RTNL,
13637         },
13638         {
13639                 .cmd = NL80211_CMD_TDLS_OPER,
13640                 .doit = nl80211_tdls_oper,
13641                 .policy = nl80211_policy,
13642                 .flags = GENL_UNS_ADMIN_PERM,
13643                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13644                                   NL80211_FLAG_NEED_RTNL,
13645         },
13646         {
13647                 .cmd = NL80211_CMD_UNEXPECTED_FRAME,
13648                 .doit = nl80211_register_unexpected_frame,
13649                 .policy = nl80211_policy,
13650                 .flags = GENL_UNS_ADMIN_PERM,
13651                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13652                                   NL80211_FLAG_NEED_RTNL,
13653         },
13654         {
13655                 .cmd = NL80211_CMD_PROBE_CLIENT,
13656                 .doit = nl80211_probe_client,
13657                 .policy = nl80211_policy,
13658                 .flags = GENL_UNS_ADMIN_PERM,
13659                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13660                                   NL80211_FLAG_NEED_RTNL,
13661         },
13662         {
13663                 .cmd = NL80211_CMD_REGISTER_BEACONS,
13664                 .doit = nl80211_register_beacons,
13665                 .policy = nl80211_policy,
13666                 .flags = GENL_UNS_ADMIN_PERM,
13667                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13668                                   NL80211_FLAG_NEED_RTNL,
13669         },
13670         {
13671                 .cmd = NL80211_CMD_SET_NOACK_MAP,
13672                 .doit = nl80211_set_noack_map,
13673                 .policy = nl80211_policy,
13674                 .flags = GENL_UNS_ADMIN_PERM,
13675                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13676                                   NL80211_FLAG_NEED_RTNL,
13677         },
13678         {
13679                 .cmd = NL80211_CMD_START_P2P_DEVICE,
13680                 .doit = nl80211_start_p2p_device,
13681                 .policy = nl80211_policy,
13682                 .flags = GENL_UNS_ADMIN_PERM,
13683                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13684                                   NL80211_FLAG_NEED_RTNL,
13685         },
13686         {
13687                 .cmd = NL80211_CMD_STOP_P2P_DEVICE,
13688                 .doit = nl80211_stop_p2p_device,
13689                 .policy = nl80211_policy,
13690                 .flags = GENL_UNS_ADMIN_PERM,
13691                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13692                                   NL80211_FLAG_NEED_RTNL,
13693         },
13694         {
13695                 .cmd = NL80211_CMD_START_NAN,
13696                 .doit = nl80211_start_nan,
13697                 .policy = nl80211_policy,
13698                 .flags = GENL_ADMIN_PERM,
13699                 .internal_flags = NL80211_FLAG_NEED_WDEV |
13700                                   NL80211_FLAG_NEED_RTNL,
13701         },
13702         {
13703                 .cmd = NL80211_CMD_STOP_NAN,
13704                 .doit = nl80211_stop_nan,
13705                 .policy = nl80211_policy,
13706                 .flags = GENL_ADMIN_PERM,
13707                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13708                                   NL80211_FLAG_NEED_RTNL,
13709         },
13710         {
13711                 .cmd = NL80211_CMD_ADD_NAN_FUNCTION,
13712                 .doit = nl80211_nan_add_func,
13713                 .policy = nl80211_policy,
13714                 .flags = GENL_ADMIN_PERM,
13715                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13716                                   NL80211_FLAG_NEED_RTNL,
13717         },
13718         {
13719                 .cmd = NL80211_CMD_DEL_NAN_FUNCTION,
13720                 .doit = nl80211_nan_del_func,
13721                 .policy = nl80211_policy,
13722                 .flags = GENL_ADMIN_PERM,
13723                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13724                                   NL80211_FLAG_NEED_RTNL,
13725         },
13726         {
13727                 .cmd = NL80211_CMD_CHANGE_NAN_CONFIG,
13728                 .doit = nl80211_nan_change_config,
13729                 .policy = nl80211_policy,
13730                 .flags = GENL_ADMIN_PERM,
13731                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13732                                   NL80211_FLAG_NEED_RTNL,
13733         },
13734         {
13735                 .cmd = NL80211_CMD_SET_MCAST_RATE,
13736                 .doit = nl80211_set_mcast_rate,
13737                 .policy = nl80211_policy,
13738                 .flags = GENL_UNS_ADMIN_PERM,
13739                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13740                                   NL80211_FLAG_NEED_RTNL,
13741         },
13742         {
13743                 .cmd = NL80211_CMD_SET_MAC_ACL,
13744                 .doit = nl80211_set_mac_acl,
13745                 .policy = nl80211_policy,
13746                 .flags = GENL_UNS_ADMIN_PERM,
13747                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13748                                   NL80211_FLAG_NEED_RTNL,
13749         },
13750         {
13751                 .cmd = NL80211_CMD_RADAR_DETECT,
13752                 .doit = nl80211_start_radar_detection,
13753                 .policy = nl80211_policy,
13754                 .flags = GENL_UNS_ADMIN_PERM,
13755                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13756                                   NL80211_FLAG_NEED_RTNL,
13757         },
13758         {
13759                 .cmd = NL80211_CMD_GET_PROTOCOL_FEATURES,
13760                 .doit = nl80211_get_protocol_features,
13761                 .policy = nl80211_policy,
13762         },
13763         {
13764                 .cmd = NL80211_CMD_UPDATE_FT_IES,
13765                 .doit = nl80211_update_ft_ies,
13766                 .policy = nl80211_policy,
13767                 .flags = GENL_UNS_ADMIN_PERM,
13768                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13769                                   NL80211_FLAG_NEED_RTNL,
13770         },
13771         {
13772                 .cmd = NL80211_CMD_CRIT_PROTOCOL_START,
13773                 .doit = nl80211_crit_protocol_start,
13774                 .policy = nl80211_policy,
13775                 .flags = GENL_UNS_ADMIN_PERM,
13776                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13777                                   NL80211_FLAG_NEED_RTNL,
13778         },
13779         {
13780                 .cmd = NL80211_CMD_CRIT_PROTOCOL_STOP,
13781                 .doit = nl80211_crit_protocol_stop,
13782                 .policy = nl80211_policy,
13783                 .flags = GENL_UNS_ADMIN_PERM,
13784                 .internal_flags = NL80211_FLAG_NEED_WDEV_UP |
13785                                   NL80211_FLAG_NEED_RTNL,
13786         },
13787         {
13788                 .cmd = NL80211_CMD_GET_COALESCE,
13789                 .doit = nl80211_get_coalesce,
13790                 .policy = nl80211_policy,
13791                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13792                                   NL80211_FLAG_NEED_RTNL,
13793         },
13794         {
13795                 .cmd = NL80211_CMD_SET_COALESCE,
13796                 .doit = nl80211_set_coalesce,
13797                 .policy = nl80211_policy,
13798                 .flags = GENL_UNS_ADMIN_PERM,
13799                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13800                                   NL80211_FLAG_NEED_RTNL,
13801         },
13802         {
13803                 .cmd = NL80211_CMD_CHANNEL_SWITCH,
13804                 .doit = nl80211_channel_switch,
13805                 .policy = nl80211_policy,
13806                 .flags = GENL_UNS_ADMIN_PERM,
13807                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13808                                   NL80211_FLAG_NEED_RTNL,
13809         },
13810         {
13811                 .cmd = NL80211_CMD_VENDOR,
13812                 .doit = nl80211_vendor_cmd,
13813                 .dumpit = nl80211_vendor_cmd_dump,
13814                 .policy = nl80211_policy,
13815                 .flags = GENL_UNS_ADMIN_PERM,
13816                 .internal_flags = NL80211_FLAG_NEED_WIPHY |
13817                                   NL80211_FLAG_NEED_RTNL,
13818         },
13819         {
13820                 .cmd = NL80211_CMD_SET_QOS_MAP,
13821                 .doit = nl80211_set_qos_map,
13822                 .policy = nl80211_policy,
13823                 .flags = GENL_UNS_ADMIN_PERM,
13824                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13825                                   NL80211_FLAG_NEED_RTNL,
13826         },
13827         {
13828                 .cmd = NL80211_CMD_ADD_TX_TS,
13829                 .doit = nl80211_add_tx_ts,
13830                 .policy = nl80211_policy,
13831                 .flags = GENL_UNS_ADMIN_PERM,
13832                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13833                                   NL80211_FLAG_NEED_RTNL,
13834         },
13835         {
13836                 .cmd = NL80211_CMD_DEL_TX_TS,
13837                 .doit = nl80211_del_tx_ts,
13838                 .policy = nl80211_policy,
13839                 .flags = GENL_UNS_ADMIN_PERM,
13840                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13841                                   NL80211_FLAG_NEED_RTNL,
13842         },
13843         {
13844                 .cmd = NL80211_CMD_TDLS_CHANNEL_SWITCH,
13845                 .doit = nl80211_tdls_channel_switch,
13846                 .policy = nl80211_policy,
13847                 .flags = GENL_UNS_ADMIN_PERM,
13848                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13849                                   NL80211_FLAG_NEED_RTNL,
13850         },
13851         {
13852                 .cmd = NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH,
13853                 .doit = nl80211_tdls_cancel_channel_switch,
13854                 .policy = nl80211_policy,
13855                 .flags = GENL_UNS_ADMIN_PERM,
13856                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13857                                   NL80211_FLAG_NEED_RTNL,
13858         },
13859         {
13860                 .cmd = NL80211_CMD_SET_MULTICAST_TO_UNICAST,
13861                 .doit = nl80211_set_multicast_to_unicast,
13862                 .policy = nl80211_policy,
13863                 .flags = GENL_UNS_ADMIN_PERM,
13864                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13865                                   NL80211_FLAG_NEED_RTNL,
13866         },
13867         {
13868                 .cmd = NL80211_CMD_SET_PMK,
13869                 .doit = nl80211_set_pmk,
13870                 .policy = nl80211_policy,
13871                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13872                                   NL80211_FLAG_NEED_RTNL,
13873         },
13874         {
13875                 .cmd = NL80211_CMD_DEL_PMK,
13876                 .doit = nl80211_del_pmk,
13877                 .policy = nl80211_policy,
13878                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13879                                   NL80211_FLAG_NEED_RTNL,
13880         },
13881         {
13882                 .cmd = NL80211_CMD_EXTERNAL_AUTH,
13883                 .doit = nl80211_external_auth,
13884                 .policy = nl80211_policy,
13885                 .flags = GENL_ADMIN_PERM,
13886                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13887                                   NL80211_FLAG_NEED_RTNL,
13888         },
13889         {
13890                 .cmd = NL80211_CMD_CONTROL_PORT_FRAME,
13891                 .doit = nl80211_tx_control_port,
13892                 .policy = nl80211_policy,
13893                 .flags = GENL_UNS_ADMIN_PERM,
13894                 .internal_flags = NL80211_FLAG_NEED_NETDEV_UP |
13895                                   NL80211_FLAG_NEED_RTNL,
13896         },
13897         {
13898                 .cmd = NL80211_CMD_GET_FTM_RESPONDER_STATS,
13899                 .doit = nl80211_get_ftm_responder_stats,
13900                 .policy = nl80211_policy,
13901                 .internal_flags = NL80211_FLAG_NEED_NETDEV |
13902                                   NL80211_FLAG_NEED_RTNL,
13903         },
13904 };
13905
13906 static struct genl_family nl80211_fam __ro_after_init = {
13907         .name = NL80211_GENL_NAME,      /* have users key off the name instead */
13908         .hdrsize = 0,                   /* no private header */
13909         .version = 1,                   /* no particular meaning now */
13910         .maxattr = NL80211_ATTR_MAX,
13911         .netnsok = true,
13912         .pre_doit = nl80211_pre_doit,
13913         .post_doit = nl80211_post_doit,
13914         .module = THIS_MODULE,
13915         .ops = nl80211_ops,
13916         .n_ops = ARRAY_SIZE(nl80211_ops),
13917         .mcgrps = nl80211_mcgrps,
13918         .n_mcgrps = ARRAY_SIZE(nl80211_mcgrps),
13919 };
13920
13921 /* notification functions */
13922
13923 void nl80211_notify_wiphy(struct cfg80211_registered_device *rdev,
13924                           enum nl80211_commands cmd)
13925 {
13926         struct sk_buff *msg;
13927         struct nl80211_dump_wiphy_state state = {};
13928
13929         WARN_ON(cmd != NL80211_CMD_NEW_WIPHY &&
13930                 cmd != NL80211_CMD_DEL_WIPHY);
13931
13932         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13933         if (!msg)
13934                 return;
13935
13936         if (nl80211_send_wiphy(rdev, cmd, msg, 0, 0, 0, &state) < 0) {
13937                 nlmsg_free(msg);
13938                 return;
13939         }
13940
13941         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13942                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13943 }
13944
13945 void nl80211_notify_iface(struct cfg80211_registered_device *rdev,
13946                                 struct wireless_dev *wdev,
13947                                 enum nl80211_commands cmd)
13948 {
13949         struct sk_buff *msg;
13950
13951         WARN_ON(cmd != NL80211_CMD_NEW_INTERFACE &&
13952                 cmd != NL80211_CMD_DEL_INTERFACE);
13953
13954         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
13955         if (!msg)
13956                 return;
13957
13958         if (nl80211_send_iface(msg, 0, 0, 0, rdev, wdev,
13959                                cmd == NL80211_CMD_DEL_INTERFACE) < 0) {
13960                 nlmsg_free(msg);
13961                 return;
13962         }
13963
13964         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
13965                                 NL80211_MCGRP_CONFIG, GFP_KERNEL);
13966 }
13967
13968 static int nl80211_add_scan_req(struct sk_buff *msg,
13969                                 struct cfg80211_registered_device *rdev)
13970 {
13971         struct cfg80211_scan_request *req = rdev->scan_req;
13972         struct nlattr *nest;
13973         int i;
13974
13975         if (WARN_ON(!req))
13976                 return 0;
13977
13978         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_SSIDS);
13979         if (!nest)
13980                 goto nla_put_failure;
13981         for (i = 0; i < req->n_ssids; i++) {
13982                 if (nla_put(msg, i, req->ssids[i].ssid_len, req->ssids[i].ssid))
13983                         goto nla_put_failure;
13984         }
13985         nla_nest_end(msg, nest);
13986
13987         nest = nla_nest_start(msg, NL80211_ATTR_SCAN_FREQUENCIES);
13988         if (!nest)
13989                 goto nla_put_failure;
13990         for (i = 0; i < req->n_channels; i++) {
13991                 if (nla_put_u32(msg, i, req->channels[i]->center_freq))
13992                         goto nla_put_failure;
13993         }
13994         nla_nest_end(msg, nest);
13995
13996         if (req->ie &&
13997             nla_put(msg, NL80211_ATTR_IE, req->ie_len, req->ie))
13998                 goto nla_put_failure;
13999
14000         if (req->flags &&
14001             nla_put_u32(msg, NL80211_ATTR_SCAN_FLAGS, req->flags))
14002                 goto nla_put_failure;
14003
14004         if (req->info.scan_start_tsf &&
14005             (nla_put_u64_64bit(msg, NL80211_ATTR_SCAN_START_TIME_TSF,
14006                                req->info.scan_start_tsf, NL80211_BSS_PAD) ||
14007              nla_put(msg, NL80211_ATTR_SCAN_START_TIME_TSF_BSSID, ETH_ALEN,
14008                      req->info.tsf_bssid)))
14009                 goto nla_put_failure;
14010
14011         return 0;
14012  nla_put_failure:
14013         return -ENOBUFS;
14014 }
14015
14016 static int nl80211_prep_scan_msg(struct sk_buff *msg,
14017                                  struct cfg80211_registered_device *rdev,
14018                                  struct wireless_dev *wdev,
14019                                  u32 portid, u32 seq, int flags,
14020                                  u32 cmd)
14021 {
14022         void *hdr;
14023
14024         hdr = nl80211hdr_put(msg, portid, seq, flags, cmd);
14025         if (!hdr)
14026                 return -1;
14027
14028         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14029             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14030                                          wdev->netdev->ifindex)) ||
14031             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14032                               NL80211_ATTR_PAD))
14033                 goto nla_put_failure;
14034
14035         /* ignore errors and send incomplete event anyway */
14036         nl80211_add_scan_req(msg, rdev);
14037
14038         genlmsg_end(msg, hdr);
14039         return 0;
14040
14041  nla_put_failure:
14042         genlmsg_cancel(msg, hdr);
14043         return -EMSGSIZE;
14044 }
14045
14046 static int
14047 nl80211_prep_sched_scan_msg(struct sk_buff *msg,
14048                             struct cfg80211_sched_scan_request *req, u32 cmd)
14049 {
14050         void *hdr;
14051
14052         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14053         if (!hdr)
14054                 return -1;
14055
14056         if (nla_put_u32(msg, NL80211_ATTR_WIPHY,
14057                         wiphy_to_rdev(req->wiphy)->wiphy_idx) ||
14058             nla_put_u32(msg, NL80211_ATTR_IFINDEX, req->dev->ifindex) ||
14059             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, req->reqid,
14060                               NL80211_ATTR_PAD))
14061                 goto nla_put_failure;
14062
14063         genlmsg_end(msg, hdr);
14064         return 0;
14065
14066  nla_put_failure:
14067         genlmsg_cancel(msg, hdr);
14068         return -EMSGSIZE;
14069 }
14070
14071 void nl80211_send_scan_start(struct cfg80211_registered_device *rdev,
14072                              struct wireless_dev *wdev)
14073 {
14074         struct sk_buff *msg;
14075
14076         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14077         if (!msg)
14078                 return;
14079
14080         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14081                                   NL80211_CMD_TRIGGER_SCAN) < 0) {
14082                 nlmsg_free(msg);
14083                 return;
14084         }
14085
14086         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14087                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14088 }
14089
14090 struct sk_buff *nl80211_build_scan_msg(struct cfg80211_registered_device *rdev,
14091                                        struct wireless_dev *wdev, bool aborted)
14092 {
14093         struct sk_buff *msg;
14094
14095         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14096         if (!msg)
14097                 return NULL;
14098
14099         if (nl80211_prep_scan_msg(msg, rdev, wdev, 0, 0, 0,
14100                                   aborted ? NL80211_CMD_SCAN_ABORTED :
14101                                             NL80211_CMD_NEW_SCAN_RESULTS) < 0) {
14102                 nlmsg_free(msg);
14103                 return NULL;
14104         }
14105
14106         return msg;
14107 }
14108
14109 /* send message created by nl80211_build_scan_msg() */
14110 void nl80211_send_scan_msg(struct cfg80211_registered_device *rdev,
14111                            struct sk_buff *msg)
14112 {
14113         if (!msg)
14114                 return;
14115
14116         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14117                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14118 }
14119
14120 void nl80211_send_sched_scan(struct cfg80211_sched_scan_request *req, u32 cmd)
14121 {
14122         struct sk_buff *msg;
14123
14124         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14125         if (!msg)
14126                 return;
14127
14128         if (nl80211_prep_sched_scan_msg(msg, req, cmd) < 0) {
14129                 nlmsg_free(msg);
14130                 return;
14131         }
14132
14133         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(req->wiphy), msg, 0,
14134                                 NL80211_MCGRP_SCAN, GFP_KERNEL);
14135 }
14136
14137 static bool nl80211_reg_change_event_fill(struct sk_buff *msg,
14138                                           struct regulatory_request *request)
14139 {
14140         /* Userspace can always count this one always being set */
14141         if (nla_put_u8(msg, NL80211_ATTR_REG_INITIATOR, request->initiator))
14142                 goto nla_put_failure;
14143
14144         if (request->alpha2[0] == '0' && request->alpha2[1] == '0') {
14145                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14146                                NL80211_REGDOM_TYPE_WORLD))
14147                         goto nla_put_failure;
14148         } else if (request->alpha2[0] == '9' && request->alpha2[1] == '9') {
14149                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14150                                NL80211_REGDOM_TYPE_CUSTOM_WORLD))
14151                         goto nla_put_failure;
14152         } else if ((request->alpha2[0] == '9' && request->alpha2[1] == '8') ||
14153                    request->intersect) {
14154                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14155                                NL80211_REGDOM_TYPE_INTERSECTION))
14156                         goto nla_put_failure;
14157         } else {
14158                 if (nla_put_u8(msg, NL80211_ATTR_REG_TYPE,
14159                                NL80211_REGDOM_TYPE_COUNTRY) ||
14160                     nla_put_string(msg, NL80211_ATTR_REG_ALPHA2,
14161                                    request->alpha2))
14162                         goto nla_put_failure;
14163         }
14164
14165         if (request->wiphy_idx != WIPHY_IDX_INVALID) {
14166                 struct wiphy *wiphy = wiphy_idx_to_wiphy(request->wiphy_idx);
14167
14168                 if (wiphy &&
14169                     nla_put_u32(msg, NL80211_ATTR_WIPHY, request->wiphy_idx))
14170                         goto nla_put_failure;
14171
14172                 if (wiphy &&
14173                     wiphy->regulatory_flags & REGULATORY_WIPHY_SELF_MANAGED &&
14174                     nla_put_flag(msg, NL80211_ATTR_WIPHY_SELF_MANAGED_REG))
14175                         goto nla_put_failure;
14176         }
14177
14178         return true;
14179
14180 nla_put_failure:
14181         return false;
14182 }
14183
14184 /*
14185  * This can happen on global regulatory changes or device specific settings
14186  * based on custom regulatory domains.
14187  */
14188 void nl80211_common_reg_change_event(enum nl80211_commands cmd_id,
14189                                      struct regulatory_request *request)
14190 {
14191         struct sk_buff *msg;
14192         void *hdr;
14193
14194         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14195         if (!msg)
14196                 return;
14197
14198         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd_id);
14199         if (!hdr) {
14200                 nlmsg_free(msg);
14201                 return;
14202         }
14203
14204         if (nl80211_reg_change_event_fill(msg, request) == false)
14205                 goto nla_put_failure;
14206
14207         genlmsg_end(msg, hdr);
14208
14209         rcu_read_lock();
14210         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14211                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14212         rcu_read_unlock();
14213
14214         return;
14215
14216 nla_put_failure:
14217         nlmsg_free(msg);
14218 }
14219
14220 static void nl80211_send_mlme_event(struct cfg80211_registered_device *rdev,
14221                                     struct net_device *netdev,
14222                                     const u8 *buf, size_t len,
14223                                     enum nl80211_commands cmd, gfp_t gfp,
14224                                     int uapsd_queues)
14225 {
14226         struct sk_buff *msg;
14227         void *hdr;
14228
14229         msg = nlmsg_new(100 + len, gfp);
14230         if (!msg)
14231                 return;
14232
14233         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14234         if (!hdr) {
14235                 nlmsg_free(msg);
14236                 return;
14237         }
14238
14239         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14240             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14241             nla_put(msg, NL80211_ATTR_FRAME, len, buf))
14242                 goto nla_put_failure;
14243
14244         if (uapsd_queues >= 0) {
14245                 struct nlattr *nla_wmm =
14246                         nla_nest_start(msg, NL80211_ATTR_STA_WME);
14247                 if (!nla_wmm)
14248                         goto nla_put_failure;
14249
14250                 if (nla_put_u8(msg, NL80211_STA_WME_UAPSD_QUEUES,
14251                                uapsd_queues))
14252                         goto nla_put_failure;
14253
14254                 nla_nest_end(msg, nla_wmm);
14255         }
14256
14257         genlmsg_end(msg, hdr);
14258
14259         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14260                                 NL80211_MCGRP_MLME, gfp);
14261         return;
14262
14263  nla_put_failure:
14264         nlmsg_free(msg);
14265 }
14266
14267 void nl80211_send_rx_auth(struct cfg80211_registered_device *rdev,
14268                           struct net_device *netdev, const u8 *buf,
14269                           size_t len, gfp_t gfp)
14270 {
14271         nl80211_send_mlme_event(rdev, netdev, buf, len,
14272                                 NL80211_CMD_AUTHENTICATE, gfp, -1);
14273 }
14274
14275 void nl80211_send_rx_assoc(struct cfg80211_registered_device *rdev,
14276                            struct net_device *netdev, const u8 *buf,
14277                            size_t len, gfp_t gfp, int uapsd_queues)
14278 {
14279         nl80211_send_mlme_event(rdev, netdev, buf, len,
14280                                 NL80211_CMD_ASSOCIATE, gfp, uapsd_queues);
14281 }
14282
14283 void nl80211_send_deauth(struct cfg80211_registered_device *rdev,
14284                          struct net_device *netdev, const u8 *buf,
14285                          size_t len, gfp_t gfp)
14286 {
14287         nl80211_send_mlme_event(rdev, netdev, buf, len,
14288                                 NL80211_CMD_DEAUTHENTICATE, gfp, -1);
14289 }
14290
14291 void nl80211_send_disassoc(struct cfg80211_registered_device *rdev,
14292                            struct net_device *netdev, const u8 *buf,
14293                            size_t len, gfp_t gfp)
14294 {
14295         nl80211_send_mlme_event(rdev, netdev, buf, len,
14296                                 NL80211_CMD_DISASSOCIATE, gfp, -1);
14297 }
14298
14299 void cfg80211_rx_unprot_mlme_mgmt(struct net_device *dev, const u8 *buf,
14300                                   size_t len)
14301 {
14302         struct wireless_dev *wdev = dev->ieee80211_ptr;
14303         struct wiphy *wiphy = wdev->wiphy;
14304         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14305         const struct ieee80211_mgmt *mgmt = (void *)buf;
14306         u32 cmd;
14307
14308         if (WARN_ON(len < 2))
14309                 return;
14310
14311         if (ieee80211_is_deauth(mgmt->frame_control))
14312                 cmd = NL80211_CMD_UNPROT_DEAUTHENTICATE;
14313         else
14314                 cmd = NL80211_CMD_UNPROT_DISASSOCIATE;
14315
14316         trace_cfg80211_rx_unprot_mlme_mgmt(dev, buf, len);
14317         nl80211_send_mlme_event(rdev, dev, buf, len, cmd, GFP_ATOMIC, -1);
14318 }
14319 EXPORT_SYMBOL(cfg80211_rx_unprot_mlme_mgmt);
14320
14321 static void nl80211_send_mlme_timeout(struct cfg80211_registered_device *rdev,
14322                                       struct net_device *netdev, int cmd,
14323                                       const u8 *addr, gfp_t gfp)
14324 {
14325         struct sk_buff *msg;
14326         void *hdr;
14327
14328         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14329         if (!msg)
14330                 return;
14331
14332         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14333         if (!hdr) {
14334                 nlmsg_free(msg);
14335                 return;
14336         }
14337
14338         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14339             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14340             nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14341             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14342                 goto nla_put_failure;
14343
14344         genlmsg_end(msg, hdr);
14345
14346         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14347                                 NL80211_MCGRP_MLME, gfp);
14348         return;
14349
14350  nla_put_failure:
14351         nlmsg_free(msg);
14352 }
14353
14354 void nl80211_send_auth_timeout(struct cfg80211_registered_device *rdev,
14355                                struct net_device *netdev, const u8 *addr,
14356                                gfp_t gfp)
14357 {
14358         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_AUTHENTICATE,
14359                                   addr, gfp);
14360 }
14361
14362 void nl80211_send_assoc_timeout(struct cfg80211_registered_device *rdev,
14363                                 struct net_device *netdev, const u8 *addr,
14364                                 gfp_t gfp)
14365 {
14366         nl80211_send_mlme_timeout(rdev, netdev, NL80211_CMD_ASSOCIATE,
14367                                   addr, gfp);
14368 }
14369
14370 void nl80211_send_connect_result(struct cfg80211_registered_device *rdev,
14371                                  struct net_device *netdev,
14372                                  struct cfg80211_connect_resp_params *cr,
14373                                  gfp_t gfp)
14374 {
14375         struct sk_buff *msg;
14376         void *hdr;
14377
14378         msg = nlmsg_new(100 + cr->req_ie_len + cr->resp_ie_len +
14379                         cr->fils.kek_len + cr->fils.pmk_len +
14380                         (cr->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14381         if (!msg)
14382                 return;
14383
14384         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONNECT);
14385         if (!hdr) {
14386                 nlmsg_free(msg);
14387                 return;
14388         }
14389
14390         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14391             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14392             (cr->bssid &&
14393              nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, cr->bssid)) ||
14394             nla_put_u16(msg, NL80211_ATTR_STATUS_CODE,
14395                         cr->status < 0 ? WLAN_STATUS_UNSPECIFIED_FAILURE :
14396                         cr->status) ||
14397             (cr->status < 0 &&
14398              (nla_put_flag(msg, NL80211_ATTR_TIMED_OUT) ||
14399               nla_put_u32(msg, NL80211_ATTR_TIMEOUT_REASON,
14400                           cr->timeout_reason))) ||
14401             (cr->req_ie &&
14402              nla_put(msg, NL80211_ATTR_REQ_IE, cr->req_ie_len, cr->req_ie)) ||
14403             (cr->resp_ie &&
14404              nla_put(msg, NL80211_ATTR_RESP_IE, cr->resp_ie_len,
14405                      cr->resp_ie)) ||
14406             (cr->fils.update_erp_next_seq_num &&
14407              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14408                          cr->fils.erp_next_seq_num)) ||
14409             (cr->status == WLAN_STATUS_SUCCESS &&
14410              ((cr->fils.kek &&
14411                nla_put(msg, NL80211_ATTR_FILS_KEK, cr->fils.kek_len,
14412                        cr->fils.kek)) ||
14413               (cr->fils.pmk &&
14414                nla_put(msg, NL80211_ATTR_PMK, cr->fils.pmk_len, cr->fils.pmk)) ||
14415               (cr->fils.pmkid &&
14416                nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, cr->fils.pmkid)))))
14417                 goto nla_put_failure;
14418
14419         genlmsg_end(msg, hdr);
14420
14421         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14422                                 NL80211_MCGRP_MLME, gfp);
14423         return;
14424
14425  nla_put_failure:
14426         nlmsg_free(msg);
14427 }
14428
14429 void nl80211_send_roamed(struct cfg80211_registered_device *rdev,
14430                          struct net_device *netdev,
14431                          struct cfg80211_roam_info *info, gfp_t gfp)
14432 {
14433         struct sk_buff *msg;
14434         void *hdr;
14435         const u8 *bssid = info->bss ? info->bss->bssid : info->bssid;
14436
14437         msg = nlmsg_new(100 + info->req_ie_len + info->resp_ie_len +
14438                         info->fils.kek_len + info->fils.pmk_len +
14439                         (info->fils.pmkid ? WLAN_PMKID_LEN : 0), gfp);
14440         if (!msg)
14441                 return;
14442
14443         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_ROAM);
14444         if (!hdr) {
14445                 nlmsg_free(msg);
14446                 return;
14447         }
14448
14449         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14450             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14451             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid) ||
14452             (info->req_ie &&
14453              nla_put(msg, NL80211_ATTR_REQ_IE, info->req_ie_len,
14454                      info->req_ie)) ||
14455             (info->resp_ie &&
14456              nla_put(msg, NL80211_ATTR_RESP_IE, info->resp_ie_len,
14457                      info->resp_ie)) ||
14458             (info->fils.update_erp_next_seq_num &&
14459              nla_put_u16(msg, NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM,
14460                          info->fils.erp_next_seq_num)) ||
14461             (info->fils.kek &&
14462              nla_put(msg, NL80211_ATTR_FILS_KEK, info->fils.kek_len,
14463                      info->fils.kek)) ||
14464             (info->fils.pmk &&
14465              nla_put(msg, NL80211_ATTR_PMK, info->fils.pmk_len, info->fils.pmk)) ||
14466             (info->fils.pmkid &&
14467              nla_put(msg, NL80211_ATTR_PMKID, WLAN_PMKID_LEN, info->fils.pmkid)))
14468                 goto nla_put_failure;
14469
14470         genlmsg_end(msg, hdr);
14471
14472         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14473                                 NL80211_MCGRP_MLME, gfp);
14474         return;
14475
14476  nla_put_failure:
14477         nlmsg_free(msg);
14478 }
14479
14480 void nl80211_send_port_authorized(struct cfg80211_registered_device *rdev,
14481                                   struct net_device *netdev, const u8 *bssid)
14482 {
14483         struct sk_buff *msg;
14484         void *hdr;
14485
14486         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
14487         if (!msg)
14488                 return;
14489
14490         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PORT_AUTHORIZED);
14491         if (!hdr) {
14492                 nlmsg_free(msg);
14493                 return;
14494         }
14495
14496         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14497                 goto nla_put_failure;
14498
14499         genlmsg_end(msg, hdr);
14500
14501         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14502                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14503         return;
14504
14505  nla_put_failure:
14506         nlmsg_free(msg);
14507 }
14508
14509 void nl80211_send_disconnected(struct cfg80211_registered_device *rdev,
14510                                struct net_device *netdev, u16 reason,
14511                                const u8 *ie, size_t ie_len, bool from_ap)
14512 {
14513         struct sk_buff *msg;
14514         void *hdr;
14515
14516         msg = nlmsg_new(100 + ie_len, GFP_KERNEL);
14517         if (!msg)
14518                 return;
14519
14520         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_DISCONNECT);
14521         if (!hdr) {
14522                 nlmsg_free(msg);
14523                 return;
14524         }
14525
14526         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14527             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14528             (reason &&
14529              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason)) ||
14530             (from_ap &&
14531              nla_put_flag(msg, NL80211_ATTR_DISCONNECTED_BY_AP)) ||
14532             (ie && nla_put(msg, NL80211_ATTR_IE, ie_len, ie)))
14533                 goto nla_put_failure;
14534
14535         genlmsg_end(msg, hdr);
14536
14537         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14538                                 NL80211_MCGRP_MLME, GFP_KERNEL);
14539         return;
14540
14541  nla_put_failure:
14542         nlmsg_free(msg);
14543 }
14544
14545 void nl80211_send_ibss_bssid(struct cfg80211_registered_device *rdev,
14546                              struct net_device *netdev, const u8 *bssid,
14547                              gfp_t gfp)
14548 {
14549         struct sk_buff *msg;
14550         void *hdr;
14551
14552         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14553         if (!msg)
14554                 return;
14555
14556         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_JOIN_IBSS);
14557         if (!hdr) {
14558                 nlmsg_free(msg);
14559                 return;
14560         }
14561
14562         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14563             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14564             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
14565                 goto nla_put_failure;
14566
14567         genlmsg_end(msg, hdr);
14568
14569         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14570                                 NL80211_MCGRP_MLME, gfp);
14571         return;
14572
14573  nla_put_failure:
14574         nlmsg_free(msg);
14575 }
14576
14577 void cfg80211_notify_new_peer_candidate(struct net_device *dev, const u8 *addr,
14578                                         const u8* ie, u8 ie_len, gfp_t gfp)
14579 {
14580         struct wireless_dev *wdev = dev->ieee80211_ptr;
14581         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14582         struct sk_buff *msg;
14583         void *hdr;
14584
14585         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_MESH_POINT))
14586                 return;
14587
14588         trace_cfg80211_notify_new_peer_candidate(dev, addr);
14589
14590         msg = nlmsg_new(100 + ie_len, gfp);
14591         if (!msg)
14592                 return;
14593
14594         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NEW_PEER_CANDIDATE);
14595         if (!hdr) {
14596                 nlmsg_free(msg);
14597                 return;
14598         }
14599
14600         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14601             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14602             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
14603             (ie_len && ie &&
14604              nla_put(msg, NL80211_ATTR_IE, ie_len , ie)))
14605                 goto nla_put_failure;
14606
14607         genlmsg_end(msg, hdr);
14608
14609         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14610                                 NL80211_MCGRP_MLME, gfp);
14611         return;
14612
14613  nla_put_failure:
14614         nlmsg_free(msg);
14615 }
14616 EXPORT_SYMBOL(cfg80211_notify_new_peer_candidate);
14617
14618 void nl80211_michael_mic_failure(struct cfg80211_registered_device *rdev,
14619                                  struct net_device *netdev, const u8 *addr,
14620                                  enum nl80211_key_type key_type, int key_id,
14621                                  const u8 *tsc, gfp_t gfp)
14622 {
14623         struct sk_buff *msg;
14624         void *hdr;
14625
14626         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14627         if (!msg)
14628                 return;
14629
14630         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_MICHAEL_MIC_FAILURE);
14631         if (!hdr) {
14632                 nlmsg_free(msg);
14633                 return;
14634         }
14635
14636         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14637             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
14638             (addr && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr)) ||
14639             nla_put_u32(msg, NL80211_ATTR_KEY_TYPE, key_type) ||
14640             (key_id != -1 &&
14641              nla_put_u8(msg, NL80211_ATTR_KEY_IDX, key_id)) ||
14642             (tsc && nla_put(msg, NL80211_ATTR_KEY_SEQ, 6, tsc)))
14643                 goto nla_put_failure;
14644
14645         genlmsg_end(msg, hdr);
14646
14647         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14648                                 NL80211_MCGRP_MLME, gfp);
14649         return;
14650
14651  nla_put_failure:
14652         nlmsg_free(msg);
14653 }
14654
14655 void nl80211_send_beacon_hint_event(struct wiphy *wiphy,
14656                                     struct ieee80211_channel *channel_before,
14657                                     struct ieee80211_channel *channel_after)
14658 {
14659         struct sk_buff *msg;
14660         void *hdr;
14661         struct nlattr *nl_freq;
14662
14663         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_ATOMIC);
14664         if (!msg)
14665                 return;
14666
14667         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_REG_BEACON_HINT);
14668         if (!hdr) {
14669                 nlmsg_free(msg);
14670                 return;
14671         }
14672
14673         /*
14674          * Since we are applying the beacon hint to a wiphy we know its
14675          * wiphy_idx is valid
14676          */
14677         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, get_wiphy_idx(wiphy)))
14678                 goto nla_put_failure;
14679
14680         /* Before */
14681         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_BEFORE);
14682         if (!nl_freq)
14683                 goto nla_put_failure;
14684
14685         if (nl80211_msg_put_channel(msg, wiphy, channel_before, false))
14686                 goto nla_put_failure;
14687         nla_nest_end(msg, nl_freq);
14688
14689         /* After */
14690         nl_freq = nla_nest_start(msg, NL80211_ATTR_FREQ_AFTER);
14691         if (!nl_freq)
14692                 goto nla_put_failure;
14693
14694         if (nl80211_msg_put_channel(msg, wiphy, channel_after, false))
14695                 goto nla_put_failure;
14696         nla_nest_end(msg, nl_freq);
14697
14698         genlmsg_end(msg, hdr);
14699
14700         rcu_read_lock();
14701         genlmsg_multicast_allns(&nl80211_fam, msg, 0,
14702                                 NL80211_MCGRP_REGULATORY, GFP_ATOMIC);
14703         rcu_read_unlock();
14704
14705         return;
14706
14707 nla_put_failure:
14708         nlmsg_free(msg);
14709 }
14710
14711 static void nl80211_send_remain_on_chan_event(
14712         int cmd, struct cfg80211_registered_device *rdev,
14713         struct wireless_dev *wdev, u64 cookie,
14714         struct ieee80211_channel *chan,
14715         unsigned int duration, gfp_t gfp)
14716 {
14717         struct sk_buff *msg;
14718         void *hdr;
14719
14720         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14721         if (!msg)
14722                 return;
14723
14724         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14725         if (!hdr) {
14726                 nlmsg_free(msg);
14727                 return;
14728         }
14729
14730         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14731             (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14732                                          wdev->netdev->ifindex)) ||
14733             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14734                               NL80211_ATTR_PAD) ||
14735             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, chan->center_freq) ||
14736             nla_put_u32(msg, NL80211_ATTR_WIPHY_CHANNEL_TYPE,
14737                         NL80211_CHAN_NO_HT) ||
14738             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
14739                               NL80211_ATTR_PAD))
14740                 goto nla_put_failure;
14741
14742         if (cmd == NL80211_CMD_REMAIN_ON_CHANNEL &&
14743             nla_put_u32(msg, NL80211_ATTR_DURATION, duration))
14744                 goto nla_put_failure;
14745
14746         genlmsg_end(msg, hdr);
14747
14748         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14749                                 NL80211_MCGRP_MLME, gfp);
14750         return;
14751
14752  nla_put_failure:
14753         nlmsg_free(msg);
14754 }
14755
14756 void cfg80211_ready_on_channel(struct wireless_dev *wdev, u64 cookie,
14757                                struct ieee80211_channel *chan,
14758                                unsigned int duration, gfp_t gfp)
14759 {
14760         struct wiphy *wiphy = wdev->wiphy;
14761         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14762
14763         trace_cfg80211_ready_on_channel(wdev, cookie, chan, duration);
14764         nl80211_send_remain_on_chan_event(NL80211_CMD_REMAIN_ON_CHANNEL,
14765                                           rdev, wdev, cookie, chan,
14766                                           duration, gfp);
14767 }
14768 EXPORT_SYMBOL(cfg80211_ready_on_channel);
14769
14770 void cfg80211_remain_on_channel_expired(struct wireless_dev *wdev, u64 cookie,
14771                                         struct ieee80211_channel *chan,
14772                                         gfp_t gfp)
14773 {
14774         struct wiphy *wiphy = wdev->wiphy;
14775         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14776
14777         trace_cfg80211_ready_on_channel_expired(wdev, cookie, chan);
14778         nl80211_send_remain_on_chan_event(NL80211_CMD_CANCEL_REMAIN_ON_CHANNEL,
14779                                           rdev, wdev, cookie, chan, 0, gfp);
14780 }
14781 EXPORT_SYMBOL(cfg80211_remain_on_channel_expired);
14782
14783 void cfg80211_new_sta(struct net_device *dev, const u8 *mac_addr,
14784                       struct station_info *sinfo, gfp_t gfp)
14785 {
14786         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14787         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14788         struct sk_buff *msg;
14789
14790         trace_cfg80211_new_sta(dev, mac_addr, sinfo);
14791
14792         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14793         if (!msg)
14794                 return;
14795
14796         if (nl80211_send_station(msg, NL80211_CMD_NEW_STATION, 0, 0, 0,
14797                                  rdev, dev, mac_addr, sinfo) < 0) {
14798                 nlmsg_free(msg);
14799                 return;
14800         }
14801
14802         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14803                                 NL80211_MCGRP_MLME, gfp);
14804 }
14805 EXPORT_SYMBOL(cfg80211_new_sta);
14806
14807 void cfg80211_del_sta_sinfo(struct net_device *dev, const u8 *mac_addr,
14808                             struct station_info *sinfo, gfp_t gfp)
14809 {
14810         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14811         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14812         struct sk_buff *msg;
14813         struct station_info empty_sinfo = {};
14814
14815         if (!sinfo)
14816                 sinfo = &empty_sinfo;
14817
14818         trace_cfg80211_del_sta(dev, mac_addr);
14819
14820         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
14821         if (!msg) {
14822                 cfg80211_sinfo_release_content(sinfo);
14823                 return;
14824         }
14825
14826         if (nl80211_send_station(msg, NL80211_CMD_DEL_STATION, 0, 0, 0,
14827                                  rdev, dev, mac_addr, sinfo) < 0) {
14828                 nlmsg_free(msg);
14829                 return;
14830         }
14831
14832         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14833                                 NL80211_MCGRP_MLME, gfp);
14834 }
14835 EXPORT_SYMBOL(cfg80211_del_sta_sinfo);
14836
14837 void cfg80211_conn_failed(struct net_device *dev, const u8 *mac_addr,
14838                           enum nl80211_connect_failed_reason reason,
14839                           gfp_t gfp)
14840 {
14841         struct wiphy *wiphy = dev->ieee80211_ptr->wiphy;
14842         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14843         struct sk_buff *msg;
14844         void *hdr;
14845
14846         msg = nlmsg_new(NLMSG_GOODSIZE, gfp);
14847         if (!msg)
14848                 return;
14849
14850         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONN_FAILED);
14851         if (!hdr) {
14852                 nlmsg_free(msg);
14853                 return;
14854         }
14855
14856         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14857             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac_addr) ||
14858             nla_put_u32(msg, NL80211_ATTR_CONN_FAILED_REASON, reason))
14859                 goto nla_put_failure;
14860
14861         genlmsg_end(msg, hdr);
14862
14863         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
14864                                 NL80211_MCGRP_MLME, gfp);
14865         return;
14866
14867  nla_put_failure:
14868         nlmsg_free(msg);
14869 }
14870 EXPORT_SYMBOL(cfg80211_conn_failed);
14871
14872 static bool __nl80211_unexpected_frame(struct net_device *dev, u8 cmd,
14873                                        const u8 *addr, gfp_t gfp)
14874 {
14875         struct wireless_dev *wdev = dev->ieee80211_ptr;
14876         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
14877         struct sk_buff *msg;
14878         void *hdr;
14879         u32 nlportid = READ_ONCE(wdev->ap_unexpected_nlportid);
14880
14881         if (!nlportid)
14882                 return false;
14883
14884         msg = nlmsg_new(100, gfp);
14885         if (!msg)
14886                 return true;
14887
14888         hdr = nl80211hdr_put(msg, 0, 0, 0, cmd);
14889         if (!hdr) {
14890                 nlmsg_free(msg);
14891                 return true;
14892         }
14893
14894         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14895             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
14896             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr))
14897                 goto nla_put_failure;
14898
14899         genlmsg_end(msg, hdr);
14900         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14901         return true;
14902
14903  nla_put_failure:
14904         nlmsg_free(msg);
14905         return true;
14906 }
14907
14908 bool cfg80211_rx_spurious_frame(struct net_device *dev,
14909                                 const u8 *addr, gfp_t gfp)
14910 {
14911         struct wireless_dev *wdev = dev->ieee80211_ptr;
14912         bool ret;
14913
14914         trace_cfg80211_rx_spurious_frame(dev, addr);
14915
14916         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14917                     wdev->iftype != NL80211_IFTYPE_P2P_GO)) {
14918                 trace_cfg80211_return_bool(false);
14919                 return false;
14920         }
14921         ret = __nl80211_unexpected_frame(dev, NL80211_CMD_UNEXPECTED_FRAME,
14922                                          addr, gfp);
14923         trace_cfg80211_return_bool(ret);
14924         return ret;
14925 }
14926 EXPORT_SYMBOL(cfg80211_rx_spurious_frame);
14927
14928 bool cfg80211_rx_unexpected_4addr_frame(struct net_device *dev,
14929                                         const u8 *addr, gfp_t gfp)
14930 {
14931         struct wireless_dev *wdev = dev->ieee80211_ptr;
14932         bool ret;
14933
14934         trace_cfg80211_rx_unexpected_4addr_frame(dev, addr);
14935
14936         if (WARN_ON(wdev->iftype != NL80211_IFTYPE_AP &&
14937                     wdev->iftype != NL80211_IFTYPE_P2P_GO &&
14938                     wdev->iftype != NL80211_IFTYPE_AP_VLAN)) {
14939                 trace_cfg80211_return_bool(false);
14940                 return false;
14941         }
14942         ret = __nl80211_unexpected_frame(dev,
14943                                          NL80211_CMD_UNEXPECTED_4ADDR_FRAME,
14944                                          addr, gfp);
14945         trace_cfg80211_return_bool(ret);
14946         return ret;
14947 }
14948 EXPORT_SYMBOL(cfg80211_rx_unexpected_4addr_frame);
14949
14950 int nl80211_send_mgmt(struct cfg80211_registered_device *rdev,
14951                       struct wireless_dev *wdev, u32 nlportid,
14952                       int freq, int sig_dbm,
14953                       const u8 *buf, size_t len, u32 flags, gfp_t gfp)
14954 {
14955         struct net_device *netdev = wdev->netdev;
14956         struct sk_buff *msg;
14957         void *hdr;
14958
14959         msg = nlmsg_new(100 + len, gfp);
14960         if (!msg)
14961                 return -ENOMEM;
14962
14963         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
14964         if (!hdr) {
14965                 nlmsg_free(msg);
14966                 return -ENOMEM;
14967         }
14968
14969         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
14970             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
14971                                         netdev->ifindex)) ||
14972             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
14973                               NL80211_ATTR_PAD) ||
14974             nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq) ||
14975             (sig_dbm &&
14976              nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
14977             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
14978             (flags &&
14979              nla_put_u32(msg, NL80211_ATTR_RXMGMT_FLAGS, flags)))
14980                 goto nla_put_failure;
14981
14982         genlmsg_end(msg, hdr);
14983
14984         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
14985
14986  nla_put_failure:
14987         nlmsg_free(msg);
14988         return -ENOBUFS;
14989 }
14990
14991 void cfg80211_mgmt_tx_status(struct wireless_dev *wdev, u64 cookie,
14992                              const u8 *buf, size_t len, bool ack, gfp_t gfp)
14993 {
14994         struct wiphy *wiphy = wdev->wiphy;
14995         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
14996         struct net_device *netdev = wdev->netdev;
14997         struct sk_buff *msg;
14998         void *hdr;
14999
15000         trace_cfg80211_mgmt_tx_status(wdev, cookie, ack);
15001
15002         msg = nlmsg_new(100 + len, gfp);
15003         if (!msg)
15004                 return;
15005
15006         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME_TX_STATUS);
15007         if (!hdr) {
15008                 nlmsg_free(msg);
15009                 return;
15010         }
15011
15012         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15013             (netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15014                                    netdev->ifindex)) ||
15015             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15016                               NL80211_ATTR_PAD) ||
15017             nla_put(msg, NL80211_ATTR_FRAME, len, buf) ||
15018             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15019                               NL80211_ATTR_PAD) ||
15020             (ack && nla_put_flag(msg, NL80211_ATTR_ACK)))
15021                 goto nla_put_failure;
15022
15023         genlmsg_end(msg, hdr);
15024
15025         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15026                                 NL80211_MCGRP_MLME, gfp);
15027         return;
15028
15029  nla_put_failure:
15030         nlmsg_free(msg);
15031 }
15032 EXPORT_SYMBOL(cfg80211_mgmt_tx_status);
15033
15034 static int __nl80211_rx_control_port(struct net_device *dev,
15035                                      struct sk_buff *skb,
15036                                      bool unencrypted, gfp_t gfp)
15037 {
15038         struct wireless_dev *wdev = dev->ieee80211_ptr;
15039         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15040         struct ethhdr *ehdr = eth_hdr(skb);
15041         const u8 *addr = ehdr->h_source;
15042         u16 proto = be16_to_cpu(skb->protocol);
15043         struct sk_buff *msg;
15044         void *hdr;
15045         struct nlattr *frame;
15046
15047         u32 nlportid = READ_ONCE(wdev->conn_owner_nlportid);
15048
15049         if (!nlportid)
15050                 return -ENOENT;
15051
15052         msg = nlmsg_new(100 + skb->len, gfp);
15053         if (!msg)
15054                 return -ENOMEM;
15055
15056         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CONTROL_PORT_FRAME);
15057         if (!hdr) {
15058                 nlmsg_free(msg);
15059                 return -ENOBUFS;
15060         }
15061
15062         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15063             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15064             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15065                               NL80211_ATTR_PAD) ||
15066             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15067             nla_put_u16(msg, NL80211_ATTR_CONTROL_PORT_ETHERTYPE, proto) ||
15068             (unencrypted && nla_put_flag(msg,
15069                                          NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT)))
15070                 goto nla_put_failure;
15071
15072         frame = nla_reserve(msg, NL80211_ATTR_FRAME, skb->len);
15073         if (!frame)
15074                 goto nla_put_failure;
15075
15076         skb_copy_bits(skb, 0, nla_data(frame), skb->len);
15077         genlmsg_end(msg, hdr);
15078
15079         return genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15080
15081  nla_put_failure:
15082         nlmsg_free(msg);
15083         return -ENOBUFS;
15084 }
15085
15086 bool cfg80211_rx_control_port(struct net_device *dev,
15087                               struct sk_buff *skb, bool unencrypted)
15088 {
15089         int ret;
15090
15091         trace_cfg80211_rx_control_port(dev, skb, unencrypted);
15092         ret = __nl80211_rx_control_port(dev, skb, unencrypted, GFP_ATOMIC);
15093         trace_cfg80211_return_bool(ret == 0);
15094         return ret == 0;
15095 }
15096 EXPORT_SYMBOL(cfg80211_rx_control_port);
15097
15098 static struct sk_buff *cfg80211_prepare_cqm(struct net_device *dev,
15099                                             const char *mac, gfp_t gfp)
15100 {
15101         struct wireless_dev *wdev = dev->ieee80211_ptr;
15102         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15103         struct sk_buff *msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15104         void **cb;
15105
15106         if (!msg)
15107                 return NULL;
15108
15109         cb = (void **)msg->cb;
15110
15111         cb[0] = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_NOTIFY_CQM);
15112         if (!cb[0]) {
15113                 nlmsg_free(msg);
15114                 return NULL;
15115         }
15116
15117         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15118             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15119                 goto nla_put_failure;
15120
15121         if (mac && nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15122                 goto nla_put_failure;
15123
15124         cb[1] = nla_nest_start(msg, NL80211_ATTR_CQM);
15125         if (!cb[1])
15126                 goto nla_put_failure;
15127
15128         cb[2] = rdev;
15129
15130         return msg;
15131  nla_put_failure:
15132         nlmsg_free(msg);
15133         return NULL;
15134 }
15135
15136 static void cfg80211_send_cqm(struct sk_buff *msg, gfp_t gfp)
15137 {
15138         void **cb = (void **)msg->cb;
15139         struct cfg80211_registered_device *rdev = cb[2];
15140
15141         nla_nest_end(msg, cb[1]);
15142         genlmsg_end(msg, cb[0]);
15143
15144         memset(msg->cb, 0, sizeof(msg->cb));
15145
15146         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15147                                 NL80211_MCGRP_MLME, gfp);
15148 }
15149
15150 void cfg80211_cqm_rssi_notify(struct net_device *dev,
15151                               enum nl80211_cqm_rssi_threshold_event rssi_event,
15152                               s32 rssi_level, gfp_t gfp)
15153 {
15154         struct sk_buff *msg;
15155         struct wireless_dev *wdev = dev->ieee80211_ptr;
15156         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15157
15158         trace_cfg80211_cqm_rssi_notify(dev, rssi_event, rssi_level);
15159
15160         if (WARN_ON(rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_LOW &&
15161                     rssi_event != NL80211_CQM_RSSI_THRESHOLD_EVENT_HIGH))
15162                 return;
15163
15164         if (wdev->cqm_config) {
15165                 wdev->cqm_config->last_rssi_event_value = rssi_level;
15166
15167                 cfg80211_cqm_rssi_update(rdev, dev);
15168
15169                 if (rssi_level == 0)
15170                         rssi_level = wdev->cqm_config->last_rssi_event_value;
15171         }
15172
15173         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15174         if (!msg)
15175                 return;
15176
15177         if (nla_put_u32(msg, NL80211_ATTR_CQM_RSSI_THRESHOLD_EVENT,
15178                         rssi_event))
15179                 goto nla_put_failure;
15180
15181         if (rssi_level && nla_put_s32(msg, NL80211_ATTR_CQM_RSSI_LEVEL,
15182                                       rssi_level))
15183                 goto nla_put_failure;
15184
15185         cfg80211_send_cqm(msg, gfp);
15186
15187         return;
15188
15189  nla_put_failure:
15190         nlmsg_free(msg);
15191 }
15192 EXPORT_SYMBOL(cfg80211_cqm_rssi_notify);
15193
15194 void cfg80211_cqm_txe_notify(struct net_device *dev,
15195                              const u8 *peer, u32 num_packets,
15196                              u32 rate, u32 intvl, gfp_t gfp)
15197 {
15198         struct sk_buff *msg;
15199
15200         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15201         if (!msg)
15202                 return;
15203
15204         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_PKTS, num_packets))
15205                 goto nla_put_failure;
15206
15207         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_RATE, rate))
15208                 goto nla_put_failure;
15209
15210         if (nla_put_u32(msg, NL80211_ATTR_CQM_TXE_INTVL, intvl))
15211                 goto nla_put_failure;
15212
15213         cfg80211_send_cqm(msg, gfp);
15214         return;
15215
15216  nla_put_failure:
15217         nlmsg_free(msg);
15218 }
15219 EXPORT_SYMBOL(cfg80211_cqm_txe_notify);
15220
15221 void cfg80211_cqm_pktloss_notify(struct net_device *dev,
15222                                  const u8 *peer, u32 num_packets, gfp_t gfp)
15223 {
15224         struct sk_buff *msg;
15225
15226         trace_cfg80211_cqm_pktloss_notify(dev, peer, num_packets);
15227
15228         msg = cfg80211_prepare_cqm(dev, peer, gfp);
15229         if (!msg)
15230                 return;
15231
15232         if (nla_put_u32(msg, NL80211_ATTR_CQM_PKT_LOSS_EVENT, num_packets))
15233                 goto nla_put_failure;
15234
15235         cfg80211_send_cqm(msg, gfp);
15236         return;
15237
15238  nla_put_failure:
15239         nlmsg_free(msg);
15240 }
15241 EXPORT_SYMBOL(cfg80211_cqm_pktloss_notify);
15242
15243 void cfg80211_cqm_beacon_loss_notify(struct net_device *dev, gfp_t gfp)
15244 {
15245         struct sk_buff *msg;
15246
15247         msg = cfg80211_prepare_cqm(dev, NULL, gfp);
15248         if (!msg)
15249                 return;
15250
15251         if (nla_put_flag(msg, NL80211_ATTR_CQM_BEACON_LOSS_EVENT))
15252                 goto nla_put_failure;
15253
15254         cfg80211_send_cqm(msg, gfp);
15255         return;
15256
15257  nla_put_failure:
15258         nlmsg_free(msg);
15259 }
15260 EXPORT_SYMBOL(cfg80211_cqm_beacon_loss_notify);
15261
15262 static void nl80211_gtk_rekey_notify(struct cfg80211_registered_device *rdev,
15263                                      struct net_device *netdev, const u8 *bssid,
15264                                      const u8 *replay_ctr, gfp_t gfp)
15265 {
15266         struct sk_buff *msg;
15267         struct nlattr *rekey_attr;
15268         void *hdr;
15269
15270         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15271         if (!msg)
15272                 return;
15273
15274         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_REKEY_OFFLOAD);
15275         if (!hdr) {
15276                 nlmsg_free(msg);
15277                 return;
15278         }
15279
15280         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15281             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15282             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, bssid))
15283                 goto nla_put_failure;
15284
15285         rekey_attr = nla_nest_start(msg, NL80211_ATTR_REKEY_DATA);
15286         if (!rekey_attr)
15287                 goto nla_put_failure;
15288
15289         if (nla_put(msg, NL80211_REKEY_DATA_REPLAY_CTR,
15290                     NL80211_REPLAY_CTR_LEN, replay_ctr))
15291                 goto nla_put_failure;
15292
15293         nla_nest_end(msg, rekey_attr);
15294
15295         genlmsg_end(msg, hdr);
15296
15297         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15298                                 NL80211_MCGRP_MLME, gfp);
15299         return;
15300
15301  nla_put_failure:
15302         nlmsg_free(msg);
15303 }
15304
15305 void cfg80211_gtk_rekey_notify(struct net_device *dev, const u8 *bssid,
15306                                const u8 *replay_ctr, gfp_t gfp)
15307 {
15308         struct wireless_dev *wdev = dev->ieee80211_ptr;
15309         struct wiphy *wiphy = wdev->wiphy;
15310         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15311
15312         trace_cfg80211_gtk_rekey_notify(dev, bssid);
15313         nl80211_gtk_rekey_notify(rdev, dev, bssid, replay_ctr, gfp);
15314 }
15315 EXPORT_SYMBOL(cfg80211_gtk_rekey_notify);
15316
15317 static void
15318 nl80211_pmksa_candidate_notify(struct cfg80211_registered_device *rdev,
15319                                struct net_device *netdev, int index,
15320                                const u8 *bssid, bool preauth, gfp_t gfp)
15321 {
15322         struct sk_buff *msg;
15323         struct nlattr *attr;
15324         void *hdr;
15325
15326         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15327         if (!msg)
15328                 return;
15329
15330         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PMKSA_CANDIDATE);
15331         if (!hdr) {
15332                 nlmsg_free(msg);
15333                 return;
15334         }
15335
15336         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15337             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15338                 goto nla_put_failure;
15339
15340         attr = nla_nest_start(msg, NL80211_ATTR_PMKSA_CANDIDATE);
15341         if (!attr)
15342                 goto nla_put_failure;
15343
15344         if (nla_put_u32(msg, NL80211_PMKSA_CANDIDATE_INDEX, index) ||
15345             nla_put(msg, NL80211_PMKSA_CANDIDATE_BSSID, ETH_ALEN, bssid) ||
15346             (preauth &&
15347              nla_put_flag(msg, NL80211_PMKSA_CANDIDATE_PREAUTH)))
15348                 goto nla_put_failure;
15349
15350         nla_nest_end(msg, attr);
15351
15352         genlmsg_end(msg, hdr);
15353
15354         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15355                                 NL80211_MCGRP_MLME, gfp);
15356         return;
15357
15358  nla_put_failure:
15359         nlmsg_free(msg);
15360 }
15361
15362 void cfg80211_pmksa_candidate_notify(struct net_device *dev, int index,
15363                                      const u8 *bssid, bool preauth, gfp_t gfp)
15364 {
15365         struct wireless_dev *wdev = dev->ieee80211_ptr;
15366         struct wiphy *wiphy = wdev->wiphy;
15367         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15368
15369         trace_cfg80211_pmksa_candidate_notify(dev, index, bssid, preauth);
15370         nl80211_pmksa_candidate_notify(rdev, dev, index, bssid, preauth, gfp);
15371 }
15372 EXPORT_SYMBOL(cfg80211_pmksa_candidate_notify);
15373
15374 static void nl80211_ch_switch_notify(struct cfg80211_registered_device *rdev,
15375                                      struct net_device *netdev,
15376                                      struct cfg80211_chan_def *chandef,
15377                                      gfp_t gfp,
15378                                      enum nl80211_commands notif,
15379                                      u8 count)
15380 {
15381         struct sk_buff *msg;
15382         void *hdr;
15383
15384         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15385         if (!msg)
15386                 return;
15387
15388         hdr = nl80211hdr_put(msg, 0, 0, 0, notif);
15389         if (!hdr) {
15390                 nlmsg_free(msg);
15391                 return;
15392         }
15393
15394         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex))
15395                 goto nla_put_failure;
15396
15397         if (nl80211_send_chandef(msg, chandef))
15398                 goto nla_put_failure;
15399
15400         if ((notif == NL80211_CMD_CH_SWITCH_STARTED_NOTIFY) &&
15401             (nla_put_u32(msg, NL80211_ATTR_CH_SWITCH_COUNT, count)))
15402                         goto nla_put_failure;
15403
15404         genlmsg_end(msg, hdr);
15405
15406         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15407                                 NL80211_MCGRP_MLME, gfp);
15408         return;
15409
15410  nla_put_failure:
15411         nlmsg_free(msg);
15412 }
15413
15414 void cfg80211_ch_switch_notify(struct net_device *dev,
15415                                struct cfg80211_chan_def *chandef)
15416 {
15417         struct wireless_dev *wdev = dev->ieee80211_ptr;
15418         struct wiphy *wiphy = wdev->wiphy;
15419         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15420
15421         ASSERT_WDEV_LOCK(wdev);
15422
15423         trace_cfg80211_ch_switch_notify(dev, chandef);
15424
15425         wdev->chandef = *chandef;
15426         wdev->preset_chandef = *chandef;
15427         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15428                                  NL80211_CMD_CH_SWITCH_NOTIFY, 0);
15429 }
15430 EXPORT_SYMBOL(cfg80211_ch_switch_notify);
15431
15432 void cfg80211_ch_switch_started_notify(struct net_device *dev,
15433                                        struct cfg80211_chan_def *chandef,
15434                                        u8 count)
15435 {
15436         struct wireless_dev *wdev = dev->ieee80211_ptr;
15437         struct wiphy *wiphy = wdev->wiphy;
15438         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15439
15440         trace_cfg80211_ch_switch_started_notify(dev, chandef);
15441
15442         nl80211_ch_switch_notify(rdev, dev, chandef, GFP_KERNEL,
15443                                  NL80211_CMD_CH_SWITCH_STARTED_NOTIFY, count);
15444 }
15445 EXPORT_SYMBOL(cfg80211_ch_switch_started_notify);
15446
15447 void
15448 nl80211_radar_notify(struct cfg80211_registered_device *rdev,
15449                      const struct cfg80211_chan_def *chandef,
15450                      enum nl80211_radar_event event,
15451                      struct net_device *netdev, gfp_t gfp)
15452 {
15453         struct sk_buff *msg;
15454         void *hdr;
15455
15456         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15457         if (!msg)
15458                 return;
15459
15460         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_RADAR_DETECT);
15461         if (!hdr) {
15462                 nlmsg_free(msg);
15463                 return;
15464         }
15465
15466         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15467                 goto nla_put_failure;
15468
15469         /* NOP and radar events don't need a netdev parameter */
15470         if (netdev) {
15471                 struct wireless_dev *wdev = netdev->ieee80211_ptr;
15472
15473                 if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15474                     nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15475                                       NL80211_ATTR_PAD))
15476                         goto nla_put_failure;
15477         }
15478
15479         if (nla_put_u32(msg, NL80211_ATTR_RADAR_EVENT, event))
15480                 goto nla_put_failure;
15481
15482         if (nl80211_send_chandef(msg, chandef))
15483                 goto nla_put_failure;
15484
15485         genlmsg_end(msg, hdr);
15486
15487         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15488                                 NL80211_MCGRP_MLME, gfp);
15489         return;
15490
15491  nla_put_failure:
15492         nlmsg_free(msg);
15493 }
15494
15495 void cfg80211_sta_opmode_change_notify(struct net_device *dev, const u8 *mac,
15496                                        struct sta_opmode_info *sta_opmode,
15497                                        gfp_t gfp)
15498 {
15499         struct sk_buff *msg;
15500         struct wireless_dev *wdev = dev->ieee80211_ptr;
15501         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15502         void *hdr;
15503
15504         if (WARN_ON(!mac))
15505                 return;
15506
15507         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15508         if (!msg)
15509                 return;
15510
15511         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STA_OPMODE_CHANGED);
15512         if (!hdr) {
15513                 nlmsg_free(msg);
15514                 return;
15515         }
15516
15517         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx))
15518                 goto nla_put_failure;
15519
15520         if (nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex))
15521                 goto nla_put_failure;
15522
15523         if (nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, mac))
15524                 goto nla_put_failure;
15525
15526         if ((sta_opmode->changed & STA_OPMODE_SMPS_MODE_CHANGED) &&
15527             nla_put_u8(msg, NL80211_ATTR_SMPS_MODE, sta_opmode->smps_mode))
15528                 goto nla_put_failure;
15529
15530         if ((sta_opmode->changed & STA_OPMODE_MAX_BW_CHANGED) &&
15531             nla_put_u8(msg, NL80211_ATTR_CHANNEL_WIDTH, sta_opmode->bw))
15532                 goto nla_put_failure;
15533
15534         if ((sta_opmode->changed & STA_OPMODE_N_SS_CHANGED) &&
15535             nla_put_u8(msg, NL80211_ATTR_NSS, sta_opmode->rx_nss))
15536                 goto nla_put_failure;
15537
15538         genlmsg_end(msg, hdr);
15539
15540         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15541                                 NL80211_MCGRP_MLME, gfp);
15542
15543         return;
15544
15545 nla_put_failure:
15546         nlmsg_free(msg);
15547 }
15548 EXPORT_SYMBOL(cfg80211_sta_opmode_change_notify);
15549
15550 void cfg80211_probe_status(struct net_device *dev, const u8 *addr,
15551                            u64 cookie, bool acked, s32 ack_signal,
15552                            bool is_valid_ack_signal, gfp_t gfp)
15553 {
15554         struct wireless_dev *wdev = dev->ieee80211_ptr;
15555         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15556         struct sk_buff *msg;
15557         void *hdr;
15558
15559         trace_cfg80211_probe_status(dev, addr, cookie, acked);
15560
15561         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15562
15563         if (!msg)
15564                 return;
15565
15566         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_PROBE_CLIENT);
15567         if (!hdr) {
15568                 nlmsg_free(msg);
15569                 return;
15570         }
15571
15572         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15573             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15574             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, addr) ||
15575             nla_put_u64_64bit(msg, NL80211_ATTR_COOKIE, cookie,
15576                               NL80211_ATTR_PAD) ||
15577             (acked && nla_put_flag(msg, NL80211_ATTR_ACK)) ||
15578             (is_valid_ack_signal && nla_put_s32(msg, NL80211_ATTR_ACK_SIGNAL,
15579                                                 ack_signal)))
15580                 goto nla_put_failure;
15581
15582         genlmsg_end(msg, hdr);
15583
15584         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15585                                 NL80211_MCGRP_MLME, gfp);
15586         return;
15587
15588  nla_put_failure:
15589         nlmsg_free(msg);
15590 }
15591 EXPORT_SYMBOL(cfg80211_probe_status);
15592
15593 void cfg80211_report_obss_beacon(struct wiphy *wiphy,
15594                                  const u8 *frame, size_t len,
15595                                  int freq, int sig_dbm)
15596 {
15597         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15598         struct sk_buff *msg;
15599         void *hdr;
15600         struct cfg80211_beacon_registration *reg;
15601
15602         trace_cfg80211_report_obss_beacon(wiphy, frame, len, freq, sig_dbm);
15603
15604         spin_lock_bh(&rdev->beacon_registrations_lock);
15605         list_for_each_entry(reg, &rdev->beacon_registrations, list) {
15606                 msg = nlmsg_new(len + 100, GFP_ATOMIC);
15607                 if (!msg) {
15608                         spin_unlock_bh(&rdev->beacon_registrations_lock);
15609                         return;
15610                 }
15611
15612                 hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FRAME);
15613                 if (!hdr)
15614                         goto nla_put_failure;
15615
15616                 if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15617                     (freq &&
15618                      nla_put_u32(msg, NL80211_ATTR_WIPHY_FREQ, freq)) ||
15619                     (sig_dbm &&
15620                      nla_put_u32(msg, NL80211_ATTR_RX_SIGNAL_DBM, sig_dbm)) ||
15621                     nla_put(msg, NL80211_ATTR_FRAME, len, frame))
15622                         goto nla_put_failure;
15623
15624                 genlmsg_end(msg, hdr);
15625
15626                 genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, reg->nlportid);
15627         }
15628         spin_unlock_bh(&rdev->beacon_registrations_lock);
15629         return;
15630
15631  nla_put_failure:
15632         spin_unlock_bh(&rdev->beacon_registrations_lock);
15633         nlmsg_free(msg);
15634 }
15635 EXPORT_SYMBOL(cfg80211_report_obss_beacon);
15636
15637 #ifdef CONFIG_PM
15638 static int cfg80211_net_detect_results(struct sk_buff *msg,
15639                                        struct cfg80211_wowlan_wakeup *wakeup)
15640 {
15641         struct cfg80211_wowlan_nd_info *nd = wakeup->net_detect;
15642         struct nlattr *nl_results, *nl_match, *nl_freqs;
15643         int i, j;
15644
15645         nl_results = nla_nest_start(
15646                 msg, NL80211_WOWLAN_TRIG_NET_DETECT_RESULTS);
15647         if (!nl_results)
15648                 return -EMSGSIZE;
15649
15650         for (i = 0; i < nd->n_matches; i++) {
15651                 struct cfg80211_wowlan_nd_match *match = nd->matches[i];
15652
15653                 nl_match = nla_nest_start(msg, i);
15654                 if (!nl_match)
15655                         break;
15656
15657                 /* The SSID attribute is optional in nl80211, but for
15658                  * simplicity reasons it's always present in the
15659                  * cfg80211 structure.  If a driver can't pass the
15660                  * SSID, that needs to be changed.  A zero length SSID
15661                  * is still a valid SSID (wildcard), so it cannot be
15662                  * used for this purpose.
15663                  */
15664                 if (nla_put(msg, NL80211_ATTR_SSID, match->ssid.ssid_len,
15665                             match->ssid.ssid)) {
15666                         nla_nest_cancel(msg, nl_match);
15667                         goto out;
15668                 }
15669
15670                 if (match->n_channels) {
15671                         nl_freqs = nla_nest_start(
15672                                 msg, NL80211_ATTR_SCAN_FREQUENCIES);
15673                         if (!nl_freqs) {
15674                                 nla_nest_cancel(msg, nl_match);
15675                                 goto out;
15676                         }
15677
15678                         for (j = 0; j < match->n_channels; j++) {
15679                                 if (nla_put_u32(msg, j, match->channels[j])) {
15680                                         nla_nest_cancel(msg, nl_freqs);
15681                                         nla_nest_cancel(msg, nl_match);
15682                                         goto out;
15683                                 }
15684                         }
15685
15686                         nla_nest_end(msg, nl_freqs);
15687                 }
15688
15689                 nla_nest_end(msg, nl_match);
15690         }
15691
15692 out:
15693         nla_nest_end(msg, nl_results);
15694         return 0;
15695 }
15696
15697 void cfg80211_report_wowlan_wakeup(struct wireless_dev *wdev,
15698                                    struct cfg80211_wowlan_wakeup *wakeup,
15699                                    gfp_t gfp)
15700 {
15701         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15702         struct sk_buff *msg;
15703         void *hdr;
15704         int size = 200;
15705
15706         trace_cfg80211_report_wowlan_wakeup(wdev->wiphy, wdev, wakeup);
15707
15708         if (wakeup)
15709                 size += wakeup->packet_present_len;
15710
15711         msg = nlmsg_new(size, gfp);
15712         if (!msg)
15713                 return;
15714
15715         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_SET_WOWLAN);
15716         if (!hdr)
15717                 goto free_msg;
15718
15719         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15720             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15721                               NL80211_ATTR_PAD))
15722                 goto free_msg;
15723
15724         if (wdev->netdev && nla_put_u32(msg, NL80211_ATTR_IFINDEX,
15725                                         wdev->netdev->ifindex))
15726                 goto free_msg;
15727
15728         if (wakeup) {
15729                 struct nlattr *reasons;
15730
15731                 reasons = nla_nest_start(msg, NL80211_ATTR_WOWLAN_TRIGGERS);
15732                 if (!reasons)
15733                         goto free_msg;
15734
15735                 if (wakeup->disconnect &&
15736                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_DISCONNECT))
15737                         goto free_msg;
15738                 if (wakeup->magic_pkt &&
15739                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_MAGIC_PKT))
15740                         goto free_msg;
15741                 if (wakeup->gtk_rekey_failure &&
15742                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_GTK_REKEY_FAILURE))
15743                         goto free_msg;
15744                 if (wakeup->eap_identity_req &&
15745                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_EAP_IDENT_REQUEST))
15746                         goto free_msg;
15747                 if (wakeup->four_way_handshake &&
15748                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_4WAY_HANDSHAKE))
15749                         goto free_msg;
15750                 if (wakeup->rfkill_release &&
15751                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_RFKILL_RELEASE))
15752                         goto free_msg;
15753
15754                 if (wakeup->pattern_idx >= 0 &&
15755                     nla_put_u32(msg, NL80211_WOWLAN_TRIG_PKT_PATTERN,
15756                                 wakeup->pattern_idx))
15757                         goto free_msg;
15758
15759                 if (wakeup->tcp_match &&
15760                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_MATCH))
15761                         goto free_msg;
15762
15763                 if (wakeup->tcp_connlost &&
15764                     nla_put_flag(msg, NL80211_WOWLAN_TRIG_WAKEUP_TCP_CONNLOST))
15765                         goto free_msg;
15766
15767                 if (wakeup->tcp_nomoretokens &&
15768                     nla_put_flag(msg,
15769                                  NL80211_WOWLAN_TRIG_WAKEUP_TCP_NOMORETOKENS))
15770                         goto free_msg;
15771
15772                 if (wakeup->packet) {
15773                         u32 pkt_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211;
15774                         u32 len_attr = NL80211_WOWLAN_TRIG_WAKEUP_PKT_80211_LEN;
15775
15776                         if (!wakeup->packet_80211) {
15777                                 pkt_attr =
15778                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023;
15779                                 len_attr =
15780                                         NL80211_WOWLAN_TRIG_WAKEUP_PKT_8023_LEN;
15781                         }
15782
15783                         if (wakeup->packet_len &&
15784                             nla_put_u32(msg, len_attr, wakeup->packet_len))
15785                                 goto free_msg;
15786
15787                         if (nla_put(msg, pkt_attr, wakeup->packet_present_len,
15788                                     wakeup->packet))
15789                                 goto free_msg;
15790                 }
15791
15792                 if (wakeup->net_detect &&
15793                     cfg80211_net_detect_results(msg, wakeup))
15794                                 goto free_msg;
15795
15796                 nla_nest_end(msg, reasons);
15797         }
15798
15799         genlmsg_end(msg, hdr);
15800
15801         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15802                                 NL80211_MCGRP_MLME, gfp);
15803         return;
15804
15805  free_msg:
15806         nlmsg_free(msg);
15807 }
15808 EXPORT_SYMBOL(cfg80211_report_wowlan_wakeup);
15809 #endif
15810
15811 void cfg80211_tdls_oper_request(struct net_device *dev, const u8 *peer,
15812                                 enum nl80211_tdls_operation oper,
15813                                 u16 reason_code, gfp_t gfp)
15814 {
15815         struct wireless_dev *wdev = dev->ieee80211_ptr;
15816         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
15817         struct sk_buff *msg;
15818         void *hdr;
15819
15820         trace_cfg80211_tdls_oper_request(wdev->wiphy, dev, peer, oper,
15821                                          reason_code);
15822
15823         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15824         if (!msg)
15825                 return;
15826
15827         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_TDLS_OPER);
15828         if (!hdr) {
15829                 nlmsg_free(msg);
15830                 return;
15831         }
15832
15833         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15834             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
15835             nla_put_u8(msg, NL80211_ATTR_TDLS_OPERATION, oper) ||
15836             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, peer) ||
15837             (reason_code > 0 &&
15838              nla_put_u16(msg, NL80211_ATTR_REASON_CODE, reason_code)))
15839                 goto nla_put_failure;
15840
15841         genlmsg_end(msg, hdr);
15842
15843         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15844                                 NL80211_MCGRP_MLME, gfp);
15845         return;
15846
15847  nla_put_failure:
15848         nlmsg_free(msg);
15849 }
15850 EXPORT_SYMBOL(cfg80211_tdls_oper_request);
15851
15852 static int nl80211_netlink_notify(struct notifier_block * nb,
15853                                   unsigned long state,
15854                                   void *_notify)
15855 {
15856         struct netlink_notify *notify = _notify;
15857         struct cfg80211_registered_device *rdev;
15858         struct wireless_dev *wdev;
15859         struct cfg80211_beacon_registration *reg, *tmp;
15860
15861         if (state != NETLINK_URELEASE || notify->protocol != NETLINK_GENERIC)
15862                 return NOTIFY_DONE;
15863
15864         rcu_read_lock();
15865
15866         list_for_each_entry_rcu(rdev, &cfg80211_rdev_list, list) {
15867                 struct cfg80211_sched_scan_request *sched_scan_req;
15868
15869                 list_for_each_entry_rcu(sched_scan_req,
15870                                         &rdev->sched_scan_req_list,
15871                                         list) {
15872                         if (sched_scan_req->owner_nlportid == notify->portid) {
15873                                 sched_scan_req->nl_owner_dead = true;
15874                                 schedule_work(&rdev->sched_scan_stop_wk);
15875                         }
15876                 }
15877
15878                 list_for_each_entry_rcu(wdev, &rdev->wiphy.wdev_list, list) {
15879                         cfg80211_mlme_unregister_socket(wdev, notify->portid);
15880
15881                         if (wdev->owner_nlportid == notify->portid) {
15882                                 wdev->nl_owner_dead = true;
15883                                 schedule_work(&rdev->destroy_work);
15884                         } else if (wdev->conn_owner_nlportid == notify->portid) {
15885                                 schedule_work(&wdev->disconnect_wk);
15886                         }
15887                 }
15888
15889                 spin_lock_bh(&rdev->beacon_registrations_lock);
15890                 list_for_each_entry_safe(reg, tmp, &rdev->beacon_registrations,
15891                                          list) {
15892                         if (reg->nlportid == notify->portid) {
15893                                 list_del(&reg->list);
15894                                 kfree(reg);
15895                                 break;
15896                         }
15897                 }
15898                 spin_unlock_bh(&rdev->beacon_registrations_lock);
15899         }
15900
15901         rcu_read_unlock();
15902
15903         /*
15904          * It is possible that the user space process that is controlling the
15905          * indoor setting disappeared, so notify the regulatory core.
15906          */
15907         regulatory_netlink_notify(notify->portid);
15908         return NOTIFY_OK;
15909 }
15910
15911 static struct notifier_block nl80211_netlink_notifier = {
15912         .notifier_call = nl80211_netlink_notify,
15913 };
15914
15915 void cfg80211_ft_event(struct net_device *netdev,
15916                        struct cfg80211_ft_event_params *ft_event)
15917 {
15918         struct wiphy *wiphy = netdev->ieee80211_ptr->wiphy;
15919         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
15920         struct sk_buff *msg;
15921         void *hdr;
15922
15923         trace_cfg80211_ft_event(wiphy, netdev, ft_event);
15924
15925         if (!ft_event->target_ap)
15926                 return;
15927
15928         msg = nlmsg_new(100 + ft_event->ies_len + ft_event->ric_ies_len,
15929                         GFP_KERNEL);
15930         if (!msg)
15931                 return;
15932
15933         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_FT_EVENT);
15934         if (!hdr)
15935                 goto out;
15936
15937         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15938             nla_put_u32(msg, NL80211_ATTR_IFINDEX, netdev->ifindex) ||
15939             nla_put(msg, NL80211_ATTR_MAC, ETH_ALEN, ft_event->target_ap))
15940                 goto out;
15941
15942         if (ft_event->ies &&
15943             nla_put(msg, NL80211_ATTR_IE, ft_event->ies_len, ft_event->ies))
15944                 goto out;
15945         if (ft_event->ric_ies &&
15946             nla_put(msg, NL80211_ATTR_IE_RIC, ft_event->ric_ies_len,
15947                     ft_event->ric_ies))
15948                 goto out;
15949
15950         genlmsg_end(msg, hdr);
15951
15952         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(&rdev->wiphy), msg, 0,
15953                                 NL80211_MCGRP_MLME, GFP_KERNEL);
15954         return;
15955  out:
15956         nlmsg_free(msg);
15957 }
15958 EXPORT_SYMBOL(cfg80211_ft_event);
15959
15960 void cfg80211_crit_proto_stopped(struct wireless_dev *wdev, gfp_t gfp)
15961 {
15962         struct cfg80211_registered_device *rdev;
15963         struct sk_buff *msg;
15964         void *hdr;
15965         u32 nlportid;
15966
15967         rdev = wiphy_to_rdev(wdev->wiphy);
15968         if (!rdev->crit_proto_nlportid)
15969                 return;
15970
15971         nlportid = rdev->crit_proto_nlportid;
15972         rdev->crit_proto_nlportid = 0;
15973
15974         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
15975         if (!msg)
15976                 return;
15977
15978         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_CRIT_PROTOCOL_STOP);
15979         if (!hdr)
15980                 goto nla_put_failure;
15981
15982         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
15983             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
15984                               NL80211_ATTR_PAD))
15985                 goto nla_put_failure;
15986
15987         genlmsg_end(msg, hdr);
15988
15989         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg, nlportid);
15990         return;
15991
15992  nla_put_failure:
15993         nlmsg_free(msg);
15994 }
15995 EXPORT_SYMBOL(cfg80211_crit_proto_stopped);
15996
15997 void nl80211_send_ap_stopped(struct wireless_dev *wdev)
15998 {
15999         struct wiphy *wiphy = wdev->wiphy;
16000         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
16001         struct sk_buff *msg;
16002         void *hdr;
16003
16004         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, GFP_KERNEL);
16005         if (!msg)
16006                 return;
16007
16008         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_STOP_AP);
16009         if (!hdr)
16010                 goto out;
16011
16012         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16013             nla_put_u32(msg, NL80211_ATTR_IFINDEX, wdev->netdev->ifindex) ||
16014             nla_put_u64_64bit(msg, NL80211_ATTR_WDEV, wdev_id(wdev),
16015                               NL80211_ATTR_PAD))
16016                 goto out;
16017
16018         genlmsg_end(msg, hdr);
16019
16020         genlmsg_multicast_netns(&nl80211_fam, wiphy_net(wiphy), msg, 0,
16021                                 NL80211_MCGRP_MLME, GFP_KERNEL);
16022         return;
16023  out:
16024         nlmsg_free(msg);
16025 }
16026
16027 int cfg80211_external_auth_request(struct net_device *dev,
16028                                    struct cfg80211_external_auth_params *params,
16029                                    gfp_t gfp)
16030 {
16031         struct wireless_dev *wdev = dev->ieee80211_ptr;
16032         struct cfg80211_registered_device *rdev = wiphy_to_rdev(wdev->wiphy);
16033         struct sk_buff *msg;
16034         void *hdr;
16035
16036         if (!wdev->conn_owner_nlportid)
16037                 return -EINVAL;
16038
16039         msg = nlmsg_new(NLMSG_DEFAULT_SIZE, gfp);
16040         if (!msg)
16041                 return -ENOMEM;
16042
16043         hdr = nl80211hdr_put(msg, 0, 0, 0, NL80211_CMD_EXTERNAL_AUTH);
16044         if (!hdr)
16045                 goto nla_put_failure;
16046
16047         if (nla_put_u32(msg, NL80211_ATTR_WIPHY, rdev->wiphy_idx) ||
16048             nla_put_u32(msg, NL80211_ATTR_IFINDEX, dev->ifindex) ||
16049             nla_put_u32(msg, NL80211_ATTR_AKM_SUITES, params->key_mgmt_suite) ||
16050             nla_put_u32(msg, NL80211_ATTR_EXTERNAL_AUTH_ACTION,
16051                         params->action) ||
16052             nla_put(msg, NL80211_ATTR_BSSID, ETH_ALEN, params->bssid) ||
16053             nla_put(msg, NL80211_ATTR_SSID, params->ssid.ssid_len,
16054                     params->ssid.ssid))
16055                 goto nla_put_failure;
16056
16057         genlmsg_end(msg, hdr);
16058         genlmsg_unicast(wiphy_net(&rdev->wiphy), msg,
16059                         wdev->conn_owner_nlportid);
16060         return 0;
16061
16062  nla_put_failure:
16063         nlmsg_free(msg);
16064         return -ENOBUFS;
16065 }
16066 EXPORT_SYMBOL(cfg80211_external_auth_request);
16067
16068 /* initialisation/exit functions */
16069
16070 int __init nl80211_init(void)
16071 {
16072         int err;
16073
16074         err = genl_register_family(&nl80211_fam);
16075         if (err)
16076                 return err;
16077
16078         err = netlink_register_notifier(&nl80211_netlink_notifier);
16079         if (err)
16080                 goto err_out;
16081
16082         return 0;
16083  err_out:
16084         genl_unregister_family(&nl80211_fam);
16085         return err;
16086 }
16087
16088 void nl80211_exit(void)
16089 {
16090         netlink_unregister_notifier(&nl80211_netlink_notifier);
16091         genl_unregister_family(&nl80211_fam);
16092 }